Deployment of a security policy based on network topology and device capability

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
• receive network topology information of a network and device capability information corresponding to capabilities of devices in the network;
• detect a threat to an affected client device of the network using a threat feed from a threat detection system,
• the threat feed being included in a plurality of threat feeds used by the device, and
• the plurality of threat feeds including:
• a Command and Control (CnC) feed indicating a list of identified malicious entities or a Geographical Internet Protocol (Geo IP) feed indicating a list of at least one of locations or internet protocol (IP) addresses associated with locations that include malicious entities,
• an Infected Host Feed indicating a list of entities that have been identified as infected with malware, and
• a Malware feed indicating a list of identified malicious files;
• determine threat information associated with the threat based on the threat feed used to detect the threat;
• select a security policy to mitigate the threat based on the threat information;
• select an enforcement device in the network to enforce the security policy based on a location of the enforcement device indicated in the network topology information and an ability of the enforcement device to enforce the security policy indicated in the device capability information,
• the enforcement device being selected from a switch nearest the affected client device, a firewall nearest the affected client device, a firewall at a perimeter of the network, and an internal segmentation firewall,
• the firewall nearest the affected client device being selected as the enforcement device, and not the switch nearest the affected client device, to enforce a first security policy when the threat feed used to detect the threat is the CnC feed or the Geo IP feed,
• the switch nearest the affected client device and the firewall at the perimeter of the network being selected as the enforcement device to enforce a second security policy when the threat feed used to detect the threat is the Infected Host Feed, and
• the internal segmentation firewall being selected as the enforcement device, and not the firewall at the perimeter of the network nor the switch nearest the affected client device, to enforce a third security policy when the threat feed used to detect the threat is the Malware feed;
• and
• perform an action associated with the threat based on the security policy and the enforcement device.

A method, comprising:

• receiving, by one or more devices of a security platform, network topology information of a network and device capability information of devices in the network based on a change to a topology of the network or a change to a device capability of a device of the network;
• detecting, by at least one of the one or more devices, a threat to an affected client device of the network, using a threat feed from a threat detection system,
• the threat feed being included in a plurality of threat feeds used by the one or more devices, and
• the plurality of threat feeds including:
• a Command and Control (CnC) feed indicating a list of identified malicious entities or a Geographical Internet Protocol (Geo IP) feed indicating a list of at least one of locations or internet protocol (IP) addresses associated with locations that include malicious entities,
• an Infected Host Feed indicating a list of entities that have been identified as infected with malware, and
• a Malware feed indicating a list of identified malicious files;
• determining, by at least one of the one or more devices, threat information indicating a threat risk level or a threat presence level associated with the threat based on the threat feed used to detect the threat;
• selecting, by at least one of the one or more devices, a security policy and an enforcement device of the network to enforce the security policy based on the network topology information, the device capability information, and/or the threat information,
• the enforcement device being selected from a switch nearest the affected client device, a firewall nearest the affected client device, a firewall at a perimeter of the network, and an internal segmentation firewall,
• the firewall nearest the affected client device being selected as the enforcement device, and not the switch nearest the affected client device, to enforce a first security policy when the threat feed used to detect the threat is the CnC feed or the Geo IP feed,
• the switch nearest the affected client device and the firewall at the perimeter of the network being selected as the enforcement device to enforce a second security policy when the threat feed used to detect the threat is the Infected Host Feed, and
• the internal segmentation firewall being selected as the enforcement device, and not the firewall at the perimeter of the network nor the switch nearest the affected client device, to enforce a third security policy when the threat feed used to detect the threat is the Malware feed;
• and
• performing, by at least one of the one or more devices, an action associated with the threat based on the security policy and the enforcement device.