Analyzing packet level data within a network has become a vital component within an organization's security architecture. Packet level visibility provides essential information needed to protect against security breaches that affect business operations.
When implementing a security monitoring solution, consideration must be given to the potential risk of introducing security vulnerabilities – especially when the approach utilizes SPAN/Mirror ports on switches.
Using SPAN/Mirror ports and then aggregating these feeds together within a Network Packet Broker prior to delivery to the Monitoring or Security tool is often considered to be the simplest and lowest cost method. But what are the risks?
SPAN Ports are Prone to Human Error
SPAN/Mirror ports involve management intervention and reconfiguration of the switches. This is not always a simple task, especially where VLANs are also involved, and is prone to error.
SPAN Ports Do Not Provide Complete Visibility
SPAN/Mirror ports do not guarantee 100% packet visibility. Due to their lower priority within the Switch, if the live network utilization is high, then priority is given to the live network ports and the SPAN/Mirror ports will discard packets. While live network traffic utilization might be low in normal circumstances, during a security compromise traffic levels will often significantly increase resulting in lost visibility. This is not the recommended visibility access point for security monitoring, as SPAN was not designed for continuous monitoring applications.
SPAN Ports Can Introduce Bidirectional Traffic
The SPAN/Mirror port is a physical switch port and therefore has both a ‘Transmit’ and also a ‘Receive’ capability. Each SPAN/Mirror connection is ultimately a backdoor into the live network and therefore a potential security risk.
Utilizing Data Diode TAPs can solve all three of these vulnerabilities.
Deploying Data Diode TAPs
A best practice for network visibility is to always use a Network TAP to copy traffic directly from a network link to the security and monitoring tools. As network TAPs create an exact copy of both sides of the traffic flow, continuously, 24/7/365 without impacting or compromising network integrity.
Acting at the physical level network TAPs can be installed once and never require reconfiguration or removal. A network TAP will immediately remove the SPAN/Mirror port risks of configuration errors and dropped packets previously highlighted.
Data Diode Network TAPs send a unidirectional copy of that traffic to the out-of-band monitoring tools and the link between the two appliances is unaffected. There is no physical connection between the Data Diode monitoring ports and the network, eliminating any possible intrusion from the destination.
There are also some situations where the use of SPAN/Mirror ports is still needed for visibility. In these instances, it is “Best Practice” to connect the SPAN/Mirror port to a Data Diode SPAN TAP to pass the mirrored SPAN data onto the monitoring and security devices. Using unidirectional Data Diode SPAN Taps in this way eliminates bidirectional traffic flow ensuring that there can be no data passed back into the Switch SPAN/Mirror port.
Data Diode SPAN TAPs are purpose-built network hardware devices that enforce one-way data flow for switch SPAN links with physical hardware separation, guaranteeing protection of critical digital systems, such as industrial control systems (ICS), from inbound cyber threats.
Looking to add Data Diode TAP visibility, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.
