NC1701

FEATUREREAL-TIME DETECTION
SITUATIONALLY AWARE
SUN TZU ARTICULATED THE MERITS OF KNOWING BOTH ENEMY
AND SELF. REGGIE BEST, CHIEF PRODUCT OFFICER AT LUMETA
EXPLAINS WHY REAL-TIME NETWORK VISIBILITY IS THE FIRST STEP
IN BOLSTERING NETWORK SECURITY AND BREACH DETECTION
All organisations are faced with a
growing and evolving cyber-threat
landscape staffed by criminals,
hacktivists and cyber-spies. Their complex and
multi-vectored attacks are difficult to detect
and mitigate.
THE CHALLENGE
IT infrastructure comprises an increasingly
dynamic environment, including cloud, virtual,
on premise, mobile and IoT devices. Many
organisations are using public cloud
infrastructure as a service (IasS) to augment
their private data centre. Often there is a
virtual private network connection between
IaaS and the data centre making the IaaS
cloud part of the enterprise network. There
may be several public cloud instances, each
managed by a departmental administrator.
These resources have the ability to change
network topology dynamically by simply
running-up a virtual machine with a virtualised
network function, switch, router, firewall,
packet forwarder, etc. That function may only
run for a few minutes or an hour, and only
when that virtual machine is executed.
This dynamic and growing attack surface
creates a difficult and significant IT security
challenge.
YOUR DYNAMIC NETWORK IN
REAL-TIME
Real-time network visibility is the first essential
step to strengthen network security defences.
This should include an accurate inventory of
authorised network infrastructure and the
active IPv4 and IPv6 addresses in use. Visibility
of when mobile, cloud and virtual endpoints
connect and leave also makes your current
and dynamic network edge visible.
NETWORK SEGMENTATION
Segmenting your network and critical
information resources and then monitoring
them in real-time, ensures the segmentation
stays intact and can expose hunting for
unauthorised routes between entities. It can
also find unknown networks, non-responding
networks, multi-homed hosts and split
tunnelling. It should also provide visibility into
external network connections and any
unrestricted paths to your network from the
Internet or to a vendor or supply chain partner.
THREAT INTELLIGENCE
Should attackers have already compromised
security you still need to monitor the network in
real-time for the tell-tale signs of nefarious
activity including cyber-espionage, criminal
activity and hacktivism. Threat intelligence
feeds can keep up with the evolution of cyberthreat
methods. They are made actionable by
correlating the real-time network infrastructure
and segmentation data against known threats,
new threat intelligence and newly connected
devices, to provide real-time cybersecurity
breach detection.
Threat intelligence feeds can hunt for zombie
computers and communications on the
network and analyse threat conversations
(unauthorised communication flows) occurring
between devices on the network (internal
origination points) and known bad actor IP
addresses. They can also identify the internal
use of known Trojan or malware ports or
outbound access to the dark web or
command & control botnets, as well as
malware using unauthorised ports for lateral
network movement.
Using threat intelligence to identify threats
before they can establish a foothold reduces
the likelihood and severity of these highimpact
incidents which exposes intellectual
property, financial assets and personal data.
This helps to protect reputation and
compliance.
MAXIMISING EXISTING SECURITY
INVESTMENTS
Network security analysts traditionally rely on
products such as host vulnerability assessment
(HVA), network modelling (what-if) tools and
endpoint detection and response (EDR) to gain
insights into endpoints and network
infrastructure. Without real-time visibility into
the network, such tools will miss considerable
activity and create unacceptable risk.
Adding real-time network visibility feeds to
these existing security investments and the
enterprise security data lakes, maximises their
effectiveness by ensuring that they work off of
a complete index of network knowledge.
Endpoint security needs to be proactive to
disrupt advanced attacks and EDR software
requires a client agent on every device. If an
organisation has any undefended endpoints -
blind spots - they remain vulnerable to cyberattacks.
Real-time visibility of all devices
connected to the network ensures that EDR
software is aware of all endpoints and can
provide protection. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards JANUARY/FEBRUARY 2017 NETWORKcomputing 9