We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byJoe Boor
Modified over 3 years ago
Decreasing Incident Response Time ______________________________ Benefits of Packet Capture & Real-time NetFlow Generation Boni Bruno, CISSP, CISM, CGEIT Technical Director
2 Copyright © 2014 You Just Suffered a Major Security Breach! What Happened?! Who Was Affected?! When Will It Be Fixed?! 3 Questions Your IT Staff Better Answer in the First 8 Hours!! Could Your Current SEM/SIEM Tools Cover You for this Security Breach?
3 Copyright © 2014 Suspect Identify Mitigate Impact Tools Fixed Permanent Protection Security Incident Lifecycle
4 Copyright © 2014 Security Incident Lifecycle Unique EventCan lead to repetitive events if not correctly identified…
5 Copyright © 2014 Security Incident Lifecycle
6 Copyright © 2014 Security Incident Lifecycle Reduced Frequency Minimize Scope of Impact Faster Remediation ID Root Cause
7 Copyright © 2014 Security Architecture Full Content Repository Current Security Infrastructure: Firewall IDS/IPS DLP End Point Security Events pcaps Event-driven “snippets” and/or ALL traffic recorded into a rolling buffer Alarm Search & Analysis Event / Log Repository Packet Storage SIEM (Security Info & Event Mgmt) Packet Capture
8 Copyright © 2014 SIEM Integration via RESTful API
Visibility & recording infrastructure for high- speed networks Endace provides 100% accurate network recording at 1Gbps to 100Gbps!!!
10 Copyright © 2014 Next-Generation EndaceDAG Overview Designed for data capture applications requiring 100% network data capture Three “Feature Bundles” Three Product Configurations Low Overhead Zero Loss Capture Hardware Time Stamps Global Clock Synch In-Band Metadata Classification/filtering Load Balancing
11 Copyright © 2014 Endace Network Visibility Infrastructure Network Visibility Headend Allows EndaceProbe INRs/ODE to scale to 40 and 100GbE EndaceAccess™ Network Visibility Headend Endace Open Hosting Platform (ODE ) High Performance Intelligent Network Recording Up to 64 TB storage Mix of 1 and 10GbE ports EndaceProbe™ Intelligent Network Recorder EndaceFlow™ NetFlow Generator Appliance (NGA) Hosting Platform for Monitoring Applications 8x1GbE or 4x10GbE Ports Up to 16 TB internal storage; Fibre Channel support for SAN High-Speed NetFlow Generation for 10GbE Networks 4x10GbE Ports EndaceProbe: Provides 100% packet capture on 10Gb Ethernet links NetFlow Generator: Generate unsampled netflows from 1GbE/10GbE links EndaceAccess: Load-balances 40Gb/100Gb links across multiple INRs Endace ODE: Provide packets for hosted 3 rd party applications
12 Copyright © 2014 The Endace Probe Solution
13 Copyright © 2014 Monitoring and Recording Fabrics
14 Copyright © 2014 100% Packet Capture means 100% Network Visibility
15 Copyright © 2014 Can you Pinpoint Microbursts Occurring on your Network?
16 Copyright © 2014 Can you Identify Applications Running on your Network?
17 Copyright © 2014 Can you Identify Traffic Changes Over Time?
18 Copyright © 2014 Can you see Conversations on the Network?
19 Copyright © 2014 Search through Packets in a Browser!
20 Copyright © 2014 100Gbps Packet Capture…
21 Copyright © 2014 Time Synchronization
23 Copyright © 2013 NetFlow – The New Way!!!
24 Copyright © 2013 NetFlow – The New Way!!!
25 Copyright © 2013
26 Copyright © 2013
1© Copyright 2011 EMC Corporation. All rights reserved. The Future of the Advance Soc 3rd Annual Privacy, Access and Security Congress, Ottawa, 2012 Mike.
Network Systems Sales LLC
Complete Event Log Viewing, Monitoring and Management.
Business Solutions Network Security Solutions Gateway Security
LeadManager™- Internet Marketing Lead Management Solution May, 2009.
SHARKFEST ‘10 | Stanford University | June 14–17, 2010 Operating a Flexible Network Monitoring Infrastructure June 17, 2010 Dr Stephen Donnelly Core Software.
Stonesoft Roadmap WHAT FEATURES WILL COME IN
A new Network Concept for transporting and storing digital video…………
MUNIS Platform Migration Project WELCOME. Agenda Introductions Tyler Cloud Overview Munis New Features Questions.
SHARKFEST '09 | Stanford University | June 15–18, 2009 Now and Then, How and When? June 16 th, 2009 Stephen Donnelly Technologist | Endace Technology SHARKFEST.
The Most Analytical and Comprehensive Defense Network in a Box.
1 Emulex Confidential - © 2013 Emulex Corporation Emulex Network Visibility Products (NVP) Customer Success Stories Overview Emulex Corporation October,
SHARKFEST ‘10 | Stanford University | June 14–17, 2010 The Shark Distributed Monitoring System: Distributing Wireshark Deep Packet Analysis to LAN/WAN.
© 2015 Cisco and/or its affiliates. All rights reserved. 1 The Importance of Threat-Centric Security William Young Security Solutions Architect It’s Our.
“It’s going to take a month to get a proof of concept going.” “I know VMM, but don’t know how it works with SPF and the Portal” “I know Azure, but.
© 2004 Visible Systems Corporation. All rights reserved. 1 (800) 6VISIBLE Holistic View of the Enterprise Business Development Operations.
Security Monitoring In Your Network Welcome Ray Jones
A survey of commercial tools for intrusion detection 1. Introduction 2. Systems analyzed 3. Methodology 4. Results 5. Conclusions Cao er Kai. INSA lab.
MIGRATION FROM SCREENOS TO JUNOS based firewall
© 2014 Level 3 Communications, LLC. All Rights Reserved. Proprietary and Confidential. Polycom event Security Briefing 12/03/14 Level 3 Managed Security.
© 2018 SlidePlayer.com Inc. All rights reserved.