As any InfoSec professional will tell you, traffic spikes can have a big effect on the performance of key security appliances including firewalls, advanced threat detection systems, forensic data capture and more.
When the applications themselves – or their network connections – get overloaded, the “extra” packets are often lost from view. If the analyzer can’t see all the traffic flowing in and out of the network, they can’t do their job. That's why the topic in every IT department is network visibility.
In today’s complex environments, this happens more than you might think. Companies that use a switch’s SPAN port to copy traffic and send it to their security appliances are particularly vulnerable. When the network becomes overloaded, so does the switch controlling that traffic. In these cases, the switch actually prioritizes its own traffic management tasks over the “copy and send” tasks that connected appliances require. This means that there will be gaps in the traffic streams that are sent to the various appliances. Even firewalls and other in-line applications that are directly connected to the network can have problems. If traffic levels exceed their ability to process data, here again packets will be lost from their view.
That’s why everyone’s talking about visibility these days.
They're looking for connectivity solutions that can't get overloaded and don't miss packets when traffic levels spike. Today, the most basic, reliable way to get a clear copy of all the traffic is to install a network TAP. These purpose-built, hardware devices can be inserted at any point in the network – as traffic flows past, they simply make a copy and send it to any connected appliances. They don’t actively process the traffic so they are immune to overload. Packets don’t get dropped and appliances get the 360 degree visibility they need to protect an organization from advanced threats in real time.
Making the Connection
Like any other InfoSec project, your unique environmental requirements will dictate your choice of network TAP. Here are a few things to consider before you make your choice:
Physical network configurations: Network TAPs must match in the same physical characteristics as your existing network. Before you can select a network TAP, find out if your network uses copper or fiber connections.
Network speed: A network TAP must be able to copy and send traffic at the same speed as the network operates. Otherwise there will be delays in how the information is processed. Worse, in-line devices such as firewalls and intrusion detection systems will not be able to react to suspicious activity in real time which opens a gap that hackers will quickly exploit.
In-line or out-of-band: A network TAP can support both types of appliance installations.
Data Collection Points: Many security applications benefit from being able to compare traffic patterns from different points in the network (into and out of web servers; in front of and behind firewalls). A long range review of your security program will show where your network TAPs should be placed to maximize visibility.
Load balancing: Just because the network TAP isn’t effected by traffic spikes doesn’t mean that security appliances can say the same. When a packet broker is combined with a hybrid bypass TAP, you gain both load balancing and filtering along with traditional network TAP technology. Now, you can store excesses and send fully correlated traffic as soon as resources become available so you never have to miss any part of the data stream. Alternatively, you can distribute the traffic across multiple appliances to ensure that it is being analyzed in real-time.
With attack vectors becoming more sophisticated every day, you can’t afford any unreliability at the appliance-network connection level. Today, we’re seeing more and more companies move away from the less dependable methods of taking feeds from switch SPAN ports or even connecting directly to the network itself. And, with the prevalence of DoS and DDoS attacks whose first mission it is to overload networks, companies cannot afford a solution that can’t handle traffic spikes – missing packets when a network is under attack is a risk I’m sure no CSO wants to take.