Infected endpoint containment using aggregated security status information

A network device comprising:

• at least one processor;
• at least one interface card configured to send and receive packets over a network;
• and an authorization database, wherein the at least one processor is configured to:
• store health status information specifying a current security status for each of a plurality of authenticated endpoint devices within the authorization database in accordance with an authorization data model;
• update the current security status of each of at least two of the plurality of authenticated endpoint devices connected to an enterprise network to indicate that each of the at least two of the plurality of authenticated endpoint devices has a compromised security status;
• identify a characteristic common to both of the at least two of the plurality of authenticated endpoint devices having a compromised security status;
• and interface with one or more policy enforcement devices, via the at least one interface card, to cause the one or more policy enforcement devices to quarantine a set of the plurality of endpoint devices associated with the identified characteristic, wherein the current security status of at least one of the quarantined set of the plurality of endpoint devices indicates that the at least one of the quarantined set of the plurality of endpoint devices does not have a compromised security status.

A non-transitory computer-readable storage medium comprising instructions that, when executed, cause at least one processor of a network device to:

• store health status information specifying a current security status for each of a plurality of authenticated endpoint devices in accordance with an authorization data model;
• update the current security status of each of at least two of the plurality of authenticated endpoint devices connected to an enterprise network to indicate that each of the at least two of the plurality of authenticated endpoint devices has a compromised security status;
• identify a characteristic common to both of the at least two of the plurality of authenticated endpoint devices having a compromised security status;
• and interface with one or more policy enforcement devices to cause the one or more policy enforcement devices to quarantine a set of the plurality of endpoint devices associated with the identified characteristic, wherein the current security status of at least one of the quarantined set of the plurality of endpoint devices indicates that the at least one of the quarantined set of the plurality of endpoint devices does not have a compromised security status.

A network system comprising:

• a plurality of endpoint devices;
• one or more network switches;
• one or more resource servers;
• one or more firewalls intermediately positioned between the at least one network switch and the at least one resource server;
• and a unified access control (UAC) device, wherein the UAC device comprises at least one processor configured to:
• receive one or more indications from the at one or more firewalls that each of at least two of the plurality of endpoint devices has a compromised security status;
• update the current security status of each of at least two of the plurality of authenticated endpoint devices connected to an enterprise network to indicate that each of the at least two of the plurality of authenticated endpoint devices has a compromised security status;
• identify a characteristic common to both of the at least two of the plurality of authenticated endpoint devices having a compromised security status;
• and interface with at least one of the one or more network switches to cause the at least one of the one or more network switches to quarantine a set of the plurality of endpoint devices associated with the identified characteristic, wherein the current security status of at least one of the quarantined set of the plurality of endpoint devices indicates that the at least one of the quarantined set of the plurality of endpoint devices does not have a compromised security status.