Enforcing a centralized, cryptographic network policy for various traffic at a host

A system comprising:

• a memory having computer-readable instructions;
• and
• one or more processors for executing the computer-readable instructions, the computer-readable instructions comprising:
• monitoring a plurality of connections of a plurality of host applications at a host, wherein a first connection of the plurality of connections carries network traffic associated with a first host application running at the host, and wherein a second connection of the plurality of connections carries network traffic associated with a second host application running at the host;
• detecting a plurality of sets of security attributes, comprising a a first set of security attributes of the first connection of the first host application running at the host and a second set of security attributes of the second connection of the second host application running at the host;
• storing the plurality of sets of security attributes in a security database;
• comparing, from the security database, the first set of security attributes of the first connection to a centralized security policy;
• determining that the first set of security attributes of the first connection fails to meet one or more requirements of the centralized security policy;
• comparing, from the security database, the second set of security attributes of the second connection to the centralized security policy;
• determining that the second set of security attributes of the second connection meet the one or more requirements of the centralized security policy;
• and
• performing a remedial action related to the first connection of the first host application while allowing network traffic to continue over the second connection of the second host application, responsive to the first set of security attributes of the first connection of the first host application failing to meet the one or more requirements of the centralized security policy while the second set of security attributes of the second connection of the second host application meets the one or more requirements of the centralized security policy;
• wherein a selection of which connections to remediate from among the plurality of connections is based on which connections are associated with respective security attributes that fail to meet the one or more requirements of the centralized security policy.

A computer-program product for enforcing a centralized, cryptographic network policy, the computer-program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:

• monitoring a plurality of connections of a plurality of host applications at a host, wherein a first connection of the plurality of connections carries network traffic associated with a first host application running at the host, and wherein a second connection of the plurality of connections carries network traffic associated with a second host application running at the host;
• detecting a plurality of sets of security attributes, comprising a a first set of security attributes of the first connection of the first host application running at the host and a second set of security attributes of the second connection of the second host application running at the host;
• storing the plurality of sets of security attributes in a security database;
• comparing, from the security database, the first set of security attributes of the first connection to a centralized security policy;
• determining that the first set of security attributes of the first connection fails to meet one or more requirements of the centralized security policy;
• comparing, from the security database, the second set of security attributes of the second connection to the centralized security policy;
• determining that the second set of security attributes of the second connection meet the one or more requirements of the centralized security policy;
• and
• performing a remedial action related to the first connection of the first host application while allowing network traffic to continue over the second connection of the second host application, responsive to the first set of security attributes of the first connection of the first host application failing to meet the one or more requirements of the centralized security policy while the second set of security attributes of the second connection of the second host application meets the one or more requirements of the centralized security policy;
• wherein a selection of which connections to remediate from among the plurality of connections is based on which connections are associated with respective security attributes that fail to meet the one or more requirements of the centralized security policy.