Back to results
US 12,587,545 B2Granted
Securing endpoints in a heterogenous enterprise network
AssigneeSophos Limited
InventorsMoritz Daniel Grimm, Daniel Stutz, Andrew J. Thomas, Kenneth D. Ray
Life of this patent
Estimating the term…
Abstract
Endpoints and a corresponding switch within a heterogeneous network work cooperatively to respond to notifications of compromise in order to protect the enterprise network. Endpoints self-isolate when a local security agent detects a compromise, and shun a compromised one of the other endpoints in response to a corresponding notification. The switch forwards a notice of compromise from an endpoint to a threat management facility for the enterprise network and prevents communications from a compromised endpoint through the switch in response to receiving a corresponding request from the threat management facility.
Claims20
A system comprising:
- an enterprise network including a gateway coupling a heterogeneous network of devices in the enterprise network to an external network;
- a plurality of endpoints connected to the heterogeneous network, each one of the endpoints configured by a local security agent executing independently of a threat management facility to monitor for a local detection of compromise, to self-isolate the endpoint on which the local security agent is executing from other endpoints of the enterprise network in response to the local detection of compromise, to shun a first one of the other endpoints in response to a notification of compromise of the first one of the other endpoints received over the enterprise network directly from a first local security agent of the first one of the other endpoints, and to shun the first one of the other endpoints in response to the notification of compromise of the first one of the other endpoints received over the enterprise network directly from a second local security agent of a second one of the other endpoints;
- and
- a switch coupling the plurality of endpoints to the heterogeneous network, the switch managed by the threat management facility for the enterprise network, the switch configured to forward the notification of compromise from the local security agent of one of the plurality of endpoints to the threat management facility, the notification identifying the one of the other endpoints for which a compromise is detected, and to receive a request from the threat management facility responsive to the notification of compromise to isolate the one of the other endpoints from communications through the switch, wherein the one of the other endpoints is configured to isolate from the plurality of endpoints connected to the switch via shunning each of the plurality of endpoints in response to a receipt of the notification of compromise from the one of the other endpoints, and wherein the one of the other endpoints is configured to isolate from other devices in the heterogenous network via the request from the threat management facility for the switch to isolate the one of the other endpoints from communication through the switch.
1 more element
A system comprising:
- a plurality of endpoints connected to a heterogeneous network of devices in an enterprise network, each of the endpoints executing, independently of a threat management facility, a local security agent configured to monitor for a local detection of compromise, to self-isolate the endpoint on which the local security agent is executing from other endpoints of the enterprise network in response to the local detection of compromise, to shun a first one of the other endpoints in response to a notification of compromise of the first one of the other endpoints received over the enterprise network directly from a first local security agent of the first one of the other endpoints, and to shun the first one of the other endpoints in response to the notification of compromise of the first one of the other endpoints received over the enterprise network directly from a second local security agent of a second one of the other endpoints;
- and
- a switch coupling the plurality of endpoints to the heterogeneous network, the switch configured to forward the notification of compromise from the local security agent of one of the plurality of endpoints to the threat management facility of the enterprise network, the notification identifying a compromised one of the other endpoints for which a compromise is detected, and the switch configured to receive a request from the threat management facility responsive to the notification to isolate the compromised one of the other endpoints from communications through the switch, wherein the one of the other endpoints is configured to isolate from the plurality of endpoints connected to the switch via shunning by each of the plurality of endpoints in response to a receipt of the notification of compromise from the one of the other endpoints, and wherein the one of the other endpoints is configured to isolate from other devices in the heterogenous network via the request from the threat management facility for the switch to isolate the one of the other endpoints from communication through the switch.
Dependencies are inferred from the claim text.