Outbound/inbound lateral traffic punting based on process risk

A method, comprising:

• receiving process identification (ID) information at a network device from an endpoint (EP) agent executed on an EP device on an enterprise network, wherein the process ID information identifies a process that is associated with a network session, wherein the network session is an outbound network session or an inbound network session on the EP device on the enterprise network, wherein the process ID information indicates that it is a known process, an unknown process, or a known but unexpected process, wherein the process ID information is stored as a digest of a file name of a binary/executable associated with the process that initiated the network session, and wherein the EP agent selected the network session for punting to the network device for inspection;
• monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session;
• and
• performing an action based on a security policy using the process ID information and the APP ID, wherein the security policy includes an EP security policy, wherein the EP agent implements the EP security policy to selectively punt the network session to the network device on the enterprise network, wherein the network device includes a firewall, wherein the security policy includes a fine-grained firewall policy, and wherein the firewall implements the fine-grained firewall policy.

A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

• receiving process identification (ID) information at a network device from an endpoint (EP) agent executed on an EP device on an enterprise network, wherein the process ID information identifies a process that is associated with a network session, wherein the network session is an outbound network session or an inbound network session on the EP device on the enterprise network, wherein the process ID information indicates that it is a known process, an unknown process, or a known but unexpected process, wherein the process ID information is stored as a digest of a file name of a binary/executable associated with the process that initiated the network session, and wherein the EP agent selected the network session for punting to the network device for inspection;
• monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session;
• and
• performing an action based on a security policy using the process ID information and the APP ID, wherein the security policy includes an EP security policy, wherein the EP agent implements the EP security policy to selectively punt the network session to the network device on the enterprise network, wherein the network device includes a firewall, wherein the security policy includes a fine-grained firewall policy, and wherein the firewall implements the fine-grained firewall policy.