CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

sources (such as syslog’s, Net Flow data, authentication logs, and application logs) and trying to
reconstruct what happened.
Leading US healthcare organizations’ security teams are turning to continuous packet capture to
give them an edge in dealing with the flood of alerts and helping them accelerate the investigation
and response process. Recording what happens on their network lets SecOps teams go from a
security alert in their monitoring tools directly to definitive, packet-level evidence. Real-life
examples include:
A hospital group in the Northeastern US is preventing malware attacks by extracting and
reconstructing executable email attachments from recorded traffic and running them in a sandbox
to validate whether they are malware or not. It also uses recorded network history to successfully
thwart phishing attacks and identify potentially compromised credentials before attackers have an
opportunity to use them to access systems. It can also identify when hospital staff have had their
personal credentials compromised while on the hospital’s network (e.g. banking logins
compromised through phishing) and as a result can warn them to change their passwords
immediately.
A large healthcare organization based in the Southern US uses recorded network history to
accelerate the investigation of security alerts raised by their security monitoring software tools,
such as Darktrace, and collected by their Spelunk SIEM. The security team can swiftly retrieve
the packets relating to an alert to see precisely what has occurred, and immediately go into
analysis mode to know how to respond and what the scope of the threat is.
Virtualizing and streamlining security functions on a common platform can enable organizations
to continually evolve their defenses and keep ahead of security threats. With access to a packetlevel
history of network activity, analysts can examine the actual packets relating to a security
alert to make sure they have the definitive evidence they need to quickly and conclusively
investigate and respond to security threats and reduce the backlog of unexamined alerts.
About the Author
John Attala is the Director, North America for Endace, a world leader in
high-speed network monitoring and recording technology. As the North
American sales leader, John has played a pivotal role in launching and
building Endace’s network monitoring business within the North
America. He has more than 20 years’ experience in selling networking
and security solutions to Fortune 1000 companies and government
accounts—bringing a deep understanding of the market, delivering a
consultative, solution selling approach to solve complex problems and
improving network security across the globe. John can be
Reached at Twitter (https://twitter.com/endace) and LinkedIn
(https://www.linkedin.com/in/john-attala-8408a9a/)
and at our company website (http://www.endace.com ) and
LinkedIn (https://www.linkedin.com/company/endace/).