Enterprise firewall management and network isolation

Abstract

The invention relates to firewall management in a system comprising access points, including a feature to isolate network elements on the managed access points. An access point management agent (204, 206, 208, 210) cooperates with a remote management service (202) to perform policy management and synchronization, implement isolation mode when necessary, and perform related support tasks.

Description

technical field

[0001] The invention relates to the use and management of firewalls and the deployment of network isolation techniques in an enterprise computer network environment. Context

[0002] Firewalls are commonly used to secure networked computing environments. Each firewall includes policies that control access to a particular network element, such as an individual computer or server. In enterprise networks, implementing these firewall policies can be challenging due to the number of access points to manage. System performance and security can degrade as more firewall rules and policies are deployed on a system.

[0003] In a network environment with multiple access points and firewalls, it can be difficult to control whether a user, group of users, or machine has been granted permissions that create unreasonable risks to the network. These risks include vulnerabilities to individual access points and the network as a whole.

[0004] The lack of controls also compromises networks in other ways. For example, when a machine on the network is infected with malware or otherwise compromised, isolating and recovering that machine takes longer because decentralized policies and rules are difficult to deploy quickly, thus increasing the system's vulnerability. Every minute of vulnerability for a single machine poses a risk to the entire network. It is necessary to implement firewall controls and system-wide services on the network to minimize overhead and reduce the time required to isolate and recover infected machines. Summary

[0005] In a computer network with a firewall, different firewall policies and settings are used. These settings are specific to access points, specific to users at the user level, or specific to users at the group level.

[0006] A firewall management component provides centralized management of the types of firewalls that protect access points in the network. One aspect of the firewall management component is a firewall management agent installed on each managed endpoint. These access points include computers and servers. The firewall management agents manage the enterprise firewalls and the access point firewalls on these computers and servers, and generally on any host in the network.

[0007] A second aspect of the firewall management component is a firewall management service. This service runs on a central server and collects and manages current policies. The firewall management service also synchronizes policies and initiates and configures isolation mode. Application settings, permissions, and firewall configurations are controlled by the firewall management service.

[0008] The administrator enters a global structure, the same for each type of firewall, which includes a policy or part of a policy to be modified or deployed. The firewall management service stores the policy and associates it with the specified user, user group, or machine. A firewall management component performs forward and reverse synchronization of policies between the server and the agents. Another firewall management component supports a policy hierarchy.

[0009] A firewall management agent deploys a required policy. In the case of a software-level firewall, a broad policy can be applied. For an enterprise firewall, a narrower policy is chosen.

[0010] An administrator initiates network machine isolation if a network machine is infected. Isolation mode is configured to leave certain services enabled, such as those required to heal the machine. The isolation policy is the highest priority policy. After the machine has healed, a security officer can disable network isolation and reconnect it with a fully recovered access point firewall policy.

[0011] The actual policy configuration is determined from the latest recorded forward and reverse synchronizations. The current active policies are converted into a unified policy representation format.

[0012] A firewall management component performs a dynamic analysis of the required IP addresses. If the addresses change, the firewall management component rewrites the firewall rules that include blocked or allowed IP addresses. Summary of figures

[0013] Figure 1 illustrates the relationship between the system administrator and the end user. Figure 2 shows a deployment diagram for one embodiment of the invention. Figure 3 shows an example of rule configuration for two ranges. Figure 4 shows an example of rule priority for the Windows Firewall. Figure 5 shows an example of the Windows Firewall settings structure. Figure 6 shows a rule hierarchy for conflict resolution. Figure 7 shows an example of isolation mode. Figure 8 shows an example of exiting isolation mode. Figure 9 shows an example of creating and modifying policies. Figure 10 shows an example of analyzing the current firewall settings. Figure 11 shows an example of forward synchronization. Figure 12 shows an example of reverse synchronization. Figure 13 shows an example of the overall architecture used to implement the system.Figure 14 shows an example of a plugin feature used in relation to the system. Figure 15 shows additional feature extensions for the system. Figure 16 shows an alternative architecture with a GPRM add-on. Detailed description

[0014] A network with a firewall management component is implemented to provide centralized management for the types of firewalls that protect the access points in the network. The firewall management component includes a firewall management agent ("management agent") installed on each managed access point, such as computers and servers. These management agents manage the firewalls on these access point computers and servers. The firewall management component further includes a firewall management service ("management service"). This service runs on a central server and collects and manages current policies. The management service also synchronizes policies and initiates and configures isolation mode. Application settings, permissions, and firewall configurations are controlled by the firewall management service.

[0015] A management agent is a computer program that acts on behalf of users or other programs in an agency relationship. The agency relationship means that the agent has the power to take action—or not to take action—depending on the circumstances. A management service is a set of software functionalities. For example, a service might retrieve information or execute a set of instructions. A service has clients that can use it for different purposes. Services also have policies that control how the service is used. These policies are usually based on the identity of the client requesting the service.

[0016] Firewall policies and settings apply at different levels of the network. For example, there are policies and settings specific to endpoints, users, and user groups. The overall structure is created when policies are established for the firewall types within the network. The management service stores the policies and associates them with specific users.

[0017] The firewall management component performs forward and reverse policy synchronization between a central server and the management agents. Synchronization occurs between the management agent and the system backend. The backend typically refers to services and data that are not directly accessible to end users.

[0018] Firewall policy changes can be made outside the management service, including changes to local and group policies. The management agent itself performs policy collection and synchronization. This collection and synchronization occur at intervals based, for example, on time or Windows event tracing. Event Tracing for Windows (ETW) runs the management agent and detects the appropriate events from a Microsoft-Windows-DNS-Client provider.

[0019] When a change to the firewall configuration is detected or made by synchronization, the management agent initiates a communication protocol with the server. The protocol includes retrieving the current policy and beginning interaction with the background using an application programming interface, such as a REST API. The background retrieves the latest policy stored in a background policy database and compares it to the current policy. This comparison of background and local rules presents several typical scenarios. If the policies do not match, the background calculates the differences and sends them to the management agent using a structure that includes rules to modify, rules to delete, and rules to add.If the comparison detects new local changes that contradict a backend priority policy, the backend configures new rules and sends them to the agent using a structure that includes rules to modify, rules to delete, and rules to add. In these cases, the management agent saves the new policy configuration and applies the changes to the managed access point.

[0020] Reverse synchronization occurs when the background initiates a request to the policy agent for current policies. This can be done, for example, using an application programming interface, such as the REST API. The policy agent retrieves a current policy and sends it to the background. If the policies do not match, the background policy database is updated. The background calculates the differences, and if the local changes contradict a higher-priority policy, then new corrective rules are configured by the background, stored in the background policy database, and sent to the policy agent with a structure including rules to modify, rules to delete, and rules to add.If the backend database contains policy updates that haven't been applied on the management agent side, these will be treated as differences. The backend will send corrective rules to the management agent using a structure that includes rules to modify, rules to delete, and rules to add. The management agent then applies the rule changes, and both the management agent and the central server record the results of the reverse synchronization.

[0021] In some cases, local or background rules may conflict with centralized management configurations. For example, in Windows environments, there are Group Policy configurations collectively known as Group Policy Objects (GPOs). A common difference calculation algorithm is used to address this situation. The algorithm begins when the management agent sends a current policy to the central server. The central server retrieves the most recently stored policy from the background policy database and compares it to the data from the management agent. The first step is to identify the differences. This process is performed using unique identifiers. Each firewall setting has a unique identifier, for example, the registry branch where the firewall setting is stored.On the central server and the management agent's registry, each firewall setting is stored with its unique identifier. When a new policy is applied by the central server, the modified setting is stored with a temporary unique identifier. After making the change, the management agent sends the central server a permanent unique identifier for the modified setting. The central server then changes the temporary unique identifier to a permanent one. The backend compares the settings stored before the change with the settings after the change. Matching settings with the same unique identifiers are compared. The backend detects new settings by their new unique identifiers. New and modified settings are considered differences by the backend.The background process prepares a detailed description of the differences, for example, using JavaScript object notation (JSON). This description includes the rules that the agent needs to remove, add, or modify. The differences are then communicated to the management agent. If merge policy conflicts arise—for example, when a lower-priority rule contradicts a higher-priority rule—the background process creates a set of policy changes to resolve the conflict. If the conflict results from a change made by a local administrator, the background policy changes take precedence. If the conflict results from a change made by the background administrator, the background policy change is disabled.

[0022] The process described above also applies to reverse synchronization. The difference is that the synchronization is initiated by the central server instead of the management agent.

[0023] The described system preferably includes a policy hierarchy. These policies, ranked from highest to lowest, include an isolation policy, an Active Directory Group Policy, an access point policy, and local policies. For example, in a Windows environment, firewall rules can be configured either by a Windows Firewall or by a third-party firewall. In the case of a Windows Firewall with advanced security, firewall rules can be deployed by the local administrator, by the firewall management component, or by Group Policy Objects (GPO). In the case of third-party firewalls, rules can be deployed by the firewall management component or by an administrator. If the firewall management component simply applies all the rules, the resulting policy will be the sum of the existing rules, following the merge rules established in each firewall, and could produce unexpected results.If only priorities are used for resolution, the final policy will be obscured. The solution is to determine and apply the primary firewall policy, controlling changes accordingly. If a suitable rule is missing from the primary firewall policy, the merge conflict will be resolved by considering the priority of the different policy sources. In one embodiment of the invention, the differences are continuously calculated for each type of firewall rule when a new policy is applied. An example of a new policy would be an administrator allowing all outbound connections. An example of a policy conflict would be an administrator attempting to allow an outbound connection to port 234, but that connection is blocked by a third-party firewall. The primary firewall policy is checked first.If there is no suitable rule in the main firewall policy, the highest priority rule will be activated, according to a predetermined rule priority.

[0024] The management agent deploys firewall policies selectively. For example, software-level firewalls can be assigned more inclusive policies. For server-level firewalls and enterprise firewalls, narrower policies can be defined.

[0025] When a machine on the network is infected with malware, an administrator initiates the process of isolating the machine from the network. The background marks the machine as isolated and sends a command to all firewalls blocking all traffic to and from the infected machine, with certain exceptions. For example, exceptions can be made for the Remote Desktop Protocol (RDP), backend access, and specific ports. This isolation policy is then deployed to the affected terminal.

[0026] The isolation mode algorithm generally comprises the following steps. All current firewall rules and settings remain unchanged. The firewall management component receives the static IP addresses corresponding to the services and exceptions that must be available to the isolated machine. The firewall management component then creates a set of restrictive rules. For example, for given IP addresses within a given range, restrictive rules are configured with exclusions for specific IP addresses that must have access to an infected machine even in isolation mode. For the excluded addresses, no rules need to be configured.

[0027] An isolation policy is the highest priority policy and it prevails over all other policies that conflict with it.

[0028] In one embodiment, an administrator initiates an analysis of current policies. The central server provides the administrator with the actual policy configurations saved from the most recent forward and reverse synchronizations. The current active policies are converted into a unified policy representation format. The policy format can be narrow or wide, but all are represented in the same format. Unused fields are defined by default values ​​or are left blank. After conversion to the unified format, a report with the results is available to the administrator.

[0029] In another embodiment, an isolation mode algorithm includes a step in which the firewall management component performs a dynamic scan of the required IP addresses. If the IP addresses have changed, the firewall management component rewrites the rules based on the new configuration.

[0030] In an exemplary embodiment, the management service and the management agent each include the following components: policy storage, firewall manager, isolation mode manager and synchronization manager.

[0031] Figure 1 illustrates the respective roles 100 of a system administrator 102 and a representative user 104 within the network. Administrators use the system to create or modify access point policies 106, user and group policies 108, initiate isolation of the infected machine 110, and check current policies 112. When a machine enters isolation mode, the user 104 receives a warning 114.

[0032] Figures 2A and 2B illustrate an example deployment. The firewall management service 202 (“Service”) communicates with the firewall management agents (“Agent”) 204, 206, 208, and 210. Agents 204, 206, 208, and 210 are installed on the system's access points: computer 212, computer 214, server 216, and Active Directory (AD) domain controller 218. The AD domain controller is a server that responds to authentication requests and verifies users. Users and computers are organized by domains in the network. Traffic between the agents on the access points and the Service is routed through switch 220. The Service is controlled via API 22, which can be implemented as a console or a graphical user interface.

[0033] The access points are protected by firewalls 230, 232, 234 and 236. The agents at each access point include the following components: Access point policy storage 250, 260, 270 and 280; Access point synchronization manager 252, 262, 272 and 282; Access point firewall manager 254, 264, 274 and 284; and Access point isolation mode manager 256, 266, 276 and 286.

[0034] Service 202 includes the following components: Storage Background Rules 240, Background Firewall Manager 242, Background Sync Manager 244, and Background Isolation Mode Manager 246.

[0035] In Figure 2A, server 216 is connected to firewall 290. The deployment of firewall 290 is shown in Figure 2B. Behind firewall 290 are access points: the computer in the DMZ 219 and server 221. DMZ stands for DMZ, a secure zone that contains and exposes external services to an untrusted, typically larger, network such as the Internet. Agents 211 and 213 are installed on these access points. The agents include the following components: Rule Storage access points 250 and 260; Sync Manager access points 252 and 262; Firewall Manager access points 254 and 264; and Isolation Mode Manager access points 256 and 266.

[0036] Figure 3 shows an example of creating a 300 rule for IP addresses on the managed network. The entire 302 range of IP addresses is divided into sub-ranges, for example, the first range 304 and the second range 306. Between these sub-ranges are addresses 310, 312, and 314. In one embodiment, isolation mode has been entered, and all addresses in the 302 range are blocked. Address 314 is excluded from the rule and can be accessed even in isolation mode. Addresses 310 and 312 are the addresses immediately before and after the excluded address.

[0037] Figure 4 shows an example 400 of priority rules. Given group policies 402, 404, and 406, different sets of rules are available in order of evaluation, from highest to lowest priority. These rules include hardening 410, connecting 412, bypassing 414, blocking 416, allowing 418, and failing 420. The evaluation order 422 goes from top to bottom.

[0038] In one embodiment, 410 rules include hardening of Windows services. This type of built-in rule prevents services from establishing connections in a way that deviates from the original design decisions. For example, service restrictions are configured so that Windows services can only communicate in a specified way, for example, by allowing traffic only on a specified port.

[0039] Connection security rules 412 define how and when computers authenticate using Internet Protocol Security (IPsec), a suite of secure network protocols. IPsec authenticates and encrypts data packets to provide secure encrypted communication between two computers on an IP (Internet Protocol) network. A connection security rule may also require encryption for data confidentiality. Connection security rules are commonly used to establish server and domain isolation, as well as to enforce Network Access Protection (NAP) policies. NAP is a technology for creating, enforcing, and remediating client health policies. With NAP, system administrators can automatically establish and enforce health policies, which may include software requirements, security update requirements, and other settings.Client computers that do not comply with the health policy may be granted restricted network access until their configuration is updated and made compliant with the NAP policy.

[0040] Authenticated 414 bypass rules allow specified computers or users to connect even when inbound firewall rules would block traffic. This rule typically requires that network traffic from authorized computers be authenticated by IPsec so that identity can be confirmed.

[0041] Blocking rules 416 block specific incoming or outgoing traffic. Allowing rules 418 permit a specific type of incoming or outgoing traffic. Blocking rules 416 are evaluated before allowing rules 418 and therefore have priority. Thus, network traffic will be blocked if it matches both an active blocking rule and an active allowing rule.

[0042] Default rules 420 define the action that occurs when a connection does not match any other rule. For example, a default rule for inbound traffic is to block connections, while a default rule for outbound traffic is to allow connections. In a Windows environment, default rules can be modified for each profile in the Windows Firewall properties. Each firewall profile can be configured with respect to local firewall rules and local connection security rules. These settings define whether locally defined rules are applied. The default configuration is that local firewall rules are applied. If the default rule is disabled, locally created rules will have no effect, whether created by an administrator or a program. If local firewall rules are enabled, the resulting rules are cumulative.

[0043] Figure 5 shows the firewall configuration structure 500 with profiles 502 and 504 in relation to rules 506, policy 508, and change state 510. Policy 508 is retrieved from a database to determine the current applicable policy with respect to profiles 502 and 504. Rules 506 are checked to determine whether changes to state 510 need to be made.

[0044] Figure 6 shows an exemplary policy hierarchy 600 comprising an isolation policy 602, an AD group policy 604, an access point policy 606 and local policy changes 608. The policies are ranked in order of priority 610 from top to bottom.

[0045] Figure 7 shows the isolation mode 700 implemented by the administrator 702 for the user 740. The components used are the console 704, the background isolation mode manager 706, and the access point isolation mode managers 708. The administrator 702 enters the isolation mode request 720 on the console 704. The console 704 returns an empty exception description 722. The administrator 702 enters a filled exception description 724 (if applicable), and the isolation description 726 is passed to the background isolation mode manager 706, which in turn sends a notification 728 indicating that the isolation mode is applied. The background isolation mode manager 708 sends the isolation configuration 730 to the access point isolation mode managers 708.These mode managers apply the isolation mode 732 locally and send the responses and results to the background isolation mode manager 706. These responses are returned to the console 704 as processed responses and the administrator 702 receives a corresponding report 738.

[0046] Figure 8 shows the exit from isolation mode 800 implemented by the administrator 802 for the user 840. The components used are the console 804, the background isolation mode manager 806, and the access point isolation mode managers 808. The administrator 802 enters the request 820 to exit isolation mode on the console 804. The console 804 returns an empty exception description 822. The administrator 802 enters a filled exception description 824 (if applicable), and the isolation details 826 are passed to the background isolation mode manager 806, which in turn sends a notification 828 to the user 840 indicating that isolation mode is disabled. The background isolation mode manager 806 retrieves policies 830 and generates a recovery configuration 832.Access point isolation mode managers 808 apply policy changes 834 locally and send responses and results to the background isolation mode manager 806. These responses are returned to the console 804 as processed responses and the administrator 802 receives a corresponding report 838.

[0047] Figure 9 shows an exemplary case of policy creation and modification 900 by the administrator 902. The components used are the console 904, the backend firewall manager 906, the backend policy store 908, the access point firewall manager 910, and the access point policy store 912. The administrator 902 enters a request 920 to create or modify a policy on the console 904. The console 904 returns an empty policy description 922. The administrator 902 enters a filled policy description 924. In one embodiment, the policy description 924 is a broad policy description. Console 904 sends policy description 926 to backend firewall manager 906, which sends a request 928 for the saved policy to backend policy store 908.The back-end policy store 908 responds by sending the current synchronized policy configuration 930. The back-end firewall manager 906 takes the current policy configuration 930 and configures a new policy 932. Then, the back-end firewall manager 906 sends the new policy configuration 934 to the back-end policy store 908, which saves the policy as the new policy 936. The back-end firewall manager 906 also sends the new policy configuration 938 to the access point firewall manager 910, where policy 942 is applied. The new policy configuration 940 is sent to the access point policy store 912, where the new policy 944 is saved.

[0048] Figure 10 shows procedure 1000 for analyzing the current firewall settings at the request of administrator 1002. The components used are console 1004, background firewall manager 1006, and background policy storage 1008. Administrator 1002 requests a scan 1020 via console 1004. The scan request 1022 is passed to the background firewall manager 1006. The background firewall manager 1006 requests the last saved synchronization configuration from the background policy storage 1008. Data collection 1026 takes place, and the current firewall configuration 1028 is passed to the background firewall manager 1006. This data is processed by the background firewall manager and sent to the console 1004 as processed results 1030 which are available to the administrator 1002 in the form of report 1032.

[0049] Figure 11 shows an example 1100 of direct synchronization initiated by the administrator 1102. The components used include the access point event viewer 1104, the access point synchronization manager 1106, the background policy synchronization manager 1110, and the background policy store 1112. The administrator 1102 initiates a change to the access point firewall policy by sending the change 1114 to the access point event viewer 1104. In turn, the access point event viewer 1104 sends a notification 1114 about the policy changes to the access point synchronization manager 1106. The policy synchronization 1116 takes place between the endpoint synchronization manager 1106 and the background policy synchronization manager 1108.Synchronized policy 1118 is sent to background policy storage 1110 where synchronized policy backup 1120 occurs.

[0050] Figure 12 shows an example 1200 of reverse synchronization initiated by the administrator 1202. The components used are the background synchronization manager 1204, the access point synchronization manager 1206, and the background policy store 1208. The administrator 1202 configures a policy reverse synchronization frequency 1210 via the background synchronization manager 1204. Policy synchronization 1212 takes place between the background synchronization manager 1204 and the access point synchronization manager 1206. The background synchronization manager sends the synchronized policy 1214 to the background policy store 1208, where the synchronized policy backup 1216 occurs.

[0051] Figure 13 shows an overall architecture diagram 1300 with a firewall library 1302 comprising basic primitives 1304 and a plugin feature 1306. The basic primitives 1304 include common internal representations of firewall parameters. For example, there are rules 1320 (for all firewall types) and policies 1322 that describe the rules for each firewall type to some extent. Feature 1324 allows for a unified representation of errors. There is also a feature 1326 for storing information (for example, information in JSON format or in a database) and retrieving this information from storage. The basic primitives 1304 also include other firewall parameters 1328, either for all firewall types or for individual firewalls.

[0052] Plugin functionality 1306 includes plugin loading 1330 and plugin calls 1332. Global plugin primitives 1308 include the plugin API 1340 and the operation states 1342. Communicating with global plugin primitives 1308 is the firewall dynamic plugin library 1310, which includes plugin 1350 and the manager 1352. Dynamic link libraries (DLLs), for example Sophos.dll 1360, Cisco.dd 1362, and Linux.dll 1364, also communicate with global plugin primitives 1308 and the firewall dynamic plugin library 1310.

[0053] The 1340 plugin API is configured to provide a single interface for different plugins. The 1310 Firewall Plugin Dynamic Library is accessible through the 1340 plugin API, as are the 1360, 1362, and 1364 DLLs. Furthermore, the 1340 plugin API is also connected to the 1302 Firewall Library. Thus, the 1340 plugin API provides the same functionality for managing different types of firewalls. For example, the 1340 plugin API retrieves current plugin parameters such as names and versions from the dynamic plugin library. The 1340 plugin API can also be used for initial firewall configuration if a configuration file is required. Another function of the API is to enable the firewall management process, for example, by providing a password, username, or other parameters; by retrieving firewall settings such as rules, rule groups, and policies.Other API functions include adding new firewall settings or modifying existing rules. Finally, the 1340 plugin API offers the ability to disable the firewall management process.

[0054] Figure 14 shows an overview 1400 of the plugin functionality described as a sequence of steps. In the first step 1402, a dynamic plugin library is loaded from a given file path. Then, functions are exported from this library in step 1404. In step 1406, a user can call the functions of the loaded plugin as needed. Finally, in step 1408, all loaded plugins can be deactivated.

[0055] Figure 15 shows an alternative configuration 1500 for the service manager 1502 and the management agent 1504, where user 1506 has access via the administration console 1508. User 1506 can be a super user, an administrator, or another user with similar access privileges. The management service 1502 includes the add-on module 1510 GRPM (General Resource and Policy Manager), the alert manager 1512, the backup manager 1514, the synchronization service add-on module 1516, and the notification server 1518. In another embodiment, the management service 1502 is a cloud-based service. The management agent 1504 includes an alert manager 1520, a backup agent 1522, a firewall policy manager 1524, a notification agent 1526 and a policy collector 1528.

[0056] In one embodiment, user 1506 discovers that a machine playing an important role in the network, or having access to certain sensitive information, is infected. User 1506 begins by interacting with the administration console 1508 and opens a connection to the service manager 1502. User 1506 selects one or more machines to isolate and selects the type of isolation actions. In some isolation types, the backup manager 1514 (on the server side) and the backup agent 1522 (on the agent side) also participate in the isolation process. User 1506 enables or disables an option, such as "show messages to the end user." User 1506 specifies a list, such as a list of exceptions to / from which the connection should remain available in isolation mode.Examples of possible lists include IP addresses, ports, hostnames, or URLs via a dynamic scan of IP addresses.

[0057] User 1506 initiates the process of isolating a computer or machine from the network when the configured requirements are sent to the GRPM firewall add-on 1510 (a specific handle) and are validated. The GRPM firewall add-on 1510 calculates the necessary isolation rules according to this algorithm and places the new rules in the database using the synchronization service add-on 1516, and initiates the disabling of the group policy on the target access point. According to the synchronization algorithm, isolation rules are applied directly, and the influence of group rules is disabled by the firewall rule manager 1524. Synchronization is initiated between the GRPM firewall add-on 1510 and the management agent 1504. Policy retrieval takes place on the agent side, while synchronization occurs via the policy collector 1528 and the firewall policy manager 1524.The GRPM 1510 firewall add-on marks the machine as isolated and interfaces with notification modules to display information on the progress of the isolation mode.

[0058] After the infected computer has been processed, user 1506 initiates the deactivation of isolation mode via the administration console 1508. The GRPM firewall add-on 1510 calculates the changes to the isolation policy to be disabled, and via the interface with the synchronization service add-on 1516, fully restores the machine's policy. The actions available in isolation mode are: isolate only, isolate and back up the infected device, isolate and back up the infected device with forensic data, and isolate and shut down the device. This functionality is supported by the notification server 1518 and the notification agent.

[0059] In one embodiment, several machines are isolated simultaneously. In this embodiment, the entire allowlist is the same for all machines. The allowlist can be modified or edited once the machine enters its isolated state, without exiting that isolated state. In another embodiment, the computer to be isolated is not currently online. In this case, the isolation policy will be applied when the connection is established. The isolation policy is a policy of the highest priority, so all other policies that conflict with the isolation policy are prohibited.

[0060] In one embodiment, alerts will be displayed if the machine fails to enter isolation mode. Alert messages are processed by the alert manager 1520 and displayed to the user 1506 via notification systems. For example, if the user 1506 enables the "show messages to the access point user" option, alerts and messages regarding the progress of activating isolation mode will also be displayed by the alert manager 1520 on the agent side. Alerts will be displayed if the machine fails to exit isolation mode. In another embodiment, certain alert messages will be processed by the alert manager 1512 and displayed on the administration console 1508 via notification systems.

[0061] In one embodiment, the components of Figure 15 are used for policy control including the creation or modification of the current policy on the access point, the creation of new rules, the modification of firewall settings and default actions.

[0062] The administration console 1508 is used to define a broad policy structure for a chosen type of supported firewall, such as Windows, Linux, Sophos, Cisco, or others. The new policy is delivered to the GRPM firewall addon 1510, which validates the policy. The GRPM firewall addon retrieves the current policy using the synchronization service addon 1516 and adds, modifies, or deletes new or old rules and settings in the databases. According to the synchronization algorithm, at the time of initial synchronization between the GRPM firewall addon 1510 and the firewall policy manager 1524 (assuming the managed computer is on the network), the new policies are directly applied by the firewall policy manager 1524. This step depends on the type of firewall being managed.For example, the enterprise firewall only supports a more limited portion of the extended policy description. The policy is updated when synchronized with the help of the policy collector (1528) and the firewall policy manager (1524) on the agent side. Policy conflicts are resolved based on the policy's priority. Alerts showing conflict details are handled by the alert manager (1512).

[0063] In one embodiment, the library supports a broad description of a policy, such as rules, user groups, rule groups, or default actions, which can be configured and applied to a given access point. Policies are defined based on the selection of parameters.

[0064] If a stricter policy is required and an enterprise firewall cannot support it, the GRPM 1510 Firewall Add-on provides this functionality by involving other types of default managed firewalls that operate at the software level. In one embodiment, older parts of a policy are modified and saved in the database or deleted from the database. Alternatively, policies are renewed when new parts of the policy are saved in the database.

[0065] In an embodiment with enterprise firewalls, only a narrower policy is deployed when certain elements of the broader policy are unavailable. Conversely, for software-level firewalls, a broad policy structure is implemented. The broad policy structure is defined with restrictions at the user or user group level for a chosen type of supported firewall, such as Windows, Linux, Sophos, Cisco, or others. The GRPM firewall addon 1510 performs policy validation. The GRPM firewall addon 1510 retrieves the current policy using the synchronization service addon 1516 and adds, modifies, or deletes new or old rules and settings in the database, associating the changes with a user group or user.According to the synchronization algorithm, when the synchronization between the GRPM firewall add-on (1510) and the firewall policy manager (1524) is initialized, new policies are directly applied by the firewall policy manager (1524). This step depends on the type of firewall being managed. Policy updates occur during synchronization with the assistance of the policy collector (1528) and the firewall policy manager on the agent side. Policy conflicts are resolved based on policy priority. Alerts containing conflict details are sent by the alert manager (1520).

[0066] In one embodiment, a managed firewall does not currently support policies for users or user groups. In this case, policies for specific users and user groups are stored and loaded after the user is activated. The 1504 management agent and a local database perform these steps.

[0067] To provide URL and hostname resolution functionality when a machine is in an uninfected state, the background receives a list of DNS servers. The background stores these in a database such as "IP addresses known to DNS servers." The background checks a provided list of DNS servers. A given server is considered trusted if it is a local Windows Active Directory DNS server or a public server that supports DNSSEC. In one embodiment, the DNS servers that were characterized as trusted during the discovery process will be used to resolve URLs and hostnames.

[0068] The IP addresses of the DNS servers are configured for later use in resolving URLs and hostnames during isolation mode. If a DNS server is not trusted, the corresponding alert message is displayed on the administration console 1508. Interaction will be performed as with a trusted DNS server if the user 1506 authorizes it. The background sends the management agent 1504 a list of IP addresses of trusted DNS servers, and a list of URLs and hostnames, which must be resolved into a list of IP addresses. The management agent 1504 accesses the corresponding DNS servers and sends the received IP addresses (resolved URLs and hostnames) to the background. The background creates exceptions for the received IP addresses according to the algorithm.When switching to isolation mode, you may need more than what's in the administrator's "allowed list," as well as additional ports and IP addresses to interact with the background. This includes ports and IP addresses for DNS servers. According to this policy, there are two main ways to update dynamic IP addresses. First, the management agent 1520 detects certain events from the DNS client. In this case, the 1520 agent sends a "refresh ping request" to the background, and step b begins. Next, the background sends a verification request to the 1504 agent to check the validity of URLs and hostnames against the IP address list. This step can be performed either independently or following the first step.In another embodiment, before the second step, user 1506 modifies a list of trusted DNS servers in the background. Then, the updated isolation rules are sent to management agent 1504. Preferably, this is done so that the isolated machine can access the new DNS servers. Management agent 1504 forwards the received IP address updates to the background, which checks them against the existing rules and replaces them if changes have been made. The new, modified isolation rules are then sent to agent 1504, and the modified isolation rules are applied to agent 1504.

[0069] In one embodiment, the dynamic IP address policy is updated. For example, Event Tracing for Windows (ETW) running on the 1504 management agent detects the appropriate events from the Microsoft-Windows-DNS-Client provider. In this case, the 1504 agent initiates the update of IP addresses that correspond to certain URLs or hostnames in the isolation policy. According to the specified configurable time intervals, for example, 10 minutes, the 1504 agent initiates the update of the appropriate IP addresses. The administrator can use the administration console to force the update of dynamic IP addresses on the selected terminal. In this case, the background forces the 1504 agent to initiate the update of IP addresses that correspond to certain URLs or hostnames in the isolation policy.

[0070] For the isolation mode to be implemented, all machines on the managed network must support the ability to be isolated. Currently, these requirements can be met by a machine running the Microsoft Windows operating system. An appropriate policy is also required, for example, policy.machine.network_isolation in JSON format:

[0071] Where “immediate action” may contain the following values: isolate only; isolate and back up the infected device; isolate and back up the infected device with forensic data; and isolate and shut down the device. An authorized property must contain the values ​​corresponding to its name with an indication of the traffic direction, whether inbound, outbound, or both inbound and outbound (default).

[0072] A network isolation addon will be registered by calling POST on the GRPM / addons endpoint (POST / api / resource and_policy_addons / v1 / addons) with content describing the policy and resource traits. According to the GRPM addon REST API, the Network Isolation Addon should assist GRPM in resource discovery and policy validation. Newly discovered resource types must be validated when, for example, new machines join the network. Policy validation is implemented by " / validator", which validates the administrator-configured policy structure against a specified allowlist. Policy validation is also implemented by " / applicability endpoints", which verifies that the policy can be applied to the resource, for example, a machine running the Windows operating system.The policy deployment role is implemented by the ` / deployment endpoint` because Network Isolation requires custom execution. Since the Network Isolation policy assumes non-continuous execution, this role is implemented by the ` / run endpoint`.

[0073] Figure 16 shows an embodiment 1600 with the additional GRPM function described in relation to Figure 15. In one embodiment, a mandatory hook interface is used and access is controlled. For example, a GRPM superuser with special permissions can be granted exclusive authority to use the mandatory hook interface via console 1601, which is communicating with a cloud-based service 1602. Under management are server 1604, two access points 1606 and 1608, connected by switch 1610. In one embodiment, firewall 1612 refers to an enterprise firewall protecting other network resources behind it.

[0074] Access points 1606 and 1608 include access point firewall management agents 1620 and 1630 and access point firewalls 1622 and 1632. Server 1604 includes a centralized firewall management agent 1640 and an access point firewall 1642.

[0075] The cloud service 1602 includes the GRPM 1650, the GRPM 1652 firewall management addon, and the policy storage 1654 in communication with the GRPM 1652 addon.

[0076] The system and methods described above are implemented in an enterprise computer network environment. In the context of the invention, the term "enterprise" refers to the use of managed access points and a centralized management server. Such configurations can be implemented by commercial, non-profit, and government organizations.

Claims

1. A system for isolating machines in a computer network with a plurality of access points, comprising a. a centralized firewall management service; b. one or more firewall management agents installed on managed access points; c. wherein the firewall management service is configured to deploy an isolation mode for at least one access point; and d. wherein application firewall settings, permissions, and firewall configurations are controlled by the firewall management service.

2. The system of claim 1, wherein the firewall management service and one or more firewall management agents perform direct policy synchronization between the firewall management service and one or more firewall management agents.

3. The system of claim 2, in which the firewall management service includes a hierarchy of firewall policies.

4. The system of claim 3, in which the access points include software with firewall policies and the firewall policies applied to the software are broader than the policies that apply at the network level.

5. The system of claim 3, wherein isolation mode rules block all network traffic to and from an access point except for isolation mode rules that are configured to exclude one or more barrier services on incoming and outgoing network traffic.

6. The claim 5 system, in which in the hierarchy of firewall policies, the isolation policy is the highest priority policy.

7. The claim 6 system, in which current firewall policies are converted into a unified policy representation format.

8. The system of claim 6, wherein the firewall management service is configured to perform dynamic scanning of IP addresses.

9. A method for isolating access points in a computer network with a firewall management service and one or more firewall management agents installed on one or more machines at the access points, comprising the steps of: a. identifying an access point infected with malware; b. configuring firewall policies for the access point that permit access to the machine by specified services; c. cleaning the isolated machine of malware; and d. restoring network firewall rules for the isolated machine.

10. The method of claim 9, further comprising the steps of: a. direct synchronization of policies by the firewall management service and one or more firewall management agents.

11. The method of claim 10, further comprising the step of synchronizing firewall policies with reference to a hierarchy of firewall policies.

12. The method of claim 11, wherein the access points include software with firewall policies and further comprising the step of configuring the firewall policies applied to the software, are broader than the policies that apply at the network level.

13. The method of claim 12, further comprising the step of allowing access by one or more services to the machine which would otherwise be blocked according to firewall policies controlling incoming and outgoing network traffic.

14. A method of claim 13, wherein, in the hierarchy of firewall policies, the isolation policy is the highest priority policy.

15. The method of claim 11, further comprising the step of converting current firewall policies into a unified policy representation format.

16. The method of claim 11, further comprising the step of performing a dynamic scan of IP addresses via the firewall management service.

17. Method of claim 11, wherein the machine is a server.

18. A means for isolating a machine in a computer network under management by a firewall management service and a firewall management agent, the means comprising: a. means for isolating a machine infected by malware; b. means for creating one or more rules governing access to the isolated machine; and c. means for restoring the isolated machine to its pre-isolation state.

19. The means of claim 18, further including means to safeguard modified firewall policies after recovery of an isolated machine.

20. The means of claim 18, further comprising API means for configuring firewall rules by retrieving current plugin settings from available libraries, accessing the current firewall configuration, and retrieving firewall settings or parameters.