METHOD FOR ENFORCING ENDPOINT HEALTH STANDARDS

• US 20180173881A1
• Filed: 02/14/2018
• Published: 06/21/2018
• Est. Priority Date: 06/01/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Granted Patent: US 10,542,030 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An approach for enforcing standards regarding security vulnerabilities for an endpoint user device associated with a user includes collecting, at an inline frame implemented with a web application, endpoint health data of the endpoint user device in response to the user interfacing with the web application through the endpoint user device, generating endpoint health intelligence from the endpoint health data, the endpoint health intelligence indicating endpoint security health of the endpoint user device, generating a first endpoint health notification comprising the endpoint health intelligence, and notifying an administrator of network with the first endpoint health notification.

Claims

1. A method of securing a network from vulnerable endpoints, the method comprising:

implementing an interrogating inline frame that is operably integrated within a login web application that enables access to the network with successful login credentials from a user;

using the interrogating inline frame to collect a first set of data that includes web browser identification data from a web browser interacting with the login web application;

interrogating by the interrogating inline frame an agent-less endpoint user device that is operating the web browser;

collecting by the interrogating inline frame responses to the interrogation, wherein the responses comprises a second set of data that includes endpoint device data of the agent-less endpoint user device;

generating an endpoint security assessment of the agent-less endpoint user device and the login web browser based on an evaluation of the collected web browser identification data and the collected endpoint device data against one or more predetermined endpoint health requirements of the network;

enabling the agent-less endpoint user device to successfully login to the network via the login web application when the endpoint security assessment of the agent-less endpoint user device and the web browser satisfy the one or more predetermined endpoint health requirements of the network, or

disabling the agent-less endpoint user device from accessing the network via the login web application when the endpoint security assessment of the agent-less endpoint user device and the web browser do not satisfy the one or more predetermined endpoint health requirements of the network.

2. The method of claim 1, wherein:

interrogating by the interrogating inline frame the agent-less endpoint user device that is operating the web browser includes interrogating one or more client-side programs operating on the agent-less endpoint user device; and

collecting by the interrogating inline frame responses to the interrogation includes collecting responses from the one or more client-side programs operating on the agent-less endpoint user device.

3. The method of claim 1, wherein:

interrogating by the interrogating inline frame the agent-less endpoint user device that is operating the web browser includes interrogating the agent-less endpoint user device to determine endpoint configuration data comprising one or more of client TCP/IP configuration data, client operating system, client wireless settings, client hardware clock skew, and client MAC address of the agent-less endpoint user device; and

collecting by the interrogating inline frame responses to the interrogation includes collecting endpoint configuration data of the agent-less endpoint user device.

4. The method of claim 1, wherein:

interrogating by the interrogating inline frame the agent-less endpoint user device that is operating the web browser includes transmitting from the interrogating inline frame one or more probes to the agent-less endpoint user device; and

collecting by the interrogating inline frame responses to the interrogation includes collecting responses to the one or more probes.

5. The method of claim 1, wherein:

the agent-less user endpoint device comprises a user endpoint device without a host agent of the network installed on the user endpoint device.

6. The method of claim 1, wherein:

the agent-less user endpoint device comprises a user endpoint device that is unmanaged by the network.

7. The method of claim 1, wherein:

collecting the web browser identification data from the web browser includes collecting HTTP user-agent header data comprising a browser version number data and a browser type data.

8. The method of claim 1, wherein:

the login web application enables access via virtual private network access to the network when authentication credentials via the login web application are successful and the endpoint security assessment of the agent-less endpoint user device and the web browser satisfy the predetermined endpoint health requirements of the network.

9. The method of claim 1, further comprising:

interrogating by the interrogating inline frame the web browser operated by the agent-less endpoint user device; and

collecting by the interrogating inline frame responses to the interrogation of the web browser, wherein the responses comprise a third set of data that includes endpoint browser data of the web browser.

10. The method of claim 8, wherein:

interrogating by the interrogating inline frame the web browser includes interrogating one or more software applications installed in the web browser; and

collecting by the interrogating inline frame responses to the interrogation of the web browser includes collecting responses from the one or more software applications installed in the web browser.

11. The method of claim 1, wherein:

the interrogation by the interrogating inline frame of the agent-less endpoint user device is performed during an authentication attempt by the user of the agent-less endpoint user device through the login web application.

12. The method of claim 1, further comprising:

setting a network access policy that enables the user of the agent-less endpoint user device to access the network for a restricted period when one or more aspects of the endpoint security assessment of the agent-less endpoint user device and the web browser does not satisfy one or more of the predetermined endpoint health requirements of the network.

13. The method of claim 1, further comprising:

setting a network access policy that enables the user of the agent-less endpoint user device to access the network for a restricted number of times when one or more aspects of the endpoint security assessment of the agent-less endpoint user device and the web browser does not satisfy one or more of the predetermined endpoint health requirements of the network.

14. The method of claim 1, further comprising:

implementing a first network access policy for accessing the network based on detecting that the agent-less endpoint user device;

after installing a host agent onto the agent-less endpoint user device, implementing a second network access policy for accessing the network, wherein the second network access policy is less restrictive than the first network access policy.

15. A method of securing a network from agent-less endpoints, the method comprising:

implementing an inline frame that is operably integrated within a web application that is used to login into the network;

using the inline frame to collect;

(i) a first set of data that includes web browser identification data from an agent-less endpoint web browser interacting with the web application;

(ii) a second set of data that includes endpoint device data of an agent-less endpoint user device that is operating the agent-less web browser by interrogating the agent-less endpoint user device and collecting responses to the interrogation;

generating an endpoint security assessment of the agent-less endpoint user device and the web browser based on an evaluation of the collected web browser identification data and the collected endpoint device data against predetermined endpoint health requirements of the network;

enabling the agent-less endpoint user device to successfully login to the network via the web application when the endpoint security assessment of the agent-less endpoint user device and the web browser satisfy the predetermined endpoint health requirements of the network, or

disabling the agent-less endpoint user device from accessing the network via the web application when the endpoint security assessment of the agent-less endpoint user device and the web browser do not satisfy the predetermined endpoint health requirements of the network.

16. The method of claim 15, wherein:

the interrogation by the inline frame of the agent-less endpoint user device and the agent-less endpoint web browser is performed during an authentication attempt by the user of the agent-less endpoint user device through the login web application.

17. A system for securing a network from vulnerable endpoints, the method comprising:

a web application server that deploys a login web application that enables access to the network with successful login credentials from a user;

an endpoint health computing server comprising a non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors, perform steps of;

implementing an interrogating inline frame that is operably integrated within a login web application that enables access to the network with successful login credentials from a user;

using the interrogating inline frame to collect a first set of data that includes web browser identification data from a web browser interacting with the login web application;

interrogating by the interrogating inline frame an agent-less endpoint user device that is operating the web browser;

collecting by the interrogating inline frame responses to the interrogation, wherein the responses comprises a second set of data that includes endpoint device data of the agent-less endpoint user device;

generating an endpoint security assessment of the agent-less endpoint user device and the login web browser based on an evaluation of the collected web browser identification data and the collected endpoint device data against one or more predetermined endpoint health requirements of the network;

enabling the agent-less endpoint user device to successfully login to the network via the login web application when the endpoint security assessment of the agent-less endpoint user device and the web browser satisfy the one or more predetermined endpoint health requirements of the network, or

disabling the agent-less endpoint user device from accessing the network via the login web application when the endpoint security assessment of the agent-less endpoint user device and the web browser do not satisfy the one or more predetermined endpoint health requirements of the network.

18. The method of claim 17, wherein:

the interrogation by the interrogating inline frame of the agent-less endpoint user device is performed during an authentication attempt by the user of the agent-less endpoint user device through the login web application.