Download
1 / 26
260 likes | 416 Vues
Decreasing Incident Response Time ______________________________ Benefits of Packet Capture & Real-time NetFlow Generation. Boni Bruno, CISSP, CISM, CGEIT Technical Director. You Just Suffered a Major Security Breach!. 3 Questions Your IT Staff Better Answer in the First 8 Hours!!.
E N D
Decreasing Incident Response Time______________________________Benefits of Packet Capture & Real-time NetFlow Generation Boni Bruno, CISSP, CISM, CGEIT Technical Director
You Just Suffered a Major Security Breach! 3 Questions Your IT Staff Better Answer in the First 8 Hours!! Could Your Current SEM/SIEM Tools Cover You for this Security Breach?
Security Incident Lifecycle Suspect Identify Mitigate Impact Permanent Protection Tools Fixed
Security Incident Lifecycle Unique Event Can lead to repetitive events if not correctly identified…
Security Incident Lifecycle Faster Remediation Minimize Scope of Impact Reduced Frequency ID Root Cause
Security Architecture • Current Security • Infrastructure: • • Firewall • • IDS/IPS • • DLP • End Point Security SIEM(Security Info & Event Mgmt) Events Event / Log Repository Alarm Packet Storage Full Content Repository Search & Analysis pcaps Packet Capture Event-driven “snippets” and/or ALL traffic recorded into a rolling buffer
Visibility & recording infrastructure for high-speed networks Endace provides 100% accurate network recording at 1Gbps to 100Gbps!!!
Next-Generation EndaceDAG Overview Designed for data capture applications requiring 100% network data capture Three “Feature Bundles” Low Overhead Zero Loss Capture Hardware Time Stamps Global Clock SynchIn-Band MetadataClassification/filteringLoad Balancing Three ProductConfigurations
Endace Network VisibilityInfrastructure EndaceProbe™ Intelligent Network Recorder EndaceFlow™ NetFlow Generator Appliance (NGA) Endace OpenHosting Platform (ODE) EndaceAccess™ Network Visibility Headend Hosting Platform for Monitoring Applications 8x1GbE or 4x10GbE Ports Up to 16 TB internal storage; Fibre Channel support for SAN High-Speed NetFlow Generation for 10GbE Networks 4x10GbE Ports High Performance Intelligent Network Recording Up to 64 TB storage Mix of 1 and 10GbE ports Network Visibility Headend Allows EndaceProbe INRs/ODE to scale to 40 and 100GbE NetFlow Generator:Generate unsampled netflows from 1GbE/10GbE links EndaceProbe:Provides 100% packet capture on 10Gb Ethernet links Endace ODE:Provide packets for hosted 3rd party applications EndaceAccess:Load-balances 40Gb/100Gb links across multiple INRs
