Network switch port access control and information security

An information security method comprising:

• receiving, by a threat management server, a device identifier for an endpoint device in response to the endpoint device changing its connection to a switch from a first port on the switch to a second port on the switch;
• determining, by the threat management server, the endpoint device is present in a blacklist based on the device identifier in response to receiving the endpoint device identifier, wherein the blacklist identifies:
• one or more endpoint devices blocked from accessing a network;
• block timeout periods indicating an amount of time each of the one or more endpoint devices is blocked from the switch;
• and
• ports on the switch each of the one or more endpoint devices have been blocked from;
• determining, by the threat management server, the endpoint device is blocked from the first port on the switch based on information in the blacklist;
• blocking, by the threat management server, the endpoint device from accessing the network via the second port on the switch in response to determining the endpoint device is blocked from the first port on the switch;
• and
• increasing, by the threat management server, a block timeout period associated with the endpoint device in response to blocking the endpoint device.