Centralized Network Segmentation for Data-Based Security Risk
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security solutions are ineffective in dynamically adapting to the changing nature of devices within a network, lacking flexibility and failing to proactively mitigate data-based security risks, especially in large and medium organizations, due to manual reconfiguration and the inability to handle dynamic changes in device criticality and hardware/software updates.
Innovation Solution
A network monitor entity scans the network to assess security risks based on data sensitivity and vulnerability, dynamically segmenting the network and adjusting access policies through enforcement points to isolate or reduce access to risky devices, using a centralized approach that adapts to changes in software, hardware, and data configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual reconfiguration is used to adapt network security, then security policies can be adjusted, but the system cannot dynamically respond to changing device criticality and hardware/software updates
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and assessing device security risks in advance, maintaining an updated risk assessment database that evaluates device criticality, hardware/software configurations, and security postures before incidents occur, enabling proactive rather than reactive security management
Solution Approach 2:
The system implements dynamic network segmentation that automatically adjusts segment assignments and access policies in real-time based on changing device risk assessments, allowing the network topology to adapt dynamically to device changes, updates, and criticality variations without manual intervention
2Reliability
If DLP software is installed on devices to enhance security, then data protection is improved, but devices become overburdened with restrictive software
Solution Approach 1:
The system extracts the security enforcement function from individual devices and relocates it to a centralized cloud-based platform. The risk assessment database and segmentation logic reside externally, allowing devices to be monitored and controlled without installing heavy DLP software locally, thus reducing device complexity while maintaining security reliability
Solution Approach 2:
The system introduces a centralized network monitor entity as an intermediary between security policies and devices. This mediator assesses device risks, determines appropriate segmentation levels, and enforces access policies without requiring direct software installation on monitored devices, reducing their software burden while maintaining security control
3Object-affected harmful factors
If network segmentation is implemented to isolate risky devices, then security risks are reduced, but network access flexibility is limited
Solution Approach 1:
The system implements dynamic network segmentation where segment assignments and access policies automatically adjust based on real-time device risk assessments. Devices can move between security segments as their risk profiles change, maintaining access flexibility for low-risk devices while automatically isolating high-risk devices, thus balancing security risk reduction with network access versatility
Solution Approach 2:
The system applies differentiated access policies to different network segments based on local risk characteristics. Each segment receives security controls tailored to its specific risk level and device criticality, allowing high-security zones for sensitive devices while maintaining open access for low-risk devices, thereby reducing overall security risk exposure while preserving necessary network access flexibility
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and related technologies for identifying and reducing security risks on a network are described. Data that is held on each of one or more devices that are connected to a network is determined. A security risk of each of the one or more devices is determined based at least on the data. In response to the security risk of one of the one or more devices satisfying a threshold, the network is segmented such that the one of the one or more devices is placed on a less accessible segment of the network which reduces the security risk of the one of the one or more devices.