Untrusted network device identification and removal for access control and information security

A device configured to implement threat management server, comprising:

• a memory configured to store:
• a device log file comprising:
• a first set of device identifiers for endpoint devices that have failed authentication with a network authentication server;
• and
• a second set of device identifiers for endpoint devices that have previously passed authentication with the network authentication server;
• and
• a threat management engine implemented by a processor configured to:
• receive a device identifier for an endpoint device indicating the endpoint device is failing authentication on a port of a switch;
• identify the endpoint device for removal in response to receiving the device identifier, wherein identifying the endpoint device for removal comprises:
• comparing the device identifier to the second set of device identifiers for endpoint devices that have previously passed authentication with the network authentication server;
• determining that the device identifier is present in the second set of device identifiers;
• determining a number of times that the endpoint device has failed authentication in response to determining that the device identifier is present in the second set of device identifiers;
• and
• determining that the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period;
• and
• block the endpoint device from accessing a network via the port on the switch in response to identifying the endpoint device for removal.

An information security method comprising:

• identifying, by a threat management server, an endpoint device for removal comprising:
• receiving a device identifier for the endpoint device indicating the endpoint device is failing authentication on a port of a switch;
• comparing the device identifier to a set of device identifiers for endpoint devices that have previously passes authentication with a network authentication server;
• determining the device identifier is present in the set of device identifiers;
• determining a number of times that the endpoint device has failed authentication in response to determining that the device identifier is present in the set of device identifiers;
• determining that the number of times the endpoint device has failed authentication exceeds a first threshold value within a first time period;
• and
• blocking, by the threat management server, the endpoint device from accessing a network via the port of the switch in response to determining that the number of times the endpoint device has failed authentication exceeds the first threshold value within the first time period.