Score-based dynamic firewall rule enforcement

A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of score-based dynamic firewall rule enforcement, wherein the method comprises:

• in response to detecting a first request by a user to access a first resource:
• identifying a first score associated with the user, and a firewall rule that is applicable to the user based at least in part on information associated with the user;
• and
• based on determination that the first score satisfies a threshold requirement specified by the firewall rule, applying the firewall rule to allow access to the first resource;
• adjusting the first score to a second score that represents a more restrictive access level compared to the first score;
• and
• in response to detecting a second request by the user to access the first resource:
• based on determination that the second score fails to satisfy the threshold requirement, applying the firewall rule to block the second request to access the first resource.

A computer system configured to perform score-based dynamic firewall rule enforcement in a software-defined networking (SDN) environment, wherein the computer system comprises:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, in response to execution by the processor, cause the processor to:
• in response to detecting, from a virtualized computing instance which is associated with a user, a first request to access a first resource protected within a firewall of the SDN environment:
• identify a first score associated with the user, and a firewall rule that is associated with the firewall and that is applicable to the user based on information associated with the user;
• and
• based on the first score, apply the firewall rule to allow access to the first resource;
• adjust the first score to a second score that represents a more restrictive access level compared to the first score, wherein adjustment of the first score to the second score is based on an attempted unauthorized access by the user to at least one resource protected within the firewall;
• and
• in response to detecting, from the virtualized computing instance associated with the user, a second request to access the first resource:
• based on the second score, apply the firewall rule to block the second request to access the first resource.

A method for score-based dynamic firewall rule enforcement, comprising:

• receiving a packet from a user, wherein the packet corresponds to an access request by the user to a resource protected by a firewall along a datapath of the packet;
• associating the packet with an identity of the user;
• determining a trust score associated with the user;
• identifying a matching firewall rule in the firewall that is applicable to the packet, based at least in part on the identity of the user or on characteristics of the packet;
• determining if the trust score associated with the user satisfies a threshold requirement of the matching firewall rule;
• and
• based at least in part of whether the trust score satisfies the threshold requirement of the matching firewall rule, allowing the packet or blocking the packet.