Optimize compliance evaluation of endpoints
The techniques described herein relate to authorizing networked devices to access protected network zones and/or network resources in a private network. In response to a first access request, a network appliance requests full compliance information from the networked device. The received compliance information is stored in a database. Subsequently, when the compliance information on the networked device changes, the network device sends updated compliance information to the network appliance. The network appliance reevaluates the compliance state of the networked device based on the updated compliance information and the compliance information stored in the database.
1. A method, comprising:
in response to receiving, by a network appliance, a first request to access a protected network resource from an endpoint device, wherein the endpoint device is assigned a role and includes a client software module configured to communicate with the network appliance:
determining, by the network appliance, which compliance information related to policies is associated with access of the protected network resource by the endpoint device having the assigned role;
requesting, by the network appliance, all of the determined compliance information from the client software module;
evaluating, by the network appliance, the compliance of the endpoint device based on the compliance information received from the client software module to determine a compliance state and providing access based on the compliance state;
storing, by the network appliance, the received compliance information in a database associated with the network appliance;
in response to receiving, by the network appliance, first updated compliance information that includes only updated ones of the compliance information required by the policies, evaluating, by the network appliance, the compliance of the endpoint device based on the updated compliance information and the compliance information stored in the database to determine an updated compliance state;
providing, by the network appliance, access to the protected network resource to the endpoint device based on the updated compliance state; and
after a first time period, deleting the compliance information stored in the database,
wherein the compliance information includes at least one of an identity of an antivirus product, settings of the antivirus product, an identity of a firewall product, settings of the firewall product, an identity of a patch management product, settings of the patch management product, a status of an application, a presence of a file on the device, a status of one or more ports, or settings of registry keys.
2. The method of claim 1 , further comprising, in response to receiving, by the network appliance, second updated compliance information from the endpoint device, when a threshold period of time has passed since the first request, requesting all of the determined compliance information from the client software module.
3. The method of claim 1 , further comprising, in response to receiving, by the network appliance, a second request to access the protected network resource from the endpoint device, when a threshold period of time has not elapsed since the first request, requesting the updated compliance information from the client software module.
4. The method of claim 1 , further comprising, after a first threshold period of time has elapsed, requesting the updated compliance information from the client software module.
5. The method of claim 4 , further comprising after a second threshold period of time has elapsed, requesting all of the determined compliance information from the client software module, the second threshold period of time being after the first threshold period of time.
6. The method of claim 1 , further comprising, storing, by the network appliance, the first updated compliance information.
7. The method of claim 6 , further comprising deleting, after the first time period, the first updated compliance information stored in the database.
8. The method of claim 7 , further comprising in response to receiving, by the network appliance, a third request to access the protected network resource from the endpoint device after the first time period, requesting all of the determined compliance information from the client software module.
9. A network appliance configured to enforce one or more policies for accessing a protected network resource on a private network, the network appliance comprising:
at least one hardware processor; and
a non-transitory computer-readable medium having encoded therein programming code executable by the at least one hardware processor to perform or control performance of operations in response to receiving a first request to access the protected network resource from an endpoint device having an assigned role and including a client software module configured to communicate with the network appliance, the operations comprising:
determine, using a policy database, which compliance information related to policies is associated access of the protected network resource by the endpoint device having the assigned role;
request all of the determined compliance information from the client software module;
evaluate the compliance of the endpoint device based on the compliance information received from the client software module to determine a first compliance state and provide access based on the compliance state;
store the received compliance information in a database associated with the network appliance;
in response to receiving first updated compliance information that includes only updated ones of the compliance information required by the policies, evaluate the compliance of the endpoint device based on the updated compliance information and the compliance information stored in the database to determine an updated compliance state;
provide access to the protected network resource to the endpoint device based on the updated compliance state; and
after a first time period, deleting the compliance information stored in the database,
wherein the compliance information includes at least one of an identity of an antivirus product, settings of the antivirus product, an identity of a firewall product, settings of the firewall product, an identity of a patch management product, settings of the patch management product, a status of an application, a presence of a file on the device, a status of one or more ports, or settings of registry keys.
10. The network appliance of claim 9 , further comprising, in response to receiving, by the network appliance, second updated compliance information from the endpoint device, when a threshold period of time has passed since the first request, the network appliance is configured to request all of the determined compliance information from the client software module.
11. The network appliance of claim 9 , further comprising, in response to receiving, by the network appliance, a third request to access the protected network resource from the endpoint device, when a threshold period of time has not elapsed since the first request, requesting the updated compliance information from the client software module.
12. The network appliance of claim 9 , further comprising, after a first threshold period of time has elapsed, requesting the updated compliance information from the client software module.
13. The network appliance of claim 12 , further comprising after a second threshold period of time has elapsed, requesting all of the determined compliance information from the client software module, the second threshold period of time being after the first threshold period of time.
14. The network appliance of claim 9 , further comprising in response to receiving, by the network appliance, a third request to access the protected network resource from the endpoint device after the first time period, requesting all of the determined compliance information from the client software module.
15. A method, comprising:
in response to receiving, by a network appliance, a request to access a protected network resource from an endpoint device that includes a client software module configured to communicate with the network appliance:
determining, by the network appliance, whether a compliance database includes compliance information associated with the endpoint device;
in response to the compliance database not including the compliance information associated with the endpoint device:
determining, by the network appliance, which of the compliance information related to policies associated with access of the protected network resource by the endpoint device based on the protected network resource and a role assigned to the endpoint device; and
requesting, by the network appliance, all of the determined compliance information from the client software module;
in response to the compliance database including the compliance information associated with the endpoint device, accessing, by the network appliance, the compliance information of the endpoint device stored in the database and requesting an update from the endpoint device;
evaluating, by the network appliance, the compliance of the endpoint device based on the compliance information to determine a compliance state;
providing, by the network appliance, access to the protected network resource to the endpoint device based on the compliance state; and
deleting, after a first time period, the compliance information stored in the compliance database,
wherein the compliance information includes at least one of an identity of an antivirus product, settings of the antivirus product, an identity of a firewall product, settings of the firewall product, an identity of a patch management product, settings of the patch management product, a status of an application, a presence of a file on the device, a status of one or more ports, or settings of registry keys.
16. The method of claim 15 , further comprising, in response to requesting the update from the endpoint device, receiving less than all of the required compliance information from the client software module.
17. The method of claim 16 , further comprising, updating the compliance database with the compliance information received in response to the update request.