Network forensics can be an intimidating subject. When IT personnel hear the word “forensics” they often recoil with visions of complicated software such as EnCase. Or they may think about expensive packet capture solutions such as Niksun’s NetDetector product line. While these tools can serve a specific purpose, your first line of network forensics defense should always be found in NetFlow and IPFIX…
Author: Adam Powers
Experienced technology professional specializing in information security. Skilled orator and accomplished public presenter (see webinars, blogs, etc below). Lead advocate for NetFlow and IPFIX technology adoption.
100 Universities Hacked: Time For a Change in Network Security Philosophy?
A hacktivist group calling itself Team GhostShell has claimed responsibility for leaking 120,000 records from more than 100 higher-education networks. Team GhostShell claims the attacks were carried out in an attempt to “bring attention to failing educational standards worldwide.”
From the looks of it they were quite successful. The story has been picked up many times with dozens of articles discussing it.
I don’t want to get into a debate on world-wide educational standards, but I do think there is a serious discussion to be had around higher education network design, policy, and network security methodology.
NetFlow and IPFIX For PCI Compliance: Verify, Investigate, Impress
At least two or three times each week we’re asked how NetFlow relates to PCI compliance. Our answer is crisp and simple. No fancy requirement references or complicated legal speak, just practical advice that’s actually useful for those concerned with the PCI audit process. There are three key areas NetFlow and IPFIX analysis can aid the enterprise as it relates to PCI:
BYOD Policy Essentials: Trust But Verify
The IT Consumerization or “Bring Your Own Device” (BYOD) movement is already well underway and the iPhone5 launch will see even more employee sourced devices hitting the enterprise network. Even if you’re lucky enough to work for a company that provides iPhones to their employees, you probably don’t want to wait for IT to upgrade your iPhone now do you? You’ll want to BYOD.
So in support of iPhone5 users everywhere, here are three essential components of a BYOD-ready company: Policy, Education, Technology. Let’s discuss…
A Firewall Monitoring Tool You Didn’t Know Existed: NetFlow and IPFIX
IT professionals have been looking for better ways to monitor and store firewall logs for years. Properly handled, firewall events can give insight into APTs, DoS attacks, firewall rule planning and misconfigurations, policy violations, and much more. To date, Syslog has been the go-to mechanism for access to firewall log info. It’s universally supported by the firewall community, easy to understand, and it’s quick to implement on both the firewall as well as the syslog analyzer.
Unfortunately syslog is resource intensive on both the firewall and the log analyzer. It’s largely unstructured, requires string pattern matching, and the exact format and fields vary from one firewall to the next. How often do you turn on full “Accept” and “Deny” logging for every rule? Sure you can and yes it’s valuable but the amount of syslog created is tremendous.
Enter NetFlow and IPFIX…