How to See the Unseen for Stronger Network Security

With the adoption of novel services and technologies like 5G, connected devices, sensors, edge computing and automation, networks are becoming increasingly complex, and these complicated networks are powering some of the world’s most sensitive organizations. These sophisticated interconnected networks now enable governments, healthcare facilities, utility providers and other public services to deliver quicker, more efficient and available services to users all over the world. These networks are the backbone of network infrastructure services.

But the problem is that while these architectures support efficiency and performance, they also increase the organization’s attack surface. There’s a lack of transparency and coverage across highly complex networks due to many of the data lakes being siloed or inaccessible to administrators or their security tools. Without complete visibility, you can’t get an accurate picture of what’s taking place, which leaves room for threats to infiltrate unseen.

Existing solutions have failed to fully tackle this problem, which therefore requires a new approach – one that’s purpose-built with the intricacies of extensive interconnected, heavy network volumes and complex networks architectures in mind.

What happens when you lack transparency 

To gain full visibility into a network, cybersecurity and networking teams need a solution that can actually capture each and every packet of an organization’s network, look at each packet and perform a quick analysis – answering the question, “Is this legitimate or suspicious?”

Previously, this simple query might have been easier to answer, but the increased complexity of networks has made this far more difficult. Even the most advanced solutions available are limited in terms of capacity to at most 40 gigabytes per second. And if you put such a solution into an environment that’s handling petabytes of data per second, that’s the equivalent of a drop of water in the sea when it comes to monitoring.

What’s happening as a result is that for many organizations, there are major swaths of the network that aren’t being closely monitored – or even observed at all. Many organizations in this situation will then choose to focus just on a few sensitive areas of the network, which leaves a troubling lack of overall transparency.

This creates a major problem. An architectural misconfiguration or a network failure can start in any one of hundreds or even thousands of network devices. This can lead to a substantial compromise of network security. The consequent lack of transparency leads to unmitigated threats, unanticipated attacks and other potentially harmful security anomalies.

This is not theoretical. The massive cybersecurity attack against SolarWinds in December 2020 was one of the largest and most sophisticated attacks ever seen, compromising around 100 companies and roughly a dozen government agencies.

Where traditional approaches fall short

Those blind spots in your network are where bad actors will find their way in, so a lack of transparency must not continue. A report by Enterprise Management Associates found that, aside from the rare insider attack, 99% of cyberattacks traverse the network in some way.

And the truth is that legacy solutions can’t keep up. Some organizations assume that adding specialized monitoring to each network device, coupled with network monitoring and detection solutions, will take care of the problem.

But detection of increasingly sophisticated cybercriminal activity requires a global view and the ability to analyze patterns between many devices. And that requires covering your entire network with monitoring and detection solutions. That is expensive; it requires a lot of network modification and device configurations, it can have a negative impact on performance, and is thus practically not feasible so in reality you need to compromise on a daily basis – where to monitor, cover and protect and where (and this is the majority of the network) not.

A new approach: Next-gen network detection and response

According to Forrester Research, 62% of respondents surveyed expect to increase their network security tech budgets in 2021. But security doesn’t have to come at the cost of performance, and gaining visibility doesn’t have to be so complicated. Network detection and response (NDR) solutions offer a way to solve these problems by using techniques like machine learning to create a baseline for what’s normal in a network. They monitor traffic in real time to establish this baseline, with alerts issued when unusual behavior is detected.

But legacy NDR tools won’t suffice for today’s networks. Fortunately, there are now next-generation NDR tools making network security even easier with solutions that can be rapidly onboarded and are more affordable. This leads to a faster time to value. Such tools don’t require agents, sensors or probes, which enables effortless scalability no matter how complex the network is. They also provide full visibility into the NS/EW (inbound/outbound and in-organization) traffic.

Closing the security gaps

It’s an unfortunate consequence of technological progress: as networks grow in complexity and scale, they also expand their threat landscape. When organizations don’t have network visibility, they are essentially putting up the “Welcome!” sign for intruders because they don’t know where their security gaps are. Because 100% network packet capture is unrealistic and coverage is costly and only as good as your visibility, this is where next-generation NDR capabilities can help. By learning what normal traffic looks like for your network, NDR provides effective monitoring and alerts with higher efficiency and effectiveness.

Written by Eyal Elyashiv.