Network Monitoring Archives - Page 12 of 12

5 Ways to Use APM for Post-Event Security Forensics

Most security experts agree that the rapidly changing nature of malware, hack attacks and government espionage practically guarantees your IT infrastructure will be compromised. According to the 2014 Cost of Data Breach Study conducted by the Ponemon Institute, the average detection, escalation and notification costs for a breach is approximately $1 million. Post-incident costs averaged $1.6 million.

Once an attacker is within the network, it can be very difficult to identify and eliminate the threat without deep-packet inspection. The right Application Performance Management (APM) solution that includes network forensics can help IT operations deliver superior performance for users, and when incorporated into your IT security initiatives, deep packet inspection can provide an extra level of support to existing antivirus software, Intrusion Detection System (IDS) and Data Loss Prevention (DLP) solutions. The ability to capture and store all activity that traverses your IT infrastructure acts like a 24/7 security camera that enables your APM tool to serve as a backstop to your business’ IT security efforts if other lines of defense fail.

To use APM solutions for security forensics for post-event analysis, you must have a network retrospective analyzer that has at least the following capabilities:

High-speed (10 Gb and 40 Gb) data center traffic capture
Expert analytics of network activity with deep packet inspection
Filtering using Snort or custom user defined rules
Event replay and session reconstruction

Capacity to store massive amounts of traffic data (we’re potentially talking petabytes) for post-event analysis

Like utilizing video footage from a surveillance camera, captured packets and analysis of network conversations can be retained and looked at retrospectively to detect, clean up and provide detailed information of a breach. This back-in-time analysis can be especially important if the threat comes from within, such as a disgruntled employee within a company firewall. It also allows companies to determine exactly what data was compromised and help in future prevention.

Below are five ways to use network monitoring and analysis to investigate breaches:

Identify changes in overall network traffic behavior, such as applications slowing down that could be a sign of an active security breach.
Detect unusual individual user’s account activity; off-hour usage, large data transfers, or attempts to access unauthorized systems or services — actions often associated with disgruntled employees or a hacked account.
Watch for high-volume network traffic at unusual times, it could be a rogue user in the process of taking sensitive data or stealing company IP.
View packet capture of network conversations to determine how the breach occurred and develop strategies to eliminate future threats by strengthening the primary IT security.
Discover what infrastructure, services, and data were exposed to aid in resolution, notification, and regulatory compliance.

By incorporating retrospective network analysis, companies can use their network monitoring as a back stop to IDS and DLP solutions, and accelerate detection and resolution.

Thanks to APM Digest for the article.

A Unified View of Network Monitoring

In the past few years, the enterprise computing technology has changed dramatically. Virtualization, SaaS, and cloud computing are creating fundamental changes, and leading to an time in which enterprises distribute critical IT applications across multiple service providers and infrastructure. These changes are rendering legacy monitoring tools, which have their roots in the computing environments of a decade or more ago, virtually useless. This paper explores today’s computing trends and their monitoring implications. In addition, it reveals how a new monitoring paradigm, the NMSaaS architecture, uniquely addresses the monitoring realities of today’s and tomorrow’s enterprises—whether they rely on internal platforms, external service providers, or a combination of both.

Download the white paper

Network Management Network Monitoring Network Monitoring Software

Data Security and Performance Management from Network Instruments

Network Instruments Data Security and Performance Management

Is your performance management solution a target for attackers? With increasingly creative exploits, it is important to stay ahead of the curve when it comes to data protection. Performance monitoring tools that do not keep pace can leave your information vulnerable.

TOTAL PERFORMANCE MANAGEMENT

The Observer® Performance Management Platform is a fully integrated solution, purpose-built to support the highest level of network security.

Its features include:

TLS-based 256-bit encryption for data in motion and data at rest
Power to keep up with line-rate during encryption
Network invisibility option with internal Gen2 capture card
Web-based interface for reduced learning curve, maximum ease of use
Centralized management of AAA

The Observer Platform delivers a return far above its cost, as not only a powerful monitoring solution but a wise addition to any enterprise security strategy.

Learn more by downloading the white paper

Network Management Network Monitoring Network Performance Network Security

The 5 Main Questions You Have to Ask in Network Management

Although many people may perceive Network Management as an extremely complicated and diverse area of specialty, there really are only 5 questions that every Network Manager needs to think about. The main components behind every problem in Network Management, are as follows:

What do I have?

If you don’t know what you have how can you manage or monitor it. Most of the time in Network Management you’re trying to track down potential issues and how you’re going to resolve these issues. This is a very hard task especially if you’re dealing with a large scale network. If one thing goes down within the network it starts a trickle effect and then more aspects of the network will in return start to go down.

If you don’t know what you have how are you meant to know if you need an upgrade. Numerous enterprises are paying for upgrades that aren’t needed and getting charged for unnecessary maintenance. A simple tool like automated discovery management can help resolve this. It identifies what you have, displays topology maps and automatically compiles reports.

Is anything broken?

At times, technology seems like it is advancing faster than we can keep up with it. As the industry evolves, your business must adapt to take these changes, especially if you want to stay as efficient as possible. Finding out if there are any issues with your infrastructure sooner rather than later is an obvious factor, but some people find this harder than others with the size of their IT infrastructure.

Having the right Network Management solution enables you to find the flaws early on so they don’t snow ball into a catastrophe. Continuous monitoring of all systems ( devices, services, UPS’s) are all key components to eliminate these issues, an application such as Root Cause Analysis or Weathermapping can help you manage these complications.

Why is it slow?

The number one complaint is why is it slow? Everyone always presumes that it’s the networks fault that the application is slow, in reality there is a number of issues. These concerns include over capacity of links, poorly written applications, firewall problems or even QoS issues. Sometimes it’s tricky to find the actual cause of the application being slow as most of the time there is no evident issue to be found.

What can be done? TEST, TEST, TEST, and then correlate these to come up with a realistic resolution. You can use NetFlow to get a real deep dive into what’s going on.

Is it secure?

Is my network secure is a hot topic these times with breaches occurring in some of the top firm’s applications. Company’s such as JP Morgan, EBay and Snapchat have all had security threats in 2014 with a lot of their customer’s information being jeopardized. Many wonder if these networks are safe and the answer is that that they are.

There is always going to be vulnerabilities no matter what, in the first of half 2014 there were over 400 security breaches within companies withholding personal information. As long as you have a trusted network manager you should be ok, a lot of these hacks are just wake up calls for companies to improve their security network.

Our approach to security is to create, push and perform security policies. Every network application should have a good protection policy configuration. Here at NMSaaS we can create those policy checking systems which have the possibilities to take down any possible vulnerabilities and eliminate them.

Can I recover if something fails?

In reality nothing lasts forever, the average life span for a hardware device is 4 years. The main concern is are you able to recover your data if a problem arises, and the answer is yes.

What to do

Back up all of you device configuration files (off site)
Maintain a consistent schedule of backups.
Have a quick and simple restoration process if something does fail.
There are always going to be problems no matter what, but what you have to remember is that there is always a solution to every problem!

Network Management Network Monitoring Network Monitoring Software Network Security

Security & Compliance Monitoring

High-stakes Monitoring

Global finance moves fast. When data and transactions don’t take place as smoothly or securely as expected, the company’s revenues and reputation may instantly suffer, causing valued customers to seek more reliable providers. Regulatory requirements are also growing, creating a greater need for security and compliance monitoring.

To mitigate risk and ensure performance, Ixia’s network visibility solutions deliver the ongoing data needed to dynamically detect, avoid, and address issues that affect production networks, private clouds, and applications. With security and compliance monitoring requirements increasing and physical networks becoming more complex, the Ixia suite of network monitoring switches optimizes use of network monitoring access points and overcomes hardware limitations for increased visibility at reduced cost.

Leveraging industry-leading network visibility technology, Ixia’s solutions enable engineers running the world’s most demanding networks to:

Minimize latency and speed transaction times
Prevent fraud and secure data across multiple networks and private cloud infrastructures
Maintain compliance with rigorous regulatory standards associated with PCI-DSS and other governance
Maximize existing investments while evolving to 40Gbps and beyond
Demonstrate fairness to customers and compliance with requirements tied to Service Level Agreements

Ixia’s suite of solutions also supports testing, assessing and optimizing of network and application performance, security, compliance, and management under diverse conditions. These breakthrough solutions deliver:

Increased network visibility by efficiently providing network, application, and security monitoring tools the exact data they need
Expanded network monitoring capacity with aggregation, filtering, and replication of data enabling simultaneous monitoring of multiple connection points from a single port
Maximum tool utilization extending 1Gbps monitoring tools to 10Gbps and 40Gbps networks to defer costly upgrades
Automated troubleshooting that reduces mean time to repair (MTTR)
Industry-first “drag and drop” interface that speeds and simplifies configuration and management

Related Products


Net Tool Optimizers Out-of-band traffic aggregation, filtering, dedup, load balancing	Net Optics Network Taps Passive network access for security and monitoring tools	Phantom Virtualization Tap Passive network access to traffic passing between VMs	Net Optics Network Packet Brokers Inline traffic aggregation, filtering, deduplication and load balancing for monitoring tools	Ixia Application and Threat Intelligence Processor Better data for better decisions

Resources

The Real Secret to Securing your Network

Thanks to Ixia for the article.

Network Access Network Monitoring Network Security Network Taps