September 30, 2021
Recent U.S. Federal cybersecurity initiatives have been put in place to ensure critical infrastructure, whether it's a pipeline, food processor, or water treatment facilities are protected from modern cyber threats and vulnerabilities. The new ‘Cyber Incident Reporting for Critical Infrastructure Act of 2021’ establishes a mandatory cyber incident reporting framework for critical infrastructure companies.
The Cybersecurity and Infrastructure Security Agency (CISA) is now expanding cybersecurity assessments. Congress is currently considering giving the Agency the ability to fine or even subpoena organizations that they believe have cybersecurity vulnerability in their critical networks.
Department of Defense (DOD) agencies like the Defense Threat Reduction Agency (DTRA) are conducting cybersecurity audits for companies to get ahead of and prevent government action. Things like certifying they're doing regular security audits and confirming their systems are hardened to the government regulations.
To accomplish these cybersecurity audits, Cyber Protection Teams (CPTs) are equipped with Fly-away Kits (FAK), Expeditionary Kits, or Mobile Air CyberKits. These mobile IT networks are designed to be able to be deployed at a moment’s notice anywhere on the planet to assess a location or company’s cybersecurity vulnerability.
DOD CPT teams are deployed to Garrisons or operating bases around the world, from Fort Bragg to Camp Humphreys in Korea. These teams go behind the enclave connections to the DODIN to make sure that anomalous traffic or corrupted or suspicious traffic isn't being fed through the connection site and into the network. They use the Flyaway CyberKits equipped with Network TAPs and Packet Brokers to feed the network data to monitoring tools. CPT team can then analyze the connection between the Garrison network and Tennent networks, to locate anomalous behavior and guarantee no one is affecting the security from within the network.
CPT Flyaway CyberKits typically comprise of:
The goal is to determine if there are any obvious vulnerabilities. Then store the information for future forensics.
Today’s modern Flyaway CyberKits need to have the ultimate flexibility to process any media type and data speed at a moment's notice in any environment.
These mobile kits need to be light, compact, and shock-tolerant for single-person fast deployments. Specifically, the kits need to fit in the overhead compartment of a commercial airline, for two reasons:
Once the CPT team gets on site, it needs the capability to support any fiber, copper, and transceiver media as well as a whole host of speeds from 10/100m up to 100G to ensure their analytics and storage can quickly accommodate the environment.
The challenge is that most IT network equipment can be bulky, 19” rack-mounted equipment not designed to accommodate a mobile network.
This is the case with recent deployments with other vendors, who offer their data center packet broker solutions that do not fit into the transit cases, where teams have to carry the external chassis separately and velcro to the top of the case during deployments. But size isn’t the only factor plaguing data center these solutions:
Garland Technology on the other hand has been working with Flyaway CyberKit integrators to design network TAP and packet brokers to provide exactly what federal and private agencies are looking for – flexibility and compactness.
Not only does Garland provide the only 13” deep packet broker in the industry, but also offers a portable 4 port packet broker that supports 1G and 10G SFP+. This allows teams the ultimate flexibility to completely configure TAP modes, ports, speeds, and the media you need, as well as packet broker functionality like advanced filtering for Layer 2, Layer 3, and Layer 4.
Federal agencies turn to Garland Technology for Flyaway CyberKits not just because the products are designed to be flexible, compact, and rugged but also because they are TAA compliant being made and tested in the USA.
Looking to add flyaway kit-ready TAP visibility or traffic aggregation to your mobile deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.
If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.
If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.
While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.
Some of you may have noticed a flaw in the logic behind this solution! You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.
Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.
Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.
Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.