<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
BLOG

Ensuring Federal Cybersecurity Success with Flexible, Compact Flyaway CyberKit Visibility

September 30, 2021

Compact Flyaway CyberKit Visibility

Recent U.S. Federal cybersecurity initiatives have been put in place to ensure critical infrastructure, whether it's a pipeline, food processor, or water treatment facilities are protected from modern cyber threats and vulnerabilities. The new ‘Cyber Incident Reporting for Critical Infrastructure Act of 2021’ establishes a mandatory cyber incident reporting framework for critical infrastructure companies.

The Cybersecurity and Infrastructure Security Agency (CISA) is now expanding cybersecurity assessments. Congress is currently considering giving the Agency the ability to fine or even subpoena organizations that they believe have cybersecurity vulnerability in their critical networks.

Department of Defense (DOD) agencies like the Defense Threat Reduction Agency (DTRA) are conducting cybersecurity audits for companies to get ahead of and prevent government action. Things like certifying they're doing regular security audits and confirming their systems are hardened to the government regulations.

To accomplish these cybersecurity audits, Cyber Protection Teams (CPTs) are equipped with Fly-away Kits (FAK), Expeditionary Kits, or Mobile Air CyberKits. These mobile IT networks are designed to be able to be deployed at a moment’s notice anywhere on the planet to assess a location or company’s cybersecurity vulnerability.


Cyber Protection Teams are Looking for Vulnerabilities

DOD CPT teams are deployed to Garrisons or operating bases around the world, from Fort Bragg to Camp Humphreys in Korea. These teams go behind the enclave connections to the DODIN to make sure that anomalous traffic or corrupted or suspicious traffic isn't being fed through the connection site and into the network. They use the Flyaway CyberKits equipped with Network TAPs and Packet Brokers to feed the network data to monitoring tools. CPT team can then analyze the connection between the Garrison network and Tennent networks, to locate anomalous behavior and guarantee no one is affecting the security from within the network.

CPT Flyaway CyberKits typically comprise of:

  • Network TAP to capture all the traffic on the network
  • Packet Broker to filter out extraneous data and aggregate the traffic data
  • Deployable servers and monitoring tools to analyze traffic
  • Storage tool to save packet capture for further analysis

The goal is to determine if there are any obvious vulnerabilities. Then store the information for future forensics.


What is the Optimal Flyaway CyberKit for Modern Deployments

Today’s modern Flyaway CyberKits need to have the ultimate flexibility to process any media type and data speed at a moment's notice in any environment.

These mobile kits need to be light, compact, and shock-tolerant for single-person fast deployments. Specifically, the kits need to fit in the overhead compartment of a commercial airline, for two reasons:

  • Protecting the kits. The CPT teams must reduce the risk of kits being damaged in transit.
  • Securing a chain of custody. In many use cases, it is critically important to ensure a chain of custody. A lot of the information they may have recorded is classified. So they must have a chain of custody, so they need to have it in their possession the entire time they're either on-site or returning from the site.

Learn how to Add to Visibility Architecture to Your Zero Trust Cybersecurity Strategy

 

Once the CPT team gets on site, it needs the capability to support any fiber, copper, and transceiver media as well as a whole host of speeds from 10/100m up to 100G to ensure their analytics and storage can quickly accommodate the environment. 

The challenge is that most IT network equipment can be bulky, 19” rack-mounted equipment not designed to accommodate a mobile network.

Garland vs. Competition – Garland is Purpose-Built for Flexibility

This is the case with recent deployments with other vendors, who offer their data center packet broker solutions that do not fit into the transit cases, where teams have to carry the external chassis separately and velcro to the top of the case during deployments. But size isn’t the only factor plaguing data center these solutions:

  • Lower speed TAPs like 10/100 are not supported
  • License fees. These kits must be flexible, so keeping every ‘port lit’ with license renewals even when they are not being used, year over year bloats the total cost of ownership (TCO).

Garland Technology on the other hand has been working with Flyaway CyberKit integrators to design network TAP and packet brokers to provide exactly what federal and private agencies are looking for – flexibility and compactness.


Garland offers ‘ala carte menu’ Flyaway CyberKit portable network TAP options:

  • High-density portable single-mode, multi-mode, BiDi, and MTP/MPO passive fiber TAPs at speeds from 1G to 100G.
  • Portable failsafe Copper RJ45 TAPs that support 10/100/1000M
  • Multi-function TAPs that can provide tap ‘breakout,’ TAP aggregation and advanced filtering as well as media conversion from Fiber to Copper and SFP/SFP+
  • Pocket-sized USB and media conversion Field TAPs
  • Rugged metal design, made and tested in the USA

 

Garland offers industry-exclusive Flyaway CyberKit packet broker options:

  • Innovate 13" deep packet brokers fit in standard 19" rack Pelican cases
  • Advanced filtering for Layer 2, Layer 3, and Layer 4
  • Traffic aggregation, filtering, and load balancing
  • 20 SFP+ ports
  • Supports network speeds from 1Gbps and 10Gbps

Not only does Garland provide the only 13” deep packet broker in the industry, but also offers a portable 4 port packet broker that supports 1G and 10G SFP+. This allows teams the ultimate flexibility to completely configure TAP modes, ports, speeds, and the media you need, as well as packet broker functionality like advanced filtering for Layer 2, Layer 3, and Layer 4.

Federal agencies turn to Garland Technology for Flyaway CyberKits not just because the products are designed to be flexible, compact, and rugged but also because they are TAA compliant being made and tested in the USA.

Looking to add flyaway kit-ready TAP visibility or traffic aggregation to your mobile deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.

zero-trust-cybersecurity-free-whitepaper

See Everything. Secure Everything.

Contact us now to secure and optimized your network operations

Heartbeats Packets Inside the Bypass TAP

If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.

If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.

While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.

Some of you may have noticed a flaw in the logic behind this solution!  You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.

Glossary

  1. Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.

  2. Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.

  3. Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.

NETWORK MANAGEMENT | THE 101 SERIES