rsz_1secure_automation333

Security Automation

by Publications

Security Automation

In today's fast-paced digital landscape, ensuring the security of our online presence has become more critical than ever. With the ever-evolving threat landscape and increasing complexity of cyberattacks, manual security measures may no longer suffice. This is where security automation comes into play, revolutionizing the way we protect our digital assets. In this blog post, we will explore the benefits of security automation and how it can effectively safeguard our digital world.

Security automation is the process of automating security tasks and processes to enhance the efficiency and effectiveness of security operations. It involves leveraging technologies such as artificial intelligence, machine learning, and robotic process automation to streamline security processes, detect threats in real-time, and respond promptly to mitigate risks. By automating repetitive and time-consuming tasks, security teams can focus on more strategic activities.

Enhanced Threat Detection and Response: With security automation, organizations can detect and respond to threats in real-time, significantly reducing the time it takes to identify and mitigate security incidents. Automated systems can analyze vast amounts of data, identify patterns, and generate alerts for potential threats, enabling security teams to respond swiftly and effectively.

Improved Efficiency and Productivity: By automating routine security tasks, organizations can free up valuable resources and allocate them to more critical security activities. This leads to increased efficiency and productivity within the security operations, allowing teams to better prioritize and manage security incidents.

Consistency and Accuracy: Manual security processes are prone to human error, which can have severe consequences in the realm of cybersecurity. Security automation ensures consistent execution of security measures, eliminating the possibility of human oversight or negligence. Automated systems follow predefined rules and guidelines, ensuring accuracy and reducing the risk of human-induced vulnerabilities.

Threat Intelligence and Analysis: Automated threat intelligence platforms can continuously monitor and analyze vast amounts of data from multiple sources, including threat feeds, vulnerability databases, and security event logs. By aggregating and correlating this information, organizations can gain valuable insights into emerging threats and proactively implement mitigation measures.

Incident Response and Remediation: Security automation facilitates rapid incident response by automating the process of gathering evidence, containing threats, and initiating remediation actions. Automated incident response workflows can be triggered based on predefined rules and playbooks, ensuring consistent and timely response to security incidents.

In an increasingly interconnected and digital world, security automation offers a powerful solution to safeguard our digital assets. By leveraging automation technologies, organizations can enhance threat detection and response capabilities, improve efficiency and accuracy, and proactively protect against emerging threats. Embracing security automation is not merely an option but a necessity in today's evolving threat landscape. Let us harness the power of automation to fortify our digital world and ensure a secure future.

Matt Conran

Highlights: Security Automation

Automation Scenarios

We can apply our knowledge of automation to different scenarios and workloads that revolve around security. For example, when tedious and everyday tasks are automated, individuals doing those tasks can focus on solving the security problems they are dealing with. This enables a whole new way of looking at how we learn about security, how much we can store, process, and analyze log data (DFIR), and how we can keep applying security updates without interruptions (security operations).

At its core, security automation involves using advanced technologies and intelligent systems to automate various security processes. It enables organizations to streamline security operations, detect real-time threats, and respond swiftly and effectively. From threat intelligence gathering to incident response and recovery, automation is pivotal in strengthening an organization’s security posture.

Key Benefits of Security Automation:

a) Enhanced Threat Detection: By deploying intelligent monitoring systems, security automation can swiftly identify and respond to potential threats in real-time. This proactive approach minimizes the risk of breaches and allows security teams to stay one step ahead of malicious actors.

b) Accelerated Incident Response: Manual incident response can be time-consuming and prone to delays. However, with security automation, incidents can be detected, analyzed, and remediated swiftly and accurately. Automated incident response workflows can help contain and mitigate security breaches before they escalate, reducing the organization’s impact.

c) Efficient Vulnerability Management: Identifying and patching vulnerabilities is critical to maintaining a secure infrastructure. Security automation tools can continuously scan networks, applications, and systems, providing organizations with real-time vulnerability assessments. This enables security teams to prioritize and address vulnerabilities promptly, reducing the window of opportunity for potential attackers.

Integrated Automation Platform

If you are only using scripting in the security automation world, it will only get you so far. Eventually, you will need a fully integrated platform with your security and network infrastructure. For secure automation, there are different types of platforms you can use. This post will address two different types.

Example: Red Hat Tower can integrate and configure network and security devices—also, Splunk SOAR. The SOAR meaning is about abstracting complexity away with security-focused playbooks. This reduces repetitive work and the ability to respond to security events in a standardized way.

**Platform Examples**

Backing up configs and collecting logs is only a tiny part of automation. Red Hat Ansible Tower and Splunk SOAR have new ways to reach the most advanced use cases. For security automation, Splunk Security with Splunk SOAR has a security-focused application consisting of specially crafted playbooks for every security requirement.

**Red Hat Ansible Tower**

For example, you can check the domain and file reputation or create your own. On the other hand, Red Hat Tower Ansible Architecture allows you to securely reach and support the most edge use cases with increased portability using execution environments and automation mesh. In addition, you can securely bring automation to the edge with a certain overlay functionality.

**Splunk SOAR**

The difference between an attack being a routine annoyance and a catastrophic event comes down to a product’s robustness and the technologies you choose to adopt. Splunk has several products that can help you here, ranging from the Splunk SIEM to the Splunk SOAR. There are also several Observability products, all of which are well-integrated and can assist you with security automation. 

Example: Splunk Enterprise & Cloud

Customers can solve their primary SIEM use cases using Splunk Enterprise and Cloud, core Splunk platforms that provide collection, indexing, search, and reporting capabilities. The Splunk SIEM collects or ingests machine data and can make this available to the Splunk SOAR.

Automation with Security Command Center (SCC)

**Understanding the Core Features of Security Command Center**

Security Command Center stands out with its robust set of features tailored for Google Cloud environments. At its core, SCC offers asset inventory management, enabling security teams to gain a clear view of their cloud assets and configurations. The integration with other Google Cloud security tools enhances its capabilities, providing automated threat detection that identifies vulnerabilities, misconfigurations, and potential security threats across your cloud infrastructure. Moreover, the centralized dashboard of SCC allows for real-time monitoring and quick response to incidents, ensuring that your organization’s digital assets remain secure.

**Automating Threat Detection with Google Cloud Security**

One of the standout benefits of Security Command Center is its automation capabilities. By leveraging machine learning and advanced analytics, SCC automates the process of threat detection, significantly reducing the time and effort required by security teams. This automation not only minimizes the chances of human error but also ensures that threats are identified and addressed promptly. With built-in integration to Google Cloud’s security products like Cloud Armor and VPC Service Controls, SCC provides a seamless and holistic approach to safeguarding your cloud environment.

**Investigating Threats: A Step-by-Step Approach**

Once a threat is detected, the investigation phase is crucial to understanding and mitigating the risk. Security Command Center simplifies this process with its detailed logging and alerting system. Security teams can follow a structured approach to investigate threats, starting with analyzing alerts, examining the affected resources, and understanding the potential impact. SCC’s comprehensive logging capabilities provide valuable insights into the nature of threats, helping teams to develop effective response strategies and prevent future occurrences.

**Enhancing Your Security Posture with SCC**

Beyond threat detection and investigation, Security Command Center offers tools to enhance your organization’s overall security posture. By providing insights into security best practices and compliance requirements, SCC helps organizations align their security strategies with industry standards. The tool’s continuous monitoring capabilities ensure that your security measures are always up-to-date, adapting to the ever-changing threat landscape.

Security Automation: The World of Scripting

Challenge: Self-driving Scripts 

In the traditional world of security automation, it was common to use custom in-house automation frequently. As a result, we have a variety of self-driving scripting methods that solve specific short-term security problems. For example, for secure automation, you may need to collect logs from several devices for security. However, this is far from a scalable and sustainable long-term approach to an enterprise’s automation strategy.

With more self-maintained scripting tools and working in siloed, you are creating more security blind spots. With more point tools, you have to make more silos and potential security blind spots, which may trigger the adoption of more narrowly focused tools. The more tools you have, the less control over your environment that could easily open up the spread of lateral movements.

Example: Security Scan with Lynis

Lynis offers a wide range of features that contribute to its effectiveness as a security scanning tool. It utilizes a modular and extensible framework, allowing easy customization and integration with other security tools. With its powerful scripting abilities, Lynis can automate security audits and generate detailed reports. It also supports local and remote scanning, making it suitable for various environments.

Required: The need for a security platform

For example, look at lateral movements in an Active Directory (AD) network. Lateral movements are a real problem, and some advances in lateral movement techniques have been made using Metasploit, Impact, and PurpleSharp. However, detecting whether this is a bad actor or a sys admin carrying out daily activities can be challenging.

Once the bad actor stealthily navigates the network with lateral movements, they can compromise accounts, find valuable assets, and gradually exfiltrate data. All of this can be unnoticed with a below-the-radar style of attacks. A favored vector is to use DNS to exfiltrate data. Therefore, DNS often needs to be checked.

Related: For additional pre-information, you may find the following post helpful:

  1. Cloud Native meaning
  2. SASE Definition

Security Automation

SOAR meaning: A quick point

In this case, you should integrate Splunk SOAR with User Behaviour Analytics (UBA) to detect deviations from the baseline. UBA works with unsupervised machine learning and builds profiles of entities on the network. Today’s attacks are distributed, and multiple entities are used to stage an attack.

An anomaly is sent once there is a significant deviation from normal entity behavior. Of course, an anomaly does not necessarily mean a threat. However, the anomaly can be combined with other network and infrastructure aspects to determine if a bad actor exists. So, for example, we would look at the time of day, frequency, or any other usual activity, such as privilege escalation techniques.

  • Lack of Speed

Without integrated security tools with security automation and a lack of automated and orchestration processes. The manual response slows MTTR and increases the possibility of a successful threat. Bad actors can breach and exfiltrate data when the mean time to detect (MTTD) is too long.

So, the manual approach to detecting, triaging, and responding to threats must be faster. For example, ransomware is quick; the game is over once the binaries are executed. It would help if you focused your efforts on the detection phase of the kill chain and caught any lateral movements, even when they pivot to valuable assets.

  • The Need for Security Automation

To address this challenge, you need a security solution that integrates its existing security products to reduce the response and remediation gap. In addition, these automation and orchestration events must be carried out across all its security vendors to consolidate response and remediation.

For secure automation, a unified and standard response to security can be made using pre-approved policies, consistently configuring resources according to pre-approved guidelines, and proactively maintaining them in a repeatable fashion.

Level of Automation Maturity

  • Security-focused content collection

This provides a faster, more efficient, and streamlined way to automate the identification, triage, and response processes to security events. In addition, we can use security-focused content. In the case of Red Hat Tower, this comes in the form of collections of roles and modules dedicated to security teams.

Splunk SOAR also has secure-focused applications and content ready to use in the Splunk database. The pre-approved policies and playbooks of Ansible Tower and Splunk SOAR will reduce the chances of misconfiguration and speed up all aspects of security investigation.

  • Secure Automation and Orchestration

When a few waves of Malware, Phishing, Ransomware, and under-the-radar attacks target you, automation and orchestration are the only ways to combat this. Security automation does most of the work, so you no longer have to weed through and manually address every alert as it comes in or process every security action or task.

For example, the level of automation you want to adopt depends on the maturity level of the automation you already have in our environments. If you are new to automation, you can have SOAR or Tower playbooks send an alert for further investigation. So, you can start with a semi-automated approach.

However, if you are further in your automation strategy, you can combine different playbooks to carry out coherent security detection and response. It’s easy to do this in SOAR with a playbook visualizer, and Ansible Tower has workflow templates that can be used with role-based access control.

**Red Hat Tower: How to Start**

In most organizations, we have IT operations and a security team. These teams have traditionally disjoint roles and responsibilities. The IT Operations are hardening systems, managing the infrastructure, and deploying and maintaining systems. The security operations team would track ongoing threats, perform intrusion detection/prevention, and perform firewall management activities.

A. Ansible has a common language.

With these two disjointed teams, we can use Ansible as the common automation language for everyone across your organization. Specifically, Red Hat Tower can be the common language between security tools and can be used for various security use cases that can bring the two teams together.

B. Red Hat Tower: Security Automation

Red Hat Tower can orchestrate security systems using a series of curated security collections of modules, roles, and playbooks to investigate and respond to threats using trusted content. This enables you to coordinate your enterprise security systems to perform several security duties, such as investigation enrichment, threat hunting, and incident response.

C. Pre-approved Playbooks

You can integrate Red Hat Tower with your security infrastructure here and have pre-approved playbooks ready to run upon threat detection. For example, a playbook can be automatically triggered by the results of a security scan. The following lists some of the use cases for Ansible Tower playbooks.

Security Automation Examples

1) Secure Automation: Security Patching

You could start with patching. Not patching your servers is one of the biggest causes of breaches. Automated patching boosts system security and stability, improving uptime. And this will be noticed straight away.

2) Secure Automation: System Hardening

Then, activities such as system hardening are something everyone can do for all systems. With automation, we can rapidly identify systems that require patches or reconfiguration. Then, applying patches or changing system settings consistently across many systems is easier according to defined baselines. For example, make changes to your SSH config.

Here, you can use automation to configure the SSH daemon and not allow authentication using an empty password. You can run these playbooks in check mode so those who don’t require full automation rights can run checks safely. Again, I would combine this with role-based access control.

3) Secure Automation: Network Configuration 

For network management, you can configure an ACL or filter to restrict ACL or filter management access to the device from only the management network. You can also use automation to lock down who has managed to access specific subnets.

4) Secure Automation: Firewall Integration

If an increase in incident management tickets is due to incorrect firewall rules causing an increase in change requests, aim to reduce the number of tickets or change requests through automation. For our Firewall integration, the role of automation can speed up policy and log configuration changes.

For example, we can add an allowlist entry in the firewall configuration to allow traffic from a particular machine to another.

We can automate a playbook that adds the source and destination IPs as variables. Then, when a source and destination object are defined, the actual access rule between those is defined.

5) Secure Automation: Intrusion Detection and Prevention Systems

Tower can simplify the rule and log management for your intrusion detection and prevention systems. Automation can be used to manage IDPS rules, and IDPS roles are offered. These roles can work with multiple IDPS providers, so the corresponding playbook needs to have a variable stating the actual IDPS provider. 

Once the role is imported, and this is the first step, the new IDPS rule is handed over via defined variables:

6) Secure Automation: Privileged Access Management (PAM) Tools

Ansible Tower can streamline the rotation and management of privileged credentials to automate the prevention. So we can streamline credential management, which is hard to do manually. 

7) Secure Automation: Endpoint Protection

Automation can simplify everyday endpoint management tasks, integrate into Endpoint Protection, and provide event-driven detection, quarantining, and remediation. 

Advanced Red Hat Tower Features

Job Templates vs. Workflow Template

When creating a job template, we choose a job or workflow template. We choose the job template to develop simple employment out of it. However, creating more complex jobs composed of multiple job templates, with flow control features between one position and the next, is possible with a workflow template. This workflow template can also be integrated into your CI/CD pipelines and Jenkins.

Security Benefits

This makes it easier to have playbooks that are job templates from different teams. This is used in large environments, so multiple job templates are connected. Then, complex interactions between jobs can be defined in a workflow before the next job starts, depending on the previous position. Any inventory and any credentials can be used. So, it brings a lot of flexibility to automation.

In its multi-playbook workflows, the user can create pipelines of playbooks to be executed in sequence on any inventory using one or more users’ credentials. Security teams can configure a series of jobs that share inventory, playbooks, or permissions to fully automate investigations or remediations, bringing many consistency and security benefits.

Ansible Tower and Scheduling:

With Ansible Tower, we have Templates with the Launch feature; think of this as an ad hoc way to run Ansible for one of the tasks. However, if you are using Tower, you should use Schedules to control your automation better. For example, you may have a maintenance window when you apply changes. Here, we can set the times and frequency of playbook runs.

Scheduling this playbook in Tower will automatically refresh systems significantly out of spec. This includes calling back into Tower to apply our basic configuration once new instances are spun up with the provisioning callback feature. I find this useful for dynamic cloud environments.

GitHub for Playbooks

GitHub is all about version control, so multiple people can work on different types of code and review and merge changes. It’s also about managing change in your other environments. When Red Hat Tower runs the playbooks, it checks the URL specified in your playbooks, and here, we can have multiple options that can enhance your GitHub integrations, such as webhooks and personal access tokens.

Benefits: Removes Inconsistency of Playbooks

This is an important feature to enable as if you don’t have it checked; there is the possibility that someone notices a problem in a playbook and fixes it, then they run the playbook feeling sure that they are running the latest version.

Someone must remember to run the synchronization task before running the playbook, effectively running the older version.

Therefore, when using this option, we are removing the inconsistency of playbooks. So, increasing your security posture is very important. A lot of security breaches first start with a simple misconfiguration.

SOAR for Automation: SOAR Meaning

  • Splunk SOAR Meaning

Splunk SOAR drives accuracy and consistency in the incident response process. With SOAR, workflows can be orchestrated via integrations with other technologies and automated to achieve desired outcomes. Utilizing automation with Splunk SOAR can dramatically reduce the time to investigate malware alerts, driving accuracy and consistency across its incident response processes.

  • SOAR and Phantom

SOAR is the rebranding of Phantom but has multi-deployment options. Phantom was just on-premise, but now we have both on-premise and on-cloud delivery.  Consider SOAR as a layer of connective tissue for all security operations.

Decision-making and action need to be automated. SOAR can turn proceeds into playbooks, allowing us to create complex security operation workflows.

We have an extensive collection of security-focused SOAR applications that interact with the API of existing security and network infrastructure, such as your Firewalls, to support activities such as containment and recovery. We’ll talk about these in a moment.

  • Automation Broker

We have an Automation Broker, a modified version of Splunk SOAR with reduced features. It’s a reverse proxy for automation actions. The Automation Broker is a Docker container that uses an encrypted outbound connection from Splunk Cloud SOAR to the customer premises. As the communication is set outbound on the firewalls, it would help to open inbound ports to the perimeter firewall.

Security-Focused Playbooks

**SOAR Meaning: Security-Focused Playbooks**

Instead of manually going into other security tools and injecting data, enriching logs, and carrying out actions such as blocking or manual analysis intervention, SOAR playbooks can be used. You can have several security-focused playbooks that automatically carry out the tasks. The SOAR playbook can automate many repetitive duties. For example, you no longer have to respond manually to repetitive incidents. For example, you can have Splunk SOAR respond to malicious emails with playbooks. 

**Actions based on the Playbooks**

Then, we could have a list of actions based on playbook results. This could include additional investigation tasks or notifying users. Finally, when you want to push the boundaries of automation, we could take several steps to isolate or quarantine hosts, depending on the results of the previous playbooks. These steps would be integrated with multi-factor authentication to ensure the action is appropriately authorized. 

Splunkbase with Security-related Apps

Additionally, Splunkbase offers over 800 other security-related apps with pre-built searches, reports, and visualizations for specific third-party security vendors. These ready-to-use apps and add-ons help monitor security, a next-generation firewall, and advanced threat management capabilities. You can even build your custom application, from monitoring and Observability to improving safety.

**SOAR Meaning: SOAR Apps**

You are using many tools from many vendors, and when you respond, each one performs a different event and function. Splunk integrates with all devices with API, and SOAR can directly integrate all tools to act in a specific sequence.

So it can coordinate all security actions. With SOAR, you don’t get rid of your existing tools; instead, SOAR can sit between them and abstract a lot of complexity.

Think of Splunk as the conductor that supports over 350 apps. It has tools to build apps; you can create your own if it has an API. In addition, it can perform over 2000 actions. SOAR apps are Python modules that collect events from anything, such as SIEM, then normalize the information and make it available to playbooks.

**SOAR Meaning: Example: SOAR playbooks**

We have a network-based sandbox to detect malware that can enter via email. An Alert is received from SIEM, sent to SOAR, and triggers a playbook. SOAR communicates back to SIEM to query Active Directory to identify who is there and which department, and based on that, SOAR can query Carbon Black to see how the threat lives.

Finally, the SOAR can notify an analyst to manually intervene and double-check the results. This could take 30 mins by hand, but SOAR can do it in 30 seconds. 

Let’s look at another SOAR playbook in action. A Splunk SOAR playbook is triggered when an email malware alert is received. Due to the lack of context in these alerts, Splunk SOAR’s first order within the playbook is to query the security information and event management (SIEM) solution for all recipients, then Active Directory to collect context from all affected users’ profiles, business groups, titles, and locations.

A key point: SOAR means with workbooks and phases

Another name for a playbook is the SOAR workbook. Each workbook can have several phases, each with tasks to carry out our security actions. In this scenario, one phase and several playbooks will be in a single step. Some playbooks can be triggered automatically, and some are invoked manually.

Then, some are being gathered manually but will have prompts for additional information. These tasks will be semi-automatic because they can automatically import data for you and enrich events. Furthermore, they can import this data and enhance events from several platforms. 

Prevent Lateral Movements

A **Splunk and Lateral Movements**

You can have playbooks to hunt for lateral movements. There are many ways to move laterally in active directory networks. For example, Psexec is a sysadmin tool that allows admins to connect to other machines and perform admin tasks remotely. However, what if psexec is used to gain a remote shell or execute a PowerShell cradle on a remote device? When looking for lateral movement, we identify processes connecting remotely to a host.

B **Lateral Movement Activity**

To start a threat investigation, we could have a playbook to conduct an initial search for a known lateral movement activity. Windows security logs contain a wealth of information. The playbook can look for authentication events over the network from rare or unusual hosts or users.

C **Event Window Code**

For example, in a Windows event log, you would see a Windows event code for successful login, another log for a network connection, and another for privilege escalation events. Each event doesn’t mean much by itself but indicates a threat together. For example, here you can see that someone has used an admin account to connect over the network from a particular host and gained command-line access to a victim host.

D. Splunk SOAR’s visual playbook editor

Splunk SOAR comes with 100 pre-made playbooks, so you can start automating security tasks immediately and hunt for lateral movements. To simplify life, we have a Splunk SOAR visual playbook editor that makes creating, editing, implementing, and scaling automated playbooks easier to help your business eliminate security analyst grunt work.  

Popular Playbook Examples

  • Splunk Intelligence Management (TruSTAR) Indicator Enrichment

Then, we have a Splunk Intelligence Management (TruSTAR) Indicator Enrichment. This playbook uses Splunk Intelligence Management normalized indicator enrichment, which is captured within the notes of a container. An analyst can view details and specify subsequent actions directly within a single Splunk SOAR prompt for a manual response.

  • Crowdstrike Malware Triage

There is a Cowdstrike Malware Triage. This playbook walks through the steps performed automatically by Splunk SOAR to triage file hashes ingested from Crowdstrike and quarantine potentially infected devices.

  • Finding and Disabling Inactive Users on AWS Splunk SOAR’s

Then, there are playbooks specific to cloud environments. Finding and Disabling Inactive Users on AWS Splunk SOAR’s orchestration, automation, response, collaboration, and case management capabilities are available from your mobile device. 

Summary: Security Automation

In today’s rapidly evolving digital landscape, ensuring the security of our online presence has become paramount. With the ever-increasing number of cyber threats, organizations and individuals alike are seeking efficient and effective ways to protect their sensitive information. This is where security automation steps in, revolutionizing the way we defend ourselves from potential breaches and attacks. In this blog post, we explored the concept of security automation, its benefits, and how it can fortify your digital world.

Understanding Security Automation

Security automation refers to the process of automating security-related tasks and operations, reducing the need for manual intervention. It involves utilizing advanced technologies, such as artificial intelligence and machine learning, to streamline security processes, detect vulnerabilities, and respond to potential threats in real-time.

Benefits of Security Automation

Enhanced Threat Detection and Response:

By leveraging automation, security systems can continuously monitor networks, applications, and user behavior, instantly detecting any suspicious activities. Automated threat response mechanisms allow for swift actions, minimizing the potential damage caused by cyber attacks.

Time and Cost Efficiency:

Automation eliminates the need for manual security tasks, freeing up valuable time for security teams to focus on more critical issues. Additionally, by reducing human intervention, organizations can achieve significant cost savings in terms of personnel and resources.

Strengthening Security Measures

Proactive Vulnerability Management:

Security automation enables organizations to proactively identify and address vulnerabilities before they can be exploited by malicious actors. Automated vulnerability scanning, patch management, and configuration checks help maintain a robust security posture.

Continuous Compliance Monitoring:

Compliance with industry standards and regulations is crucial for organizations. Security automation can ensure continuous compliance by automating the monitoring and reporting of security controls, reducing the risk of non-compliance penalties.

Integration and Scalability

Seamless Integration with Existing Systems:

Modern security automation solutions are designed to seamlessly integrate with a variety of existing security tools and systems. This allows organizations to build a comprehensive security ecosystem that works harmoniously to protect their digital assets.

Scalability for Growing Demands:

As organizations expand their digital footprint, the security landscape becomes more complex. Security automation provides the scalability required to handle growing demands efficiently, ensuring that security measures keep pace with rapid business growth.

Conclusion:

Security automation is a game-changer in the world of cybersecurity. By harnessing the power of automation, organizations can bolster their defenses, detect threats in real-time, and respond swiftly to potential breaches. The benefits of security automation extend beyond cost and time savings, providing a proactive and scalable approach to safeguarding our digital world.

Splunk Security

Splunk Security

by Publications

Splunk Security

In today's rapidly evolving digital landscape, the need for robust security measures is more crucial than ever. With cyber threats becoming increasingly sophisticated, organizations must arm themselves with advanced tools and technologies to safeguard their valuable data. Enter Splunk Security, a powerful solution that revolutionizes the way businesses approach data protection and threat detection.

At its core, Splunk Security is a comprehensive security information and event management (SIEM) platform that enables organizations to gain real-time insights into security events and incidents. By collecting, analyzing, and visualizing data from various sources, Splunk Security empowers businesses to proactively identify potential threats and mitigate risks effectively.

Splunk Security offers a wide array of features and capabilities that strengthen an organization's security posture. These include:

1. Log Management: Splunk Security allows for the centralization and indexing of logs from diverse sources, such as network devices, servers, and applications. This consolidated view enables efficient log analysis and correlation, making it easier to identify security anomalies.

2. Threat Intelligence: The platform integrates with external threat intelligence feeds, providing up-to-date information on emerging threats and vulnerabilities. By leveraging this intelligence, organizations can quickly detect and respond to potential attacks, minimizing the impact on their systems.

3. User Behavior Analytics: Splunk Security leverages machine learning algorithms to establish baselines of normal user behavior. This allows for the detection of anomalous activities that may indicate insider threats or compromised accounts, enhancing overall security posture.

One of the significant advantages of Splunk Security is its ability to seamlessly integrate with existing security tools and infrastructure. Whether it's firewalls, intrusion detection systems, or endpoint protection solutions, Splunk Security can ingest data from these sources and correlate it for a comprehensive security view. Furthermore, the platform is highly scalable, accommodating the growing data volumes and security needs of organizations of all sizes.

Splunk Security's real-time monitoring capabilities empower organizations to respond swiftly to potential threats. By continuously analyzing incoming data, the platform can trigger alerts and notifications based on predefined rules and thresholds. This proactive approach allows security teams to take immediate action, preventing security incidents from escalating into major breaches.

Splunk Security is a game-changer in the realm of data protection and threat detection. By leveraging its powerful features, seamless integration capabilities, and real-time monitoring, organizations can enhance their security posture and stay one step ahead of malicious actors. Embracing Splunk Security is not just a proactive measure; it's a strategic investment in safeguarding valuable data and ensuring business continuity.

Matt Conran

Highlights: Splunk Security

Splunk Monitoring

Splunk is software for monitoring, searching, analyzing, and visualizing real-time machine-generated data. This tool can monitor and read several log files and store data as events in indexers. In addition, it uses dashboards to visualize data in various forms. Splunk is commonly thought of as “a Google for log files” because, like Google, it can be used to define the state of a network and the activities taking place within it. It is a centralized log management tool but works well with structured and unstructured data.

A. Real-time monitoring and Detection:

One of Splunk Security’s critical strengths is its ability to monitor and analyze massive volumes of data in real time. By aggregating data from various sources such as logs, network traffic, and security devices, Splunk Security provides a unified view of the entire IT environment. This enables the detection of anomalies, suspicious activities, and potential threats, empowering security teams to take immediate action and mitigate risks effectively.

B. Threat Intelligence Integration:

Splunk Security integrates seamlessly with external threat intelligence feeds, enriching the analysis and detection capabilities. By leveraging threat intelligence data from trusted sources, organizations can stay ahead of emerging threats and proactively defend their infrastructure. Splunk’s threat intelligence integration empowers security teams to identify patterns, correlate events, and make well-informed real-time decisions.

C. Incident Response and Forensics:

When a security incident occurs, time is of the essence—Splunk Security streamlines incident response by providing automated workflows, playbooks, and case management capabilities. Security teams can quickly investigate and triage alerts, gather evidence, and take necessary actions to contain and remediate the incident. Splunk’s forensics capabilities enable detailed analysis and post-incident investigations, helping organizations learn from past incidents and improve their security posture.

The Role of Visibility and Analytics

**Real time Visibility & Analytics**

Splunk Security is a powerful tool for monitoring an organization’s network security. It provides real-time visibility and analytics into network traffic, helping organizations promptly detect and respond to security threats. It can also identify malicious activity and vulnerabilities and help organizations protect their assets proactively.

Splunk Security is a comprehensive solution offering various security use cases, including threat detection, vulnerability management, incident response, and compliance reporting features. It is designed to be easy to use and secure, making it an ideal solution for any organization.

**Example: Splunk Enterprise Security**

The product set offering Splunk Security has several well-integrated products, such as Splunk Enterprise Security, also known as Splunk ES, which is the Splunk SIEM, Splunk SOAR, and User Behavior Analytics (UBA), and a variety of Observability tools at your disposal.

**Multiple Phases & Tasks**

In addition, SOAR Splunk brings a lot of power, especially when you push the boundaries of automation to fully detect and respond to scenarios with multiple phases and tasks. Finally, consider Splunk, the platform in the middle of your infrastructure that removes all the complexity.

One significant benefit of using Splunk security is that it can ingest data from every source and combine it into one platform that fully satisfies all security requirements.

Related: For pre-information, you may find the following helpful:

  1. Security Automation
  2. Observability vs. Monitoring
  3. Network Visibility
  4. Ansible Architecture
  5. Ansible Tower
  6. OpenStack Neutron
  7. OpenvSwitch Performance
  8. Event Stream Processing

Common Security Challenges

Security Teams are under pressure.

Security teams face diverse challenges, from repetitive tasks to cumbersome processes. They often need help with constant alerts, manual investigations, and the array of tools distributed throughout the organization. Hundreds of security alerts overpower analysts, making it impossible for them to investigate and resolve each day thoroughly. As a result, security operations work is rife with monotonous, routine, and repetitive tasks, with a complete lack of integration and process.

**Custom-made Logging**

Some security teams built their log analytics and incident response capabilities from the ground up. However, such a custom-made logging tool requires manually assembling correlated logs with too many custom-built and siloed point products. Teams are expected to manage disconnected security tools, which consist of static, independent controls with little or no integration.

In the current environment, many security teams must establish workflows and standard operating procedures for different security events. As a result, analysts can only act quickly and decisively when responding to an attack. However, the real problem is the manual process, especially with manual scripting. 

**Issues of scripting**

Carrying out this capability across many security vendors will be challenging when using traditional scripting for automation. In addition, each vendor may change the API for its product. As a result, the automation scripts must change, leading to management and maintenance challenges. Most will only be able to integrate and create an automated workflow partially. The difficult-to-maintain processes lead to a need for more context. 

Phishing, Ransomware, and Supply Chain

Security Concerns:

We have a rapidly changing threat landscape that includes everything from Phishing to the proliferation of Malware, Supply Chain, and Ransomware. In addition, there is a pervasive nature of Ransomware to when it started, and it has grown considerably since the early Ransomware strains such as Wanna Cry. So, we have a Ransomware wave with loads of Ransomware families that encrypt in different ways. 

Remember that Ransomware applies Malware to many endpoints simultaneously, so if you have a network design with extensive macro segmentation and no intra-segment filtering, it can compromise all hosts with valuable assets.

Example Phishing Attack

Below is an example of a phishing attack. I’m using the Credential Harvestor to sniff credentials on a Google Web Template. The credential harvester, a credential stealer, is malicious software designed to steal sensitive login information from unsuspecting victims. Its primary targets are online banking platforms, email accounts, and social media platforms. By infiltrating a victim’s device, it quietly captures keystrokes, takes screenshots, or even intercepts network traffic to gather valuable login credentials.

Safeguarding Against Credential Harvestors

Protecting oneself from the clutches of a credential harvester requires a proactive approach. Here are some essential tips to enhance your cybersecurity:

1. Strengthen Passwords: Use complex, unique passwords for each online account, incorporating a mix of uppercase and lowercase letters, numbers, and symbols.

2. Enable Two-Factor Authentication: Implement an additional layer of security by enabling two-factor authentication whenever available. This adds an extra step for authentication, making it harder for attackers to gain unauthorized access.

3. Exercise Caution with Emails and Links: Be vigilant when opening emails or clicking on links, especially from unknown senders. Avoid providing login credentials on suspicious websites or pop-up windows.

4. Keep Software Updated: Regularly update your operating system, antivirus software, and applications to ensure you have the latest security patches and protection against known vulnerabilities.

Protect Against Malware

Malware endeavors to destroy backups, perform data exfiltration, and corrupt the data. Once the Ransomware binaries have been executed, encryption starts over. 

How might the adversary hop from one machine to another without exploiting vulnerabilities? Some long-established tactics are known: remotely creating WMI processes, scheduling tasks, and building services. However, they often go unseen. It would help if you focused on the detection. For Ransomware, we have about a 5-day window. You will not catch them using the manual process within such a short time.

Easy to evade; Malware is polymorphic.

Despite innovations like next-generation anti-malware solutions, threat intelligence feeds, and government collaboration initiatives and mandates such as zero trust, many of these attack techniques evade even the most innovative security tools today. For example, malware is polymorphic and programmed to avoid common signatures and rules, and we know that the perimeter-based defense mechanisms have not worked for a while now.

**Note: It is hard to do things quickly and thoroughly understanding**

– Fast detection and response to security events take a lot of work. A security analyst can spend hours on an alert. Multiply that by the hundreds of security alerts they deal with daily. For example, it’s common for an analyst to spend 90 minutes on average investigating and containing a single phishing alert.

– In addition, a SOC could receive hundreds of phishing emails in a given day. Security analysts are overwhelmed with phishing alerts to investigate and respond to. It takes too long to process each before the potential threat can cause damage manually. Phishing emails are a great starting point for Splunk SOAR to reply with low-code playbooks automatically.

**Note: Unknown accounts with Privilege access and controls**

– Not to mention that businesses frequently add contractors and others with privileged access to networks, it becomes challenging to understand whether everyone complies with the security policies and best practices or if there are any hidden risks in these activities. As a result, they face new challenges around secure configuration, software vulnerabilities, compliance, and maintaining an audit trail of access and training.

Splunk Security & Splunk ES: The Way, Forward

**Data Integration and Automated Response

So, you need to design security around data and build an approach to detect and respond to those risks. This requires a platform that can not collect the data but gain valuable insights. Of course, many platforms can collect data, but turning this data into useful insights for security is an entirely different challenge.

Therefore, data integration and an automated response will play a more significant role in security. This is where Splunk Enterprise Security ( Splunk ES), Splunk SIEM, and Splunk SOAR products can assist.

We can’t stop attacks

We can’t stop attacks, and you will be breached even by adopting the most robust zero-trust principles. All we can do is find ways to mitigate risk promptly. Splunk has a variety of security products that can help you do this.

One of the most critical ways to evolve and stay ahead is to examine data and derive helpful security insights. These insights can help you detect and respond to known, unknown, and advanced threats and fully use automation and orchestration to improve your security posture.

**Splunk Enterprise Security and Splunk SOAR

Automation is changing how teams traditionally use a Splunk SIEM. Splunk SOAR and Splunk Enterprise Security ( Splunk ES ) complement each other very well and allow us to improve security capabilities. So now we have a platform approach to security to fulfill diverse security use cases.

**Splunk SOAR: Orchestration and automation

The prime components of Splunk SOAR are automation and orchestration. With orchestration and automation, you will better support product-level workflows that allow security teams to automate complex processes across disparate products.

Introducing automation and orchestrating workflows and responses across your security stack will enable each previously siloed security product to participate more seamlessly in your defense strategy. So, we still have the unique tools, but Splunk SOAR is in the middle of orchestrating the events for each device with Playbooks.

A Splunk SOAR tool can easily thread the intelligence from multiple devices within the SOC, enriching alert data and surfacing it into a single interface. In addition, there is a playbook visualizer, so you can easily stick together security tasks.

**Integration with Existing Security Infrastructure

By automating the data collection and enrichment process from various sources, the analyst can see valuable details related to the alert as soon as it surfaces. This boosts your defenses by integrating existing security infrastructure, creating a mesh of more difficult-to-penetrate protection.

Splunk SOAR supports 350+ third-party tools and 2,400+ actions, allowing you to connect and coordinate workflows across teams and tools. This increases the speed of your investigation and response and unlocks value from previous investments. We will look at these playbooks in a moment.

Splunk Enterprise Security ( Splunk ES & Splunk SIEM )

Splunk Enterprise Security, the Splunk SIEM technology, is typically deployed to do the following security activities.

  1. Discover external and internal threats. This will help you detect compromised credentials and privileged attacks.
  2. Monitor users’ activities and specific types of users, such as those with privileged access and access to critical data assets. For example, this will help you see if users use the sysadmin tool Psexec or other means to move throughout the network laterally.
  3. Monitor server and database resource access and offer some data exfiltration monitoring capabilities. This can help you detect moments before Ransomware starts to encrypt your files.
  4. Support compliance requirements and provide compliance reporting.
  5. Provide analytics and workflow to support incident response. Orchestrate and automate actions and workflows by integrating with other tools, such as the SOAR.

A. Splunk ES & Splunk SIEM: The Value of Machine Data for Security

Splunk ES can complete these activities by gathering and turning unstructured data into valuable meaning. For example, we need to turn to machine data to understand the evidence of an attack and its movement in an organization.

Armed with that data, security teams can better remediate known threats and proactively respond to new threats in real-time to minimize potential damage to the organization.

B. Machine data and monitoring

Data can come in many forms, such as standard logs. So, by ingesting your application logs into Splunk SIEM, you can determine, for example, your application’s latency or your web server’s raw error rate. This can be carried out by using a simple SPL query against the.

Then, we have a security use case, our main concern. Machine data can tell you where a specific attack is coming from or how many login attempts result from invalid user names.

Machine data is everywhere and flows from all the devices we interact with, making up around 90% of today’s data. Harsing this data can give you powerful security insights. However, machine data can be in many formats, such as structured and unstructured. As a result, it can be challenging to predict and process.

C. Splunk SIEM. How Splunk Can Leverage Machine Data

This is where Splunk SIEM comes into play, and it can take any data and create an intelligent, searchable index—adding structure to previously unstructured data. This will allow you to extract all sorts of insights, which can be helpful for security and user behavior monitoring. In the case of Splunk Enterprise Security ( Splunk ES ), it helps you know your data very quickly. Splunk is a big data platform for machine data. It collects raw unstructured data and converts them into searchable events.

D. Splunk ES and Splunk SIEM Stage: Aggregates and Analyzes event data 

SIEM technology aggregates and analyzes the event data produced by networks, devices, systems, and applications. The primary data source has been time-series-based log data, but SIEM technology is evolving to process and leverage other forms of data. SIEM technology aggregates event data produced by security devices, network infrastructure, systems, and applications. 

**Any Source of Data**

The Index collects data from virtually any source. As data enters Splunk Enterprise Security, it examines it and understands how to process it. When it finds a match, it labels the data with source types. At the heart of Splunk is the Index, and data gets ingested. The Index contains machine data from servers, network devices, and web applications.

These events are then stored in the Splunk index. Once the events are in the Index, they can be searched. You can find events that contain values across multiple data sources so that you can run analysis and statistics on events using the Splunk search language.

E. Splunk ES and Splunk SIEM Stage: Searching and Analysis

Once data gets ingested into the Index, it is available for searching and analysis. Then, you can save search results into reports that can then be used to power dashboard panels. And that comes not just from tools that can sift through the volume of alerts and distractions. Analysts must find the cause, impact, and best resolution from all infrastructure elements. This will include the applications, networks, devices, and human users.

F. Splunk ES and Splunk SIEM Stage: Notable Events and Incident Review

Splunk Enterprise Security allows you to streamline the incident management process. Consolidating incident management will enable effective lifecycle management of security incidents, enabling rapid decision-making. Here, we automatically align all security contexts together for fast incident qualification. 

G. Splunk ES and Splunk SIEM Stage: Event Correlation Rule Management

With Splunk Security, we have a framework for rule management, using which we can manage all correlation rules across the system.

Detailed Information on Splunk SOAR 

  • Low-code playbooks

With automated playbooks orchestrating and executing actions across different point products, Splunk SOAR can automate repetitive tasks, investigation, and response. We have several playbooks that are considered low-code to carry out the automation. Implementing low-code “playbooks” allows for the codification of processes where automation can be applied to improve consistency and time savings. 

  • Actions based on the Playbooks

Then, we could have a list of actions based on playbook results. This could include further investigation tasks or notifying users. Finally, when you want to push the boundaries of automation, we could have several steps to isolate or quarantine hosts depending on the results of the previous playbooks. These steps would be integrated with multi-factor authentication to ensure the action is appropriately authorized. 

  • Phases and Task

We have noted low-code playbooks and how they can be used to automate tasks and merge with security tools and other Spunk products. All of this is done with workbooks and phases. For example, we can have a single workbook with several tasks to complete, and after executing these tasks, we can quickly start a separate phase or even a different workbook.

  • Splunk SOAR Integration with Other Products

You want to perform a containment action. The SOAR platform can, for example, use Carbon Black. Here, you can have manual, semi-automatic, or fully automatic containment. Or you can use Zscaler for containment. So, there are several additional products that SOAR can integrate with.

In this scenario, there will be one phase. And several playbooks in a single phase. First, some playbooks can be triggered automatically, and some are invoked manually. Then, some are being gathered manually but will have prompts for additional information.

These tasks will be semi-automatic because they can automatically import data for you and enrich events. Furthermore, they can import this data and enhance events from several platforms. So, this phase, which consists of a Risk Investigate workbook, is used as your initial triage.

Splunk SOAR Examples: 

Splunk SOAR Example: Phishing Investigation and Response

A typical phishing email investigation begins with analyzing the initial data and searching for artifacts. Some artifacts to investigate include attachments within the email, phishing links disguised as legitimate URLs, email headers, the sender’s email address, and even the entire email content.

  • Splunk SOAR Example: Phishing Investigate and Respond Playbook 

In this use case, we will highlight the Phishing Investigate and Respond Playbook, which automatically investigates and contains incoming phishing emails. The Playbook has 15 actions available. Once Splunk SOAR receives a phishing email alert from a third-party source (e.g., fetching email directly from the mail server), it will automatically kick off the Playbook and begin analyzing the following artifacts: file reputation, URL reputation, and Domain Reputation.

Suppose a file, URL, IP address, or domain seems suspicious during the investigation phase. In that case, the Playbook will use the predetermined parameters to decide whether to contain the threat by deleting the email from the user’s inbox.

Splunk SOAR Example: Endpoint Malware Triage

Although endpoint detection and response (EDR) or endpoint protection platform (EPP) tools can help monitor any suspicious activity within endpoints in your organization’s systems, these tools can generate many alerts — some of which could be false positives, while others are legitimate threats.

Fortunately, a SOAR tool can orchestrate decisions and actions to investigate, triage quickly, and respond to this high volume of alerts, filtering out the false positives, determining the risk level, and reacting accordingly.

  • Splunk SOAR Example: Crowdstrike Malware Triage Playbook 

It enriches the alert detected by Crowdstrike and provides additional context for determining the severity. Once all the information is collected, the analyst will be prompted to review it. Based on the analyst’s choice, the file in question can be added to the custom indicators list in Crowdstrike with a detection policy of “detect” or “none.” The analyst can optionally quarantine the endpoint from the network. 

Splunk SOAR Example: Command and Control with Investigation and Containment

  • C2 Investigate and Contain Playbook

As soon as an alert for a command-and-control attack surfaces, Splunk SOAR will start the C2 Investigate and Contain Playbook. This Playbook is designed to perform the investigative and potential containment steps to handle a command-and-control attack scenario properly. It will extract file and connection information from a compromised virtual machine, enrich it, and then take containment actions depending on the significance of the data. Significant information includes files with threat scores greater than 50 and IP addresses with reputation status “MALICIOUS,” among other attributes.

Splunk SOAR Example: Alert Enrichment

  • Indicators of Compromise

When investigating security alerts, you must first look at the indicators of compromise (IOCs), such as IP address, URL, user name, domain, hash, and other relevant criteria. This helps determine the severity of the alert. Many analysts manually dive into the data to search for additional context or hop between different threat intelligence platforms to gather more information.

  • Recorded Future Indicator Enrichment Playbook 

The Recorded Future Indicator Enrichment Playbook enriches ingested events that contain file hashes, IP addresses, domain names, or URLs. Contextualizing these details around relevant threat intelligence and IOC helps accelerate the investigation. Recorded Future is a security intelligence platform that provides additional context for analysts to respond to threats faster. 

  • Recorded Future Correlation Response Playbook 

The Recorded Future Correlation Response Playbook gathers more context about the relevant network indicators in response to a Splunk correlation search. Once there’s enough context, the Playbook automatically blocks access upon an analyst’s approval. By comparing traffic monitoring data with Recorded Future bulk threat feeds, Splunk identifies high-risk network connections and forwards them to Splunk SOAR. 

Splunk SOAR queries Recorded Future for details about why the network indicators are on the threat list and presents the analyst with a decision about whether the IP address and domain names should be blocked.

This example uses Layer 4 Traffic Monitoring by Cisco WSA as the network monitoring data source. Cisco Firepower NGFW and Cisco Umbrella can enforce blocking actions at the perimeter using DNS sinkholes. Once the analyst can secure the network access via the Recorded Future Correlation Response Playbook, Splunk SOAR can trigger a second playbook to investigate, hunt, and block a URL. 

  • Zscaler Hunt and Block URL Playbook

When a suspicious URL is detected, the Zscaler Hunt and Block URL Playbook can identify internal devices that have accessed that URL and triage their organizational importance. 

Then, depending on the URL’s maliciousness and whether or not the affected device belongs to an executive in the organization, the URL will be blocked, and an appropriate ServiceNow ticket will be created. This Playbook is supported via VirusTotal, Zscaler, Microsoft Exchange, ServiceNow, Splunk, and Carbon Black. Use these pre-built playbooks to help your team save time by tracking down malicious indicators so they can spend more time addressing critical tasks.

Summary: Splunk Security

In today’s ever-evolving digital landscape, ensuring the security of your organization’s data and infrastructure has become paramount. One solution that has gained significant traction is Splunk Security. In this blog post, we will explore Splunk Security’s capabilities and benefits and how it can empower your defense strategy.

Understanding Splunk Security

Splunk Security is a comprehensive platform designed to help organizations monitor, detect, and respond to security threats effectively. Aggregating and analyzing data from various sources provides real-time insights into potential risks and vulnerabilities.

Splunk Security offers many features that enable proactive threat hunting, incident response, and security analytics. From its powerful search and correlation capabilities to its customizable dashboards and visualizations, Splunk Security provides security teams with a holistic view of their environment.

Threat Intelligence Integration

One of Splunk Security’s key strengths is its ability to integrate with external threat intelligence feeds. By leveraging up-to-date threat intelligence data, organizations can enhance their threat detection capabilities and stay ahead of emerging threats.

Automation and Orchestration

Splunk Security offers automation and orchestration capabilities to address the ever-increasing volume and complexity of security incidents. By automating repetitive tasks and orchestrating incident response workflows, security teams can streamline processes and respond to threats more efficiently.

Advanced Analytics and Machine Learning

Splunk Security leverages advanced analytics and machine learning algorithms to identify patterns, anomalies, and potential indicators of compromise. These capabilities enable early detection of threats and provide valuable insights for proactive mitigation strategies.

Conclusion: In conclusion, Splunk Security is a powerful and versatile solution that can significantly enhance your organization’s defense strategy. You can stay one step ahead of cyber threats by leveraging its comprehensive features, integrating threat intelligence, harnessing automation and orchestration, and utilizing advanced analytics. Embrace the power of Splunk Security and fortify your security posture today.

Cisco Secure Workload

Cisco Umbrella CASB

by Publications

Cisco Umbrella CASB

In today's digital landscape, businesses face numerous security challenges. Protecting sensitive data and ensuring compliance with regulations are top priorities. This is where Cisco Umbrella CASB (Cloud Access Security Broker) comes into play. In this blog post, we will explore the key features and benefits of Cisco Umbrella CASB, and how it empowers organizations to secure their cloud environments effectively.

CASB, short for Cloud Access Security Broker, is a critical component of modern cybersecurity strategies. It provides organizations with visibility and control over cloud services, ensuring data protection and compliance. Cisco Umbrella CASB takes this to the next level, offering a comprehensive solution that covers all aspects of cloud security.

Cisco Umbrella CASB boasts a wide range of features that make it a powerful tool for securing cloud environments. From advanced threat protection to data loss prevention, here are some key features that set it apart:

Cloud Application Visibility: Cisco Umbrella CASB provides detailed visibility into all cloud applications in use within an organization. This allows administrators to identify potential risks and enforce policies to mitigate them effectively.

Threat Detection and Response: With its advanced threat detection capabilities, Cisco Umbrella CASB helps organizations identify and respond to potential security breaches promptly. It leverages machine learning algorithms and behavioral analytics to detect anomalous activities and prevent data exfiltration.

Data Loss Prevention (DLP): Protecting sensitive data is a top priority for organizations. Cisco Umbrella CASB enables granular data loss prevention policies, ensuring that confidential information remains protected throughout its lifecycle in the cloud.

One of the significant advantages of Cisco Umbrella CASB is its seamless integration with existing security infrastructure. It can easily integrate with other Cisco security solutions, such as Cisco Secure Email Gateway and Cisco Advanced Malware Protection, providing a unified approach to cloud security.

Compliance with industry regulations is crucial for organizations across various sectors. Cisco Umbrella CASB offers robust compliance and governance features that help organizations meet regulatory requirements. It provides visibility into user activities, enforces policies, and generates detailed compliance reports.

Cisco Umbrella CASB is a game-changer in the realm of cloud security. Its comprehensive features, seamless integration capabilities, and enhanced compliance and governance make it a go-to solution for organizations seeking to secure their cloud environments effectively. By leveraging the power of Cisco Umbrella CASB, businesses can confidently embrace the cloud while safeguarding their valuable data.

Matt Conran

Highlights: Cisco Umbrella CASB

Understanding Cisco Umbrella CASB

**Understanding the Basics of Cisco Umbrella CASB**

Cisco Umbrella CASB is designed to provide comprehensive security for cloud applications. It acts as an intermediary between cloud service users and providers, ensuring that data and applications are used securely. By offering visibility and control over user activities, it helps organizations mitigate risks associated with unmanaged devices and shadow IT. Its seamless integration into existing security frameworks makes it a preferred choice for IT administrators looking to enhance their cloud security posture.

**Key Features and Capabilities**

One of the standout features of Cisco Umbrella CASB is its ability to provide detailed insight into cloud service usage. It offers real-time monitoring and analytics, allowing organizations to identify potential threats and vulnerabilities quickly. Additionally, the platform supports advanced threat protection, data loss prevention, and compliance management, ensuring that all cloud activities adhere to regulatory standards. These capabilities make Cisco Umbrella CASB a comprehensive solution for businesses looking to secure their cloud environments.

**Implementing Cisco Umbrella CASB in Your Organization**

Deploying Cisco Umbrella CASB is a straightforward process that can significantly enhance your organization’s cloud security. By integrating with existing security tools and systems, it provides a unified approach to managing cloud access and protecting sensitive data. Organizations can customize policies to meet specific security needs, ensuring a tailored approach to risk management and compliance. This flexibility makes Cisco Umbrella CASB an invaluable asset in the quest for secure cloud operations.

Deployment: CASB Solution

– CASBs operate using two approaches: Inline CASB solutions reside in the users and service connection path. They may do this through a hardware appliance or an endpoint agent that routes requests through the CASB.

– This approach requires the configuration of the network and endpoint devices. However, it provides the advantage of seeing requests before they are sent to the cloud service, allowing the CASB to block submissions that violate policy.

– API-based CASB solutions do not interact directly with the user but rather with the cloud provider through the provider’s API. This approach provides direct access to the cloud service and does not require any user device configuration. However, it also does not allow the CASB to block requests that violate policy. As a result, API-based CASBs are limited to monitoring user activity and reporting on or correcting policy violations after the fact.

Key Features and Benefits:

a) Cloud Application Visibility: Cisco Umbrella CASB offers real-time visibility into cloud applications being used within your organization. This enables you to identify shadow IT, assess the risk associated with different applications, and enforce appropriate security policies.

b) Data Loss Prevention: With advanced data loss prevention capabilities, Cisco Umbrella CASB helps prevent unauthorized access, sharing, or leakage of sensitive data. It allows you to define granular policies, monitor data movement, and take proactive measures to mitigate data breaches.

c) Threat Detection and Response: Powered by machine learning and artificial intelligence, Cisco Umbrella CASB proactively detects and blocks threats in real-time. It analyzes user behavior, identifies anomalies, and provides actionable insights to secure your cloud environment against malware, phishing attacks, and other cyber threats.

d) A Platform Approach

We must opt for a platform approach to visibility and control. More specifically, a platform that works in a 3rd party environment. So, for cloud security, this is where secure access service edge (SASE) can assist. In particular, the Cisco version is SASE, or Cisco Umbrella CASB, which comes with various versions depending on your needs. The SASE Cisco umbrella CASB solution has a variety of CASB security functions and CASB tools, Data Loss Prevention (DLP), and Umbrella Remote Browser Isolation (RBI), which can help you better understand and control your environment.

e) Automatic Discovery and Risk Profiling

The manual process involves investigating and mapping traffic patterns, data movement, and usage. For this, we need automatic discovery and risk profiling. It would help if you had visibility into applications, files, and data you may know and those you do not know about. You will be amazed by the number of malicious files and data already in sanctioned applications.

Example Technology: Sensitive Data Protection

Sensitive data protection

Cloud Security Threats

  • Cloud Challenges:

Today’s shared challenge is that organizations need to know what applications they have in their environment. They also need to figure out what to do with specific types of data or how to find users and assign policies to them. These requirements must be met on someone else’s infrastructure, the cloud.

Working in cloud environments, which differ significantly from on-premises, involves significant risks. Could you consider storage? For example, unprotected storage environments pose a much greater security risk in the public cloud than in a private data center.

  • On-premise Data Centers

Within an on-premise private data center, the firewall controls generally restrict direct access to storage, limiting the exposure of an unprotected file to users who already have access to data center systems. On the other hand, an improperly managed storage bucket in the public cloud may be entirely unfiltered for the entire Internet, with only a few clicks by a single person or automated playbooks without role-based access control (RBAC).

Related: For pre-information, you may find the following helpful:

  1. SD WAN SASE
  2. Cisco Secure Firewall
  3. SASE Model
  4. Cisco CloudLock

Cisco Umbrella & SASE

The Role of SASE

The Cisco Umbrella SASE solution offers other security functionality, such as a cloud-delivered Layer 7 Firewall, Secured Web Gateways (SWG), DNS-layer security, SD-WAN, and Thousand Eyes integration for Monitoring and Observability conditions. So, we have the traditional security stack you are familiar with and added enhancements to make it more cloud-friendly. These functionalities are part of a single SASE solution, and you can benefit from a Cisco Umbrella dashboard with API integrations. 

The Cisco Umbrella CASB fulfills a variety of CASB security use cases. The use case for the CASB solution depends on where you are in your SASE and cloud security voyage. For example, if you are interested in blocking Malware and content, then Umbrella DNS filtering would be fine.

Umbrella Security Features:

However, you may be looking for additional security requirements. For example, you will need Data Loss Prevention (DLP), Cloud Access Security Brokers (CASB), and Umbrella Remote Browser Isolation (RBI). In that case, we need to move toward Umbrella SIG, which includes Layer 7 Firewalls. Cisco Umbrella offers several packages ranging from DNS Security Essentials to SIG Advantage. More information can be found here: Cisco Umbrella Packages.

1.**Continuous File Monitoring**

Along with these security features, Cisco Umbrella also has continuous file monitoring. You scan data at rest for any sanctioned application and files within those approved applications that could be malicious. These tools will improve your security posture and protect organizations against cloud-specific risks.

The Cisco Umbrella CASB components take you from the initial Discovery to understanding the Risk to maintaining activity by controlling access to specific applications for certain users and actions.

These security activities are carried out by the Cisco Umbrella’s Data Loss Prevention (DLP), Cloud Access Security Brokers (CASB), and Remote Browser Isolation engines.

2.**Umbrella Remote Browser Isolation**

What is Remote Browser Isolation? Browsing the Internet is a dangerous activity. Unfortunately, there are an abundance of threats. These include malicious Javascript, malvertising, exploit kits, and drive-by downloads. All of these target users who interact with web content via their browsers.

Typically, when a user’s browser is compromised, the attacker achieves access to the machine the browser runs on. However, the bad actors’ target assets are rarely on the first machine they compromise. For this, they will commonly proceed to move throughout the network laterally.

Challenge: Lateral Movements

**Remote Browser Isolation**

Unfortunately, the tool they use to move laterally is often a good sys admin tool, so it can be hard to detect as a security best practice; it’s much better to eliminate the availability of any lateral movements.

However, with Umbrella Remote Browser Isolation (RBI), the remote browser runs in an isolated container in the cloud, thus mitigating the attack surface to an absolute minimum and removing the potential to move laterally.

Therefore, the most sensible thing to do is to isolate the browsing function. With browser isolation technologies, Malware is kept off the end user’s system, reducing the surface area for attack by shifting the risk of attack to the server sessions, which can be reset to a known good state on every new browsing session, tab opened, or URL accessed.

**Redirect Browsings**

Umbrella Remote Browser Isolation protects users from Malware and threats by redirecting browsing to a cloud-based host, which for some is based on a containerized technology. Isolation is achieved by serving web content to users via a remotely spun-up surrogate browser in the cloud.

The Umbrella Remote Browser Isolation allows users to access whatever content they want, such as a web location or document. The user is sent via an isolation engine, which strips away anything that can be malicious, such as Macros or Malware, and then gives them a fully rendered version of the content.

**Rendered Clean Version**

For example, this could be a web app or a website. With remote browser isolation, you scrub away anything that could be malicious and give it a rendered clean version.

So, to the user, it is fully transparent, and they have no idea that they are looking at a rendered version. However, it provides clean and safe content that will not introduce malware into the environment without a performance hit.

Example: Detecting Threats in Logs

Understanding syslog and auth.log

Syslog is a standard protocol for message logging, allowing devices to send log messages to a centralized server. Auth.log, on the other hand, Auth.log is a specific log file that records authentication-related events on Unix-like systems. Familiarizing ourselves with these logs is the first step toward effective security event detection.

Syslog messages can provide valuable insights into security events. By examining their content and structure, we can identify anomalies, such as repeated failed login attempts, suspicious network connections, or unexpected system reboots. Various log analysis tools, like Splunk and ELK stack, offer powerful features to aid this process.

Auth.log is a goldmine for detecting potential security breaches. This log file captures authentication-related events, such as successful logins, failed login attempts, and user privilege escalations. By carefully monitoring auth.log, security analysts can spot unauthorized access attempts, brute-force attacks, or unusual user behavior, enabling them to take timely action to mitigate potential threats.

Starting Cisco Umbrella CASB

You can use Cisco Umbrella CASB to discover your actual usage of cloud services through multiple means, such as network monitoring, integration with existing network gateways and monitoring tools or even monitoring Domain Name System (DNS) queries. The CASB solution provides this form of discovery service.

This is the first step to CASB security, understanding both sanctioned and shadow I.T. Once the different services are discovered, a CASB solution can monitor activity on approved services through two standard deployment options.

First, we have an API connection or inline (man-in-the-middle) interception. Some vendors offer a multimode approach. Both deployment modes have their advantages and disadvantages.

The CASB alone is far from a silver bullet and works in combination with other security functions. The power of Cisco Umbrella CASB depends on its Data Loss Prevention (DLP) capabilities, which can be either part of the CASB solution or an external service, depending on the CASB security vendor’s capabilities. The Cisco Umbrella has an inline DLP engine.

Data Loss Prevention

After the Discovery is performed, CASB security can be used as a preventative control to block access to SaaS products. This functionality, however, is being quickly replaced through the integration of DLP. DLP systems inspect network traffic, leaving your systems looking for sensitive data. Traffic carrying unauthorized data is terminated to protect it from loss and leakage.

Through integration with a DLP service, you can continue to allow access to a SaaS product but control what is being done within that SaaS product. For example, if somebody uses Twitter, you can restrict specific keywords or statements from being sent to the platform.

So, for example, if you’re using an application like Salesforce in the cloud and have a policy that you’re not allowed to copy customers or download customer databases from Salesforce, the CASB solution can enforce that and monitor if someone attempts to download or violate the policies.

Example Technology: IPS IDS

Suricate IPS/IDS has a range of powerful features, making it a formidable defense mechanism for your network. Some of its notable features include:

1. Intrusion Detection: Suricate continuously scans network traffic, analyzing it for any signs of malicious behavior or suspicious activities. It can identify various attacks, such as DDoS attacks, SQL injections, and malware intrusions.

2. Intrusion Prevention: Suricate IPS is a proactive shield that prevents potential threats from infiltrating your network. It can block malicious packets, unauthorized access attempts, and suspicious traffic patterns, effectively neutralizing potential risks.

3. Real-time Alerting: Suricate instantly alerts network administrators or security teams whenever it detects a potential threat. These alerts provide valuable insights and allow for immediate response and mitigation, minimizing the impact of an attack.

Cisco Umbrella CASB: SASE Capabilities

Cisco Umbrella’s CASB, DLP, and Umbrella remote browser isolation (RBI) offering is a core part of Cisco’s overall SASE strategy. The value of CASB security is from its capability to give insight into cloud application use across cloud platforms and identify unsanctioned use.

CASBs use auto-discovery to detect cloud applications and identify high-risk applications and users. In addition, they include DLP functionality and the capability to detect and provide alerts when abnormal user activity occurs to help stop internal and external threats. This enables Cisco Umbrella to expose shadow I.T. by providing the capability to detect and report on the cloud applications used across your environment.

Now, we have a central place for all applications. Cisco Umbrella CASB looks at all your cloud applications and puts them in a single box, on a single pane of glass, that you can manage and look at what’s happening, but that functionality has to exist already. So, instead of going to a hundred different applications and cloud providers, you just go to one system, and your CASB solution handles everything.

Pillar1: Visibility 

The CASB security should detect all cloud services, assign each a risk ranking, and identify all users and third-party apps able to log in. More often than there are a lot of power users, such as finance, that have access to large data sets. So, files are shared and exposed within the content of files used, and apps are installed.

This is generally due to a slight majority of users controlling most applications. So, these users, who are a small number, introduce a considerable amount of security risk. In addition, these users often collaborate with several external parties, which will be cloud-based sharing, not to mention sharing with non-corporate email addresses.

**A key point: Understanding risk**

The first thing you want to do is understand the risk. Here, you can identify risky applications by gaining visibility on any shadow I.T. These apps that admins have no control or visibility into are being used in their environment that they need to protect.

You can also investigate what identities use these applications and why they are used. How do you gain visibility? You may wonder how you get all this data. A few sources can be used to discover the data we will discuss.

Applications in your environment can be displayed in different categories and break down risk based on other criteria. For example, there is business risk, usage risk, and vendor compliance. Each risk category has different factors used to make up the risk categories. Cisco Umbrella CASB integrates with Cisco Talos, which helps you get the reputation information by looking at the Host domain and URL associated with informing you if the app has a good reputation.

Pillar2: Discovery 

To gain visibility, we have to perform Discovery. The discovery process involves pulling in and logging data out of other security products and then analyzing the information. All of the capabilities to discover apps work out of the box. You only need to set the user traffic to the Umbrella system. The first is DNS, which we can also discover with the Secure Web Gateway (SWG) proxy and a cloud-delivered firewall.

These SASE engines offer a unique view of sanctioned and unsanctioned applications. So, if you send traffic through one of these Cisco Umbrella engines, it can collect this data automatically. Also, Cisco Umbrella has a Layer 7 application Firewall that can provide information such as application protocols, giving you information on the top-used protocols per application.

Native proxy, Firewall, and DNS logs.

The Umbrella has several components of engines that help with Discovery, such as native proxy, Firewall, and DNS logs. So, the user can be determined when every engine picks up the traffic, such as DNS or Firewall levels. This will give you a holistic view of the application, such as the risk associated with it and the identity on a per-app basis. So, now we can have a broader look at risk to understand cloud apps and traffic going to, for example, Malware hosts and going C&C command servers, and if any ToR endpoints are running on your network. 

Pillar 3: Data Security and Control

When dealing with any systematic issue, prevention is critical, with a focus on data protection. A good start would be to define which applications are risky. From there, you can build a workflow and data sets that you need to protect from, for example, data leakage. Once Discovery is performed along with risk assessment, you can prevent unwanted applications in your environment, which is the first step in enforcement.

The first component is the CASB security, followed by DLP to enforce controls. We are creating DLP policies to prevent data leakage. The CASB should be able to identify and control sensitive information. So here, we have DLP features and the capability to respond to classification labels on content.

There is a component called granular control, in which you can allow access to special applications but control different actions for specific applications and users. For example, you can enable access to the app but block uploads.

You can then tie this to an identity so only your finance team can upload it. You can allow, secure, and also isolate. The CASB DLP can operate natively and in conjunction with enterprise DLP products via Internet Content Adaptation Protocol (ICAP) or REST API integration. 

A standard DLP engine for the on-premise and cloud locations will eliminate policy duplication. This Cisco Umbrella solution opts for an inline DLP engine without the need to service chain to an additional appliance.

Pillar 4: Inline Data Loss Prevention

The Data Loss Prevention policy monitors content classified as personally identifiable or sensitive information. When necessary, content is blocked from an upload or a post. With Cisco DLP, there is only one data loss prevention policy.

Rules are added to the policy to define what traffic to monitor (identities and destinations), the data classifications required, and whether content should be blocked or only monitored. For example, an office may want to monitor its network for file uploads that include credit card numbers because the uploads breach company privacy and security policies. A rule that scans the network and uploads to domains can block these files.

Cisco Umbrella: 80 pre-built data Identifiers

There are two primary functions of DLP. The first piece identifies and classifies sensitive data; the second is the actions to take. Cisco Umbrella has robust DLP classification with over 80 pre-built data identifiers that are aligned with detailed reporting on every DLP report. So, working with DLP, you have first to select data classification.

This is where you start your DLP and have different identities for the data. If you are concerned with financial data sets and want to examine credit card numbers, you can choose a list of predicted identifiers. Then, you can add your customizations.

Cisco umbrella DLP engine also supports regular expressions that support pattern patterns. This allows you to match any pattern. So we have a custom action and pre-built and then apply this to a DLP policy. As you know, there is only one data loss prevention policy.

Rules are added to the policy to define what traffic to monitor (identities and destinations), the data classifications required, and whether content should be blocked or only monitored.

**Starting a SASE Project**

A) – SASE DLP Starting Points

As a starting point, when considering DLP, there are a couple of best practices to follow. First, you must “train” a DLP to understand sensitive data and what is not. Especially with DLP, you should have it in monitoring-only mode and not be aggressive and block. You want to understand what is happening before you start to block.

Sometimes, you want to understand more about data and data ID and where it moves. Second, a DLP cannot inspect encrypted traffic; if it does, check the performance hit. Third, some cloud SDKs and APIs may encrypt portions of data and traffic, which will interfere with the success of a DLP implementation.

B) – SASE Best Practices

As a best practice with Cisco Umbrella, you can start with the pre-built identifiers and create custom dictionaries to monitor your organization’s specific keywords and phrases. Then, you can create specific rules based on users, groups, devices, and locations for which you want to watch data. Finally, you can choose which destination and apps you like to monitor; many organizations choose only to monitor when creating DLP rules and then enable block over time. 

C) – Cisco Umbrella CASB starting points

Consider the following recommendations when starting a project that consists of CASB functionality. First, discover sanctioned and unsanctioned cloud services and then access the cloud risk based on cloud service categories. This includes all cloud services and cloud plug-ins. Once this information has been gained, it can be measured, along with risk. This can then be compared to the organization’s risk tolerance. 

Next, identify and protect sensitive information. Once you find all sensitive information in the cloud, you can classify it and then apply controls to control its movement, such as DLP. For example, additional protections can be used if sensitive data is moved from the cloud services to a local unmanaged laptop.

D) – SASE Detect and Mitigate Threats.

You can access the user’s behavior and any deviations that may signal out-of-normal activity. The CASB is one of many solutions that should be used here—more mature products with advanced detection, such as Splunk User Behavior Analytics (UBA). For example, trust decreases once a significant deviation from the baseline is noticed. You could implement step-down privileges or more extreme courses, therefore changing the level of access. In addition, it would be helpful to track all data’s movement and detect and eliminate Malware. And then have an implementation strategy for remediation.

Summary: Cisco Umbrella SASE

In today’s digital landscape, businesses are rapidly adopting cloud technologies to drive innovation and enhance productivity. However, this shift towards the cloud also introduces new security challenges. Enter Cisco Umbrella CASB, a comprehensive cloud access security broker solution that empowers organizations to safely navigate their cloud journey while ensuring data protection and compliance.

Understanding Cisco Umbrella CASB

Cisco Umbrella CASB is a robust platform that provides visibility, control, and protection across all cloud applications and services utilized by an organization. It offers a centralized console to manage cloud access, enforce security policies, and detect potential threats. With its advanced capabilities, Cisco Umbrella CASB enables businesses to embrace the cloud securely.

Key Features and Benefits

a) Cloud Application Visibility: Cisco Umbrella CASB offers deep visibility into cloud applications and services being used within an organization. It provides valuable insights into user activities, data transfers, and potential risks, allowing administrators to make informed decisions.

b) Policy Enforcement: With granular policy controls, Cisco Umbrella CASB enables organizations to define and enforce security policies tailored to their specific needs. It ensures that data is accessed, shared, and stored within the cloud according to predefined guidelines, reducing the risk of data breaches or unauthorized access.

c) Threat Detection and Response: By leveraging advanced threat intelligence and machine learning, Cisco Umbrella CASB proactively identifies and mitigates potential threats within cloud environments. It alerts administrators about anomalous activities, suspicious behavior, or policy violations, enabling swift incident response.

Seamless Integration and Scalability

Cisco Umbrella CASB seamlessly integrates with existing security infrastructure, including firewalls, proxies, and endpoint security solutions. This integration allows businesses to leverage their existing investments while extending comprehensive cloud security capabilities. Additionally, the solution scales effortlessly as organizations expand their cloud footprint, ensuring continuous protection.

Real-World Use Cases

a) Data Loss Prevention: Cisco Umbrella CASB helps prevent sensitive data leakage by monitoring and controlling data transfers within cloud applications. It enables organizations to set up policies that restrict the sharing of confidential information or personally identifiable data, reducing the risk of data loss incidents.

b) Compliance and Governance: With its robust auditing and reporting capabilities, Cisco Umbrella CASB assists organizations in meeting regulatory compliance requirements. It provides detailed logs and insights into user activities, ensuring transparency and accountability in cloud usage.

Conclusion

Cisco Umbrella CASB is a game-changer in the realm of cloud security. Its comprehensive feature set, seamless integration, and scalability make it an invaluable asset for organizations aiming to secure their cloud journey. By harnessing the power of Cisco Umbrella CASB, businesses can unlock the true potential of the cloud while safeguarding their critical assets and maintaining compliance.

DNS Security

DNS Security Solutions

by Publications

DNS Security Solutions

In today's interconnected digital world, ensuring the security of your online presence is of paramount importance. One crucial aspect often overlooked is Domain Name System (DNS) security. In this blog post, we will delve into the world of DNS security solutions, exploring their significance, benefits, and implementation.

Before we dive into the realm of DNS security solutions, let's first understand what DNS is. The Domain Name System serves as the phonebook of the internet, translating domain names into IP addresses. It plays a pivotal role in facilitating online communication and accessibility.

With the increasing number of cyber threats and attacks, DNS security has become a critical concern for individuals and organizations alike. This section will shed light on the importance of safeguarding your DNS infrastructure, highlighting the potential risks and vulnerabilities associated with a compromised DNS.

DNS Filtering: DNS filtering is an effective solution that helps prevent access to malicious websites and content. By blocking requests to known malicious domains, it reduces the risk of malware infections and data breaches.

DNSSEC: DNS Security Extensions (DNSSEC) ensure the integrity and authenticity of DNS responses, mitigating the risk of DNS spoofing and cache poisoning attacks.

DDoS Protection: Distributed Denial of Service (DDoS) attacks can wreak havoc on your online presence. DNS security solutions equipped with robust DDoS protection mechanisms help mitigate the impact of such attacks, ensuring uninterrupted DNS services.

Implementing DNS security solutions requires meticulous planning and adherence to best practices. This section will provide insights into the implementation process, including considerations for choosing the right DNS security provider, configuring DNS settings, and ongoing monitoring and updates.

Investing in DNS security solutions yields numerous benefits. From enhanced online privacy and reduced downtime to improved user experience and brand reputation, this section will outline the tangible benefits and return on investment that organizations can achieve by prioritizing DNS security.

DNS security solutions are a crucial component of a comprehensive cybersecurity strategy. By safeguarding your DNS infrastructure, you can protect your online presence, mitigate potential threats, and ensure uninterrupted connectivity for your users. Stay proactive, stay secure!

Matt Conran

Highlights: DNS Layer Security

Understanding DNS Layer Security

DNS, or Domain Name System, is the backbone of the internet, responsible for translating human-readable domain names into machine-readable IP addresses. DNS layer security focuses on protecting this crucial layer from cyber threats, ensuring the availability, integrity, and confidentiality of DNS infrastructure and communications.

The significance of DNS layer security cannot be overstated. Cybercriminals often exploit vulnerabilities within DNS infrastructure to launch various attacks, such as DNS hijacking, DNS amplification, and DNS tunneling. By compromising DNS, attackers can redirect users to malicious websites, intercept sensitive information, or disrupt network operations. Implementing robust DNS layer security measures is vital for organizations to safeguard their networks and maintain trust with their users.

Techniques for DNS Layer Security:

DNSSEC: Domain Name System Security Extensions (DNSSEC) is a set of cryptographic protocols that add an extra layer of security to DNS. By digitally signing DNS data, DNSSEC ensures the authenticity and integrity of DNS responses, making it difficult for attackers to manipulate DNS records.

DNS Filtering: DNS filtering involves implementing policies to block access to malicious or unauthorized domains. By utilizing threat intelligence and real-time analysis, organizations can prevent users from accessing known malicious websites, reducing the risk of malware infections and data breaches.

Traffic Monitoring and Analysis: Regularly monitoring DNS traffic can help detect anomalies and identify potential threats. Analyzing DNS query patterns and investigating suspicious activities can allow organizations to proactively respond to threats, mitigating potential attacks before they cause significant damage.

**No Security By Default**

This post will outline the domain name system: the DNS structure, the vulnerabilities and abuses of DNS security designs, and guidance on implementing DNS protection with examples of DNS security solutions with Cisco, like Cisco Umbrella DNS. Unfortunately, like many Internet protocols, the DNS system was designed without security in mind and contained several security limitations regarding privacy, integrity, and authenticity.

**Constant Security Threats**

These security constraints, combined with bad actors’ technological advances, make DNS servers vulnerable to a broad spectrum of attacking DNS vectors, including DNS Reflection attack, DNS tunneling, DoS (Denial of Service), or the interception of private personal information via means of data exfiltration via the DNS protocol. As you can presume, this causes the DNS layer to be an excellent avenue for bad actors to operate when penetrating networks and exfiltrating data.

Network Scanning for DNS Threats

Network scanning is the process of identifying active hosts, open ports, and services within a network. By examining the network’s structure and mapping its assets, organizations comprehensively understand their digital environment. This knowledge serves as a foundation for effective security management and risk assessment.

There are several types of network scans, each serving a specific purpose. The most common ones include:

1. Port Scanning: This technique identifies open ports on network devices, allowing administrators to evaluate potential entry points for malicious activities.

2. Vulnerability Scanning: By actively searching for weaknesses and vulnerabilities in network systems, vulnerability scanning helps organizations identify areas that require immediate attention and patching.

3. Network Mapping: Network mapping involves visualizing the network’s structure, providing valuable insights into its topology, and facilitating efficient network management.

Example Product: Cisco Umbrella

DNS security involves implementing measures to protect the integrity and availability of DNS services. This includes monitoring DNS queries for suspicious activity, blocking access to known malicious domains, and ensuring that DNS responses are authentic and untampered.

### The Power of Cisco Umbrella

Cisco Umbrella is a cloud-delivered security platform that provides a first line of defense against threats on the internet. By leveraging the vast intelligence of Cisco’s global network, Umbrella offers comprehensive protection through advanced DNS security measures. It automatically blocks malicious domains, IP addresses, and URLs before they can reach your network or endpoints.

One of the standout features of Cisco Umbrella is its ability to provide threat intelligence and visibility across all internet activity. This ensures that you not only block current threats but also gain insights into potential vulnerabilities and attack vectors. Moreover, being cloud-based, Cisco Umbrella is both scalable and easy to deploy, making it an ideal choice for organizations of all sizes.

### Key Benefits for Organizations

Implementing Cisco Umbrella’s DNS security can yield numerous benefits for organizations:

1. **Improved Protection**: By blocking threats at the DNS layer, Cisco Umbrella stops attacks before they reach your network, reducing the risk of data breaches and system compromises.

2. **Enhanced Visibility**: Gain real-time insights into internet activity, helping you identify and respond to potential threats swiftly.

3. **Simplified Management**: As a cloud-based solution, Cisco Umbrella requires no hardware installations, making it easy to manage and scale according to organizational needs.

4. **Reduced Latency**: With multiple data centers around the world, Cisco Umbrella ensures fast and reliable DNS resolution, improving overall internet performance.

Cloud DNS Solutions

### Google Cloud DNS Security Solutions

Google Cloud DNS offers a variety of security features to protect your DNS infrastructure:

1. **DNSSEC (Domain Name System Security Extensions):** Google Cloud DNS supports DNSSEC, which adds an additional layer of security by enabling DNS responses to be verified. This ensures that users are directed to the legitimate website without interference from malicious actors.

2. **Private DNS Zones:** By using private DNS zones, you can limit DNS resolution within your virtual private cloud (VPC) network, enhancing security by preventing external exposure of sensitive internal DNS records.

3. **Integration with Cloud IAM:** Google Cloud Identity and Access Management (IAM) allows you to manage access to your DNS resources with fine-grained, role-based controls. This ensures that only authorized individuals can make changes to DNS configurations.

4. **Logging and Monitoring:** Google Cloud DNS integrates with Cloud Logging and Cloud Monitoring, providing real-time insights into DNS query patterns and potential security threats. This enables proactive monitoring and rapid response to suspicious activities.

**Understanding Google Cloud’s Security Command Center**

Google Cloud’s Security Command Center (SCC) acts as a centralized dashboard, providing visibility into your cloud assets and their security posture. It integrates seamlessly with Google Cloud, offering real-time detection of vulnerabilities, misconfigurations, and threats. By leveraging Google’s extensive threat intelligence, SCC empowers organizations to proactively manage and mitigate security risks before they escalate.

**The Role of DNS Security in Threat Detection**

DNS Security is a crucial component of SCC, offering an additional layer of protection. By monitoring DNS traffic, SCC can identify suspicious activities indicative of potential threats, such as data exfiltration or communication with known malicious domains. This proactive approach allows organizations to swiftly respond to emerging threats, minimizing potential damage and ensuring business continuity.

**Investigative Capabilities: Unearthing Hidden Threats**

SCC’s investigative capabilities are instrumental in unearthing hidden threats within your cloud environment. With features like anomaly detection and threat hunting, security teams can delve deep into suspicious activities, tracing their origins and assessing their impact. This level of insight is invaluable for crafting effective response strategies, ensuring threats are neutralized efficiently and effectively.

**Maximizing Security with Best Practices**

To maximize the benefits of SCC, organizations should adopt best practices such as regular security assessments, continuous monitoring, and integrating SCC with other security tools. By fostering a culture of security awareness and staying informed about the latest threat trends, businesses can fortify their defenses and maintain a robust security posture.

Related: For pre-information, you will find the following posts helpful:

  1. OpenShift SDN
  2. GTM Load Balancer
  3. Open Networking
  4. SASE Model

Decentralized but not secure

The whole resolution process may be more transparent. However, it’s usually relatively fast. One feature that speeds it up considerably is caching. A nameserver processing a recursive query may have to send out several queries to find an answer. However, it discovers a lot of information about the domain namespace as it does so.

Each time it refers to another list of nameservers, it learns that those nameservers are authoritative for some zone, and it knows the addresses of those servers. At the end of the resolution process, when it finally finds the data the original querier sought, it can also store it for future reference.

**Types of DNS Attacks**

DNS attacks come in various forms, each with modus operandi and potential damage. From DDoS attacks that flood servers to cache poisoning that redirects users to malicious websites, understanding these attack vectors is crucial for implementing adequate security strategies.  

 **DNS Security Solutions**

Thankfully, several DNS security solutions are available to safeguard your online presence. This section will explore some of the most effective and widely used security measures. From implementing DNSSEC (DNS Security Extensions) to deploying firewalls and intrusion detection systems, we will discuss how these solutions can help mitigate DNS-related threats.

**Best Practices for DNS Security**

While deploying DNS security solutions is essential, following best practices to enhance your security posture is equally important. This section will outline some key best practices for DNS security, including regular patching and updates, monitoring DNS traffic, and employing multi-factor authentication. By adopting these practices, you can bolster your defenses against potential threats.

## Cloud Armor DNS Protection ##

### How Cloud Armor Works

Cloud Armor operates by leveraging a global infrastructure to detect and filter out malicious traffic before it can reach your applications. It employs advanced algorithms and machine learning techniques to differentiate between legitimate user traffic and potential threats.

By doing so, it ensures that your services remain accessible and responsive, even in the face of an ongoing attack. Furthermore, Cloud Armor integrates seamlessly with DNS security solutions, enhancing its ability to manage and redirect traffic efficiently..

### Integrating DNS Security Solutions

An integral component of Cloud Armor’s effectiveness is its seamless integration with DNS security solutions. By working in tandem, these systems provide an additional layer of security, ensuring that DNS traffic is also scrutinized and protected against potential attacks. This integration not only enhances the overall security posture but also improves the reliability and performance of your network services.

Decentralized but not secure

The DNS protocol was developed to be decentralized and hierarchical, though not secure. Almost since its inception, there have been exploits. We must protect this critical network service. Several technologies have been implemented for DNS protection. These security technologies can be implemented with secure access service edge (SASE) products such as DNS security Cisco with the Cisco Umbrella DNS product. Cisco Umbrella DNS stops threats such as Malware before the initial connection.

DNS Protection: Are DNS inquiries encrypted?

DNS queries are not encrypted. Even if users use a DNS resolver like 1.1.1.1 that does not track their activities, DNS queries travel over the Internet in plaintext. Anyone who intercepts the query can see which websites the user is visiting. This absence of privacy impacts security significantly. If DNS queries are not private, it becomes easier for governments to censor the Internet and for bad acts to lurk on users’ online behavior unknowingly.

DNS Protection with Privacy, Integrity, and Authenticity

So, with DNS, the primary thing we care about with security is not there. In security, we care about privacy, integrity, and authenticity. However, with DNS left to its defaults, with privacy, you can see all the DNS queries in plain text. Then, for integrity, we want to know if someone has made changes between the query and response DNS stages. Finally, for authenticity, we have yet to learn if the DNS server that responded is the server we want to talk to, not some man-in-the-middle snooping and intercepting the DNS queries and forging responses, leading users to malicious websites.

Example: DNS over TLS (DoT) and DoH (DNS over HTTPS)

These concerns have directed us to introduce technologies for DNS protection. Some DNS protection technologies include the DNS firewall, DNS as a security tool with DNS reputation and inspection, and secure the channel with DNS over TLS (DoT) and DoH (DNS over HTTPS), as well as security protocol implementations with DNSSEC. When implemented correctly, all of this helps restore the privacy, integrity, and authenticity security issues we have with the current implementation of the DNS protocol.

DNS Protection: Lack of DNS Security Solutions

**Early days of DNS-

In the early 1980s, the network was much smaller, with fewer relatively well-known and trusted participants. However, as the network scaled, DNS remained an insecure and unauthenticated protocol, even though the networks grew to have many relatively unknown and untrusted participants.

Since 1980, we have been stuck with this protocol. At that time, around a hundred hosts around the USA communicated with each other. Some of these communication protocols include FTP and SMNP. You still needed to find the IP back then, so you had to look it up in a host file. Then, if you wanted to be put into this host file, you would have to call Stanford and request it literally, and they wrote it manually for you.

**Challenge: Scaling-

Before you can scale, we need to create something to replace the host file. This was when the Domain Name System was designed. So, we have delegation with hierarchy instead of a host file that must be manually edited for new hosts.

With the Domain Name System, we have the concept of hierarchy. There is a Root at the very top, which is responsible for the IPs of the servers for the TLDs, which are .com and .org; there are thousands of them now, and they are responsible for the domains that are in them and not any other domains that are not part of that TLD.

**DNS protection: DNS creates blind spots-

Organizations widely trust DNS. The concept of trust in public and private IP addresses boils down to binary numbers and has nothing to do with one being more trustworthy, except for the excessive trust placed on private IP ranges.

DNS traffic is typically permitted to pass freely through network firewalls and other security infrastructure. However, bad actors with malicious intent attack and abuse it. Because of this, DNS traffic can be manipulated through techniques such as DNS tunneling and DNS poisoning, all of which create blind spots in your security posture.

**The issue with UDP-

Let us start with the basics. Clients can ask for DNS if they want to connect to an address such as ‘www.network-insight.com’ and need to know which IP address corresponds to it. Typically, all DNS messages are sent over UDP, where the problems start.

The first issue is that UDP is a stateless protocol and that source IP addresses are blindly trusted, similar to how everyone would trust a private IP address over a public one. Therefore, each request and response described here is a single UDP request containing to and from IP addresses. 

Any host can forge the source address on a UDP message, making it look like it came from the expected source. Therefore, a bad actor sitting on a network that does not filter outbound packets can construct a UDP message that says it’s from the authoritative server and send it to the recursive resolver.

DNS Security Cisco with DNS Security Solutions:

a) Neglected attack surface

Today’s bad actors use DNS’s often neglected attack surface – to steal data, spread malware, perform data exfiltration, command, and control network surveillance, along with the capabilities to perform social engineering. DNS is a bidirectional, Internet-facing protocol that carries a tremendous amount of data, making it an adversary’s most excellent tool for carrying out attacks and causing damage.

In addition, the combination of security teams failing to secure their DNS traffic and DNS’s ubiquity makes it a bad actor’s most potent yet unforgotten tool.

b) Example: Secure Web Gateway

While they have solutions that inspect and secure areas like their network with a stateful firewall, web traffic with Secure Web Gateways (SWG), and even some of the newer zero-trust technologies, these solutions cannot perform a deep inspection of their DNS traffic, leaving them vulnerable to the many threats today that abuse DNS. This is because they are not designed to inspect DNS traffic. As a result, techniques such as DNS tunneling should be noticed.

In most instances, DNS packets – typically including IP address information – enter networks via unblocked ports without first being inspected by security systems. So, again, DNS activity in a network is rarely monitored. This makes the DNS layer the perfect blind spot for bad actors to manipulate.

c) Issues with phishing 

Many of today’s sophisticated attacks depend on DNS activity. In addition, there has been a rise in malware; ransomware binaries, once executed, are quick to encrypt, and you can’t trust that your employee won’t click on a phishing email. As a result, there needs to be more trust and high complexity.

Bad actors use this and manipulate DNS to stage the internet infrastructure to support each attack stage and fully execute their kill chain. In many of today’s more sophisticated ransomware attacks, for example, bad actors will use DNS packets to upload Malware to a device.  

DNS Protection

The vulnerability and abuses of this protocol are comprehensive, and several methods of attacking DNS exist. For example, DNS poisoning, denial of service, spoofing/hijacking, and DNS tunneling exist.

DNS Tunneling:

Unless you have DNS-layer security, the DNS packets typically used to communicate IP addresses will only be inspected as they move through your network. Additionally, most security solutions don’t even register anomalous DNS activity – like DNS tunneling- a sure sign of an in-progress attack. DNS tunneling uses the DNS protocol to communicate non-DNS traffic over port 53. It sends HTTP(s) and additional protocol traffic over DNS.

DNS tunneling establishes DNS tunnels between their servers and victims’ machines. This connection between attacker and victim allows for the exfiltration of sensitive data and the execution of command and control operations.

DNS Poisoning:

DNS Poisoning, or DNS cache poisoning, is where forged DNS data is submitted into a DNS resolver’s cache. This results in the resolver returning an incorrect IP address for a domain. Therefore, rather than going to the indented website unknown to the user, their traffic can be redirected to a malicious machine. More often, this will be a replica of the original site used for malicious purposes, such as distributing Malware or collecting login information.

DNS poisoning was first uncovered in 1998. In this case, a recursive server sends a query out to the Root. As we are using UDP, there is no connection, and the only thing back then to identify the query as it came back as a response was simply a Query ID. That was a little short. Now, there was the possibility of tricking a DNS recursive resolver into storing incorrect DNS records. Once the nameserver has stored the wrong response, it will return it to anyone who asks.

**Issue: Redirect Web Browsers**

This “DNS poisoning” attack could allow random attackers to deceive DNS and redirect web browsers to false servers, hijacking traffic. Furthermore, the incorrect stored entry will remain until the cache entry expires, down to the TTL, which could lead to weeks of compromise.

So, if you attacked the server with forged responses for a domain and tried to brute-force the Query ID not very long ago, you could eventually guess it and insert your response into that recursive server cache.

If you set the TTL for a low time, such as a week, then everyone who queries that recursive server will get your chosen IP address for this domain name. Today, there have been changes to mitigate DNS poisoning. They have made the Query string very long and hard to guess, so it is hard to do, but it can still happen.

DNS Spoofing:

Then we have DNS Spoofing, or hijacking is very easy to do and difficult to detect. For example, let’s say you type the incurred domain name. So you try to go somewhere that does not exist and are returned to a search page with many ads. This is the ISP that is hijacking NX domain responses. So when you try to query for a name that does not exist, your ISP sees this, crafts its response, and sends you to a search page to sell you ads. This commonly happens on public Wi-Fi networks.

We have similar DNS spoofing and poisoning attacks, but they have distinguishable characteristics. Both attacks attempt to trick users into revealing sensitive data, which could result in a targeted user installing malicious software that can be used later in the kill chain. Poisoning DNS cache changes entries on DNS resolvers or servers where IP addresses are stored. 

DNS Amplification Attack (DNS Flood):

Then, we have the DNS amplification style of attack, also known as DNS floods. A bad actor exploits vulnerabilities to initially turn small queries into much larger payloads, which are used to bring down the victim’s hosts.

So, we know that DNS uses UDP for transport, meaning a bad actor can spoof the source address of a DNS request and send the response to any IP address of their choosing. In this case, they can amplify DDoS attacks using DNS responses larger than the initial query packet. For example, fake DNS lookups to open recursive servers can achieve a 25x to 40x amplification factor. This is because the source IP of the bogus lookups is the victim’s website, which becomes overwhelming.

DNS Flood Attack:

DNS flood targets one or more DNS servers belonging to a given zone, attempting to impede the resolution of resource records of that zone and its sub-zones. This attack overwhelms the network capacity that connects authoritative servers to the Internet.

Once the bandwidth is depleted with malicious traffic, legitimate traffic carrying DNS queries from legitimate sources cannot contact the authoritative servers. DNS flood attacks differ from DNS amplification attacks. Unlike DNS floods, DNS amplification attacks reflect and amplify traffic off unsecured DNS servers to hide the attack’s origin and increase its effectiveness.

Random Subdomain Attack:

Random Subdomain DDoS attacks, such as the Mirai attack on Dyn, have become popular recently. In these DNS attacks, many queries are sent for a single or a few target domains, yet they include highly varying nonexistent subdomains generated randomly.

This denial-of-service attack hits a domain’s authoritative name servers with multiple requests for random, nonexistent subdomains. The name servers become bogged down when replying to these phony requests and need help responding to legitimate queries. These attacks are also called NXDomain attacks; they can result in denial of service at the recursive resolver level.

DNS Tunneling:

Then, we have DNS tunneling, which we briefly mentioned. DNS tunneling is frequently used to deliver payloads encoded in DNS queries and responses, exfiltrate data, and execute command and control attacks as the attackers use SSH, TCP, or HTTP to pass, for example, Malware or stolen information into DNS queries undetected.

This allows the bad actor to exfiltrate sensitive data in small chunks within DNS requests to bypass security. With the amount of DNS traffic and requests a network typically sees, attackers can easily hide data theft.

The bad actor can use standard protocols like TCP or SSH, encoded within DNS protocol requests. At the same time, it is not an attack on DNS. This form of malicious activity can use DNS to exfiltrate data.

**DNS Security Cisco**

There are several ways these attacks can be prevented. Firstly, the DNS firewall enables DNS layer security. DNS-layer security effectively prevents malicious activity at the earliest possible point and, in the case of Malware, contains callbacks to attackers. DNS security solutions can be accomplished with products such as Cisco Umbrella DNS.

  • DNS Security Cisco with DNS-layer security

Cisco Umbrella DNS uses DNS-layer security encompassing the Internet’s infrastructure to block malicious and unwanted domains before a connection is established as part of recursive DNS resolution. In addition, it utilizes a technology known as selective cloud provide that redirects specific requests noted as risky for a deeper and more thorough inspection.

Cisco Umbrella DNS accomplishes this process transparently through the DNS response without adding latency or degrading performance. Just as a standard firewall watches incoming and outgoing web traffic and blocks unsafe connections, a DNS firewall works the same way. The distinction is that DNS firewalls analyze and filter queries based on threat feeds and threat intelligence. There are two kinds of DNS Firewalls: those for recursive servers and those for authoritative servers.

  • No Performance Hits

A DNS firewall provides several security services for DNS servers. It sits between a user’s recursive resolver and the authoritative nameserver of the website or service they are trying to reach. This can help with reputation filtering and domain reputation.

  • Cisco Umbrella DNS: Secure the channel

We have DNS over TLS and DNS over HTTPS, two standards for encrypting DNS queries to prevent external parties from being able to read them. DNS over TLS (DoT) and DoH (DNS over HTTPS) add a secure layer to an insecure protocol. By using DoH and DoT, users can ensure the privacy of DNS responses and block eavesdropping on their DNS requests (which reveals the sites they are visiting).

  • Cisco Umbrella DNS: Secure the protocol

Application layers use security protocols such as HTTPS, DMARC, etc., so the DNS protocol should be no exception. DNS Security Extensions (DNSSEC) defends against attacks by digitally signing data to help guarantee its validity. The signing must happen at every level in the DNS lookup process, which can make it a complicated setup.

DNSSEC was one of the first things we started implementing, and it is much older than many assume. The first talks about DNSEEC were in the early 1990s. It is a way to ensure that you know that a record you get back has not been tampered with and that the server you are talking to is the server you intend to talk to. All of this is done with PKI. 

  • Public Key Infrastructure (PKI) 

The server has a public and private key pair. So we have the public key, and they can sign the record. However, as we maintain a distributed hierarchy in DNS, we must guarantee that these are signed up to the Root. DNSSEC implements a hierarchical digital signing policy across all layers of DNS.

For example, in the case of a ‘google.com’ lookup, a root DNS server would sign a key for the.COM nameserver, and the.COM nameserver would then sign a key for google.com’s authoritative nameserver. DNSSEC not only allows a DNS server to verify the authenticity of the records it returns, but It also enables the assertion of the “non-existence of records.”

DNS resolvers can also be configured to provide security solutions. For example, some DNS resolvers provide content filtering, which can stop sites known to distribute Malware and spam, and botnet protection, which blocks communication with known botnets. Many of these secure DNS resolvers are free to use

Summary: DNS Security Solutions

This blog post delved into DNS security solutions, exploring the key concepts, benefits, and best practices for safeguarding one’s online activities.

Understanding DNS Security

The DNS, often called the internet’s phonebook, translates domain names into IP addresses, allowing us to access websites by typing in familiar URLs. However, this critical system is susceptible to various security risks, such as DNS spoofing, cache poisoning, and DDoS attacks. Understanding these threats is crucial in comprehending the importance of DNS security solutions.

DNS Security Solutions Explained

Several effective DNS security solutions are available to mitigate risks and fortify your online presence. Let’s explore a few key options:

  • DNS Filtering: This solution involves implementing content filtering policies to block access to malicious websites, reducing the likelihood of falling victim to phishing attempts and malware infections.
  • DNSSEC: Domain Name System Security Extensions (DNSSEC) provide cryptographic authentication and integrity verification of DNS data, preventing DNS spoofing and ensuring the authenticity of domain name resolutions.
  • Threat Intelligence Feeds: By subscribing to threat intelligence feeds, organizations can stay updated on emerging threats and proactively block access to malicious domains, bolstering their overall security posture.

Benefits of DNS Security Solutions

Implementing robust DNS security solutions offers numerous benefits to individuals and organizations alike. Some notable advantages include:

– Enhanced Data Privacy: DNS security solutions protect sensitive user information, preventing unauthorized access or data breaches.

– Improved Network Performance: By filtering out malicious requests and blocking access to suspicious domains, DNS security solutions help optimize network performance and reduce potential downtime caused by cyberattacks.

– Mitigated Business Risks: By safeguarding your online infrastructure, DNS security solutions minimize the risk of reputational damage, financial loss, and legal repercussions due to cyber incidents.

Best Practices for DNS Security

While investing in DNS security solutions is crucial, adopting best practices is equally important to maximize their effectiveness. Here are a few recommendations:

– Regularly update DNS software and firmware to ensure you benefit from the latest security patches and enhancements.

– Implement strong access controls and authentication mechanisms to prevent unauthorized access to DNS servers.

– Monitor DNS traffic for anomalies or suspicious activities, enabling prompt detection and response to potential security breaches.

Conclusion:

In an era where online threats continue to evolve, prioritizing DNS security is vital for individuals and organizations. By understanding the risks, exploring effective solutions, and implementing best practices, you can fortify your online security, safeguard your data, and confidently navigate the digital landscape.

rsz_rh1

Ansible Tower

by Publications

Ansible Tower

In today's fast-paced world, businesses rely heavily on efficient IT operations to stay competitive and meet customer demands. Manual and repetitive tasks can slow the workflow, leading to inefficiencies and increased costs. This is where Ansible Tower comes in – a powerful automation platform that empowers organizations to streamline their IT operations and achieve greater productivity. In this blog post, we will explore the benefits and features of Ansible Tower and how it can revolutionize your IT infrastructure.

Matt Conran

Highlights: Ansible Tower

Getting Started with Ansible Tower

Ansible Tower serves as a centralized hub for managing and executing Ansible playbooks. We will begin by understanding the core components of Ansible Tower, including its web-based user interface, inventory management, and job scheduling capabilities. With Tower, you’ll experience enhanced visibility and control over your automation processes.

**Ansible Tower Considerations**

– As your infrastructure grows, so does the need for efficient scaling. Ansible Tower empowers you to scale up your automation efforts seamlessly. We will explore Tower’s ability to handle large-scale deployments, manage multiple environments, and provide role-based access control. By leveraging Tower’s scalability, you can confidently automate tasks across your entire organization.

– Ansible Tower fosters collaboration and integration with other tools, enabling you to build comprehensive automation pipelines. Ansible Tower provides several integration capabilities with version control systems, chat platforms, and ticketing systems. By seamlessly integrating Tower into your existing toolchain, you can create a robust and efficient automation ecosystem.

– Monitoring the health and performance of your automation workflows is crucial for maintaining operational efficiency. Ansible Tower offers powerful monitoring features, including real-time job status updates, event-driven notifications, and comprehensive reporting. These monitoring capabilities help you stay on top of your automation game.

Key Features and Benefits:

**Centralized Automation**: Ansible Tower provides a single control point for managing automation across the entire infrastructure. It allows you to define and execute playbooks, schedule jobs, and monitor their progress, all from a user-friendly interface. This centralized approach saves time and effort and ensures consistency in automation processes.

**Role-Based Access Control**: Security is a top concern for any organization. Ansible Tower offers robust role-based access control (RBAC) mechanisms, allowing you to define granular permissions and access levels for different users and teams. This ensures that the right people have the right level of access, enhancing security and compliance.

**Integration and Extensibility**: Ansible Tower integrates with various tools and technologies, including cloud platforms, version control systems, and monitoring solutions. This enables you to leverage existing infrastructure investments and extend Ansible Tower’s capabilities to suit your specific needs.

Ansible Tower Use Cases:

Infrastructure Provisioning: With Ansible Tower, you can automate the provisioning of infrastructure resources, whether spinning up virtual machines in the cloud or configuring network devices. This eliminates manual errors, accelerates deployment times, and ensures consistent configurations across the infrastructure.

Application Deployment: Ansible Tower simplifies deploying and managing applications across different environments. Creating reusable playbooks allows you to automate the entire application lifecycle, from deployment to scaling and updates. This enables faster release cycles and reduces the risk of configuration drift.

Continuous Integration and Delivery: Ansible Tower integrates seamlessly with popular CI/CD tools, enabling you to automate the entire software development lifecycle. From building and testing to deploying and monitoring, Ansible Tower provides a unified platform for end-to-end automation, improving collaboration and accelerating time to market.

Ansible Automation Platform

A: Central Management & RBAC

To operationalize your environment and drive automation to production, you need to have everything centrally managed and better role-based access. So you understand who is automating and what they are doing, along with a good audit trail. This is where Red Hat Ansible and Ansible Tower can assist with several Ansible Tower features and Ansible Tower use cases. Red Hat Tower, also known as the Ansible Automation Platform, is a web-based UI and RESTful API for Ansible that allows users to manage the Ansible network in an easy and scalable way.

B: Big Step away from the CLI

Ansible Tower is a big setup from using just the CLI for automation. Tower’s primary purpose is to make automation more accessible and safer with scale to do in the enterprise. It does this by presenting several Ansible Tower features from a web-based U.I.

All the Ansible Tower features, such as Projects, Credentials, and Inventory, are isolated objects with different settings. However, once these components are combined or linked, they form an automation job within a Job Template. Therefore, consider the Job template, the Tower object that glues all other components together to create an automation journey.

Related: For additional pre-information, you may find the following posts helpful:

  1. Security Automation
  2. Network Configuration Automation
  3. NFV Use Cases
  4. SD WAN Security 
  5. Security Automation

Ansible Automation Platfrom

Automation Control Plane

The control plane for the Ansible Automation Platform is the automation controller. This platform is replacing Ansible Tower. However, throughout this post, we will refer to it as Ansible Tower when discussing the Ansible Tower use cases.

For a quick recap with Ansible Tower, we have several key components, such as a user interface (UI), role-based access control (RBAC), workflows, and continuous integration and continuous delivery (CI/CD) for supporting your team to scale with more efficiency and flexibility with automation throughout the enterprise.

Ansible Tower ( Ansible Automation Platform) helps formalize how automation is deployed, initiated, delegated, and audited, permitting enterprises to automate while reducing the risk of sprawl and variance. We can, for example, manage inventory, launch and schedule workflows, track changes, and incorporate them into reporting, all from a centralized user interface and RESTful API.

Ansible Red Hat: Ansible CLI

In more undersized team environments where everyone is well-versed in Ansible, maintaining control over automating the infrastructure and adhering to Ansible’s best practices in terms of using playbooks, meeting your security conditions, and delegating control is manageable. 

1. Challenge: Scaling

However, challenges emerge as teams start to scale and the use cases of automation become diverse; many organizations now have team-based usage needs that stretch well beyond Ansible’s command-line interface (CLI) with Ansible Core.

2. Challenge: Governance & Control

When automation is moved to a product and numerous teams use the CLI for automation, the problem is governance and control. For example, various users will write their Playbooks stored locally on their laptops. These Playbooks can be controlled, but the controlling factors may not be enforced.

3. Challenge: Extending Automation

Consequently, the potentially uncontrolled playbooks are configuring your organization’s entire infrastructure. So, we need to find a way to extend automation throughout the enterprise in a more controlled, secure, and scalable way. This can only be done with a platform approach to security, not CLI.

Red Hat Tower: Ansible Tower Use Cases

**Multi-machine & multi-vendor**

Nowadays, we are looking to expand automation to various Ansible Tower use cases, not just simple application deployments but even the ability to orchestrate multi-machine deployments with multi-vendor environments. The platform must support clustering and reach some far-edge use cases, such as edge networking.

**Automation Mesh**

There is a variety of Ansible Tower use cases that can be achieved with Automation mesh. Every product out there needs automation tied in—even the Cisco ACI. If you glance at the Cisco ACI programmable network, using Endpoint Groups (EPGs) is a significant benefit of the ACI network. However, you need something to configure the endpoints in the Endpoint Groups.  

**Enforcing Compliance and Standards**

You need to shift towards a platform such as Ansible Red Hat Tower with a central point for handling automation that allows you to enforce standards with your automation from the top organizational level to the exact CLI arguments that can be run and by whom.

Ansible Tower goes beyond running automated Playbooks; it helps you have better security, control, and visibility of your entire infrastructure. Ansible Tower can tie multiple processes and actions into a coherent workflow with a central control point. It has several Ansible Tower features that make scaling automation safe.

**Security use cases**

For security use cases, you can integrate Ansible Tower with an Enterprise security system. For control, we can have role-based access control on all of the Ansible Tower objects using Teams and Groups. You can integrate Tower with a central logging system, such as the ELK stack, for visibility. For metrics, Ansible Tower can be combined with Prometheus. Prometheus captures metrics from HTTP endpoints.

**Open networking**

Ansible Tower can also be integrated with various open networking use cases. Open networking describes a network that uses open standards and commodity hardware. Ansible Tower here can perform on multi-vendor networking equipment. 

The Big Question: Why Automate?

So, when beginning automation, you must first figure out why you should automate. So, the only thing that matters is how quickly you can deploy the application. To answer this, you must consider how quickly you can move from Dev, Test, and Production.

This is where the challenges are anchored, as we have different teams, such as network, load balancing, security, storage, and virtualization teams, to get involved. What can you do to make this more efficient?

**Integration Points**

We can test Ansible Tower against a staging environment before production deployment, all of which can be integrated into your CI/CD pipeline. This will help you better predict and manage your infrastructure.

When integrated with Jenkins, Ansible Tower uses cases to open possibilities. It is a powerful tool in a CI/CD process since it takes responsibility for environment provision and inventory management, leaving Jenkins with only one job: orchestrating the process.

**Multiple Inventories**

The Ansible architecture, of course, supports multiple inventories. Creating similar dev, test, and production inventories is not a problem if you want to create them. We make three inventories (‘dev,’ ‘test,’ and ‘prod’), each with identical sets of servers but with custom Ansible variables for their environment. This allows you to have a single Playbook with Ansible variables that separate the site-specific information to run against many inventories.

**What to automate?**

Every task that you can describe and explain can be automated. This generally starts with the device and service provisioning, such as ACL and Firewall rules. You can also carry out consistency checks, continuously running checks with automation against your environments. The Survey feature is an Ansible Tower feature used to run consistency checks. Here, you can have less experience running automatic checks that don’t need complete automation requirements. 

Ansible Tower Use Cases: Starting advice

Imagine that the developers of a Playbook are not the same people as the infrastructure owners. Who can run what Inventory becomes essential as we begin to scale out automation in the enterprise?  At a fundamental level, playbooks manage configurations and deployments to remote machines. In addition, they can sequence multi-tier rollouts involving rolling updates at a more advanced level and delegate actions to other hosts.

You can run continuous tests, which can be reported as an inconsistency when something goes wrong. This could be as simple as checking the VRRP neighbor and determining if you can see the neighbor. Or you could fit more detailed information, such as a stateful inspection firewall, and examine the contents to ensure your firewall works as expected. You can go further with routing adjustment and failure remediation, all with automation. It depends on how far you want to push the limitations of automation.  

Be Careful of Automating Mistakes

A) With automation, you can automate mistakes. A good starting point is to start with read-online, such as extracting configuration and checking specific parameters are there.

B) Then, you could move to devise provisioning and service provisionings such as VLAN segments, load balancing rules, and firewall changes.

C) Once you have mastered these operations, you could examine additional Ansible Tower use cases, such as traffic re-routing and advanced security use cases where Ansible Tower can assist in your threat-hunting effort.  

Ansible Tower Features

Highlighting an Organization’s objects

Sometimes, you have multiple independent groups of people that you need to manage autonomous machines. One central Ansible Tower feature to discuss is using the Organization’s objects. Hence, if you have two parts of an enterprise with entirely different requirements but still require Ansible Tower, they can share a single Red Hat Tower instance without overlapping configuration in the user interface by Organizations.

An Organization is a tenant with unique User accounts, Teams, Projects, Inventories, and Job Templates. It is like having a separate instance of Ansible Tower that allows you to segregate roles and responsibilities.

Red Hat Ansible: Role-based access control (RBAC)

An Organization is the highest level of role-based access control and is a collection of Teams, Projects, and Inventories. If you have a small deployment, you only need one Organization. However, larger deployments allow users and teams to be configured with access to specific sets of resources. Ansible Tower has a default Organization. Users exist at the Red Hat Tower level and can have roles in multiple Organizations.

When combined with the Ansible Tower features, such as role-based access control capabilities, Playbooks can be deployed at the push of a button but in a controlled and easily audited way. Role-based access control: You can set up teams and users in various roles. These can integrate with your existing LDAP or A.D. environment.

Restricting Playbooks

You can control who has access to what, when, and where, and explicitly restrict playbook access to authorized users. For example, we can have one team that can run playbooks in check mode, which is like a read-only mode, while other, more experienced users can have full administrative access with the ability to upgrade IOS versions to a fleet of routers. Developers log into Ansible Tower and, under RBAC, see only the job templates they have permission to access and deploy.

**Autonomy of an Automation Job**

In this next section, I will introduce the autonomy of an automation job in Red Hat Tower, giving you a good outline of the available Ansible Tower features. We have a new way to manage old Ansible objects and new Tower objects. You will notice that some of the objects used in Ansible Engine are the same, such as Playbooks and Inventory, and we have some new objects, such as Job Templates.

**Playbooks and Projects

We still maintain Playbooks containing your tasks. These Playbooks are stored in Projects. And this is synced to wherever you are starting your playbook. 

**Credential Management 

One significant benefit of using Ansible Tower is that it separates credentials from the Project. This allows you to have different Credentials for different Inventories. So, we can have one playbook targeting all hosts, run against different inventories with other credentials, and keep all your software release environments the same. This scenario is perfect for constancy in dev, test, staging, and production environments.

**Inventory

The final part is the Red Hat Ansible Inventory. You need to know how to connect with SSH or API; we can have many examples here. GitHub, Netbox, and ServiceNow. Even Though ServiceNow is an ITSM tool, it can be used as a CMDB database for inventory.

Automation Job:

All of these Ansible Tower features sync together to form what is known as an automation job. So when you look at Job templates and jobs, they always need to reference Projects, Inventory, and Credentials; otherwise, they can’t run. A basic four-stage process involves getting a playbook to run from Tower. The four stages are as follows:

  1. Define a project.
  2. Define an inventory.
  3. Define credentials.
  4. Define a template.

The first three stages can be performed in any order, but the template mentioned in the final stage pulls together the three previously created facets. Therefore, it must be specified last. 

Main Details on Ansible Tower Features

Projects allow you to define that area or space that allows all your resources and playbooks to exist. It is a location where our playbooks are stored. The defaults point to GitHub, but you can choose manual as the source control credential type, and then we would have our playbooks in the local directory.  This is different from the recommended approach for production as you don’t have any version control for projects stored locally on the Tower machines.

  • Red Hat Ansible: Projects Management

Before creating Job Templates, Credentials, Inventories, and everything necessary to run a Playbook, Tower needs to know where to find all the files required for the automation job. This is where projects come into play, and we can execute a lot of governance in project management. 

  • Source control and branching

First, playbooks are governed by Source Control Management (SCM). The Tower project components support the storage of playbooks in all major SCM systems, such as GitHub. 

  • The Role of GitHub

Managing can be challenging even if only two people work on a Playbook. So, how do we follow changes across the enterprise? What if other people made a mistake? How do you roll back if they change the local machine’s text editor? So you can commit to pushing changes to GitHub and go back and forth to see who made what change. The advantages of adopting source control are:

  1. Increased scalability and manageability
  2. Audit trails of any modification
  3. Better security  
  4. The ability to perform distributed and automated testing 
  5. Multiple life cycle environments for the Ansible code (i.e., dev, test, Q.A. & prod)
  6. Consistency with CI/CD pipeline integration

Red Hat Ansible: Inventory

Basic Inventory

In its most basic form, an Inventory delivers host information to Ansible to trigger the tasks on the right managed assets. These may be containers, edge devices, or network nodes. In traditional and non-dynamic environments, the static inventory is adequate. However, as we develop our use of automation, we must transition to more effective methods of gathering ever-changing environment details. This is where dynamic inventory and smart inventories come into play.

Dynamic Inventory

When you have a dynamic inventory, such as one on AWS with an EC2 group, it populates several different variables directly from AWS. This allows you to keep current on any insurance you have launched on AWS. A prime example is using a dynamic Inventory Plugin to gather inventory information from a cloud provider or hypervisor. Ansible Red Hat has built-in dynamic Inventory support, so you don’t need to edit configuration files or install additional Python modules.

Smart Inventory

Ansible and Ansible Tower have long been able to pull inventory from several sources, such as a local CMDB, private cloud, or public cloud. However, could you tell me what you need to do to automate your inventory? For example, let’s say you want to create an inventory across all machines tagged “dev” or all machines running a potentially vulnerable piece of software.

This is where you can use Smart Inventories. Smart inventory allows you to create inventories off Ansible Tower fact caching support. So, could you please create new inventories that include all hosts that match specific criteria? This can be based on host attributes such as groups or gathering facts. Gathering facts could be anything, such as the manufacturer or installed software service.

This can be particularly helpful for dynamically creating inventories with a specific type of host based on a filter. It saves the need for manually creating many different groups—or worse, adding the same host multiple times.

Red Hat Ansible: Machine Credentials 

When running a job template against one or more remote hosts or nodes, you must create a credential and associate it with your job template. The default is the machine credential, but we have many different credential types. A machine credential is, for example, an SSH username and password or an SSH username and a private key—these are stored securely in Tower’s backend database. 

Credential via Hashicorp Vault

Ansible Credential Plugin integration via Hashicorp Vault is an API-addressable secrets engine that will make life easier for anyone wishing to improve secrets management and automation. Modern systems require multiple secrets to automate effectively: certificates, database credentials, keys for external services, operating systems, and networking. 

Understanding who is accessing secret credentials and when is complex and often platform-specific. Managing key rotation, secure storage, and detailed audit logging across a heterogeneous toolset is almost impossible. Red Hat Tower solves numerous issues, but its integration with enterprise secret management solutions can utilize secrets on demand without human interaction.

Ansible Vault

Then we have Ansible Vault. Ansible Vault is a feature that keeps sensitive data in encrypted form, for example, passwords or keys, instead of saving them as plain text in roles or playbooks.  An Ansible vault is a standard file on your disk that you can edit using your favorite text editor, with one key difference. When you hit save, the file is locked inside strong AES-256 Encryption. What I like about this is that these vault files can be securely placed in source control or distributed to multiple locations.

Red Hat Ansible: Ansible Templates

With Ansible Tower, a Playbook is run from a Job Template. Within the job templates, we can specify the number of parameters and environment details for running the playbook. The template is a job definition with all of its parameters. In addition, the Job Template can be launched or scheduled. Scheduling is suitable for running playbooks at regular intervals, such as a nightly backup of configurations of all network devices.

Two Options: Job or Workflow Template

So we have two options: add a standard Template or a Workflow Template. A job template runs a single playbook with one set of settings. On the other hand, we have a workflow template that says I want to run this job with this playbook, and then if that passes or fails, we are, for example, a continuous workflow of multiple templates. 

Job Template

Workflow Template

  • Default

  • Single Tasks

  • Useful with the check feature

  • Multiple teams

  • Chaining automation

  • Useful with delegation

1.Workflow Template

The real value here is that you can have one team of users; let’s say the Linux team creates a template. This template will reference its inventory and playbooks and has its permission structure with role-based access control. Then, we can have a Network team that has developed its Playbooks and grouped them into a template with its Inventory, Credentials, and permission structure.

**Different teams, playbooks, and credentials**

A job template allows you to connect all of this. This is done with a Job Workflow template visualizer, enabling you to connect numerous playbooks, updates, and workflows, even if different users run them, use other inventories, or have other credentials. The vital point is that the various teams use different Playbooks, Credentials, and Inventories, yet everything is easily linked in one automation unit. Therefore, complex dependencies between the templates can be broken down into steps.

Workflow approval nodes 

Workflow approval nodes require human interaction to advance the workflow. This interaction lets decision-makers approve the automation before it’s applied in the environment. A simple example of where this could be useful is the finance team checking if funds are available before deploying new services to the public cloud. Or if you want someone to double-check that there is enough capacity on the target hosts.

Ansible Red Hat: Automation Requirements

  • Requirement: Low barrier of entry

With push-button deployment access, non-privileged users can safely deploy entire applications without any previous Ansible knowledge or risk of causing damage. 

  • Requirement: Better control and manageability

Ansible Tower is a welcomed addition to the power of the original Red Hat Ansible CLI version. It ensures that you can operate your infrastructure with automation and gain all the benefits of automation in a well-managed, secure, and auditable manner. Now, we need the ability to delegate authority to different users or teams and lock down access to particular projects or resources.

  • Requirement: The ability to schedule

Manual and ad hoc practices, even with the role of automation, can be inconsistent. Ansible Tower offers a more uniform and reliable way to manage your environment with Job Scheduling. One of Tower’s primary features is the ability to schedule jobs. Scheduling can enable periodic remediation, continuous deployment, or even scheduled nightly backups.

  • Requirement: Better visibility and real-time updates

Administrators want a real-time view of what Ansible is up to at any time, such as job status updates and playbook runs, as well as what’s working in their Ansible environment. All Ansible automation is centrally logged, ensuring audibility and compliance. With Ansible Tower, we have real-time analyses. It provides a real-time update about the completion of Ansible plays and tasks and each host’s success and failure. In addition, we can see our automation’s status and which will run next.

  • Requirements: Centralized logging and metrics

The Ansible Tower dashboard could better view our inventory, hosts, scheduled tasks, and manual job runs. However, we can incorporate Ansible Tower with the ELK stacks for additional information to better understand and predict future trends.

  • Requirement: Inventory management

Ansible Tower supports multiple Inventories, making creating dev, test, and similar production inventories easy. This will help you have better consistency throughout. Additionally, this provides a better way to manage and track their inventory across complex, hybrid virtualized, and cloud environments.

  • Requirement: System tracking and audit trail

System tracking. Verifies that machines are in compliance and configured as they should be. 

  • Requirement: Enterprise integration

For additional Ansible Tower use cases, several authentication methods make it easy to embed into existing tools and processes to help ensure the right people can access Ansible Tower resources. For example, Ansible Tower can link to central directories, such as Lightweight Directory Access Protocol (LDAP) and Azure Active Directory, to assist with authentication with the ability to create user accounts locally on the server itself.

Enterprise integration integrates Ansible into an existing environment and enterprise toolset. Self-service I.T. Provides the flexibility to free up time and delegate automation jobs to others.

  • Requirement: RESTful API

This allows Red Hat Tower to interact with other I.T. gear—enabling you to integrate Ansible Tower into existing areas of your infrastructure or your pipeline. For example, we can integrate Ansible Tower with ServiceNow and Inflowblox.  Every component and function of Ansible Tower can be API-driven. So it depends on your organization and how they operationalize their automation via the API or U.I.

Ansible Tower is a game-changer when it comes to streamlining IT operations. Its powerful features, centralized management, and extensive integrations make it a valuable tool for organizations of all sizes. By leveraging Ansible Tower, businesses can achieve greater efficiency, reduce human error, and drive innovation. Embrace the power of automation with Ansible Tower and embark on a journey towards a more agile and productive IT infrastructure.

Summary: Ansible Tower

In today’s fast-paced technological landscape, efficient IT operations are crucial for businesses to stay competitive. This is where Ansible Tower comes into play. This blog post explored its features and benefits and how it can revolutionize your IT workflows.

Understanding Ansible Tower

Ansible Tower is a powerful automation platform that allows you to centralize and control your IT infrastructure. It provides a user-friendly web-based interface, making managing and automating complex tasks easy. With Ansible Tower, you can effortlessly orchestrate and scale your IT operations, saving time and resources.

Key Features of Ansible Tower

Ansible Tower offers a wide range of features that enhance your IT operations. Some notable features include:

1. Job Templates: Create reusable templates for your automation tasks, ensuring consistency and efficiency.

2. Role-Based Access Control: Assign granular permissions to users and teams, ensuring proper access control.

3. Inventory Management: Easily manage your infrastructure inventory, making it simple to target specific hosts.

4. Workflow Visualization: Gain insights into your automation workflows with visual representations, enabling better tracking and troubleshooting.

Benefits of Using Ansible Tower

Implementing Ansible Tower in your IT environment brings several benefits:

1. Increased Efficiency: Automate repetitive tasks, eliminating manual errors and saving your IT team valuable time.

2. Enhanced Collaboration: With a centralized platform, teams can collaborate seamlessly, improving communication and productivity.

3. Scalability and Flexibility: Ansible Tower allows you to scale your automation efforts, adapting to your growing infrastructure needs.

4. Compliance and Auditability: Maintain compliance with industry standards by enforcing security policies and tracking changes made through Ansible Tower.

Real-World Use Cases

Various organizations across industries have adopted Ansible Tower. Here are a few real-world use cases:

1. Continuous Deployment: Streamline your software deployment processes, ensuring consistency and reducing time-to-market.

2. Configuration Management: Manage and enforce configuration standards across your infrastructure, guaranteeing consistency and minimizing downtime.

3. Security Compliance: Automate security hardening and configuration checks, ensuring compliance with industry regulations.

Conclusion:

Ansible Tower is a game-changer when it comes to streamlining IT operations. Its powerful features, scalability, and ease of use empower organizations to automate tasks, improve productivity, and enhance collaboration. Whether a small startup or a large enterprise, Ansible Tower can revolutionize your IT workflows, enabling you to stay ahead in the ever-evolving digital landscape.

Network visibility

Network Visibility

by Publications

Network Visibility

In today's interconnected world, where digital operations are the backbone of businesses, network visibility plays a crucial role in ensuring seamless connectivity, robust security, and optimal performance. This blog explores the significance of network visibility and how it empowers organizations to stay ahead in the ever-evolving technological landscape.

Network visibility refers to the ability to gain comprehensive insights into every aspect of a network infrastructure. It involves capturing, analyzing, and interpreting network data to obtain a clear picture of traffic patterns, device behavior, and potential threats. By having complete visibility into their networks, organizations can proactively address issues, optimize performance, and make informed decisions.

Enhanced Security: Network visibility serves as a powerful security tool, enabling organizations to detect and mitigate potential threats in real-time. By monitoring network traffic, identifying anomalies, and analyzing patterns, security teams can swiftly respond to cyberattacks, prevent data breaches, and safeguard critical assets.

Proactive Troubleshooting: With network visibility, IT teams can proactively identify and resolve network issues before they impact operations. By monitoring performance metrics, analyzing network data, and leveraging predictive analytics, organizations can optimize network resources, minimize downtime, and ensure a seamless user experience.

Advanced Monitoring Solutions: Effective network visibility requires robust monitoring solutions that capture and analyze network data in real-time. Advanced tools like network packet brokers, flow collectors, and intrusion detection systems enable organizations to collect and aggregate network data, providing a holistic view of their infrastructure.

Data Visualization and Analytics: Data visualization and analytics tools play a vital role in transforming raw network data into actionable insights. By presenting complex data in intuitive dashboards and reports, organizations can quickly identify trends, pinpoint bottlenecks, and make data-driven decisions to optimize network performance.

Defining Clear Objectives: Before implementing network visibility solutions, organizations should define their specific objectives and requirements. This involves identifying key performance indicators, security priorities, and desired outcomes to tailor the visibility strategy accordingly.

Continuous Monitoring and Analysis: Network visibility is an ongoing process. Organizations should establish a robust monitoring framework to continuously capture and analyze network data. Regular audits, performance assessments, and threat intelligence updates ensure that network visibility remains effective and up-to-date.

Network visibility is no longer a luxury but a necessity in today's digital landscape. It empowers organizations to proactively protect their networks, optimize performance, and make informed decisions. By embracing network visibility solutions and following best practices, businesses can unlock the full potential of their network infrastructure, gaining a competitive edge in the ever-evolving technology landscape.

Matt Conran

Highlights: Network Visibility

Understanding Network Visibility

Network visibility can be defined as the ability to monitor and analyze network traffic, allowing organizations to gain deep insights into their network infrastructure. It involves collecting, aggregating, and analyzing data from various network devices and endpoints, providing a comprehensive view of network operations.

**Achieving Effective Network Visibility**

Implementing network visibility requires careful planning and strategic execution. This section highlights some key strategies to consider:

1. Deploying Monitoring Tools: Utilize advanced monitoring tools that offer comprehensive visibility into network traffic, including bandwidth utilization, application performance, and user behavior.

2. Traffic Analysis and Packet Inspection: Leverage traffic analysis and packet inspection techniques to gain granular insights into network behavior, identify anomalies, and detect potential security threats.

3. Network Segmentation: Implement segmentation to divide the network into smaller, more manageable segments. This allows for better control, improved performance, and easier identification of issues within specific segments.

Network Performance

One key consideration of network visibility is its role in optimizing network performance. With real-time monitoring and analysis, organizations can identify bottlenecks, latency issues, or abnormal behavior that might impact performance. This allows for timely troubleshooting and ensures that potential problems are addressed proactively, minimizing downtime and maximizing productivity.

Netstat Analysis:

Netstat is a powerful command-line tool that provides valuable insights into active network connections, listening ports, and associated processes. Regularly analyzing netstat output allows administrators to detect suspicious activities, such as unauthorized connections or unusual listening ports.

Enhanced Security

Additionaly, Network visibility plays a pivotal role in bolstering network security. Organizations can detect and mitigate potential threats by monitoring network traffic, such as unauthorized access attempts, malware infections, or suspicious activities. It provides the opportunity to set up robust security measures, implement intrusion detection systems, and respond promptly to any security incidents.

Visibility from Logs: Syslog

Syslog is a standardized protocol used for message logging. It is vital in capturing logs from different devices, applications, and systems. By analyzing syslog, security professionals can gain valuable information about network activities, system events, and potential security incidents. Understanding the structure and content of Syslog messages is the first step toward effective event detection.

The role of Auth.log

Auth.log is a specific log file that records authentication-related events on a Unix or Linux system. It provides critical insights into user login attempts, authentication failures, and other authentication-related activities. By closely monitoring auth.log, security teams can detect suspicious login patterns, brute-force attacks, and unauthorized access attempts. This section will explore the critical elements of auth.log and highlight the indicators of potential security threats.

Network Visibility Tools

Traditional network visibility tools give you the foundational data to see what’s happening in your network. Network visibility solutions are familiar, and tools like NetFlow and IPFIX have been around for a while. However, they give you an incomplete view of the landscape. Then, we have a new way of looking with a new practice of distributed systems observability.

Observability: Observability software engineering brings a different context to the meaning of the data, allowing you to examine your infrastructure and its applications from other and more exciting angles. It combines traditional network visibility with a platform approach, enabling robust analysis and visibility with full-stack microservices observability.

Understanding SPAN

SPAN, also known as port mirroring, is a feature that allows the network administrator to capture and forward network traffic from one or more source ports to a destination port for analysis. By mirroring traffic to a dedicated monitoring device or software tool, network administrators gain valuable insights into the network’s behavior, troubleshoot issues, and ensure optimal performance.

SPAN offers network administrators many benefits:

1) First, it enables network traffic monitoring without disrupting the normal flow of operations. Network administrators can analyze packets and gain insights into network behavior without interfering with live data transfer.

2) Second, SPAN provides a nonintrusive method of capturing network traffic, which is invaluable for security purposes. It allows for the detection of suspicious activities and potential threats and assists in forensic analysis.

3) Configuring SPAN on Cisco NX-OS is straightforward. Network administrators can use the CLI or a graphical interface to define source and destination ports, select the desired traffic types, and set up filters if necessary. Cisco NX-OS provides flexibility and granularity in configuring SPAN sessions, allowing administrators to tailor their monitoring needs to specific requirements.

What is NetFlow?

NetFlow is a network protocol developed by Cisco Systems that provides valuable insights into network traffic. It collects and analyzes data packets as they traverse through network devices, allowing network administrators to monitor and understand network behavior.

**Capturing from data packets**

NetFlow captures relevant information from data packets, such as source and destination IP addresses, packet size, and timestamps. This information is then stored in flow records, which provide a comprehensive view of network traffic patterns. NetFlow-enabled devices generate and export these flow records to a NetFlow collector for further analysis.

**Complete visibility to traffic patterns**

NetFlow analysis offers numerous benefits to network administrators and security professionals. Firstly, it provides visibility into network traffic patterns, allowing for better network capacity planning and optimization. Additionally, NetFlow analysis aids in troubleshooting network issues by identifying bandwidth hogs, unusual traffic patterns, and potential security threats.

**Enhancement to network security**

One significant advantage of NetFlow is its ability to enhance network security. By analyzing flow records, security teams can detect and respond to suspicious activities like network intrusion attempts, DDoS attacks, or data exfiltration. NetFlow can also contribute to incident response efforts by providing valuable forensic data.

**Network performance and diagnostics**

NetFlow plays a crucial role in performance monitoring and network diagnostics. Administrators can identify bottlenecks, application performance issues, and network congestion by analyzing flow records. This valuable insight allows for proactive measures to optimize network performance and ensure a smooth user experience.

netflow

Understanding sFlow

sFlow is a standardized packet-sampling technology that allows network administrators to monitor traffic flow without needing dedicated monitoring ports. By capturing and analyzing a representative sample of network packets, sFlow provides valuable insights into the network’s overall health and performance.

Enhanced Network Performance: sFlow on Cisco NX-OS enables administrators to identify bandwidth-hungry applications and users, allowing for proactive management and optimization of network resources. By pinpointing performance bottlenecks, network administrators can proactively ensure optimal network performance.

Strengthened Network Security: sFlow provides real-time visibility into network traffic, allowing for the detection of anomalies and potential security threats. With sFlow on Cisco NX-OS, administrators can monitor and analyze traffic patterns, identify suspicious behavior, and take immediate action to mitigate security risks.

Streamlined Troubleshooting: Troubleshooting network issues can be time-consuming and complex. However, with sFlow on Cisco NX-OS, administrators gain access to detailed network traffic data, enabling faster and more accurate troubleshooting. By analyzing sFlow data, administrators can quickly identify the root cause of network issues and implement effective solutions.

Example Product: Cisco Secure Cloud Analytics

### Unmatched Visibility and Insight

Cisco Secure Cloud Analytics offers unparalleled visibility into your cloud environment, helping you identify and address potential threats before they can cause harm. By leveraging advanced machine learning algorithms and behavioral analytics, it continuously monitors network traffic and user activities.

This ensures that any anomalous behavior, which could signify a potential breach, is swiftly detected and acted upon. The platform’s intuitive dashboard provides real-time insights and detailed reports, making it easier for security teams to stay ahead of threats.

### Seamless Integration and Scalability

One of the standout features of Cisco Secure Cloud Analytics is its ability to seamlessly integrate with existing security infrastructure. Whether your organization uses AWS, Azure, or Google Cloud, this tool can be easily deployed and scaled to meet your specific needs. Its compatibility with a wide range of APIs and third-party applications ensures that it can work harmoniously within your current ecosystem, providing a unified approach to cloud security.

### Proactive Threat Detection and Response

In the realm of cybersecurity, speed and accuracy are paramount. Cisco Secure Cloud Analytics excels in both, thanks to its proactive threat detection capabilities. It not only identifies potential threats but also prioritizes them based on their severity, allowing your security team to respond swiftly. Automated alerts and incident response workflows ensure that critical issues are addressed promptly, minimizing the risk of data breaches and operational disruptions.

### Compliance and Risk Management

Maintaining compliance with industry standards and regulations is a crucial aspect of modern cybersecurity. Cisco Secure Cloud Analytics helps organizations achieve and maintain compliance by providing detailed audit trails and compliance reports. This makes it easier to adhere to standards such as GDPR, HIPAA, and PCI-DSS, thereby reducing the risk of costly fines and reputational damage. Additionally, its risk management features enable you to assess and mitigate vulnerabilities before they can be exploited.

Network Visibility Solutions

When you look at monitoring, it’s based on event alerts and the dashboard, all of which are populated with passive ( sampling ) to generate a dashboard. It is also per domain. However, we have very complex, distributed, and hybrid environments.

**Different API Consumption**

We have a hybrid notion from a code perspective and physical location with cloud-native solutions. The way you consume API will be different in each area, too. For example, how you consume API for SaaS will differ for authentication for on-premise and cloud. Keep in mind that API security is a top concern.

With our network visibility solutions, we must support all journeys in a complex and distributed world. So, we need system full-stack observability and observability software engineering to see what happens in each domain and to know what is happening in real-time.

**Active with metrics, logs, traces and events**

So, instead of being passive with data, we are active with metrics, logs, traces, events, and any other types of data we can inject. If there is a network problem, we inject all network-related data. If there is a security problem, we inject all security-related information.

Example: Getting hit by Malware 

If Malware hits you, you need to be able to detect a container quickly. Then, avoid remote code execution attempts from succeeding while putting the affected server in quarantine for patching.

So, there are several stages you need to perform. The security breach has affected you across different domains and teams. The topology now changes, too. The backend and front end will change, so we must reroute traffic while maintaining performance. To solve this, we need to analyze different types of data.

You must inject as much telemetry data as possible, including application, security, VPC, VNETs, and Internet statistics. We create all this data via automation, metrics, events, logs, and distributed tracing based on open telemetry.

    • Metrics: Metrics are aggregated measurements grouped or collected at the standard interface or a given period. For example, there could be a 1 min aggregate, so some details are lots. Aggregation helps you save on storage but requires proper pre-planning on what metrics to consider.
    • Events are discrete actions happening at a specific moment in time. The more metadata associated with an event, the better. Events help confirm that particular actions occurred at a specific time. 
    • Logs: Logs are detailed and have timestamps associated with them. These can either be structured or unstructured. As a result, logs are very versatile and empower many use cases.
    • Traces: Traces are events that change between different application components. This item was purchased via credit card at this time; it took 37 seconds to complete the transaction. All chain details and dependencies are part of the trace, which allows you to follow what is going on.

In the case of Malware detection, a combination of metrics, traces, and logs would have helped you, and switching between views and having automated correlation will help you get to the root cause. But you must also detect and respond appropriately, leading us to secure network analytics.

Related: Before you proceed, you may find the following posts helpful:

  1. Observability vs. Monitoring
  2. Reliability In Distributed Systems
  3. WAN Monitoring
  4. Network Traffic Engineering
  5. SASE Visibility

Back to Basics: Network Visibility

Understanding Network Visibility

Network visibility refers to gaining clear insights into the network infrastructure, traffic, and the applications running on it. It involves capturing, monitoring, and analyzing network data to obtain valuable information about network performance, user behavior, and potential vulnerabilities. By having a comprehensive network view, organizations can make informed decisions, troubleshoot issues efficiently, and proactively address network challenges.

**Security threats with network analysis and visibility**

Remember, those performance problems are often a direct result of a security breach. So, distributed systems observability goes hand in hand with networking and security. It does this by gathering as much data as possible, commonly known as machine data, from multiple data points. It then ingests the data and applies normalization and correlation techniques with some algorithm or statistical model to derive meaning.  

Key Components of Network Visibility:

a) Traffic Monitoring: Effective network visibility relies on robust traffic monitoring tools that capture and analyze network packets in real-time. These tools provide granular details about network performance, bandwidth utilization, and application behavior, enabling organizations to identify and resolve bottlenecks.

b) Network Taps: Network taps are hardware devices that provide a nonintrusive way to access network traffic. By connecting to a network tap, organizations can gain full visibility into network data without disrupting network operations. This ensures accurate monitoring and analysis of network traffic.

c) Network Packet Brokers: Network packet brokers act as intermediaries between network taps and monitoring tools. They collect, filter, and distribute network packets to the appropriate monitoring tools, optimizing traffic visibility and ensuring efficient data analysis.

d) Packet Capture and Analysis: Packet capture tools capture network packets and provide detailed insights into network behavior, protocols, and potential issues. These tools enable deep packet inspection and analysis, facilitating troubleshooting, performance monitoring, and security investigations.

e) Flow-Based Monitoring: Flow-based monitoring tools collect information on network flows, including source and destination IP addresses, protocols, and data volumes. By analyzing flow data, organizations can gain visibility into network traffic patterns, identify anomalies, and detect potential security threats.

Capturing Traffic: Network Analysis

Tcpdump is a command-line packet analyzer tool for capturing and analyzing network packets. It captures packets from a network interface and displays their contents in real time or saves them to a file for later analysis. With tcpdump, you can inspect packet headers, filter packets based on specific criteria, and perform detailed network traffic analysis.

Visibility with CDP

Cisco CDP is a proprietary Layer 2 network protocol developed by Cisco Systems. It operates at the Data Link Layer of the OSI model and enables network devices to discover and gather information about other directly connected devices. By exchanging CDP packets, devices can learn about their neighbors, including device types, IP addresses, and capabilities.

Starting Network Visibility

1. Data-driven visibility

Combating the constantly evolving threat actor requires good network analysis and visibility along with analytics into all areas of the infrastructure, especially the host and user behavior aligning with the traffic flowing between hosts. This is where machine learning (ML) and multiple analytical engines detect and respond to suspicious and malicious activity in the network.

This is done against machine data that multiple tools have traditionally gathered and stored in separate databases. Adding content to previously unstructured data allows you to extract valuable insights, which can be helpful for security, network performance, and user behavior monitoring.

2. System observability 

The big difference between traditional network visibility and distributed systems observability is between seeing and understanding what’s happening in your network and, more importantly, understanding why it’s happening. This empowers you to get to the root cause more quickly. Be it a network or security-related incident. For all of this, we need to turn to data to find meaning, often called data-driven visibility in real-time, which is required to maximize positive outcomes while minimizing or eliminating issues before they happen.

3. Machine data and observability

Data-driven visibility is derived from machine data. So, what is machine data? Machine data is everywhere and flows from all the devices we interact with, making up around 90% of today’s data. Harnessing this data can give you powerful insights for networking and security. Furthermore, machine data can be in many formats, such as structured and unstructured.

As a result, it can be challenging to predict and process. When you find issues in machine data, you need to be able to fix them in less time. You need to pinpoint, correlate, and alert specific events so we can save time. 

We need a platform that can perform network analysis and visibility instead of only using multiple tools dispersed throughout the network. A platform can take data from any device and create an intelligent, searchable index. For example, a SIEM solution can create a searchable index for you. There are several network visibility solutions, such as cloud-based or on-premise-based solutions. 

4. Network Visibility Tools

Traditional, legacy, or network visibility tools are the data we collect with SNMP, network flows, and IPFIX, even from routing tables and geo-locations. To recap, IPFIX is an accounting technology that monitors traffic flows. IPFIX then interprets the client, server, protocol, and port used, counts the number of bytes and packets, and sends that data to an IPFIX collector.

Network flow or traffic is the amount of data transmitted across a network over a specific period. The flow identification is performed based on five fields in the packet header. These fields are the following: source I.P. address, destination I.P. address, protocol identifier, source port number, and destination port number.

Then, we have SNMP, a networking protocol for managing and monitoring network-connected devices. The SNMP protocol is embedded in multiple local devices. None of these technologies is going away; they must be correlated and connected.

Example Product: Cisco Cyber Vision

### The Importance of Network Visibility

One of the primary challenges in securing industrial networks is the lack of visibility. Traditional IT security tools often fall short when applied to OT environments. Cisco Cyber Vision addresses this gap by offering unparalleled network visibility. It monitors and maps all connected devices, communications, and data flows within your ICS network, ensuring that you have a clear and comprehensive view of your entire infrastructure.

### Real-time Threat Detection

In addition to providing visibility, Cisco Cyber Vision excels in real-time threat detection. By leveraging advanced analytics and machine learning, it can identify and alert you to potential threats as they occur. This proactive approach enables you to respond swiftly to security incidents, minimizing potential damage and downtime. The system continuously updates its threat database, ensuring that you are protected against the latest cyber threats.

### Seamless Integration with Existing Systems

Cisco Cyber Vision is designed to integrate seamlessly with your existing security infrastructure. Whether you use Cisco’s own security solutions or third-party tools, Cyber Vision ensures a smooth and efficient integration process. This interoperability allows you to leverage your current investments while enhancing your overall security posture. Moreover, it provides a unified platform for managing both IT and OT security, bridging the gap between these traditionally siloed domains.

### Enhancing Compliance and Reporting

Adhering to regulatory requirements and industry standards is a crucial aspect of industrial network security. Cisco Cyber Vision simplifies the compliance process by offering detailed reporting and audit capabilities. It generates comprehensive reports that outline network activity, security incidents, and compliance status. These reports not only help in meeting regulatory obligations but also provide valuable insights for continuous improvement of your security strategies.

Traditional network visibility tools:

**Populate charts and create baselines**

From this data, we can implement network security. First, we can create baselines, identify anomalies, and start to organize network activity. Alerts are triggered when thresholds are met. So we get a warning about a router that is down or an application is not performing as expected.

**Poor Thresholds**

This can be real-time or historical. However, this is all good for the previous way of doing things. But for example, when an application is not performing well, a threshold tells you nothing; you need to be able to see the full paths and any use of each part of the transaction.

All of which were used to populate the charts and graphs. These dashboards rely on known problems that we have seen in the past. However, today’s networks fail in creative ways often referred to as unknown/unknown, calling for a new approach to distributed systems observability that Site Reliability Engineering (SRE) teams employ.

Observability Software Engineering

To start an observability project, we need diverse data and visibility to see various things happening today. We don’t just have known problems anymore. We have a mix of issues that we have yet to see before. Networks fail in creative ways, some of which have never happened before. We need to look at the network differently, using new and old network visibility tools and the practices of observability software engineering.

We need to diversify your data so we have multiple perspectives to understand better what you are looking at. This can only be done with a distributed systems observability platform. What does this platform need?

Network analysis and visibility:

Multiple data types and point solutions

So, we need to get as much data as possible from all network visibility tools such as flows, SNMP, IPFIX, routing tables, packets, telemetry logs, metrics, logs, and traces. Of course, we are familiar with and have used everything in the past, and each data type provides a different perspective. However, the main drawback of not using a platform is that it lends itself to a series of point solutions, leaving gaps in network visibility.

Now we have a database of each one. So, we could have a database for network traffic flow information for application visibility or a database for SNMP. The issue with the point solution is that you can only see some things. Each data point acts on its island of visibility, and you will have difficulty understanding what is happening. At a bare minimum, you should have some automation between all these devices.

**Automation as the starting point**

Automation could be used to glue everything together. Ansible architecture has two variants: a CLI version known as Ansible Core and a platform-based approach with Ansible Tower. Automation does not provide visibility, but it is a starting point to glue together the different point solutions to increase network visibility.

For example, you collect all logs from all firewall devices and send them to a backend for analysis. Ansible variables are recommended, and you can use the Ansible inventory variable to fine-tune how you connect to your managed assets. In addition, variables bring many benefits and modularity to Ansible playbooks.

Isolated monitoring for practical network analysis and visibility

I know what happens on my LAN, but what happens in my service provider networks.? I can see VPC flows from a single cloud provider, but what happens in my multi-cloud designs? I can see what is happening in my interface states, but what is happening in my overlay networks? 

For SD-WAN monitoring, if a performance problem with one of my applications or a bad user experience is reported from a remote office, how do we map this back to tunnels? We have pieces of information that are missing end-to-end pictures. For additional information on monitoring and visibility in SD-WAN environments, check out this SDWAN tutorial.

**The issue without data correlation?**

How do we find out if there is a problem when we have to search through multiple databases and dashboards? When there is a problem, how do you correlate it to determine the root cause? What if you have tons of logs and must figure out that this interface utilization correlates with this slow DNS lookup time, which links to a change in BGP configuration?

So you can see everything with traditional or legacy visibility, but how do you go beyond that? How do you know why something has happened? This is where distributed systems observability and the practices of observability software engineering come in—having full-stack observability with network visibility solutions into all network angles.

Distributed Systems Observability

Seeing is believing

Note: The difference between seeing and understanding. Traditional network visibility solutions let you see what’s happening on your networks. On the other hand, observability helps you understand why something is happening.

With observability, we are not replacing network visibility; we are augmenting this with a distributed systems observability platform that lets us combine all the dots to form a complete picture. With a distributed systems observability platform, we still collect the same information.

Routing information, network traffic, VPC flow logs, results from synthetic tests, metrics, traces, and logs. But now we have several additional steps of normalization and correlations that the platform takes care of for you.

Gaining Visibility: Google Cloud Trace

Application Latency

Before we dive into Cloud Trace, let’s first grasp the concept of application latency. Application latency refers to the delay or time lag experienced by users when they interact with an application. It can be influenced by various factors such as network latency, server response time, and database query execution. Monitoring and analyzing application latency is essential for identifying bottlenecks and optimizing performance.

Trace Latency in Distributed Systems

Cloud Trace is a powerful tool offered by Google Cloud that enables developers to trace and analyze latency in distributed systems. It provides detailed visibility into the flow of requests across various services and helps pinpoint performance issues. With Cloud Trace, you can track requests as they traverse through different components of your application and identify latency hotspots.

**Distributed systems observability and normalization**

Interface statistics could be packets per second; flow data might be a percentage of traffic, such as 10% being DNS traffic. Then, we have to normalize and correlate it to understand what happens for the entire business transaction. So, the first step is to ingest as much data as possible, identify or tag data, and then normalize the data. Remember that this could be short-lived data, such as interface statistics.

**Applying machine learning algorithms**

All these different types of data are ingested, normalized, and correlated, which can not be done by a human. Distributed systems observability gives you practical, actionable intelligence that automates the root cause and measures network health by applying machine learning algorithms.

Supervised and unsupervised machine learning is used heavily in the security world. So, in summary, for practical network analysis and visibility, we need to do the following:

This will give you full-stack observability for enhanced network visibility, which traditional network visibility tools cannot provide.

Full Stack Observability

A: – Landscape Transitions

We’d like to briefly describe the transitions we have gone through and why we need to address full-stack observability. First, we had a monolithic application, which is still very alive today, and this is where the mission-critical system lives.

We then moved to the cloud and started adopting containers and platforms. Then, there was a drive to re-architect the code, beginning with cloud-native and, now, with observability.

Finally, monitoring becomes more important with the move to containers and kubernetes. Why? Because the environments are dynamic, you need to embed security somehow.

B: – The traditional world of normality:

In the past, network analysis and visibility were simple. Applications ran in single private data centers, potentially two data centers for high availability. These data centers were on-premises, and all components were housed internally. 

In addition, the network and infrastructure were pretty static, and there were few changes to the stack, for example, daily. However, nowadays, we are in a different environment where we have complex and distributed applications. This is with components/services located in many other places and types of places, on-premises and in the cloud, depending on local and remote services. 

Containers & Visibility

**Dynamic Environments**

There has been a considerable rise in the use of containers. The container wave introduces dynamic environments with cloud-like behavior where you can scale up and down very quickly and easily. We have temporary components. These things are coming up and down inside containers and are part of services.

The paths and transactions are both complex but also shifting. So you have multiple steps or services for an application: A business transaction. It would be best if you strived to have the automatic discovery of business transactions and application topology maps of how the traffic flows.

**Microservices: Network analysis and visibility**

With the wave towards microservices, we get the benefits of scalability and business continuity, but managing is very complex. In addition, what used to be method calls or interprocess calls within the monolith host now go over the network and are susceptible to deviations in latency. 

**The issue of silo-based monitoring**

With all these new waves of microservices and containers, we have an issue in silo monitoring with poor network analysis and visibility in a very distributed environment. Let us look at an example of isolating a problem with traditional network visibility and monitoring.

Example: Slow Checkout

The checkout for mobile or web is slow, and for the application, there could be JVM performance issues. Then, we could have a slow SQL query in the database, and on the network side, we have an interface rate of 80%. So traditional network visibility and monitoring with a silo-based approach have their tools, but something needs to be connected. How do you quickly get to the root cause of this problem?

Product: Cisco AppDynamics

### What is Cisco AppDynamics?

Cisco AppDynamics is a comprehensive application performance management (APM) tool that offers real-time monitoring, analysis, and optimization of your applications. Designed to provide deep insights into application behavior, it helps businesses identify and resolve performance issues before they impact end-users. Whether you’re dealing with complex cloud-native applications or traditional on-premises systems, AppDynamics offers a unified view of your entire application ecosystem.

### Key Features and Benefits

#### Real-Time Monitoring

One of the standout features of Cisco AppDynamics is its ability to provide real-time monitoring of your applications. This means you can continuously track performance metrics, detect anomalies, and receive alerts instantly. This proactive approach enables quick resolution of issues, minimizing downtime and enhancing user satisfaction.

#### Deep Application Insights

AppDynamics goes beyond surface-level metrics, offering deep insights into the inner workings of your applications. It provides detailed transaction traces, code-level diagnostics, and end-user experience monitoring. These insights empower development and operations teams to pinpoint root causes of performance bottlenecks and optimize application performance effectively.

#### Business Performance Correlation

Understanding how application performance impacts business outcomes is crucial. Cisco AppDynamics allows you to correlate application metrics with business performance metrics. This holistic view helps in making data-driven decisions, prioritizing performance improvements that have the most significant impact on business goals.

### Implementation and Integration

#### Easy Deployment

Implementing Cisco AppDynamics is straightforward, with support for a wide range of environments, including cloud, on-premises, and hybrid systems. The platform offers seamless integration with various popular development and operations tools, making it easier to incorporate into your existing workflows.

#### Scalability

As your business grows, so do your application performance monitoring needs. Cisco AppDynamics is designed to scale effortlessly, accommodating increasing volumes of data and complex application architectures. This scalability ensures that you can maintain optimal performance monitoring as your business evolves.

### Use Cases

#### E-Commerce

For e-commerce platforms, ensuring a seamless shopping experience is critical. Cisco AppDynamics helps monitor and optimize website performance, reducing cart abandonment rates and increasing customer satisfaction. By tracking user behavior and transaction flows, AppDynamics provides actionable insights to enhance the online shopping experience.

#### Financial Services

In the financial services sector, where application performance directly impacts customer trust and regulatory compliance, Cisco AppDynamics plays a vital role. It helps monitor transaction processing times, detect anomalies, and ensure that financial applications perform at their best, safeguarding both customer trust and regulatory compliance.

Secure Network Analytics

We need good, secure network analytics for visibility and detection and then to respond best. We have several different types of analytical engines that can be used to detect a threat. In the last few years, we have seen an increase in the talk and drive around analytics and how it can be used in networking and security. Many vendors claim they do both supervised and unsupervised machine learning, all of which are used in the detection phase.

Cisco Secure Network Analytics (Cisco SNA) is a powerful network security and management tool developed by Cisco Systems. It provides a comprehensive solution for monitoring, analyzing, and securing enterprise networks.

Key Features:

1. Network-Wide Monitoring: Cisco SNA enables real-time monitoring of the entire network, including devices, applications, and traffic flows. It provides visibility into network traffic patterns and anomalies, enabling organizations to detect and respond to potential threats quickly.

2. Threat Detection and Response: Cisco SNA uses advanced machine learning algorithms to detect and prioritize potential threats. It continuously monitors the network, analyzing traffic patterns and detecting anomalies that may indicate malicious activities. Once a threat is detected, Cisco SNA provides real-time alerts and actionable remediation steps to mitigate the risk.

3. Network Traffic Analysis: Cisco SNA offers advanced network traffic analysis capabilities. It allows organizations to gain insights into network behavior, identify bandwidth hogs, and optimize network performance. By analyzing network traffic, organizations can identify bottlenecks and bottlenecks, allowing them to make informed decisions about resource allocation and application performance.

4. Security Event Correlation: Cisco SNA integrates threat intelligence from multiple sources, including Cisco Talos threat research group. It correlates security events from across the network, enabling organizations to identify patterns and relationships that may not be apparent when analyzed individually. This helps organizations identify and prioritize threats more effectively.

5. Event and Incident Management: Cisco SNA provides a comprehensive event and incident management solution. It allows organizations to define custom policies and rules to automatically trigger alerts based on specific conditions. Additionally, Cisco SNA provides a user-friendly interface for managing incidents, including tracking investigations, assigning tasks, and coordinating response efforts.

6. Cloud Integration: Cisco SNA integrates with various cloud platforms, such as Amazon Web Services (AWS) and Microsoft Azure, to provide a unified view of network security and operations. This integration enables organizations to leverage the power of the cloud for scalability, performance, and advanced analytics.

7. Analytics and Reporting: Cisco SNA offers robust analytics and reporting capabilities. It provides real-time and historical analytics, allowing users to gain insights into network performance, security incidents, and trends. Organizations can generate customizable reports, graphs, and dashboards, enabling them to make informed decisions based on data-driven insights.

1. Algorithms and statistical models

For analytics, we have algorithms and statistical models. The algorithms and statistical models aim to achieve some outcome and are extremely useful in understanding constantly evolving domains with many variations. By definition, this is precisely what the security domain is.

However, the threat landscape is growing daily, so if you want to find these threats, you need to shift through a lot of data, commonly known as machine data, that we discussed at the start of the post.

For supervised machine learning, we take a piece of Malware and build up a threat profile that can be gleaned from massive amounts of data. When you see a matching behavior profile for that, you can make an alarm. But you need a lot of data to start with.

2. Crypto mining

This can capture very evasive threats such as crypto mining. A cryptocurrency miner is a software that uses your computer resources to mine cryptocurrency. A crypto mining event of the current miner is just a long-lived flow. It would be best if you had additional ways to determine or gather more metrics to understand that this long-lived flow is malicious and is a cryptocurrency miner.

3. Multilayer Machine Learning Model

By their nature, crypto mining and even Tor will escape most security controls. To capture these, you need a multilayer machine learning model of supervised and unsupervised. So, if you are on a standard network that blocks Tor, it will stop 70% of the time; the other 30% of the entry and exit nodes are unknown.

4. Machine Learning (ML)

Supervised and unsupervised machine learning give you the additional visibility to find those unknowns—the unique situations lurking on your networks. So here we are making an observation, and these models will help you understand whether these are not normal. There are different observation triggers.

First, there is known bad behavior, such as security policy violations and communication to known C&C. Then, we have anomaly conditions, which are observed behavior different from usual. We need to make these alerts meaningful to the business.

5. Meaningful alerts

If I.P. addresses 192.168.1.1/24, upload a large amount of data. It should say that the PCI server is uploading a large amount of data to a known malicious external network, and these are the remediation options. The statement or alert needs to mean something to the business.

We need to express the algorithms in the company’s language. This host could have a behavior profile that does not expect it to download or upload anything. 

6. Augment Information

When events leave the system, you can enrich it with data from other systems. You can enhance data inputs with additional telemetry to improve data with other sources that give it more meaning. To help with your alarm, you can add information to the entity. There’s a lot of telemetry in the network. Most devices support NetFlow and IPFIX; you can have Encrypted Traffic Analyses (ETA) and Deep Packet Inspection (DPI).

So you can get loads of valuable insights from these different types of, let’s say, technologies. You can get usernames, device identities, roles, pattern behavior, and locations for additional data sources here. ETA can get a lot of information just by looking at the header without performing decryption. So you can enhance your knowledge of the entity with additional telemetry data. 

Network analysis and visibility with a tiered alarm system

Once an alert is received, you can create actions such as sending a Syslog message, email, SMTP trap, and webhooks. So you have a tiered alarm system with different priorities and severity on alarms. Then, you can enrich or extend the detection with data from other products. It can query other products via their API, such as Cisco Talos.

Instead of presenting all the data, they must give them the data they care about. This will add context to the investigation and help the overworked security analyst who is spending 90 mins on one Phishing email investigation.

Summary: Network Visibility

Network visibility refers to real-time monitoring, analyzing, and visualizing network traffic, data, and activities. It provides a comprehensive view of the entire network ecosystem, including physical and virtual components, devices, applications, and users. By capturing and processing network data, organizations gain valuable insights into network performance bottlenecks, security threats, and operational inefficiencies.

The Benefits of Network Visibility

Enhanced Network Performance: Organizations can proactively identify and resolve performance issues with network visibility. They can optimize network resources, ensure smooth operations, and improve user experience by monitoring network traffic patterns, bandwidth utilization, and latency.

Strengthened Security Posture: Network visibility is a powerful security tool that enables organizations to detect and mitigate potential threats in real-time. By analyzing traffic behavior, identifying anomalies, and correlating events, businesses can respond swiftly to security incidents, safeguarding their digital assets and sensitive data.

Improved Operational Efficiency: Network visibility provides valuable insights into network usage, allowing organizations to optimize resource allocation, plan capacity upgrades, and streamline network configurations. This results in improved operational efficiency, reduced downtime, and cost savings.

Implementing Network Visibility Solutions

Network Monitoring Tools: Deploying robust monitoring tools is essential for achieving comprehensive visibility. These tools collect and analyze network data, generating detailed reports and alerts. Various monitoring techniques, from packet sniffing to flow-based analysis, can suit specific organizational needs.

Traffic Analysis and Visualization: Network visibility solutions often include traffic analysis and visualization capabilities, enabling organizations to gain actionable insights from network data. These visual representations help identify traffic patterns, trends, and potential issues at a glance, simplifying troubleshooting and decision-making processes.

Real-World Use Cases

Network Performance Optimization: A multinational corporation successfully utilizes network visibility to identify bandwidth bottlenecks and optimize network resources. By monitoring traffic patterns, they could reroute traffic and implement Quality of Service (QoS) policies, enhancing network performance and improving user experience.

Security Incident Response: A financial institution leverages network visibility to swiftly detect and respond to cybersecurity threats. By analyzing network traffic in real-time, they identified suspicious activities and potential data breaches, enabling them to take immediate action and mitigate risks effectively.

Conclusion: Network visibility is no longer a luxury but a necessity for businesses operating in today’s digital landscape. It empowers organizations to proactively manage network performance, strengthen security postures, and improve operational efficiency. By implementing robust network visibility solutions and leveraging the insights they provide, businesses can unlock the full potential of their digital infrastructure.

wan monitoring

WAN Monitoring

by Publications

WAN Monitoring

In today's digital landscape, the demand for seamless and reliable network connectivity is paramount. This is where Software-Defined Wide Area Networking (SD-WAN) comes into play. SD-WAN offers enhanced agility, cost savings, and improved application performance. However, to truly leverage the benefits of SD-WAN, effective monitoring is crucial. In this blogpost, we will explore the importance of SD-WAN monitoring and how it empowers businesses to conquer the digital highway.

SD-WAN monitoring involves the continuous observation and analysis of network traffic, performance metrics, and security aspects within an SD-WAN infrastructure. It provides real-time insights into network behavior, enabling proactive troubleshooting, performance optimization, and security management.

WAN monitoring refers to the practice of actively monitoring and managing a wide area network to ensure its smooth operation. It involves collecting data about network traffic, bandwidth utilization, latency, packet loss, and other key performance indicators. By continuously monitoring the network, administrators can identify potential issues, troubleshoot problems, and optimize performance.

a. Proactive Network Management: WAN monitoring enables proactive identification and resolution of network issues before they impact users. By receiving real-time alerts and notifications, administrators can take immediate action to mitigate disruptions and minimize downtime.

b. Enhanced Performance: With WAN monitoring, administrators gain granular visibility into network performance metrics. They can identify bandwidth bottlenecks, optimize routing, and allocate resources efficiently, resulting in improved network performance and user experience.

c. Security and Compliance: WAN monitoring helps detect and prevent security breaches by monitoring traffic patterns and identifying anomalies. It enables the identification of potential threats, such as unauthorized access attempts or data exfiltration. Additionally, it aids in maintaining compliance with industry regulations by monitoring network activity and generating audit logs.

a. Scalability: When selecting a WAN monitoring solution, it is important to consider its scalability. Ensure that the solution can handle the size and complexity of your network infrastructure, accommodating future growth and network expansions.

b. Real-time Monitoring: Look for a solution that provides real-time monitoring capabilities, allowing you to detect issues as they occur. Real-time data and alerts enable prompt troubleshooting and minimize the impact on network performance.

c. Comprehensive Reporting: A robust WAN monitoring solution should offer detailed reports and analytics. These reports provide valuable insights into network performance trends, usage patterns, and potential areas for improvement.

Matt Conran

Highlights: WAN Monitoring

Cloud-based Services

Cloud-based services, such as SaaS applications, are becoming increasingly popular among enterprises, increasing reliance on the Internet to deliver WAN traffic. Because many critical applications and services are no longer internal, traditional MPLS services make suboptimal use of expensive backhaul WAN bandwidth. Consequently, enterprises are migrating to hybrid WANs and SD-WAN technologies that combine traditional MPLS circuits with direct Internet access (DIA).

Over the last several years, a thriving SD-WAN vendor and managed SD-WAN provider market has met this need. As enterprises refresh their branch office routers, SD-WAN solutions, and associated network monitoring capabilities are expected to become nearly ubiquitous.

Key Points: – 

a) Choosing the Right Monitoring Tools: Selecting robust network monitoring tools is crucial for effective WAN monitoring. These tools should provide real-time insights, customizable dashboards, and comprehensive reporting capabilities to track network performance and identify potential issues.

b) Setting Up Performance Baselines: Establishing performance baselines helps organizations identify deviations from normal network behavior. IT teams can quickly identify anomalies and take corrective actions by defining acceptable thresholds for critical metrics, such as latency or packet loss.

c) Implementing Proactive Alerts: Configuring proactive alerts ensures that IT teams are promptly notified of performance issues or abnormalities. These alerts can be set up for specific metrics, such as bandwidth utilization exceeding a certain threshold, allowing IT teams to investigate and resolve issues before they impact users.

WAN Monitoring Metrics

**Overcome: Suboptimal Performance**

With a growing distributed workforce, enterprises are increasingly leveraging cloud-based applications. As evolving business needs have dramatically expanded to include software as a service (SaaS) and the cloud, enterprises are moving to wide area networks (WANs) that are software-defined, Internet-centric, and architected for optimal interconnection with cloud and external services to combat rising transport costs and suboptimal application performance. 

**Gaining: WAN Valuable Insights**

Monitoring a WAN’s performance involves tracking various metrics that provide valuable insights into its health and efficiency. These metrics include latency, packet loss, jitter, bandwidth utilization, and availability. Explore these metrics and understand their importance in maintaining a robust network infrastructure.

1. Latency: Latency refers to the time data travels from the source to the destination. Even minor delays in data transmission can significantly impact application performance, especially for real-time applications like video conferencing or VoIP. We’ll discuss how measuring latency helps identify potential network congestion points and optimize data routing for reduced latency.

2. Packet Loss: Packet loss occurs when data packets fail to reach their intended destination. This can lead to retransmissions, increased latency, and degraded application performance. By monitoring packet loss rates, network administrators can pinpoint underlying issues, such as network congestion or hardware problems, and take proactive measures to mitigate packet loss.

3. Jitter: Jitter refers to the variation in delay between data packets arriving at their destination. High jitter can lead to inconsistent performance, particularly for voice and video applications. We’ll explore how monitoring jitter helps identify network instability and implement quality of service (QoS) mechanisms to ensure smooth data delivery.

4. Bandwidth Utilization: Effective bandwidth utilization is crucial for maintaining optimal network performance. Monitoring bandwidth usage patterns helps identify peak usage times, bandwidth-hungry applications, and potential network bottlenecks. We’ll discuss the significance of bandwidth monitoring and how it enables network administrators to allocate resources efficiently and plan for future scalability.

Example Product: Cisco ThousandEyes

### Introduction to Cisco ThousandEyes

In today’s hyper-connected world, maintaining a reliable, high-performance Wide Area Network (WAN) is crucial for businesses of all sizes. Enter Cisco ThousandEyes, a robust network intelligence platform designed to provide unparalleled visibility into your WAN performance. From detecting outages to diagnosing complex network issues, ThousandEyes is a game-changer in the realm of WAN monitoring.

### Why WAN Monitoring Matters

WAN monitoring is essential for ensuring that your network operates smoothly and efficiently. With the increasing reliance on cloud services, SaaS applications, and remote work environments, any disruption in WAN can result in significant downtime and lost productivity. Cisco ThousandEyes offers a comprehensive solution by continuously monitoring the health of your WAN, identifying potential issues before they escalate, and providing actionable insights to resolve them promptly.

### Key Features of Cisco ThousandEyes

1. **Synthetic Monitoring**: Simulate user interactions to proactively identify potential issues.

2. **Real-Time Data Collection**: Gather real-time metrics on latency, packet loss, and jitter.

3. **Path Visualization**: Visualize the entire network path from end-user to server, identifying bottlenecks.

4. **Alerts and Reporting**: Set up custom alerts and generate detailed reports for proactive management.

5. **Global Agent Coverage**: Deploy agents globally to monitor network performance from various locations.

WAN Monitoring Tools

WAN monitoring tools are software applications or platforms that enable network administrators to monitor, analyze, and troubleshoot their wide area networks.

These tools collect data from various network devices and endpoints, providing valuable insights into network performance, bandwidth utilization, application performance, and security threats. Organizations can proactively address issues and optimize their WAN infrastructure by comprehensively understanding their network’s health and performance.

WAN monitoring tools offer a wide range of features to empower network administrators. These include real-time monitoring and alerts, bandwidth utilization analysis, application performance monitoring, network mapping and visualization, traffic flow analysis, and security monitoring.

With these capabilities, organizations can identify bottlenecks, detect network anomalies, optimize resource allocation, ensure Quality of Service (QoS), and mitigate security risks. Furthermore, many tools provide historical data analysis and reporting, enabling administrators to track network performance trends and make data-driven decisions.

Example Monitoring Technology: Nethogs

IP SLAs ICMP Echo Operation

IP SLAs ICMP Echo Operations, also known as Internet Protocol Service Level Agreements Internet Control Message Protocol Echo Operations, is a feature Cisco devices provide. It allows network administrators to measure network performance by sending ICMP echo requests (ping) between devices, enabling them to gather valuable data about network latency, packet loss, and jitter.

Network administrators can proactively monitor network performance, identify potential bottlenecks, and troubleshoot connectivity issues using IP SLAs ICMP Echo Operations. The key benefits of this feature include:

1. Performance Monitoring: IP SLAs ICMP Echo Operations provides real-time monitoring capabilities, allowing administrators to track network performance metrics such as latency and packet loss.

2. Troubleshooting: With IP SLAs ICMP Echo Operations, administrators can pinpoint network issues and determine whether network devices, configuration, or external factors cause them.

3. SLA Compliance: Organizations relying on Service Level Agreements (SLAs) can leverage IP SLAs ICMP Echo Operations to ensure compliance with performance targets and quickly identify deviations.

Understanding Traceroute

Traceroute, also known as tracert in Windows, is a network diagnostic tool that traces the path packets taken from your device to a destination. It provides valuable insights into the various hops or intermediate devices that data encounters. By sending a series of specially crafted packets, traceroute measures the time it takes for each hop to respond, enabling us to visualize the network path.

  • Time-to-Live (TTL) field in IP packets

Behind the scenes, traceroute utilizes the Time-to-Live (TTL) field in IP packets to gather information about the hops. It starts by sending packets with a TTL of 1, which ensures they are discarded by the first hop encountered. The hop then sends back an ICMP Time Exceeded message, indicating its presence. Traceroute then repeats this process, gradually incrementing the TTL until it reaches the destination and receives an ICMP Echo Reply.

  • Packet’s round-trip time (RTT).

As the traceroute progresses through each hop, it collects IP addresses and measures each packet’s round-trip time (RTT). These valuable pieces of information allow us to map the network path. By correlating IP addresses with geographical locations, we can visualize the journey of our data on a global scale.

  • Capture Network Issues

Traceroute is not only a fascinating tool for exploration but also a powerful troubleshooting aid. We can identify potential bottlenecks, network congestion, or even faulty devices by analyzing the RTT values and the number of hops. This makes traceroute an invaluable resource for network administrators and tech enthusiasts alike.

Understanding ICMP Basics

ICMP, often called the “heart and soul” of network troubleshooting, is an integral part of the Internet Protocol Suite. It operates at the network layer and is responsible for vital functions such as error reporting, network diagnostics, and route change notifications. By understanding the basics of ICMP, we can gain insights into how it contributes to efficient network communication.

ICMP Message Types

ICMP encompasses a wide range of message types that serve different purposes. From ICMP Echo Request (ping) to Destination Unreachable, Time Exceeded, and Redirect messages, each type serves a unique role in network diagnostics and troubleshooting. Exploring these message types and their significance will shed light on the underlying mechanisms of network communication.

**Round-trip time, packet loss, and network congestion**

Network administrators and operators heavily rely on ICMP to monitor network performance. Key metrics such as round-trip time, packet loss, and network congestion can be measured using ICMP tools and techniques. This section will delve into how ICMP aids in network performance monitoring and the benefits it brings to maintaining optimal network operations.

Use Case: At the WAN Edge

**Performance-Based Routing**

Performance-based or dynamic routing is a method of intelligently directing network traffic based on real-time performance metrics. Unlike traditional static routing, which relies on predetermined paths, performance-based routing adapts dynamically to network conditions. By continuously monitoring factors such as latency, packet loss, and bandwidth availability, performance-based routing ensures that data takes the most optimal path to reach its destination.

Key Points: – 

A. Enhanced Network Reliability: By constantly evaluating network performance, performance-based routing can quickly react to failures or congestion, automatically rerouting traffic to alternate paths. This proactive approach minimizes downtime and improves overall network reliability.

B. Improved Application Performance: Performance-based routing can prioritize traffic based on specific application requirements. Critical applications, such as video conferencing or real-time data transfer, can be allocated more bandwidth and given higher priority, ensuring optimal performance and user experience.

C. Efficient Resource Utilization: Performance-based routing optimizes resource utilization across multiple network paths by intelligently distributing network traffic. This results in improved bandwidth utilization, reduced congestion, and a more efficient use of available resources.

D. Performance Metrics and Monitoring: Organizations must deploy network monitoring tools to collect real-time performance metrics to implement performance-based routing. These metrics serve as the foundation for decision-making algorithms that determine the best path for network traffic.

E. Dynamic Path Selection Algorithms: Implementing performance-based routing requires intelligent algorithms capable of analyzing performance metrics and selecting the most optimal path for each data packet. These algorithms consider latency, packet loss, and available bandwidth to make informed routing decisions.

F. Network Infrastructure Considerations: Organizations must ensure their network infrastructure can support the increased complexity before implementing performance-based routing. This may involve upgrading network devices, establishing redundancy, and configuring routing protocols to accommodate dynamic path selection.

Ensuring High Availability and Performance

– Network downtime and performance issues can significantly impact business operations, causing financial losses and damaging reputation. Network monitoring allows organizations to proactively monitor and manage network infrastructure, ensuring high availability and optimal performance.

– Network administrators can identify and address issues promptly by tracking key performance indicators, such as response time and uptime, minimizing downtime, and maximizing productivity.

– As businesses grow and evolve, their network requirements change. Network monitoring provides valuable insights into network capacity utilization, helping organizations plan for future growth and scalability.

– By monitoring network traffic patterns and usage trends, IT teams can identify potential capacity bottlenecks, plan network upgrades, and optimize resource allocation. This proactive approach enables businesses to scale their networks effectively, avoiding performance issues associated with inadequate capacity.

Monitoring TCP

TCP (Transmission Control Protocol) is a fundamental component of Internet communication, ensuring reliable data transmission. Behind the scenes, TCP performance parameters are crucial in optimizing network performance.

TCP Performance Parameters:

TCP performance parameters are configuration settings that govern the behavior of TCP connections. These parameters determine various aspects of the transmission process, including congestion control, window size, timeouts, and more. Network administrators can balance reliability, throughput, and latency by adjusting these parameters.

Congestion Window (CWND): CWND represents the number of unacknowledged packets a sender can transmit before awaiting an acknowledgment. Adjusting CWND can affect the amount of data sent, impacting throughput and congestion control.

Maximum Segment Size (MSS): MSS refers to the maximum amount of data transmitted in a single TCP segment. Optimizing MSS can help reduce overhead and improve overall efficiency.

Window Scaling: Window scaling allows for adjusting the TCP window size beyond its traditional limit of 64KB. Enabling window scaling can enhance throughput, especially in high-bandwidth networks.

Note: To fine-tune TCP performance parameters, network administrators must carefully analyze their network’s requirements and characteristics. Here are some best practices for optimizing TCP performance:

Analyze Network Conditions: Understanding the network environment, including bandwidth, latency, and packet loss, is crucial for selecting appropriate performance parameters.

Conduct Experiments: It’s essential to test different parameter configurations in a controlled environment to determine their impact on network performance. Tools like Wireshark can help monitor and analyze TCP traffic.

Monitor and Adjust: Network conditions are dynamic, so monitoring TCP performance and adjusting parameters accordingly is vital for maintaining optimal performance.

What is TCP MSS?

TCP MSS refers to the maximum amount of data transmitted in a single TCP segment. It represents the payload size within the segment, excluding the TCP header. The MSS value is negotiated during the TCP handshake process, allowing both ends of the connection to agree upon an optimal segment size.

**Amount of data in each segement**

Efficiently managing TCP MSS is crucial for various reasons. Firstly, it impacts network performance by directly influencing the amount of data sent in each segment. Controlling MSS can help mitigate packet fragmentation and reassembly issues, reducing the overall network overhead. Optimizing TCP MSS can also enhance throughput and minimize latency, improving application performance.

**Crucial Factors to consider**

Several factors come into play when determining the appropriate TCP MSS value. Network infrastructure, such as routers and firewalls, may impose limitations on the MSS. Path MTU (Maximum Transmission Unit) discovery also affects TCP MSS, as it determines the maximum packet size that can be transmitted without fragmentation. Understanding these factors is vital for configuring TCP MSS appropriately.

Gaining WAN Visibility

Example Technology: NetFlow

Implementing NetFlow provides numerous advantages for network administrators. Firstly, it enables comprehensive traffic monitoring, helping identify and troubleshoot performance issues, bottlenecks, or abnormal behavior. Secondly, NetFlow offers valuable insights into network security, allowing the detection of potential threats, such as DDoS attacks or unauthorized access attempts. Additionally, NetFlow facilitates capacity planning by providing detailed traffic statistics, which helps optimize network resources and infrastructure.

Implementing NetFlow

Implementing NetFlow requires both hardware and software components. Network devices like routers and switches need to support NetFlow functionality. Configuring NetFlow on these devices involves defining flow record formats, setting sampling rates, and specifying collector destinations. In terms of software, organizations can choose from various NetFlow collectors and analyzers that process and visualize the collected data. These tools offer powerful reporting capabilities and advanced features for network traffic analysis.

NetFlow use cases

NetFlow finds application in various scenarios across different industries. NetFlow data is instrumental in detecting and investigating security incidents, enabling prompt response and mitigation in cybersecurity. Network administrators leverage NetFlow to optimize bandwidth allocation, ensuring efficient usage and fair distribution. Moreover, NetFlow analysis plays a vital role in compliance monitoring, aiding organizations in meeting regulatory requirements and maintaining data integrity.

netflow

Ethernet Switched Port Analyzer:

SPAN, also known as port mirroring, is a feature that enables the network switch to copy traffic from one or more source ports and send it to a destination port. This destination port is typically connected to a packet analyzer or network monitoring tool. By monitoring network traffic in real time, administrators gain valuable insights into network performance, security, and troubleshooting.

Proactive Monitoring:

The implementation of SPAN offers several advantages to network administrators. Firstly, it allows for proactive monitoring, enabling timely identification and resolution of potential network issues. Secondly, SPAN facilitates network troubleshooting by capturing and analyzing traffic patterns, helping to pinpoint the root cause of problems. Additionally, SPAN can be used for security purposes, such as detecting and preventing unauthorized access or malicious activities within the network.

Understanding sFlow:

sFlow is a technology that enables real-time network monitoring by sampling packets at wire speed. It offers a scalable and efficient way to collect comprehensive data about network performance, traffic patterns, and potential security threats. By leveraging the power of sFlow, network administrators gain valuable insights that help optimize network performance and troubleshoot issues proactively.

Implementing sFlow on Cisco NX-OS brings several key advantages. Firstly, it provides granular visibility into network traffic, allowing administrators to identify bandwidth-hungry applications, detect anomalies, and ensure optimal resource allocation. Secondly, sFlow enables real-time network performance monitoring, enabling rapid troubleshooting and minimizing downtime. Additionally, sFlow helps in capacity planning, allowing organizations to scale their networks effectively.

Use Case: Cisco Performance Routing

Understanding Cisco Pfr

Cisco Pfr, also known as Optimized Edge Routing (OER), is an advanced routing technology that automatically selects the best path for network traffic based on real-time performance metrics. It goes beyond traditional routing protocols by considering link latency, jitter, packet loss, and available bandwidth. By dynamically adapting to changing network conditions, Cisco Pfr ensures that traffic is routed through the most optimal path, improving application performance and reducing congestion.

Enhanced Network Performance: Cisco Pfr optimizes traffic flow by intelligently selecting the most efficient path, reducing latency, and improving overall network performance. This leads to enhanced end-user experience and increased productivity.

Resilience and Redundancy: Cisco Pfr ensures high network availability by dynamically adapting to network changes. It automatically reroutes traffic in case of link failures, minimizing downtime and providing seamless connectivity.

Improved Application Performance: By intelligently routing traffic based on application-specific requirements, Cisco Pfr prioritizes critical applications and optimizes their performance. This ensures smooth and reliable application delivery, even in bandwidth-constrained environments.

SD-WAN Monitoring: The Components

WAN Chalenges:

So, within your data center topology, the old approach to the WAN did not scale very well. First, there is cost, complexity, and the length of installation times. The network is built on expensive proprietary equipment that is difficult to manage, and then we have expensive transport costs that lack agility.

1.Configuration Complexity:

Not to mention the complexity of segmentation with complex BGP configurations and tagging mechanisms used to control traffic over the WAN. There are also limitations to forwarding routing protocols. It’s not that they redesigned it severely; it’s just a different solution needed over the WAN.

2.Distributed Control Plane:

There was also a distributed control plane where every node had to be considered and managed. And if you had multi-vendor equipment at the WAN edge, different teams could have managed this in other locations. 

You could look at 8 – 12 weeks as soon as you want to upgrade. With the legacy network, all the change control is with the service provider, which I have found to be a major challenge.

3.Architectural Challenges:

There was also a significant architectural change, where a continuous flow of applications moved to the cloud. Therefore, routing via the primary data center where the security stack was located was not as important. Instead, it was much better to route the application directly into the cloud in the first cloud world. 

WAN Modernization

The initial use case of SD-WAN and other routing control platforms was to increase the use of Internet-based links and reduce the high costs of MPLS. However, when you start deploying SD-WAN, many immediately see the benefits. So, as you deploy SD-WAN, you are getting 5 x 9s with dual internal links, and MPLS at the WAN edge of the network is something you could move away from, especially for remote branches.

Required: Transport Independence 

There was also the need for transport independence and to avoid the long lead times associated with deploying a new MPLS circuit. With SD-WAN, you create SD-WAN overlay tunnels over the top of whatever ISP and mix and match as you see fit.

Required: Constant Performance

With SD-WAN, we now have an SD-WAN controller in a central location. This brings with it a lot of consistency in security and performance. In addition, we have a consistent policy pushed through the network regardless of network locations.

SD-WAN monitoring and performance-based application delivery

SD-WAN is also application-focused; we now have performance-based application delivery and routing. This type of design was possible with traditional WANs but was challenging and complex to manage daily. It’s a better use of capital and business outcomes. So we can use the less expensive connection without dropping any packets. There is no longer leverage in having something as a backup. With SD-WAN, you can find several virtual paths and routes around all failures.

**The ability to route intelligently**

Now, applications can be routed intelligently, and using performance as a key driver can make WAN monitoring more complete. It’s not just about making a decision based on up or down. Now we have the concept of brownouts, maybe high latency or high jitter. That circuit is not down, but the application will route around the issue with intelligent WAN segmentation.

  • Stage1: Application Visibility

For SD-WAN to make the correct provisioning and routing decisions, visibility into application performance is required. Therefore, SD-WAN enforces the right QoS policy based on how an application is tagged. To determine what prioritization they need within QoS policies, you need monitoring tools to deliver insights on various parameters, such as application response times, network saturation, and bandwidth usage. You control the overlay.

  • Stage2: Underlay Visibility

Then it would help if you considered underlay visibility. I have found a gap in visibility between the tunnels riding over the network and the underlying transport network. SD-WAN visibility leans heavily on the virtual overlay. For WAN underlay monitoring, we must consider the network is a hardware-dependent physical network responsible for delivering packets. The underlay network can be the Internet, MPLS, satellite, Ethernet, broadband, or any transport mode. A service provider controls the underlay.

  • Stage3: Security Visibility

Finally, and more importantly, security visibility. Here, we need to cover the underlay and overlay of the SD-WAN network, considering devices, domains, IPs, users, and connections throughout the network. Often, malicious traffic can hide in encrypted packets and appear like normal traffic—for example, crypto mining. The traditional deep packet inspection (DPI) engines have proven to fall short here.

We must look at deep packet dynamics (DPD) and encrypted traffic analysis (ETA). Combined with artificial intelligence (AI), it can fingerprint the metadata of the packet and use behavioral heuristics to see through encrypted traffic for threats without the negative aspects of decryption.

Googles SD-WAN Cloud Hub

SD-WAN Cloud Hub is a cutting-edge networking technology that combines the power of software-defined wide area networking (SD-WAN) and cloud computing. It revolutionizes the way organizations connect and manage their network infrastructure. By leveraging the cloud as a central hub, SD-WAN Cloud Hub enables seamless connectivity between various branch locations, data centers, and cloud environments.

Enhance performance & reliability 

One of the key advantages of SD-WAN Cloud Hub is its ability to enhance network performance and reliability. By intelligently routing traffic through the most optimal path, it minimizes latency, packet loss, and jitter. This ensures smooth and uninterrupted access to critical applications and services.

Centralised visibility & control

Additionally, SD-WAN Cloud Hub offers centralized visibility and control, allowing IT teams to streamline network management and troubleshoot issues effectively.

Troubleshoot brownouts

Detecting brownouts

Traditional monitoring solutions focus on device health and cannot detect complex network service issues like brownouts. Therefore, it is critical to evaluate solutions that are easy to deploy and use to simulate end-user behavior from the suitable locations for the relevant network services.

Required Active Monitoring

Most of the reported brownouts reported causes require active monitoring to detect. Five of the top six reasons brownouts occur can only be seen with active monitoring: congestion, buffer full drops, missing or misconfigured QoS, problematic in-line devices, external network issues, and poor planning or design of Wi-Fi.

Challenge: Troubleshooting Brownouts

Troubleshooting a brownout is difficult, especially when understanding geo policy and tunnel performance. What applications and users are affected, and how do you tie back to the SD-WAN tunnels? Brownouts are different from blackouts as application performance is affected.

SD-WAN Monitoring and Visibility

So, we have clear advantages to introducing SD-WAN; managers and engineers must consider how they operationalize this new technology. Designing and installing is one aspect, but how will SD-WAN be monitored and maintained? Where do visibility and security fit into the picture?

While most SD-WAN solutions provide native network and application performance visibility, this isn’t enough. I would recommend that you supplement native SD-WAN visibility with third-party monitoring tools. SD-WAN vendors are not monitoring or observability experts. So, it is like a networking vendor jumping into the security space.

Encrypted traffic and DPI

Traditionally, we look for anomalies against unencrypted traffic, and you can inspect the payload and use deep packet inspection (DPI). Nowadays, there is more than simple UDP scanning. Still, bad actors appear in encrypted traffic and can mask and hide activity among the usual traffic. This means some DPI vendors are ineffective and can’t see the payloads. Without appropriate visibility, the appliance will send a lot of alerts that are false positives.

**Deep packet inspection technology**

Deep packet inspection technology has been around for decades. It utilizes traffic mirroring to analyze the payload of each packet passing through a mirrored sensor or core device, the traditional approach to network detection and response (NDR). Most modern cyberattacks, including ransomware, lateral movement, and Advanced Persistent Threats (APT), heavily utilize encryption in their attack routines. However, this limitation can create a security gap since DPI was not built to analyze encrypted traffic.

**Legacy Visibility Solution**

So, the legacy visibility solutions only work for unencrypted or clear text protocols such as HTTP. In addition, DPI requires a decryption proxy, or middlebox, to be deployed for encrypted traffic. Middleboxes can be costly, introduce performance bottlenecks, and create additional security concerns.

**Legacy: Unencrypted Traffic**

Previously, security practitioners would apply DPI techniques to unencrypted HTTP traffic to identify critical session details such as browser user agent, presence of a network cookie, or parameters of an HTTP POST. However, as web traffic moves from HTTP to encrypted HTTPS, network defenders are losing visibility into those details.

Good visibility and security posture

We need to leverage your network monitoring infrastructure effectively for better security and application performance monitoring to be more effective, especially in the world of SD-WAN. However, this comes with challenges with collecting and storing standard telemetry and the ability to view encrypted traffic.

The network teams spend a lot of time on security incidents, and sometimes, the security team has to look after network issues. So, both of these teams work together. For example, packet analysis needs to be leveraged by both teams and flow control and other telemetry data need to be analyzed by the two teams.

The role of a common platform:

It’s good that other network and security teams can work off a common platform and standard telemetry. A network monitoring system can plug into your SD-WAN controller to help operationalize your SD-WAN environments. Many application performance problems arise from security issues. So, you need to know your applications and examine encrypted traffic without decrypting.

Network performance monitoring and diagnostics:

We have Flow, SNMP, and API for network performance monitoring and diagnostics. We have encrypted traffic analysis and machine learning (ML) for threat and risk identification for security teams. This will help you reduce complexity and will increase efficiency and emerge. So we have many things, such as secure access service edge (SASE) SD-WAN, and the network and security teams are under pressure to respond better.

Merging of network and security:

The market is moving towards the merging of network and security teams. We see this with cloud, SD-WAN, and also SASE. So, with the cloud, for example, we have a lot of security built into the fabric. With VPC, we have security group policies built into the fabric. SD-WAN, we have end-to-end segmentation commonly based on an overlay technology. That can also be terminal on a virtual private cloud (VPC). Then, SASE is a combination of all.

Enhanced Detection:

We need to improve monitoring, investigation capabilities, and detection. This is where the zero trust architecture and technologies such as single packet authorization can help you monitor and enhance detection with the deduction and response solutions.

In addition, we must look at network logging and encrypted traffic analyses to improve investigation capabilities. Regarding investment, we have traditionally looked at packets and logs but have SNMP, NetFlow, and API. There are a lot of telemetries that can be used for security, viewed initially as performance monitoring. Now, it has been managed as a security and cybersecurity use case.

**The need for a baseline**

You need to understand and baseline the current network for smooth SD-WAN rollouts. Also, when it comes to policy, it is no longer just a primary backup link and a backup design. Now, we have intelligence application profiling. 

Everything is based on performance parameters such as loss, latency, and jitter. So, before you start any of this, you must have good visibility and observability. You need to understand your network and get a baseline for policy creation, and getting the proper visibility is the first step in planning the SD-WAN rollout process.

Network monitoring platform

For traditional networks, they will be SNMP, Flow data, and a lot of multi-vendor equipment. You need to monitor and understand how applications are used across the environment, and not everyone uses the same vendor for everything. For this, you need a network monitoring platform, which can easily be scaled to perform baseline and complete reporting and take into all multi-vendor networks. To deploy SD-WAN, you need a network monitoring platform to collect multiple telemetries, be multi-vendor, and scale. 

Variety of telemetry

Consuming packets, decoding this to IPFIX, and bringing API-based data is critical. So, you need to be able to consume all of this data. Visibility is key when you are rolling out SD-WAN. You first need to baseline to see what is expected. This will let you know if SD-WAN will make a difference and what type of difference it will make at each site. So, with SD-WAN, you can deploy application-aware policies that are site-specific or region-specific, but you first need a baseline to tell you what policies you need at each site.

QoS visibility

With a network monitoring platform, you can get visibility into QoS. This can be done by using advanced flow technologies to see the marking. For example, in the case of VOIP, the traffic should be marked as expedited forwarding (EF). Also, we need to be visible in the queueing, and shaping is also critical. You can assume that the user phones automatically market the traffic as EF.

Still, a misconfiguration at one of the switches in the data path could be remarking this to best efforts. Once you have all this data, you must collect and store it. The monitoring platform must scale, especially for global customers, and collect information for large environments. Flow can be challenging. What if you have 100,000 flow records per second? 

WAN capacity planning

When you have a baseline, you need to understand WAN capacity planning for each service provider. This will allow you to re-evaluate your service provider’s needs. In the long run, this will save costs. In addition, we can use WAN capacity planning to let you know each site is reaching your limit.

WAN capacity planning is not just about reports. Now, we are looking extensively at the data to draw value. Here, we can see the introduction of artificial intelligence for IT operations (AIOps) and machine learning to help predict WAN capacity and future problems. This will give you a long-term prediction when deciding on WAN bandwidth and service provider needs.

Advice: Get to know your sites and POC.

You also need to know the sites. A network monitoring platform will allow you to look at sites and understand bandwidth usage across your service providers, enabling you to identify your critical sites. You will want various sites and a cross-section of other sites on satellite connection or LTE, especially with retail. So, look for varying sites and learn about problematic sites where your users have problems with applications that are good candidates for proof of concept. 

Advice: Decide on Proof of Concept

Your network performance management software will give you visibility into what sites to include in your proof of concept. This platform will tell you what sites are critical and which are problematic in terms of performance and would be a good mix for a proof of concept. When you get inappropriate sites in the mix, you will immediately see the return on investment (ROI) for SD-WAN. So uptime will increase, and you will see this immediately. But for this to be in effect, you first need a baseline.

Identity your applications: Everything is port 80

So, we have latency, jitter, and loss. Understanding when loss happens is apparent. However, with specific applications, with 1 – 5 % packet loss, there may not be a failover, which can negatively affect the applications. Also, many don’t know what applications are running. What about people connecting to the VPN with no split tunnel and then streaming movies?  We have IP and ports to identity applications running on your network, but everything is port 80 now. So, you need to be able to consume different types of telemetry from the network to understand your applications fully.

The issues with deep packet inspection

So, what about the homegrown applications that a DPI engine might not know about? Many DPI vendors will have trouble identifying these. It would help if you had the network monitoring platform to categorize and identify applications based on several parameters that DPI can’t. A DPI engine can classify many applications but can’t do everything. A network monitoring platform can create a custom application, let’s say, based on an IP address, port number, URL, and URI.  

Requirements: Network monitoring platform

Know application routing

The network monitoring platform needs to know the application policy and routing. It needs to know when there are error threshold events as applications are routed based on intelligence policy. Once the policy is understood, you must see how the overlay application is routed. With SD-WAN, we have per segment per topology to do this based on VRF or service VPN. We can have full mesh or regions with hub and spoke. Per segment, topology verification is also needed to know that things are running correctly. To understand the application policy, what the traffic looks like, and to be able to verify brownouts. 

SD-WAN multi-vendor

Due to mergers or acquisitions, you may have an environment with multiple vendors for SD-WAN. Each vendor has its secret source, too. The network monitoring platform needs to bridge the gap and monitor both sides. There may even be different business units. So, how do you leverage common infrastructure to achieve this? We first need to leverage telemetry for monitoring and analysts. This is important as if you are putting in info packet analysis; this should be leveraged by both security and network teams, reducing tool sprawl.

Overcome the common telemetry challenges.

Trying standard telemetry does come with its challenge, and every type of telemetry has its one type of challenge. Firstly, Big Data: This is a lot of volume in terms of storage size—the speed and planning of where you will do all the packet analysis. Next, we have the collection and performance side of things. How do we collect all of this data? From a Flow perspective, you can get flow from different devices. So, how do you collect from all the edge devices and then bring them into a central location?

Finally, we have cost and complexity challenges. You may have different products for different solutions. We have an NPM for network performance monitoring, an NDR, and packet captures. Other products work on the same telemetry. Some often start with packet capture and move to an NPM or NDR solution.

A final note on encrypted traffic

**SD-WAN encryption**

With SD-WAN, everything is encrypted across public transport. So, most SD-WAN vendors can meter traffic on the LAN side before it enters the SD-WAN tunnels, but many applications are encrypted end to end. You even need to identify keystrokes through encrypted sessions. How can you get fully encrypted visibility? By 2025, all traffic will be encrypted. Here, we can use a network monitoring platform to identify and analyze threats among encrypted traffic.

**Deep packet dynamics**

So, you should be able to track and classify with what’s known as deep packet dynamic, which could include, for example, byte distributions, sequence of packets, time, jitter, RTT, and interflow stats. Now, we can push this into machine learning to identify applications and any anomalies associated with encryption. This can identify threats in encrypted traffic without decrypting the traffic.

**Improving Visibility**

Deep packet dynamics improve encrypted traffic visibility while remaining scalable and causing no impediment to latency or violation of privacy. Now, we have a malware detection method and cryptographic assessment of secured network sessions that does not rely on decryption.

This can be done without having the keys or decrypting the traffic. Managing the session key for decryption is complex and can be costly computationally. It is also often incomplete. They often only support session key forwarding on Windows or Linux or not on MacOS, never mind the world of IoT.

**Encrypted traffic analytics**

Cisco’s Encrypted Traffic Analytics (ETA) uses the software Stealthwatch to compare the metadata of benign and malicious network packets to identify malicious traffic, even if it’s encrypted. This provides insight into threats in encrypted traffic without decryption. In addition, recent work on Cisco’s TLS fingerprinting can provide fine-grained details about the enterprise network’s applications, operating systems, and processes.

The issue with packet analysis is that everything is encrypted, especially with TLS1.3. The monitoring of the traffic and the WAN edge is encrypted. How do you encrypt all of this, and how do you store all of this? How do you encrypt traffic analysis? Decrypting traffic can create an exploit and potential attack surface, and you also don’t want to decrypt everything.

Summary: WAN Monitoring

In today’s digital landscape, businesses heavily rely on their networks to ensure seamless connectivity and efficient data transfer. As organizations increasingly adopt Software-Defined Wide Area Networking (SD-WAN) solutions, the need for robust monitoring becomes paramount. This blog post delved into SD-WAN monitoring, its significance, and how it empowers businesses to optimize their network performance.

 Understanding SD-WAN

SD-WAN, short for Software-Defined Wide Area Networking, revolutionizes traditional networking by leveraging software-defined techniques to simplify management, enhance agility, and streamline connectivity across geographically dispersed locations. By abstracting network control from the underlying hardware, SD-WAN enables organizations to optimize bandwidth utilization, reduce costs, and improve application performance.

The Role of Monitoring in SD-WAN

Effective monitoring plays a pivotal role in ensuring the smooth operation of SD-WAN deployments. It provides real-time visibility into network performance, application traffic, and security threats. Monitoring tools enable IT teams to proactively identify bottlenecks, latency issues, or network disruptions, allowing them to address these challenges and maintain optimal network performance swiftly.

 Key Benefits of SD-WAN Monitoring

Enhanced Network Performance: SD-WAN monitoring empowers organizations to monitor and analyze network traffic, identify performance bottlenecks, and optimize bandwidth allocation. This leads to improved application performance and enhanced end-user experience.

Increased Security: With SD-WAN monitoring, IT teams can monitor network traffic for potential security threats, detect anomalies, and quickly respond to attacks or breaches. Monitoring helps ensure compliance with security policies and provides valuable insights for maintaining a robust security posture.

Proactive Issue Resolution: Real-time monitoring allows IT teams to identify and resolve issues before they escalate proactively. Organizations can minimize downtime, optimize resource allocation, and ensure business continuity by leveraging comprehensive visibility into network performance and traffic patterns.

Best Practices for SD-WAN Monitoring

Choosing the Right Monitoring Solution: Select a monitoring solution that aligns with your organization’s specific needs, supports SD-WAN protocols, and provides comprehensive visibility into network traffic and performance metrics.

Monitoring Key Performance Indicators (KPIs): Define relevant KPIs such as latency, packet loss, jitter, and bandwidth utilization to track network performance effectively. Regularly monitor these KPIs to identify trends, anomalies, and areas for improvement.

4.3 Integration with Network Management Systems: Integrate SD-WAN monitoring tools with existing network management systems and IT infrastructure to streamline operations, centralize monitoring, and enable a holistic network view.

Conclusion:

SD-WAN monitoring is a critical component of successful SD-WAN deployments. By providing real-time visibility, enhanced network performance, increased security, and proactive issue resolution, monitoring tools empower organizations to maximize the benefits of SD-WAN technology. As businesses continue to embrace SD-WAN solutions, investing in robust monitoring capabilities will be essential to ensuring optimal network performance and driving digital transformation.

security

Implementing Network Security

by Publications

Implementing Network Security

In today's interconnected world, where technology reigns supreme, the need for robust network security measures has become paramount. This blog post aims to provide a detailed and engaging guide to implementing network security. By following these steps and best practices, individuals and organizations can fortify their digital infrastructure against potential threats and protect sensitive information.

Network security is the practice of protecting networks and their infrastructure from unauthorized access, misuse, or disruption. It encompasses various technologies, policies, and practices aimed at ensuring the confidentiality, integrity, and availability of data. By employing robust network security measures, organizations can safeguard their digital assets against cyber threats.

Network security encompasses a range of measures designed to protect computer networks from unauthorized access, data breaches, and other malicious activities. It involves both hardware and software components, as well as proactive policies and procedures aimed at mitigating risks. By understanding the fundamental principles of network security, organizations can lay the foundation for a robust and resilient security infrastructure.

Before implementing network security measures, it is crucial to conduct a comprehensive assessment of potential risks and vulnerabilities. This involves identifying potential entry points, evaluating existing security measures, and analyzing the potential impact of security breaches. By conducting a thorough risk assessment, organizations can develop an effective security strategy tailored to their specific needs.

- Implementing Strong Access Controls: One of the fundamental aspects of network security is controlling access to sensitive information and resources. This includes implementing strong authentication mechanisms, such as multi-factor authentication, and enforcing strict access control policies. By ensuring that only authorized individuals have access to critical systems and data, organizations can significantly reduce the risk of unauthorized breaches.

- Deploying Firewalls and Intrusion Detection Systems: Firewalls and intrusion detection systems (IDS) are essential components of network security. Firewalls act as a barrier between internal and external networks, monitoring and filtering incoming and outgoing traffic. IDS, on the other hand, analyze network traffic for suspicious activities or patterns that may indicate a potential breach. By deploying these technologies, organizations can detect and prevent unauthorized access attempts.

- Regular Updates and Patches: Network security is an ongoing process that requires constant attention and maintenance. Regular updates and patches play a crucial role in addressing vulnerabilities and fixing known security flaws. It is essential to keep all network devices, software, and firmware up to date to ensure optimal protection against emerging threats.

Matt Conran

Highlights: Implementing Network Security

Understanding Network Security

Network security refers to the practices and measures used to prevent unauthorized access, misuse, modification, or denial of computer networks and their resources. It involves implementing various protocols, technologies, and best practices to ensure data confidentiality, integrity, and availability. By understanding network security fundamentals, individuals and organizations can make informed decisions to protect their networks.

Key Points: 

A) Computer Technology is changing: Computer networking technology is evolving and improving faster than ever before. Most organizations and individuals now have access to wireless connectivity. However, malicious hackers increasingly use every means to steal identities, intellectual property, and money.

B) Internal and External Threats: Many organizations spend little time, money, or effort protecting their assets during the initial network installation. Both internal and external threats can cause a catastrophic system failure or compromise. Depending on the severity of the security breach, a company may even be forced to close its doors. Business and individual productivity would be severely hindered without network security.

C) The Role of Trust: Trust must be established for a network to be secure. An organization’s employees assume all computers and network devices are trustworthy. However, it is essential to note that not all trusts are created equal. Different layers of trust can (and should) be used.

D) Privileges and permissions: Privileges and permissions are granted to those with a higher trust level. Privileges allow an individual to access an asset on a network, while permissions authorize an individual to access an asset. Violations of trust are dealt with by removing the violator’s access to the secure environment. For example, an organization may terminate an untrustworthy employee or replace a defective operating system.

**Networking is Complex**

Our challenge is that the network is complex and constantly changing. We have seen this with WAN monitoring and the issues that can arise from routing convergence. This may not come as a hardware refresh, but it constantly changes from a network software perspective and needs to remain dynamic. If you don’t have complete visibility while the network changes, this will result in different security blind spots.

**Security Tools**

Existing security tools are in place, but better security needs to be integrated. Here, we can look for the network and provide that additional integration point. In this case, we can use a network packet broker to sit in the middle and feed all the security tools with data that has already been transformed or, let’s say, optimized for that particular security device it is sending back to, reducing false positives.

**Port Scanning**

When interacting with target systems for the first time, it is expected to perform a port scan. A port scan is a way of identifying open ports on the target network. Port scans aren’t just conducted for the sake of conducting them. They allow you to identify applications and services by listening to ports. Identifying security issues on your target network is always the objective so your client or employer can improve their security posture. To identify vulnerabilities, we need to identify the applications.

**Follow a framework**

A business needs to follow a methodology that provides additional guidance. Adopting a framework could help solve this problem. Companies can identify phases to consider implementing security controls using NIST’s Cybersecurity Framework. According to NIST, the phases are identifying, protecting, detecting, responding, and recovering. The NIST Cybersecurity Framework is built around these five functions.

Improving Network Security

Network Monitoring & Scanning

Network monitoring involves continuously surveilling and analyzing network activities, including traffic, devices, and applications. It provides real-time visibility into network performance metrics, such as bandwidth utilization, latency, and packet loss. By monitoring these key indicators, IT teams can identify potential bottlenecks, troubleshoot issues promptly, and optimize network resources.

Identifying and mitigating security threats

Network monitoring plays a crucial role in identifying and mitigating security threats. With cyberattacks becoming increasingly sophisticated, organizations must be vigilant in detecting suspicious activities. Network administrators can quickly identify potential security breaches, malicious software, or unauthorized access attempts by monitoring network traffic and utilizing intrusion detection systems. This proactive approach helps strengthen network security and prevent potential data breaches.

Understanding Network Scanning

Network scanning is the proactive process of discovering and assessing network devices, systems, and vulnerabilities. It systematically examines the network to identify potential security weaknesses, misconfigurations, or unauthorized access points. By comprehensively scanning the network, organizations can identify and mitigate potential risks before malicious actors exploit them.

Network Scanning Methods

Several methods are employed in network scanning, each serving a specific purpose. Port scanning, for instance, focuses on identifying open ports and services running on targeted systems.

On the other hand, vulnerability scanning aims to detect known vulnerabilities within network devices and applications. Additionally, network mapping provides a topological overview of the network, enabling administrators to identify potential entry points for intruders.

Identifying Networks

To troubleshoot the network effectively, you can use a range of tools. Some are built into the operating system, while others must be downloaded and run. Depending on your experience, you may choose a top-down or a bottom-up approach.

**Common Network Security Components**

Firewalling: Firewalls are a crucial barrier between an internal network and the external world. They monitor and control incoming and outgoing network traffic based on predetermined security rules. By analyzing packet data, firewalls can identify and block potential threats, such as malicious software or unauthorized access attempts. Implementing a robust firewall solution is essential to fortify network security.

The UFW firewall, built upon the foundation of iptables, is a user-friendly frontend interface that simplifies the management of firewall rules. It provides an efficient way to control incoming and outgoing traffic, enhancing the security of your network. By understanding the key concepts and principles behind UFW, you can harness its capabilities to safeguard your data.

Implementing a UFW firewall brings a myriad of benefits to your network. Firstly, it is a barrier to preventing unauthorized access to your system. It filters network traffic based on predefined rules, allowing only the necessary connections. Secondly, UFW will enable you to define specific rules for different applications, granting you granular control over network access. Additionally, UFW helps mitigate common network attacks like DDoS and port scanning, enhancing overall security posture.

Intrusion Detection Systems (IDS): Intrusion Detection Systems (IDS) play a proactive role in network security. They continuously monitor network traffic, analyzing it for suspicious activities and potential security breaches. IDS can detect patterns and signatures of known attacks and identify anomalies that may indicate new or sophisticated threats. By alerting network administrators in real time, IDS helps mitigate risks and enable swift response to potential security incidents.

Example: Sensitive Data Protection

Sensitive data protection

Example Technology: Suricata – Traffic Inspection

Virtual Private Networks (VPNs): In an era of prevalent remote work and virtual collaboration, Virtual Private Networks (VPNs) have emerged as a vital component of network security. VPNs establish secure and encrypted connections between remote users and corporate networks, ensuring the confidentiality and integrity of data transmitted over public networks. By creating a secure “tunnel,” VPNs protect sensitive information from eavesdropping and unauthorized interception, offering a safe digital environment.

Authentication Mechanisms: Authentication mechanisms are the bedrock of network security, verifying the identities of users and devices seeking access to a network. From traditional password-based authentication to multi-factor authentication and biometric systems, these mechanisms ensure that only authorized individuals or devices gain entry. Robust authentication protocols significantly reduce the risk of unauthorized access and protect against identity theft or data breaches.

Encryption: Encryption plays a crucial role in maintaining the confidentiality of sensitive data. By converting plaintext into an unreadable format using complex algorithms, encryption ensures that the information remains indecipherable to unauthorized parties even if intercepted. Whether it’s encrypting data at rest or in transit, robust encryption techniques are vital to protecting the privacy and integrity of sensitive information.

IPv4 and IPv6 Network Security

IPv4 Network Security:

IPv4, the fourth version of the Internet Protocol, has been the backbone of the Internet for several decades. However, its limited address space and security vulnerabilities have prompted the need for a transition to IPv6. IPv4 faces various security challenges, such as IP spoofing, distributed denial-of-service (DDoS) attacks, and address exhaustion.

IPv4 – Lack of built-in encryption:

Issues like insufficient address space and lack of built-in encryption mechanisms make IPv4 networks more susceptible to security breaches. To enhance IPv4 network security, organizations should implement measures like network segmentation, firewall configurations, intrusion detection systems (IDS), and regular security audits. Staying updated with security patches and protocols like HTTPS can mitigate potential risks.

Example: IPv4 Standard Access Lists

Standard access lists are a type of access control mechanism used in Cisco routers. They evaluate packets’ source IP addresses to determine whether they should be allowed or denied access to a network. Unlike extended access lists, standard access lists only consider the source IP address, making them more straightforward and efficient for basic filtering needs.

**Create a Standard ACL**

To create a standard access list, define the access list number and specify the permit or deny statements. The access list number can range from 1 to 99 or 1300 to 1999. Each entry in the access list consists of a permit or deny keyword followed by the source IP address or wildcard mask. By carefully crafting the access list statements, you can control which traffic is allowed or denied access to your network.

**Apply to an Interface**

Once you have created your standard access list, apply it to an interface on your router. This can be done using the “access-group” command followed by the access list number and the direction (inbound or outbound). By applying the access list to an interface, you ensure that the defined filtering rules are enforced on the traffic passing through that interface.

**ACL Best Practices** 

To maximize standard access lists, follow some best practices. First, always place the most specific access list entries at the top, as they are evaluated in order. Second, regularly review and update your access lists to reflect any changes in your network environment. Lastly, consider using named access lists instead of numbered ones for better readability and ease of management.

IPv6 Network Security

IPv6, the latest version of the Internet Protocol, offers significant improvements over its predecessor. Its expanded address space, improved security features, and built-in encryption make it a more secure choice for networking.

IPv6 incorporates IPsec (Internet Protocol Security), which provides integrity, confidentiality, and authentication for data packets. With IPsec, end-to-end encryption and secure communication become more accessible, enhancing overall network security.

IPv6 simplifies IP address assignment and reduces the risk of misconfiguration. This feature and temporary addresses improve network security by making it harder for attackers to track devices.

Understanding Router Advertisement (RA)

Router Advertisement (RA) is a critical mechanism in IPv6 networks that allows routers to inform neighboring devices about their presence and various network parameters. RAs contain invaluable information, such as the router’s IPv6 address, network prefix, and, most importantly, the default gateway information.

Router Advertisement Preference

Router Advertisement Preference is crucial in determining the default gateway selection process for devices in an IPv6 network. By assigning preference values to RAs, network administrators can influence router prioritization, ultimately shaping the network’s behavior and performance.

Configuring RA Preference

Configuring Router Advertisement Preference involves assigning specific preference values to routers within the network. This can be achieved through various methods, including manual configuration or routing protocols such as OSPFv3 or RIPng. Network administrators can fine-tune the preference values based on factors like router capacity, reliability, or location.

IPv6 Router Advertisement (RA) Guard

IPv6 Router Advertisement (RA) is a vital component of IPv6 networks, allowing routers to inform neighboring devices about network configurations. However, RA messages can be manipulated or forged, posing potential security risks. This is where the IPv6 RA Guard comes into play.

RA operates at Layer 2

IPv6 RA Guard is a security feature that safeguards network devices against unauthorized or malicious RAs. It operates at layer 2 of the network, specifically at the access layer, to protect against potential threats introduced through unauthorized routers or rogue devices.

Inspecting & Filtering

IPv6 RA Guard functions by inspecting and filtering incoming RA messages, verifying their legitimacy, and allowing only authorized RAs to reach the intended devices. It uses various techniques, such as Neighbor Discovery Inspection (NDI) and Secure Neighbor Discovery (SEND), to validate the authenticity and integrity of RAs.

IPv6 Neighbor Discovery

Understanding IPv6 Neighbor Discovery Protocol

The Neighbor Discovery Protocol (NDP) is a fundamental part of the IPv6 protocol suite. It replaces the Address Resolution Protocol (ARP) used in IPv4 networks. NDP plays a crucial role in various aspects of IPv6 networking, including address autoconfiguration, neighbor discovery, duplicate address detection, and router discovery. Network administrators can optimize their IPv6 deployments by understanding how NDP functions and ensuring smooth communication between devices.

**Address Auto-configuration**

One of NDP’s key features is its ability to facilitate address autoconfiguration. With IPv6, devices can generate unique addresses based on specific parameters, eliminating the need for manual configuration or reliance on DHCP servers. NDP’s Address Autoconfiguration process enables devices to obtain their global and link-local IPv6 addresses, simplifying network management and reducing administrative overhead.

**Neighbor Discovery**

Neighbor Discovery is another vital aspect of NDP. It allows devices to discover and maintain information about neighboring nodes on the same network segment. Through Neighbor Solicitation and Neighbor Advertisement messages, devices can determine the link-layer addresses of neighboring devices, verify their reachability, and update their neighbor cache accordingly. This dynamic process ensures efficient routing and enhances network resilience.

**Duplicate Address Detection (DAD)**

IPv6 NDP incorporates Duplicate Address Detection (DAD) to prevent address conflicts. When a device joins a network or configures a new address, it performs DAD to ensure the uniqueness of the chosen address. By broadcasting Neighbor Solicitation messages with the tentative address, the device can detect if any other device on the network is already using the same address. DAD is an essential mechanism that guarantees the integrity of IPv6 addressing and minimizes the likelihood of address conflicts.

IPv6 & Multicast Communication

Multicast communication plays a vital role in IPv6 networks, enabling efficient data transmission to multiple recipients simultaneously. Unlike unicast communication, where data is sent to a specific destination address, multicast uses a group address to reach a set of interested receivers. This approach minimizes network traffic and optimizes resource utilization.

–The Role of Solicited Node Multicast Address–

The IPv6 Solicited Node Multicast Address is a specialized multicast address primarily used in IPv6 networks. It is crucial in enabling efficient neighbor discovery and address resolution processes. When a node joins an IPv6 network, it sends a Neighbor Solicitation message to the solicited node multicast address corresponding to its IPv6 address. This allows neighboring nodes to quickly respond with Neighbor Advertisement messages, establishing a communication link.

The construction of a IPv6 Solicited Node Multicast Address involves a specific pattern. It is formed by taking the prefix FF02:0:0:0:0:1:FF00/104 and appending the last 24 bits of the unicast address of the node being resolved. This process ensures that the unique solicited-node multicast address only reaches the intended recipients.

–Benefits: IPv6 Solicited Note Multicast Address—

Using IPv6 Solicited Node Multicast Address brings several benefits to IPv6 networks. Firstly, it significantly reduces the volume of network traffic by limiting the scope of Neighbor Solicitation messages to interested nodes. This helps conserve network resources and improves overall network performance. Additionally, the rapid and efficient neighbor discovery enabled by solicited-node multicast addresses enhances the responsiveness and reliability of communication in IPv6 networks.

IPv6 Network Address Translation 

Understanding NPTv6

NPTv6, an evolution of NAT64, is an IPv6 transition technology that facilitates communication between IPv6-only and IPv4-only networks. It allows for seamless connectivity by translating IPv6 prefixes to IPv4 addresses, enabling efficient communication across different network types. NPTv6 bridges the gap between IPv6 and IPv4 by providing this translation mechanism, facilitating the transition to the next-generation internet protocol.

Benefits: NPTv6

NPTv6 offers several notable features that make it a compelling choice for network architects and administrators. Firstly, it provides transparent communication between IPv6 and IPv4 networks, ensuring compatibility and interoperability.

Additionally, NPTv6 supports stateful and stateless translation modes, providing flexibility for various deployment scenarios. Its ability to handle large-scale address translation efficiently makes it suitable for environments with extensive IPv6 adoption.

**Eliminate Dual Stack Deployments**

The adoption of NPTv6 brings forth numerous benefits and implications for network infrastructure. Firstly, it simplifies the transition process by eliminating the need for dual-stack configurations, reducing complexity and potential security vulnerabilities.

NPTv6 also promotes IPv6 adoption by enabling communication with legacy IPv4 networks, facilitating a gradual migration strategy. Moreover, NPTv6 can alleviate the strain on IPv4 address exhaustion, extending the lifespan of existing IPv4 infrastructure.

Example Technology: NAT64

Understanding NAT64

NAT64 is a translator between IPv6 and IPv4, allowing devices using different protocols to communicate effectively. With the depletion of IPv4 addresses, the transition to IPv6 becomes crucial, and NAT64 plays a vital role in enabling this transition. By facilitating communication between IPv6-only and IPv4-only devices, NAT64 ensures smooth connectivity in a mixed network environment.

Mapping IPv6 to IPv4 addresses

NAT64 operates by mapping IPv6 to IPv4 addresses, allowing seamless communication between the two protocols. It employs various techniques, such as stateful and stateless translation, to ensure efficient packet routing between IPv6 and IPv4 networks. NAT64 enables devices to communicate across different network types by dynamically translating addresses and managing traffic flow.

NAT64 offers several advantages, including preserving IPv4 investments, simplified network management, and enhanced connectivity. It eliminates the need for costly dual-stack deployment and facilitates the coexistence of IPv4 and IPv6 networks. However, NAT64 also poses challenges, such as potential performance limitations, compatibility issues, and the need for careful configuration to ensure optimal results.

NAT64 Use Cases:

NAT64 finds applications in various scenarios, including service providers transitioning to IPv6, organizations with mixed networks, and mobile networks facing IPv4 address scarcity. It enables these entities to maintain connectivity and seamlessly bridge network protocol gaps. NAT64’s versatility and compatibility make it a valuable tool in today’s evolving network landscape.

IPv4 to IPv6 Transition

Security Considerations

Dual Stack Deployment: While transitioning from IPv4 to IPv6, organizations often deploy dual-stack networks, supporting both protocols simultaneously. However, this introduces additional security considerations, as vulnerabilities in either protocol can impact the overall network security.

Transition Mechanism Security: Various transition mechanisms, such as tunneling and translation, facilitate communication between IPv4 and IPv6 networks. Ensuring the security of these mechanisms is crucial, as they can introduce potential vulnerabilities and become targets for attackers.

Example: IPv6 Access Lists

IPv6, the next-generation Internet Protocol, brings new features and enhancements. One critical aspect of IPv6 is the access list, which allows network administrators to filter and control traffic based on various criteria. Unlike IPv4 access lists, IPv6 access lists offer a more robust and flexible approach to network security.

One of the primary purposes of IPv6 access lists is to filter traffic based on specific conditions. IPv6 has various filtering techniques, including source and destination IP address, protocol, and port-based filtering. Also, prefix lists to enhance traffic filtering capabilities.

Securing Tunnels: IPSec in IPv6 over IPv4 GRE

IPv6 over IPv4 GRE (Generic Routing Encapsulation) is a tunneling protocol that allows the transmission of IPv6 packets over an existing IPv4 network infrastructure. It encapsulates IPv6 packets within IPv4 packets, enabling seamless communication between networks that have not yet fully adopted IPv6.

IPsec: IPSec (Internet Protocol Security) ensures the confidentiality, integrity, and authenticity of the data transmitted over the IPv6 over the IPv4 GRE tunnel. IPSec safeguards the tunnel against malicious activities and unauthorized access by providing robust encryption and authentication mechanisms.

1. Enhanced Security: With IPSec’s encryption and authentication capabilities, IPv6 over IPv4 GRE with IPSec offers a high level of security for data transmission. This is particularly important in scenarios where sensitive information is being exchanged.

2.Seamless Transition: IPv6 over IPv4 GRE allows organizations to adopt IPv6 gradually without disrupting their existing IPv4 infrastructure. This smooth transition path ensures minimal downtime and compatibility issues.

3. Expanded Address Space: IPv6 provides a significantly larger address space than IPv4, addressing the growing demand for unique IP addresses. By leveraging IPv6 over IPv4 GRE, organizations can tap into this expanded address pool while still utilizing their existing IPv4 infrastructure.

Improving Network Security

Appropriate network visibility is critical to understanding network performance and implementing network security components. Much of the technology used in network performance, such as Netflow, is security-focused. The landscape is challenging; workloads move to the cloud without monitoring or any security plan. We need to find a solution to have visibility over these clouds and on-premise applications without refuting the entire tracking and security stack.

Understanding NetFlow

NetFlow is a network protocol developed by Cisco Systems that provides valuable insights into network traffic. By collecting and analyzing flow data, NetFlow enables organizations to understand their network’s behavior, identify anomalies, and detect potential security threats.

A) Identifying Suspicious Traffic Patterns: NetFlow allows security teams to monitor traffic patterns and identify deviations from the norm. NetFlow can highlight suspicious activities that may indicate a security breach or an ongoing cyberattack by analyzing data such as source and destination IPs, ports, and protocols.

B) Real-time Threat Detection: NetFlow empowers security teams to detect threats as they unfold by capturing and analyzing data in real time. By leveraging NetFlow-enabled security solutions, organizations can receive immediate alerts and proactively mitigate potential risks.

C) Forensic Analysis and Incident Response: NetFlow data is valuable for forensic analysis and incident response. NetFlow records can reconstruct network activity, identify the root cause, and enhance incident response efforts in a security incident.

D) Configuring NetFlow on Network Devices: To harness NetFlow’s power, network devices must be configured appropriately to export flow data. This involves enabling NetFlow on routers, switches, or dedicated NetFlow collectors and defining the desired flow parameters.

E) Choosing the Right NetFlow Analyzer: Organizations must invest in a robust NetFlow analyzer tool to effectively analyze and interpret NetFlow data. The ideal analyzer should offer comprehensive visualization, reporting capabilities, and advanced security features to maximize its potential.

netflow

Understanding SPAN

Understanding the fundamental concepts of SPAN is the foundation of practical network analysis.

Knowing how to configure SPAN on Cisco NX-OS is crucial for harnessing its power. This section will provide a step-by-step guide on setting up SPAN sessions, selecting source ports, and defining destination ports. SPAN has many advanced configuration options that allow you to customize SPAN according to specific monitoring requirements.

Once SPAN is configured, the next step is effectively analyzing the captured data. SPAN has various tools and techniques for analyzing SPAN traffic. From packet analyzers to flow analysis tools, along with different approaches to gaining valuable insights from the captured network data.

Understanding sFlow

sFlow is a technology that enables network administrators to gain real-time visibility into their network traffic. It provides a scalable and efficient solution for monitoring and analyzing network flows. With sFlow, network administrators can capture and analyze packet-level data without introducing significant overhead.

Cisco NX-OS, the operating system used in Cisco Nexus switches, offers robust support for sFlow. It allows network administrators to configure sFlow on their switches, enabling them to collect and analyze flow data from the network. Integrating sFlow with Cisco NX-OS provides enhanced visibility and control over the network infrastructure.

Data Center Network Security:

What are MAC ACLs?

MAC ACLs, or Media Access Control Access Control Lists, are essential to network security. Unlike traditional IP-based ACLs, MAC ACLs operate at the data link layer, allowing for granular control over traffic within a local network. By filtering traffic based on MAC addresses, MAC ACLs provide an additional layer of defense against unauthorized access and ensure secure communication within the network.

MAC ACL Implementation

Implementing MAC ACLs offers several critical benefits for network security. Firstly, MAC ACLs enable administrators to control access to specific network resources based on MAC addresses, preventing unauthorized devices from connecting to the network.

Additionally, MAC ACLs can segment network traffic, creating isolated zones for enhanced security and improved network performance. By reducing unnecessary traffic, MAC ACLs also contribute to optimizing network bandwidth.

Understanding VLAN ACLs

VLAN ACLs provide a granular level of control over traffic within VLANs. By applying access control rules, network administrators can regulate which packets are allowed or denied based on various criteria, such as source/destination IP addresses, protocols, and port numbers.

Proper configuration is key to effectively utilizing VLAN ACLs. This section will walk you through the step-by-step process of configuring VLAN ACLs on Cisco NX-OS devices.

Google Cloud Network Security: FortiGate

Understanding FortiGate

FortiGate is a comprehensive network security platform developed by Fortinet. It offers a wide range of security services, including firewall, VPN, intrusion prevention, and more. With its advanced threat intelligence capabilities, FortiGate provides robust protection against various cyber threats.

FortiGate seamlessly integrates with Google Compute Engine, allowing you to extend your security measures to the cloud. By deploying FortiGate instances within your Google Compute Engine environment, you can create a secure perimeter around your resources and control traffic flow to and from your virtual machines.

Threat Detection & Prevention

One of the key advantages of using FortiGate with Google Compute resources is its advanced threat detection and prevention capabilities. FortiGate leverages machine learning and artificial intelligence to identify and mitigate potential threats in real-time. It continuously monitors network traffic, detects anomalies, and applies proactive measures to prevent attacks.

Centralized Management & Monitoring

FortiGate offers a centralized management and monitoring platform that simplifies the administration of security policies across your Google Compute resources. Through a single interface, you can configure and enforce security rules, monitor traffic patterns, and analyze security events. This centralized approach enhances visibility and control, enabling efficient management of your security infrastructure.

Related: For pre-information, you may find the following post helpful:

  1. Technology Insight For Microsegmentation
  2. SASE Visibility
  3. Network Traffic Engineering
  4. Docker Default Networking 101
  5. Distributed Firewalls
  6. Virtual Firewalls

Implementing Network Security

The Role of Network Security

For sufficient network security to exist, it is essential to comprehend its central concepts and the implied technologies and processes around it that make it robust and resilient to cyber-attacks. However, this is complicated when the lack of a demarcation of the various network boundaries blurs the visibility.

Moreover, network security touches upon multiple attributes of security controls that we need to consider, such as security gateways, SSL inspection, threat prevention engines, policy enforcement, cloud security solutions, threat detection and insights, and attack analysis w.r.t frameworks, to name a few.

One of the fundamental components of network security is the implementation of firewalls and intrusion detection systems (IDS). Firewalls act as a barrier between your internal network and external threats, filtering out malicious traffic. On the other hand, IDS monitors network activity and alerts administrators of suspicious behavior, enabling rapid response to potential breaches.

A. Enforcing Strong Authentication and Access Controls

Controlling user access is vital to prevent unauthorized entry and data breaches. Implement strict access controls, including strong password policies, multi-factor authentication, and role-based access controls (RBAC). Regularly review user privileges to ensure they align with the principle of least privilege (PoLP).

Unauthorized access to sensitive data can have severe consequences. Implementing robust authentication mechanisms, such as two-factor authentication (2FA) or biometric verification, adds an extra layer of security. Additionally, enforcing stringent access controls, limiting user privileges, and regularly reviewing user permissions minimize the risk of unauthorized access.

B. Regular Software Updates and Patch Management

Cybercriminals often exploit vulnerabilities in outdated software. Regularly updating and patching your network’s software, including operating systems, applications, and security tools, is crucial to prevent potential breaches. Automating the update process helps ensure your network remains protected against emerging threats whenever possible.

C. Data Encryption and Secure Communication

Data encryption is critical to network security, mainly when transmitting sensitive information. Utilize industry-standard encryption algorithms to protect data at rest and in transit. Implement secure protocols like HTTPS for web communication and VPNs for remote access.

Protecting sensitive data in transit is essential to maintain network security. Implementing encryption protocols, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS), safeguards data as it travels across networks. Additionally, using Virtual Private Networks (VPNs) ensures secure communication between remote locations and adds an extra layer of encryption.

Example: SSL Policies

SSL Policies

D. Assessing Vulnerabilities

Conducting a comprehensive network infrastructure assessment before implementing network security is crucial. This assessment will identify potential vulnerabilities, weak points, and areas that require immediate attention and serve as a foundation for developing a tailored security plan.

Example: What is Lynis?

Lynis is an open-source security auditing tool designed to assess the security defenses of Linux and Unix-based systems. It performs a comprehensive scan, evaluating various security aspects such as system hardening, vulnerability scanning, and compliance testing. Lynis provides valuable insights into potential risks and weaknesses by analyzing the system’s configurations and settings.

**Building a Strong Firewall**

One of the fundamental elements of network security is a robust firewall. A firewall acts as a barrier between your internal network and the external world, filtering incoming and outgoing traffic based on predefined rules. Ensure you invest in a reliable firewall solution with advanced features such as intrusion detection and prevention systems.

Example: Zone-Based Firewall ( Transparent Mode )

Zone-based firewalls provide a robust and flexible approach to network security by dividing the network into security zones. Each zone is associated with specific security policies, allowing administrators to control traffic flow between zones based on predetermined rules. This segmentation adds an extra layer of protection and enables efficient traffic management within the network.

Transparent mode is a unique operating mode of zone-based firewalls that offers enhanced network security while maintaining seamless integration with existing network infrastructure. Unlike traditional firewalls that require explicit IP addressing and routing changes, zone-based firewalls in transparent mode work transparently without modifying the network topology. This makes them an ideal choice for organizations looking to enhance security without disrupting their existing network architecture.

Key Advantages:

One key advantage of zone-based firewalls in transparent mode is the simplified deployment process. Since they operate transparently, there is no need for complex network reconfiguration or IP address changes. This saves time and minimizes the risk of potential misconfigurations or network disruptions.

Another significant benefit is the increased visibility and control over network traffic. Zone-based firewalls in transparent mode allow organizations to monitor and analyze traffic at a granular level, effectively detecting and mitigating potential threats. Additionally, these firewalls provide a centralized management interface, simplifying the administration and configuration process.

Example: Context-Based Access Control

The CBAC firewall, or Context-Based Access Control, is a stateful inspection firewall that goes beyond traditional packet filtering. Unlike simple packet filtering firewalls, CBAC examines individual packets and their context. This contextual analysis gives CBAC a more comprehensive understanding of network traffic, making it highly effective in identifying and mitigating potential threats.

CBAC firewall offers a range of features and benefits that make it a powerful tool for network security. Firstly, it provides application-level gateway services, allowing it to inspect traffic at the application layer. This capability enables CBAC to detect and block specific types of malicious traffic, such as Denial of Service attacks or unauthorized access attempts.

Additionally, the CBAC firewall supports dynamic protocol inspection, which means it can dynamically monitor and control traffic for various protocols. This flexibility allows for efficient and effective network management while ensuring that only legitimate traffic is permitted.

F. Monitoring and Intrusion Detection

Network security is an ongoing process that requires constant vigilance. Implement a robust monitoring and intrusion detection system (IDS) to detect and respond promptly to potential security incidents. Monitor network traffic, analyze logs, and employ intrusion prevention systems (IPS) to protect against attacks proactively.

**Knowledge Check: Malware**

A. – Antivirus: Antivirus software is often used to protect or eradicate malicious software, so it is probably no surprise that virus is one of the most commonly used words to describe malware. Malware is not always a virus, but all computer viruses are malware. For a virus to infect a system, it must be activated by the user.

For the virus to be executed, the user must do something. After infecting the system, the virus may inject code into other programs, so the virus remains in control when those programs run. Regardless of whether the original executable and process are removed, the system will remain infected if the infected programs run. The virus must be removed entirely.

B. – Worm: There is a common misconception that worms are malicious, but they are not. In addition to Code Red and Nimda, many other notorious worms worldwide have caused severe damage. It is also possible to contract worms like Welchia/Nachi, in addition to removing another worm, Blaster, that worm patched systems so they were no longer vulnerable to Blaster. Removing malware such as Blaster is not enough to combat a worm. Removing malware is insufficient; if the worm’s vulnerability is not fixed, it will reinfect from another source.

C. – Trojan: As with viruses, Trojans are just another type of malware. Its distinctive feature is that it appears to be something it’s not. Although it’s probably well known, the term Trojan horse was used to describe it. During the Trojan War, the Greeks built a horse for the Trojans as a “gift” to them. There were Greeks inside the gift horse. Instead of being a wooden horse statue, it was used to deliver Greek soldiers who crept out of the horse at night and attacked Troy from within.

D. – Botnet: Viruses, worms, and Trojan horses can deliver botnets as part of their payload. Botnets are clients that are installed when you hear the word. Botnets are collections of endpoints infected with a particular type of malware. Botnet clients connect to command-and-control infrastructure (or C&C) through small pieces of software. The client receives commands from the C&C infrastructure. The purpose of a botnet is primarily to generate income for its owner, but it can be used for various purposes. Clients serve as facilitators of that process.

Hacking Stages

The hacking stages: There are different stages of an attack chain, and with the correct network visibility, you can break the attack at each stage. Firstly, there will be the initial recon, access discovery, where a bad actor wants to understand the lay of the land to determine the next moves. Once they know this, they can try to exploit it. 

Stage 1: Deter

You must first deter threats and unauthorized access, detect suspicious behavior and access, and automatically respond and alert. So, it would help if you looked at network security. We have our anti-malware devices, perimeter security devices, identity access, firewalls, and load balancers for the first stage, which deters.

Stage 2: Detect

The following dimension of security is detection. Here, we can examine the IDS, log insights, and security feeds aligned with analyses and flow consumption. Again, any signature-based detection can assist you here.

Stage 3: Respond

Then, we need to focus on how you can respond. This will be with anomaly detection and response solutions. Remember that all of this must be integrated with, for example, the firewall enabling you to block and then deter that access.

Red Hat Ansible Tower

Ansible is the common automation language for everyone across your organization. Specifically, Ansible Tower can be the common language between security tools. This leads to repetitive work and the ability to respond to security events in a standardized way. If you want a unified approach, automation can help you here, especially with a Platform such as Ansible Tower. It would help if you integrated Ansible Tower and your security technologies. 

Example: Automating firewall rules.

We can add an allowlist entry in the firewall configuration to allow traffic from a particular machine to another. We can have a playbook that first adds the source and destination I.P.s as variables. Then, when a source and destination object are defined, the actual access rule between those is defined. All can be done with automation.

Ansible vs Tower
Diagram: Ansible vs Tower. Source Red Hat.

There is not one single device that can stop an attack. We need to examine multiple approaches that should be able to break the attack at any part of this attack chain. Whether the bad actors are doing their TCP scans, ARP Scans, or Malware scans, you want to be able to identify them before they become a threat. You must always assume threat access, leverage all possible features, and ensure every application is critical and protected. 

We must improve various technologies’ monitoring, investigation capabilities, and detection. The zero-trust architecture can help you monitor and improve detection. In addition, we must look at network visibility, logging, and Encrypted Traffic Analyses (ETA) to improve investigation capabilities.

Knowledge Check: Ping Sweeps

– Consider identifying responsive systems within address spaces rather than blindly attacking them. Responding to network messages means responding appropriately to the messages sent to them. In other words, you can identify live systems before attempting to attack or probe them. Performing a ping sweep is one way to determine if systems are alive.  

– Ping sweeps involve sending ping messages to every computer on the network. As a standard message, the ping uses ICMP echo requests. They may not be noticed if you are not bombarding targets with unusually large or frequent messages. Firewall rules may block ICMP messages outside the network, so ping sweeps may not succeed.

**Network-derived intelligence**

So, when implementing network security, you need to consider that the network and its information add much value. This can still be done with an agent-based approach, where an agent collects data from the host and sends it back to, for example, a data lake where you set up a dashboard and query. However, an agent-based approach will have blind spots. It misses a holistic network view and can’t be used with unmanaged devices like far-reaching edge IoT.

The information gleaned from the host misses data that can be derived for the network. Network-derived traffic analysis is especially useful for investigating unmanaged hosts such as IoT—any host and its actual data.

This is not something that can be derived from a log file. The issue we have with log data is if a bad actor gets internal to the network, the first thing they want to do to cover their footprints is log spoofing and log injections.

**Agent-based and network-derived intelligence**

An agent-based approach and network-derived intelligence’s deep packet inspection process can be appended. Network-derived intelligence allows you to pull out tons of metadata attributes, such as what traffic this is, what the characteristics of the traffic are, what a video is, and what the frame rate is.

The beauty is that this can get both north-south and east-west traffic and unmanaged devices. So, we have expanded the entire infrastructure by combining an agent-based approach and a network-derived intelligence.

**Detecting rogue activity: Layers of security** 

Now, we can detect new vulnerabilities, such as old SSL ciphers, shadow I.T. activity, such as torrent and crypto mining, and suspicious activities, such as port spoofing. Rogue activities such as crypto mining are a big concern. Many workflows get broken, and many breaches and attacks install crypto mining software.

This is the best way for a bad actor to make money. The way to detect this is not to have an agent but to examine network traffic and look for anomalies in the traffic. When there are anomalies in the traffic, the traffic may not look too different. This is because the mining software will not generate log files, and there is no command and control communication. 

**Observability & The SIEM**

We make the observability and SIEM more targeted to get better information. With the network, we have new capabilities to detect and invent. This adds a new layer of in-depth defense and makes you more involved in the cloud threats that are happening at the moment. Netflow is used for network monitoring, detection, and response. Here, you can detect the threats and integrate them with other tools so we can see the network intrusion as it begins. It makes a decision based on the network. So you can see the threats as they happen.

You can’t protect what you can’t see.

The first step in the policy optimization process is how the network connects, what is connecting, and what it should be. You can’t protect what you can’t see. Therefore, everything desperately managed within a hybrid network must be fully understood and consolidated. Secondly, once you know how things connect, how do you ensure they don’t reconnect through a broader definition of connectivity?

You must support different user groups, security groups, and IP addresses. You can’t just rely on IP addresses to implement security controls anymore. We need visibility at traffic flow, process, and contextual data levels. Without this granular application, visibility, mapping, and understanding normal traffic flow and irregular communication patterns is challenging.

Complete network visibility

We also need to identify when there is a threat easily. For this, we need a multi-dimensional security model and good visibility. Network visibility is integral to security, compliance, troubleshooting, and capacity planning. Unfortunately, custom monitoring solutions cannot cope with the explosive growth networks.

We also have reasonable solutions from Cisco, such as Cisco’s Nexus Dashboard Data Broker (NDDB).  Cisco’s Nexus Dashboard Data Broker (NDDB) is a packet brokering solution that provides a software-defined, programmable solution that can aggregate, filter, and replicate network traffic using SPAN or optical TAPs for network monitoring and visibility. 

What prevents visibility?

There is a long list of things that can prevent visibility. Firstly, there are too many devices and complexity and variance between vendors in managing them. Even CLI commands from the same vendor vary. Too many changes result in the inability to meet the service level agreement (SLA), as you are just layering on connectivity without fully understanding how the network connects.

This results in complex firewall policies. For example, you have access but are not sure if you should have access. Again, this leads to significant, complex firewall policies without context. More often, the entire network lacks visibility. For example, AWS teams understand the Amazon cloud but do not have visibility on-premise. We also have distributed responsibilities across multiple groups, which results in fragmented processes and workflows.

Security Principles: Data-flow Mapping

Network security starts with the data. Data-flow mapping enables you to map and understand how data flows within an organization. But first, you must understand how data flows across your hybrid network and between all the different resources and people, such as internal employees, external partners, and customers. This includes the who, what, when, where, why, and how your data creates a strong security posture. You are then able to understand access to sensitive data.

Data-flow mapping will help you create a baseline. Once you have a baseline, you can start implementing Chaos Engineering projects to help you understand your environment and its limits. One example would be a chaos engineering kubernetes project that breaks systems in a controlled manner.

What prevents mapping sensitive data flows

What prevents mapping sensitive data flow? Firstly, there is an inability to understand how the hybrid network connects. Do you know where sensitive data is, how to find it, and how to ensure it has the minimum necessary access?

With many teams managing different parts and the rapid pace of application deployments, there are often no documents. No filing systems in place. There is a lack of application connectivity requirements. People don’t worry about documenting and focus on connectivity. More often than not, we have an overconnected network environment.

We often connect first and then think about security. We also cannot understand if application connectivity violates security policy and lacks application-required resources. Finally, there is a lack of visibility into the cloud and deployed applications and resources. What is in the cloud, and how is it connected to on-premise and external Internet access?

Network Security and Telemetry

Implementing network security involves leveraging the different types of telemetry for monitoring and analysis. For this, we have various kinds of packet analysis and telemetry data. Packet analysis is critical, involving new tools and technologies such as packet brokers. In addition, SPAN taps need to be installed strategically in the network infrastructure.

Example Telemetry Technologies

Telemetry, such as flow, SNMP, and API, is also examined. Flow is a technology similar to IPFIX and NETFLOW. We can also start to look at API telemetry. Then, we have logs that provide a wealth of information. So, we have different types of telemetry and different ways of collecting and analyzing it, and now we can use this from both the network and security perspectives. 

Threat Detection & Response

From the security presence, it would be for threat detection and response. Then, for the network side of things, it would be for network and application performance. So there are a lot of telemetries that can be used for security. These technologies were initially viewed as performance monitoring.

However, security and networking have been merged to meet the cybersecurity use cases. So, in summary, we have flow, SNMP, and API for network and application performance, encrypted traffic analysis, and machine learning for threat and risk identification for security teams. 

The issues with packet analysis: Encryption.

The issue with packet analysis is that everything is encrypted, especially with TLS1.3. And at the WAN Edge. So how do you decrypt all of this, and how do you store all of this? Decrypting traffic can create an exploit and potential attack surface, and you also don’t want to decrypt everything.

Do not fully decrypt the packets.

One possible solution is not fully decrypting the packets. However, when looking at the packet information, especially in the header, which can consist of layer 2 and TCP headers. You can immediately decipher what is expected and what is malicious. You can look at the packers’ length and the arrival time order and understand what DNS server it uses.

Also, look at the round trip time and the connection times. You can extract many insights and features from encrypted traffic without fully decrypting it. Combining all this information can be fed to different machine learning models to understand good and bad traffic.

You don’t need to decrypt everything.  So you may not have to look at the actual payload, but from the pattern of the packets, you can see with the right tools that one is a wrong website, and another is a good website.

Stage 1: Know your infrastructure with good visibility

The first thing is getting to know all the traffic around your infrastructure. Once you know, they need to know this for on-premises, cloud, and multi-cloud scenarios. It would help if you had higher visibility across all environments. 

Stage 2: Implement security tools

In all environments, we have infrastructure that our applications and services ride upon. Several tools protect this infrastructure, which will be placed in different network parts. As you know, we have firewalls, DLP, email gateways, and SIEM. We also have other tools to carry out various security functions. These tools will not disappear or be replaced anytime soon but must be better integrated.

Stage 3: Network packet broker

You can introduce a network packet broker. So, we can have a packed brokering device that fetches the data and then sends the data back to the existing security tools you have in place. Essentially, this ensures that there are no blind spots in the network. Remember that this network packet broker should support any workload to any tools. 

Stage 4: Cloud packet broker

In the cloud, you will have a variety of workloads and several tools, such as SIEM, IPS, and APM. These tools need access to your data. A packet broker can be used in the cloud, too. So, if you are in a cloud environment, you need to understand the native cloud protocols, such as VPC mirroring; this traffic can be brokered, allowing some transformation to happen before we move the traffic over. These transformant functions can include de-duplication, packet slicing, and TLS analyses.

This will give you complete visibility into the data set across VPC at scale, eliminating any blind spots and improving the security posture by sending appropriate network traffic, whether packets or metadata, to the tools stacked in the cloud. 

Summary: Implementing Network Security

In today’s interconnected world, where digital communication and data exchange are the norm, ensuring your network’s security is paramount. Implementing robust network security measures not only protects sensitive information but also safeguards against potential threats and unauthorized access. This blog post provided you with a comprehensive guide on implementing network security, covering key areas and best practices.

Assessing Vulnerabilities

Before diving into security solutions, it’s crucial to assess the vulnerabilities present in your network infrastructure. Conducting a thorough audit helps identify weaknesses such as outdated software, unsecured access points, or inadequate user permissions.

Firewall Protection

One of the fundamental pillars of network security is a strong firewall. A firewall is a barrier between your internal network and external threats, monitoring and filtering incoming and outgoing traffic. It serves as the first line of defense, preventing unauthorized access and blocking malicious activities.

Intrusion Detection Systems

Intrusion Detection Systems (IDS) play a vital role in network security by actively monitoring network traffic, identifying suspicious patterns, and alerting administrators to potential threats. IDS can be network- or host-based, providing real-time insights into ongoing attacks or vulnerabilities.

Securing Wireless Networks

Wireless networks are susceptible to various security risks due to their inherent nature. Implementing robust encryption protocols, regularly updating firmware, and using unique and complex passwords are essential to securing your wireless network. Additionally, segregating guest networks from internal networks helps prevent unauthorized access.

User Authentication and Access Controls

Controlling user access is crucial to maintaining network security. Implementing robust user authentication mechanisms such as two-factor authentication (2FA) or biometric authentication adds an extra layer of protection. Regularly reviewing user permissions, revoking access for former employees, and employing the principle of least privilege ensures that only authorized individuals can access sensitive information.

Conclusion:

Implementing network security measures is an ongoing process that requires a proactive approach. Assessing vulnerabilities, deploying firewalls and intrusion detection systems, securing wireless networks, and implementing robust user authentication controls are crucial steps toward safeguarding your network. By prioritizing network security and staying informed about emerging threats, you can ensure the integrity and confidentiality of your data.

Enterprise Isometric Internet security firewall protection information

Network Security Components

by Publications

Network Security Components

In today's interconnected world, network security plays a crucial role in protecting sensitive data and ensuring the smooth functioning of digital systems. A strong network security framework consists of various components that work together to mitigate risks and safeguard valuable information. In this blog post, we will explore some of the essential components that contribute to a robust network security infrastructure.

Network security encompasses a range of strategies and technologies aimed at preventing unauthorized access, data breaches, and other malicious activities. It involves securing both hardware and software components of a network infrastructure. By implementing robust security measures, organizations can mitigate risks and ensure the confidentiality, integrity, and availability of their data.

Network security components form the backbone of any robust network security system. By implementing a combination of firewalls, IDS, VPNs, SSL/TLS, access control systems, antivirus software, DLP systems, network segmentation, SIEM systems, and well-defined security policies, organizations can significantly enhance their network security posture and protect against evolving cyber threats.

Matt Conran

Highlights: Network Security Components

Value of Network Security

– Network security is essential to any company or organization’s data management strategy. It is the process of protecting data, computers, and networks from unauthorized access and malicious attacks. Network security involves various technologies and techniques, such as firewalls, encryption, authentication, and access control.

Example: Firewalls help protect a network from unauthorized access by preventing outsiders from connecting to it. Encryption protects data from being intercepted by malicious actors. Authentication verifies a user’s identity, and access control manages who has access to a network and their access type.

We have several network security components from the endpoints to the network edge, be it a public or private cloud. Policy and controls are enforced at each network security layer, giving adequate control and visibility of threats that may seek to access, modify, or break a network and its applications.

-Firstly, network security is provided from the network: your IPS/IDS, virtual firewalls, and distributed firewalls technologies.

-Second, some network security, known as endpoint security, protects the end applications. Of course, you can’t have one without the other, but if you were to pick a favorite, it would be endpoint security.

Personal Note: Remember that most network security layers in the security architecture I see in many consultancies are distinct. There may even be a different team looking after each component. This has been the case for a while, but there needs to be some integration between the layers of security to keep up with the changes in the security landscape.

**Network Security Layers**  

Design and implementing a network security architecture is a composite of different technologies working at different network security layers in your infrastructure, spanning on-premises and in the cloud. So, we can have other point systems operating at the network security layers or look for an approach where each network security device somehow works holistically. These are the two options.

Whichever path of security design you opt for, you will have the same network security components carrying out their security function, either virtual or physical, or a combination of both.

There will be a platform-based or individual point solution approach. Some traditional security functionality, such as firewalls that have been around for decades, is still widely used, along with new ways to protect, especially regarding endpoint protection.

Firewalls – 

A. Firewalls: Firewalls serve as the first line of defense by monitoring and controlling incoming and outgoing network traffic. They act as filters, scrutinizing data packets and determining whether they should be allowed or blocked based on predefined security rules. Firewalls provide an essential barrier against unauthorized access, preventing potential intrusions and mitigating risks.

–Understanding UFW

UFW, short for Uncomplicated Firewall, is a user-friendly front-end for managing netfilter firewall rules in Linux. It provides a simplified interface for creating, managing, and enforcing firewall rules to protect your network from unauthorized access and potential threats. Whether you are a beginner or an experienced user, UFW offers a straightforward approach to network security.

To start with UFW, you must ensure it is installed on your Linux system. Most distributions come with UFW pre-installed, but if not, you can easily install it using the package manager. Once installed, configuring UFW involves defining incoming and outgoing traffic rules, setting default policies, and enabling specific ports or services. We will walk you through the step-by-step process of configuring UFW to meet your security requirements.

Intrusion Detection Systems – 

B. Intrusion Detection Systems (IDS): Intrusion Detection Systems are designed to detect and respond to suspicious or malicious activities within a network. By monitoring network traffic patterns and analyzing anomalies, IDS can identify potential threats that may bypass traditional security measures. These systems act as vigilant sensors, alerting administrators to potential breaches and enabling swift action to protect network assets.

–Understanding Suricate IPS IDS

Suricate IPS IDS, short for Intrusion Prevention System and Intrusion Detection System, is a comprehensive security solution designed to detect and mitigate potential network intrusions proactively. By analyzing network traffic in real-time, it identifies and responds to suspicious activities, preventing unauthorized access and data breaches.

Suricate IPS IDS offers a wide array of features that enhance network security. Its advanced threat intelligence capabilities allow for the detection of both known and emerging threats. It can identify malicious patterns and behaviors by utilizing signature-based detection and behavioral analysis, providing an extra defense against evolving cyber threats.

Virtual Private Networks – 

C. Virtual Private Networks (VPNs): VPNs provide a secure and encrypted connection between remote users or branch offices and the leading network. VPNs ensure confidentiality and protect sensitive data from eavesdropping or interception by establishing a private tunnel over a public network. With the proliferation of remote work, VPNs have become indispensable in maintaining secure communication channels.

Access Control Systems

D. Access Control Systems: Access Control Systems regulate and manage user access to network resources. Through thorough authentication, authorization, and accounting mechanisms, these systems ensure that only authorized individuals and devices can gain entry to specific data or systems. Implementing robust access control measures minimizes the risk of unauthorized access and helps maintain the principle of least privilege.

Vault

Encryption – 

E. Encryption: Encryption converts plaintext into ciphertext, rendering it unreadable to unauthorized parties. Organizations can protect their sensitive information from interception or theft by encrypting data in transit and at rest. Robust encryption algorithms and secure critical management practices form the foundation of data protection.

Core Activity: Mapping the Network

Network Scanning

Network scanning is the systematic process of identifying active hosts, open ports, and services within a network. It is a reconnaissance technique for mapping out the network’s architecture and ascertaining its vulnerabilities. Network scanners can gather valuable information about the network’s structure and potential entry points using specialized tools and protocols like ICMP, TCP, and UDP.

Scanning Techniques

Various network scanning techniques are employed by security professionals and hackers alike. Port scanning, for instance, focuses on identifying open ports and services, providing insights into potential attack vectors. Vulnerability scanning, on the other hand, aims to uncover weaknesses and misconfigurations in network devices and software. Other notable methods include network mapping, OS fingerprinting, and packet sniffing, each serving a unique purpose in network security.

Benefits:

Network scanning offers a plethora of benefits and finds applications in various domains. Firstly, it aids in proactive network defense by identifying vulnerabilities before malicious actors exploit them. Additionally, network scanning facilitates compliance with industry regulations and standards, ensuring the network meets necessary security requirements. Moreover, it assists in troubleshooting network issues, optimizing performance, and enhancing overall network management.

**Container Security Component – Docker Bench**

A Key Point: Understanding Container Isolation

Understanding container isolation is crucial to Docker security. Docker utilizes Linux kernel features like cgroups and namespaces to provide isolation between containers and the host system. By leveraging these features, containers can run securely alongside each other, minimizing the risk of potential vulnerabilities.

  • Limit Container Privileges

One of the fundamental principles of Docker security is limiting container privileges. Docker containers run with root privileges by default, which can be a significant security risk. However, creating and running containers with the least privileges necessary for their intended purpose is advisable. Implementing this principle ensures that potential damage is limited even if a container is compromised.

  • Docker Bench Security

Docker Bench Security is an open-source tool developed by the Docker team. Its purpose is to provide a standardized method for evaluating Docker security configurations against best practices. You can identify potential security vulnerabilities and misconfigurations in your Docker environment by running Docker Bench Security.

  • Running Docker Bench

To run Docker Bench Security, you can clone the official repository from GitHub. Once cloned, navigate to the directory and execute the shell script provided. Docker Bench Security will then perform a series of security checks on your Docker installation and provide a detailed report highlighting any potential security issues.

Access List for IPv4 & IPv6

IPv4 Standard Access Lists

Standard access lists are fundamental components of network security. They enable administrators to filter traffic based on source IP addresses, offering a basic level of control. Network administrators can allow or deny specific traffic flows by carefully crafting access control entries (ACEs) within the standard ACL.

Implementing Access Lists

Implementing standard access lists brings several advantages to network security. Firstly, they provide a simple and efficient way to restrict access to specific network resources. Administrators can mitigate potential threats and unauthorized access attempts by selectively permitting or denying traffic based on source IP addresses. Standard access lists can also help optimize network performance by reducing unnecessary traffic flows.

ACL Best Practices

Following best practices when configuring standard access lists is crucial to achieving maximum effectiveness. First, it is recommended that the ACL be applied as close to the source of the traffic as possible, minimizing unnecessary processing.

Second, administrators should carefully plan and document the desired traffic filtering policies before implementing the ACL. This ensures clarity and makes future modifications easier. Lastly, regular monitoring and auditing of the ACL’s functionality is essential to maintaining a secure network environment.

Understanding IPv6 Access-lists

IPv6 access lists are a fundamental part of network security architecture. They filter and control the flow of traffic based on specific criteria. Unlike their IPv4 counterparts, IPv6 access lists are designed to handle the larger address space provided by IPv6. They enable network administrators to define rules that determine which packets are allowed or denied access to a network.

Standard & Extended ACLs

IPv6 access lists can be categorized into two main types: standard and extended. Standard access lists are based on the source IPv6 address and allow or deny traffic accordingly. On the other hand, extended access lists consider additional parameters such as destination addresses, protocols, and port numbers. This flexibility makes extended access lists more powerful and more complex to configure.

Configuring IPv6 access lists

To configure IPv6 access lists, administrators use commands specific to their network devices, such as routers or switches. This involves defining access list entries, specifying permit or deny actions, and applying the access list to the desired interface or network. Proper configuration requires a clear understanding of the network topology and security requirements.

Example Product: Cisco Secure Workload

#### What is Cisco Secure Workload?

Cisco Secure Workload, formerly known as Tetration, is an advanced security platform that provides workload protection across on-premises, hybrid, and multi-cloud environments. It offers a unified approach to securing your applications by delivering visibility, security policy enforcement, and threat detection. By leveraging machine learning and behavioral analysis, Cisco Secure Workload ensures that your network remains protected against known and unknown threats.

#### Key Features of Cisco Secure Workload

1. **Comprehensive Visibility**:

One of the standout features of Cisco Secure Workload is its ability to provide complete visibility into your network traffic. This includes real-time monitoring of all workloads, applications, and their interdependencies, allowing you to identify vulnerabilities and potential threats promptly.

2. **Automated Security Policies**:

Cisco Secure Workload enables automated policy generation and enforcement, ensuring that your security measures are consistently applied across all environments. This reduces the risk of human error and ensures that your network remains compliant with industry standards and regulations.

3. **Advanced Threat Detection**:

Using advanced machine learning algorithms, Cisco Secure Workload can detect anomalous behavior and potential threats in real-time. This proactive approach allows you to respond to threats before they can cause significant damage to your network.

4. **Scalability and Flexibility**:

Whether your organization is operating on-premises, in the cloud, or in a hybrid environment, Cisco Secure Workload is designed to scale with your needs. It provides a flexible solution that can adapt to the unique requirements of your network architecture.

#### Benefits of Implementing Cisco Secure Workload

1. **Enhanced Security Posture**:

By providing comprehensive visibility and automated policy enforcement, Cisco Secure Workload helps you maintain a robust security posture. This minimizes the risk of data breaches and ensures that your sensitive information remains protected.

2. **Operational Efficiency**:

The automation capabilities of Cisco Secure Workload streamline your security operations, reducing the time and effort required to manage and enforce security policies. This allows your IT team to focus on more strategic initiatives.

3. **Cost Savings**:

By preventing security incidents and reducing the need for manual intervention, Cisco Secure Workload can lead to significant cost savings for your organization. Additionally, its scalability ensures that you only pay for the resources you need.

#### How to Implement Cisco Secure Workload

1. **Assessment and Planning**:

Begin by assessing your current network infrastructure and identifying the specific security challenges you face. This will help you determine the best way to integrate Cisco Secure Workload into your existing environment.

2. **Deployment**:

Deploy Cisco Secure Workload across your on-premises, cloud, or hybrid environment. Ensure that all critical workloads and applications are covered to maximize the effectiveness of the platform.

3. **Policy Configuration**:

Configure security policies based on the insights gained from the platform’s visibility features. Automate policy enforcement to ensure consistent application across all environments.

4. **Monitoring and Optimization**:

Continuously monitor your network using Cisco Secure Workload’s real-time analytics and threat detection capabilities. Regularly review and optimize your security policies to adapt to the evolving threat landscape.

Related: For pre-information, you may find the following post helpful:

  1. Dynamic Workload Scaling
  2. Stateless Networking
  3. Cisco Secure Firewall
  4. Data Center Security 
  5. Network Connectivity
  6. Distributed Systems Observability
  7. Zero Trust Security Strategy
  8. Data Center Design Guide

Network Security Components

The Issue with Point Solutions

The security landscape is constantly evolving. To have any chance, security solutions also need to grow. There needs to be a more focused approach, continually developing security in line with today’s and tomorrow’s threats. For this, it is not to continuously buy more point solutions that are not integrated but to make continuous investments to ensure the algorithms are accurate and complete. So, if you want to change the firewall, you may need to buy a physical or virtual device.

**Complex and scattered**

Something impossible to do with the various point solutions designed with complex integration points scattered through the network domain. It’s far more beneficial to, for example, update an algorithm than to update the number of point solutions dispersed throughout the network. The point solution addresses one issue and requires a considerable amount of integration. You must continuously add keys to the stack, managing overhead and increased complexity. Not to mention license costs.

Would you like to buy a car or all the parts?

Let’s consider you are searching for a new car. Would you prefer to build the car with all the different parts or buy the already-built car? If we examine security, the way it has been geared up is provided in detail.

So I have to add this part here, and that part there, and none of these parts connect. Each component must be carefully integrated with another. It’s your job to support, manage, and build the stack over time. For this, you must be an expert in all the different parts.

**Example: Log management**

Let’s examine a log management system that needs to integrate numerous event sources, such as firewalls, proxy servers, endpoint detection, and behavioral response solutions. We also have the SIEM. The SIEM collects logs from multiple systems. It presents challenges to deploying and requires tremendous work to integrate into existing systems. How do logs get into the SIEM when the device is offline?

How do you normalize the data, write the rules to detect suspicious activity, and investigate if there are legitimate alerts? The results you gain from the SIEM are poor, considering the investment you have to make. Therefore, considerable resources are needed to successfully implement it.

**Changes in perimeter location and types**

We also know this new paradigm spreads the perimeter, potentially increasing the attack surface with many new entry points. For example, if you are protecting a microservices environment, each unit of work represents a business function that needs security. So we now have many entry points to cover, moving security closer to the endpoint.

Network Security Components – The Starting Point:

Enforcement with network security layers: So, we need a multi-layered approach to network security that can implement security controls at different points and network security layers. With this approach, we are ensuring a robust security posture regardless of network design.

Therefore, the network design should become irrelevant to security. The network design can change; for example, adding a different cloud should not affect the security posture. The remainder of the post will discuss the standard network security component.

Understanding Identity Management

**The Role of Authentication** 

Authentication is the process of verifying an individual or entity’s identity. It serves as a gatekeeper, granting access only to authorized users. Businesses and organizations can protect against unauthorized access and potential security breaches by confirming a user’s authenticity. In an era of rising cyber threats, weak authentication measures can leave individuals and organizations vulnerable to attacks.

Strong authentication is a crucial defense mechanism, ensuring only authorized users can access sensitive information or perform critical actions. It prevents unauthorized access, data breaches, identity theft, and other malicious activities.

There are several widely used authentication methods, each with its strengths and weaknesses. Here are a few examples:

1. Password-based authentication: This is the most common method where users enter a combination of characters as their credentials. However, it is prone to vulnerabilities such as weak passwords, password reuse, and phishing attacks.

2. Two-factor authentication (2FA): This method adds an extra layer of security by requiring users to provide a second form of authentication, such as a unique code sent to their mobile device. It significantly reduces the risk of unauthorized access.

3. Biometric authentication: Leveraging unique physical or behavioral traits like fingerprints, facial recognition, or voice patterns, biometric authentication offers a high level of security and convenience. However, it may raise privacy concerns and be susceptible to spoofing attacks.

Enhancing Authentication with Multi-factor Authentication (MFA)

Multi-factor authentication (MFA) combines multiple authentication factors to strengthen security further. By utilizing a combination of something the user knows (password), something the user has (smartphone or token), and something the user is (biometric data), MFA provides an additional layer of protection against unauthorized access.

**The Role of Authorization**

Authorization is the gatekeeper of access control. It determines who has the right to access specific resources within a system. By setting up rules and permissions, organizations can define which users or groups can perform certain actions, view specific data, or execute particular functions. This layer of security ensures that only authorized individuals can access sensitive information, reducing the risk of unauthorized access or data breaches.

A.Granular Access Control: One key benefit of authorization is the ability to apply granular access control. Rather than providing unrestricted access to all resources, organizations can define fine-grained permissions based on roles, responsibilities, and business needs. This ensures that individuals only have access to the resources required to perform their tasks, minimizing the risk of accidental or deliberate data misuse.

B.Role-Based Authorization: Role-based authorization is a widely adopted approach simplifying access control management. Organizations can streamline granting and revoking access rights by assigning roles to users. Roles can be structured hierarchically, allowing for easy management of permissions across various levels of the organization. This enhances security and simplifies administrative tasks, as access rights can be managed at a group level rather than individually.

C.Authorization Policies and Enforcement: Organizations must establish robust policies that govern access control to enforce authorization effectively. These policies define the rules and conditions for granting or denying resource access. They can be based on user attributes, such as job title or department, and contextual factors, such as time of day or location. Organizations can ensure access control aligns with their security requirements and regulatory obligations by implementing a comprehensive policy framework.

**Step1: Access control** 

Firstly, we need some access control. This is the first step to security. Bad actors are not picky about location when launching an attack. An attack can come from literally anywhere and at any time. Therefore, network security starts with access control carried out with authentication, authorization, accounting (AAA), and identity management.

Authentication proves that the person or service is who they say they are. Authorization allows them to carry out tasks related to their role. Identity management is all about managing the attributes associated with the user, group of users, or another identity that may require access. The following figure shows an example of access control. More specifically, network access control.

Identity-centric access control

It would be best to have an identity based on logical attributes, such as the multi-factor authentication (MFA), transport layer security (TLS) certificate, the application service, or a logical label/tag. Be careful when using labels/tags when you have cross-domain security.

So, policies are based on logical attributes rather than using IP addresses to base policies you may have used. This ensures an identity-centric design around the user identity, not the IP address.

Once initial security controls are passed, a firewall security device ensures that users can only access services they are allowed to. These devices decide who gets access to which parts of the network. The network would be divided into different zones or micro-segments depending on the design. Adopting micro-segments is more granular regarding the difference between micro-segmentation and micro-segmentation.

Dynamic access control

Access control is the most critical component of an organization’s cybersecurity protection. For too long, access control has been based on static entitlements. Now, we are demanding dynamic access control, with decisions made in real time. Access support must support an agile IT approach with dynamic workloads across multiple cloud environments.

A pivotal point to access control is that it is dynamic and real-time, constantly accessing and determining the risk level. Thereby preventing unauthorized access and threats like a UDP scan. We also have zero trust network design tools, such as single packet authentication (SPA), that can keep the network dark until all approved security controls are passed. Once security controls are passed, access is granted.

**Step2: The firewall design locations**

A firewalling strategy can offer your environment different firewalls, capabilities, and defense-in-depth levels. Each firewall type positioned in other parts of the infrastructure forms a security layer, providing a defense-in-depth and robust security architecture. There are two firewalling types at a high level: internal, which can be distributed among the workloads, and border-based firewalling.

Firewalling: Different network security layers

The different firewall types offer capabilities that begin with basic packet filters, reflexive ACL, stateful inspection, and next-generation features such as micro-segmentation and dynamic access control. These can take the form of physical or virtualized.

Firewalls purposely built and designed for a particular role should not be repurposed to carry out the functions that belong to and are intended to be offered by a different firewall type. The following diagram lists the different firewall types. Around nine firewall types work at various layers in the network.

Example: Firewall security policy

A firewall is an essential part of an organization’s comprehensive security policy. A security policy defines the goals, objectives, and procedures of security, all of which can be implemented with a firewall. There are many different firewalling modes and types.

However, generally, firewalls can focus on the packet header, the packet payload (the essential data of the packet), or both, the session’s content, the establishment of a circuit, and possibly other assets. Most firewalls concentrate on only one of these. The most common filtering focus is on the packet’s header, with the packet’s payload a close second.

Firewalls come in various sizes and flavors. The most typical firewall is a dedicated system or appliance that sits in the network and segments an “internal” network from the “external” Internet.

The primary difference between these two types of firewalls is the number of hosts the firewall protects. Within the network firewall type, there are primary classifications of devices, including the following:

    • Packet-filtering firewalls (stateful and nonstateful)
    • Circuit-level gateways
    • Application-level gateways

Zone-Based Firewall ( Transparent Mode )

Understanding Zone-Based Firewall

Zone-Based Firewall, or ZBFW, is a security feature embedded within Cisco IOS routers. It provides a highly flexible and granular approach to network traffic control, allowing administrators to define security zones and apply policies accordingly. Unlike traditional ACL-based firewalls, ZBFW operates based on zones rather than interfaces, enabling efficient traffic management and advanced security controls.

Transparent mode is a distinctive feature of Zone-Based Firewall that allows seamless integration into existing network infrastructures without requiring a change in the IP addressing scheme. In this mode, the firewall acts as a “bump in the wire,” transparently intercepting and inspecting traffic between different zones while maintaining the original IP addresses. This makes it ideal for organizations looking to enhance network security without significant network reconfiguration.

CBAC – Context-Based Access Control Firewall

Understanding CBAC Firewall

– CBAC Firewall, short for Context-Based Access Control Firewall, is a stateful inspection firewall operating at the OSI model’s application layer. Unlike traditional packet-filtering firewalls, CBAC Firewall provides enhanced security by dynamically analyzing the context and content of network traffic. This allows it to make intelligent decisions, granting or denying access based on the state and characteristics of the communication.

– CBAC Firewall offers a range of powerful features that make it a preferred choice for network security. Firstly, it supports session-based inspection, enabling it to track the state of network connections and only allow traffic that meets specific criteria. This eliminates the risk of unauthorized access and helps protect against various attacks, including session hijacking and IP spoofing.

– Furthermore, the CBAC Firewall excels at protocol anomaly detection. Monitoring and comparing network traffic patterns against predefined rules can identify suspicious behavior and take appropriate action. Whether detecting excessive data transfer or unusual port scanning, the CBAC Firewall enhances your network’s ability to identify potential threats and respond proactively.

CBAC Firewall CBAC Firewall

**Additional Firewalling Types**

  • Internal Firewalls 

Internal firewalls inspect higher up in the application stack and can have different types of firewall context. They operate at a workload level, creating secure micro perimeters with application-based security controls. The firewall policies are application-centric, purpose-built for firewalling east-west traffic with layer 7 network controls with the stateful firewall at a workload level. 

  • Virtual firewalls and VM NIC firewalling

I often see virtualized firewalls here, and the rise of internal virtualization in the network has introduced the world of virtual firewalls. Virtual firewalls are internal firewalls distributed close to the workloads. For example, we can have the VM NIC firewall. In a virtualized environment, the VM NIC firewall is a packet filtering solution inserted between the VM Network Interfaces card of the Virtual Machines (VM) and the virtual hypervisor switch. All traffic that goes in and out of the VM has to pass via the virtual firewall.

  • Web application firewalls (WAF)

We could use web application firewalls (WAF) for application-level firewalls. These devices are similar to reverse proxies that can terminate and initiate new sessions to the internal hosts. The WAF has been around for quite some time to protect web applications by inspecting HTTP traffic.

However, they have the additional capability to work with illegal payloads that can better identify destructive behavior patterns than a simple VM NIC firewall.

WAFs are good at detecting static and dynamic threats. They protect against common web attacks, such as SQL injection and cross-site scripting, using pattern-matching techniques against the HTTP traffic. Active threats have been the primary source of threat and value a WAF can bring.

**Step3: Understanding Encryption**

Encryption is an encoding method that allows only authorized parties to access and understand it. It involves transforming plain text into a scrambled form called ciphertext using complex algorithms and a unique encryption key.

Encryption is a robust shield that protects our data from unauthorized access and potential threats. It ensures that even if data falls into the wrong hands, it remains unreadable and useless without the corresponding decryption key.

Various encryption algorithms are used to secure data, each with strengths and characteristics. From the widely-used Advanced Encryption Standard (AES) to the asymmetric encryption of RSA, these algorithms employ different mathematical techniques to encrypt and decrypt information.

**Step4: Network Segmentation**

Macro segmentation

The firewall monitors and controls the incoming and outgoing network traffic based on predefined security rules. It establishes a barrier between the trusted network and the untrusted network. The firewall commonly inspects Layer 3 to Layer 4 at the network’s edge. In addition, to reduce hair pinning and re-architecture, we have internal firewalls. We can put an IPD/IDS or an AV on an edge firewall.

In the classic definition, the edge firewall performs access control and segmentation based on IP subnets, known as macro segmentation. Macro segmentation is another term for traditional network segmentation. It is still the most prevalent segmentation technique in most networks and can have benefits and drawbacks.

Same segment, same sensitivity level 

It is easy to implement but ensures that all endpoints in the same segment have or should have the same security level and can talk freely, as defined by security policy. We will always have endpoints of similar security levels, and macro segmentation is a perfect choice. Why introduce complexity when you do not need to?

Micro-segmentation

The same edge firewall can be used to do more granular segmentation; this is known as micro-segmentation. In this case, the firewall works at a finer granularity, logically dividing the data center into distinct security segments down to the individual workload level, then defining security controls and delivering services for each unique segment. So, each endpoint has its segment and can’t talk outside that segment without policy. However, we can have a specific internal firewall to do the micro-segmentation.

Example: Network Endpoint Groups

network endpoint groups

Example: Cisco ACI and microsegmentation

Some micro-segmentation solutions could be Endpoint Groups (EPGs) with the Cisco ACI and ACI networks. ACI networks are based on ACI contracts that have subjects and filters to restrict traffic and enable the policy. Traffic is unrestricted within the Endpoint Groups; however, we need an ACI contract for traffic to cross EPGs.

**Step5: Load Balancing**

Understanding Load Balancing

Load balancing is the process of distributing incoming network traffic across multiple servers or resources. It helps avoid congestion, optimize resource utilization, and enhance overall system performance. It also acts as a crucial mechanism for handling traffic spikes, preventing any single server from becoming overwhelmed.

Various load-balancing strategies are available, each suited for different scenarios and requirements. Let’s explore a few popular ones:

A. Round Robin: This strategy distributes incoming requests equally among the available servers cyclically. It is simple to implement and provides a basic level of load balancing.

B. Least Connection Method: With this strategy, incoming requests are directed to the server with the fewest active connections at any given time. It ensures that heavily loaded servers receive fewer requests, optimizing overall performance.

C. Weighted Round Robin: In this strategy, servers are assigned different weights, indicating their capacity to handle traffic. Servers with higher weights receive more incoming requests, allowing for better resource allocation.

Load balancers can be hardware-based or software-based, depending on the specific needs of an infrastructure. Let’s explore the two main types:

Hardware Load Balancers: These are dedicated physical appliances specializing in load balancing. They offer high performance, scalability, and advanced features like SSL offloading and traffic monitoring.

Software Load Balancers are software-based solutions that can be deployed on standard servers or virtual machines. They provide flexibility and cost-effectiveness and are often customizable to suit specific requirements.

**Scaling The load balancer**

A load balancer is a device that acts as a reverse proxy and distributes network or application traffic across several servers. This allows organizations to ensure that their resources are used efficiently and that no single server is overburdened. It can also improve running applications’ performance, scalability, and availability.

Load balancing and load balancer scaling refer to efficiently distributing incoming network traffic across a group of backend servers, also known as a server farm or pool. For security, a load balancer has some capability and can absorb many attacks, such as a volumetric DDoS attack. Here, we can have an elastic load balancer running in software.

So it can run in front of a web property and load balance between the various front ends, i.e., web servers. If it sees an attack, it can implement specific techniques. So, it’s doing a function beyond the load balancing function and providing a security function.

**Step6: The IDS** 

Traditionally, the IDS consists of a sensor installed on the network that monitors traffic for a set of defined signatures. The signatures are downloaded and applied to network traffic every day. Traditional IDS systems do not learn from behaviors or other network security devices over time. The solution only looks at a specific time, lacking an overall picture of what’s happening on the network.

**Analyse Individual Packets**

They operate from an island of information, only examining individual packets and trying to ascertain whether there is a threat. This approach results in many false positives that cause alert fatigue. Also, when a trigger does occur, there is no copy of network traffic to do an investigation. Without this, how do you know the next stage of events? Working with IDS, security professionals are stuck with what to do next.

A key point: IPS/IDS  

An intrusion detection system (IDS) is a security system that monitors and detects unauthorized access to a computer or network. It also monitors communication traffic from the system for suspicious or malicious activity and alerts the system administrator when it finds any. An IDS aims to identify and alert the system administrator of any malicious activities or attempts to gain unauthorized access to the system.

**IDS – Hardware or Software Solution**

An IDS can be either a hardware or software solution or a combination. It can detect various malicious activities, such as viruses, worms, and malware. It can also see attempts to access the system, steal data, or change passwords. Additionally, an IDS can detect any attempts to gain unauthorized access to the system or other activities that are not considered standard.

**Detection Techniques**

The IDS uses various techniques to detect intrusion. These techniques include signature-based detection, which compares the incoming traffic against a database of known attacks; anomaly-based detection, which looks for any activity that deviates from normal operations; and heuristic detection, which uses a set of rules to detect suspicious activity.

Example: Sensitive Data Protection

Sensitive data protection

Challenge: Firewalls and static rules

Firewalls use static rules to limit network access to prevent access but don’t monitor for malicious activity. An IPS/IDS examines network traffic flows to detect and prevent vulnerability exploits. The classic IPS/IDS is typically deployed behind the firewall and does protocol analysis and signature matching on various parts of the data packet.

The protocol matching is, in some sense, a compliance check against the publicly declared spec of the protocol. We are doing basic protocol checks if someone abuses some of the tags. Then, the IPS/IDS uses signatures to prevent known attacks. For example, an IPS/IDS uses a signature to prevent you from doing SQL injections. 

Example: Firewalling based on Tags

Firewall tags

**Step7: Endpoint Security** 

Move security to the workload

Like the application-based firewalls, the IPS/IDS functionality at each workload ensures comprehensive coverage without blind spots. So, as you can see, the security functions are moving much closer to the workloads, bringing the perimeter from the edge to the workload.

Endpoint security is an integral part of any organization’s security strategy. It protects endpoints like laptops, desktops, tablets, and smartphones from malicious activity. Endpoint security also protects data stored on devices and the device itself from malicious code or activity.

Endpoint Security Tools

Endpoint security includes various measures, including antivirus and antimalware software, application firewalls, device control, and patch management. Antivirus and antimalware software detect and remove malicious code from devices. Application firewalls protect by monitoring incoming and outgoing network traffic and blocking suspicious activity.

Device control ensures that only approved devices can be used on the network. Finally, patch management ensures that devices are up-to-date with the latest security patches.

Network detection and response 

Then, we have the network detection and response solutions. The Network detection and response (NDR) solutions are designed to detect cyber threats on corporate networks using machine learning and data analytics. They can help you discover evidence on the network and cloud of malicious activities that are in progress or have already occurred.

Some of the analyses promoting the NDR tools are “Next-Gen IDS.”  One significant difference between NDR and old IDS tools is that NDR tools use multiple Machine Learning (ML) techniques to identify normal baselines and anomalous traffic rather than static rules or IDS signatures, which have trouble handling dynamic threats. The following figure shows an example of a typical attack lifecycle.

**Step8: Anti-malware gateway**

Anti-malware gateway products have a particular job. They look at the download, then take the file and try to open it. Files are put through a sandbox to test whether they contain anything malicious—the bad actors who develop malware test against these systems before releasing the malware. Therefore, the gateways often lag one step behind. Also, anti-malware gateways are limited in scope and not focused on anything but malware.

Endpoint detection and response (EDR) solutions look for evidence and effects of malware that may have slipped past EPP products. EDR tools also detect malicious insider activities such as data exfiltration attempts, left-behind accounts, and open ports. Endpoint security has the best opportunity to detect several threats. It is the closest to providing a holistic offering. It is probably the best point solution, but remember, it is just a point solution. 

**DLP security-

By monitoring the machine and process, endpoint security is there for the long haul instead of assessing a file on a once-off basis. It can see when malware is executing and then implement DLP. Data Loss Prevention (DLP) solutions are security tools that help organizations ensure that sensitive data such as Personally Identifiable Information (PII) or Intellectual Property (IP) does not get outside the corporate network or to a user without access. However, endpoint security does not take sophisticated use cases into account. For example, it doesn’t care what you print or what Google drives you share. 

**Endpoint security and correlation-

In general, endpoint security does not do any correlation. For example, let’s say there is a .exe that connects to the database; there is nothing on the endpoint to say that it is a malicious connection. Endpoint security finds distinguishing benign from legitimate hard unless there is a signature. Again, it is the best solution, but it is not a managed service or has a holistic view. 

**Security controls from the different vendors-  

As a final note, consider how you may have to administer the security controls from the different vendors. How do you utilize the other security controls from other vendors, and more importantly, how do you use them adjacent to one another? For example, Palo Alto operates an App-ID, a patented traffic classification system only available in Palo Alto Networks firewalls.

Different vendors will not support this feature in a network. This poses the question: How do I utilize next-generation features from vendors adjacent to devices that don’t support them? Your network needs the ability to support features from one product across the entire network and then consolidate them into one. How do I use all the next-generation features without having one vendor?

**Use of a packet broker-

However, changing an algorithm that can affect all firewalls in your network would be better. That would be an example of an advanced platform controlling all your infrastructures. Another typical example is a packet broker that can sit in the middle of all these tools. Fetch the data from the network and endpoints and then send it back to our existing security tools. Essentially, this ensures that there are no blind spots in the network.

This packet broker tool should support any workload and be able to send information to any existing security tools. We are now bringing information from the network into your existing security tools and adopting a network-centric approach to security.

Summary: Network Security Components

This blog post delved into the critical components of network security, shedding light on their significance and how they work together to protect our digital realm.

Firewalls – The First Line of Defense

Firewalls are the first line of defense against potential threats. Acting as gatekeepers, they monitor incoming and outgoing network traffic, analyzing data packets to determine their legitimacy. By enforcing predetermined security rules, firewalls prevent unauthorized access and protect against malicious attacks.

Intrusion Detection Systems (IDS) – The Watchful Guardians

Intrusion Detection Systems play a crucial role in network security by detecting and alerting against suspicious activities. IDS monitors network traffic patterns, looking for any signs of unauthorized access, malware, or unusual behavior. With their advanced algorithms, IDS helps identify potential threats promptly, allowing for swift countermeasures.

Virtual Private Networks (VPNs) – Securing Data in Transit

Virtual Private Networks establish secure connections over public networks like the Internet. VPNs create a secure tunnel by encrypting data traffic, preventing eavesdropping and unauthorized interception. This secure communication layer is vital when accessing sensitive information remotely or connecting branch offices securely.

Access Control Systems – Restricting Entry

Access Control Systems are designed to manage user access to networks, systems, and data. Through authentication and authorization mechanisms, these systems ensure that only authorized individuals can gain entry. Organizations can minimize the risk of unauthorized access and data breaches by implementing multi-factor authentication and granular access controls.

Security Incident and Event Management (SIEM) – Centralized Threat Intelligence

SIEM systems provide a centralized platform for monitoring and managing security events across an organization’s network. SIEM enables real-time threat detection, incident response, and compliance management by collecting and analyzing data from various security sources. This holistic approach to security empowers organizations to stay one step ahead of potential threats.

Conclusion:

Network security is a multi-faceted discipline that relies on a combination of robust components to protect against evolving threats. Firewalls, IDS, VPNs, access control systems, and SIEM collaborate to safeguard our digital realm. By understanding these components and implementing a comprehensive network security strategy, organizations can fortify their defenses and ensure the integrity and confidentiality of their data.

data center design

Open Networking

by Publications

Open Networking

In today's digital age, where connectivity is the lifeline of businesses and individuals alike, open networking has emerged as a transformative approach. This blogpost delves into the concept of open networking, its benefits, and its potential to revolutionize the way we connect and communicate.

Open networking refers to a networking model that promotes interoperability, flexibility, and innovation. Unlike traditional closed networks that rely on proprietary systems, open networking embraces open standards, open source software, and open APIs. This approach enables organizations to break free from vendor lock-in, customize their network infrastructure, and foster collaborative development.

- Enhanced Agility and Scalability: Open networking empowers businesses to adapt swiftly to changing requirements. By decoupling hardware and software layers, organizations gain the flexibility to scale their networks seamlessly and introduce new services efficiently. This agility is crucial in today's dynamic business landscape.

- Cost-Effectiveness: With open networking, businesses can leverage commodity hardware and software-defined solutions, reducing capital expenditures. Moreover, the use of open source software eliminates costly licensing fees, making it an economically viable option for organizations of all sizes.

- Interoperability and Vendor Neutrality: Open networking promotes interoperability between different vendors' products, fostering a vendor-neutral environment. This not only frees organizations from vendor lock-in but also encourages healthy competition, driving innovation and ensuring the best solutions for their specific needs.

- Data Centers and Cloud Networks: Open networking has found significant applications in data centers and cloud networks. By embracing open standards and software-defined architectures, organizations can create agile and scalable infrastructure, enabling efficient management of virtual resources and enhancing overall performance.

- Campus Networks and Enterprise Connectivity: In the realm of campus networks, open networking allows organizations to tailor their network infrastructure to meet specific demands. Through open APIs and programmability, businesses can integrate various systems and applications, enhancing connectivity, security, and productivity.

- Telecommunications and Service Providers: Telecommunications and service providers can leverage open networking to deliver innovative services and improve customer experiences. By adopting open source solutions and virtualization, they can enhance network efficiency, reduce costs, and introduce new revenue streams with ease.

Open networking presents a transformative paradigm shift, empowering organizations to unleash the full potential of connectivity. By embracing open standards, flexibility, and collaboration, businesses can achieve enhanced agility, cost-effectiveness, and interoperability. Whether in data centers, campus networks, or telecommunications, open networking opens doors to innovation and empowers organizations to shape their network infrastructure according to their unique needs.

Matt Conran

Highlights: Open Networking

**Fostering Innovation**

a) Open Networking refers to a network where networking hardware devices are separated from software code. Enterprises can flexibly choose equipment, software, and networking operating systems (OS) by using open standards and bare-metal hardware. An open network provides flexibility, agility, and programmability.

b) Additionally, open networking effectively separates hardware from software. This approach enhances component compatibility, interoperability, and expandability. In this way, enterprises gain greater flexibility, which facilitates their development.

c) Open networking relies on open standards, which allow for seamless integration between different hardware and software components, regardless of the vendor. This approach not only reduces dependency on single-source suppliers but also encourages a competitive market, fostering innovation and driving down costs.

d) Furthermore, open networking solutions are often built on open-source software, which benefits from the collective expertise of a global community of developers and engineers.

At present, Open Networking is enabled by: 

  • A. Open Source Software 
  • B. Open Network Devices 
  • C. Open Compute Hardware 
  • D. Software Defined Networks 
  • E. Network Function Virtualisation 
  • F. Cloud Computing 
  • G. Automation 
  • H. Agile Methods & Processes 

Defining Open Networking

Open Networking is much broader than other definitions, but it’s the only definition that doesn’t create more solution silos or bend the solution outcome to a buzzword or competing technology.  There is a need for a holistic definition of open networking that is inclusive and holistic and produces the best results. 

As a result of these technologies, hardware-based, specific-function, and proprietary components are being replaced by more generic and more straightforward hardware, and software is being migrated to perform more critical functions.

Open Networking in Practice:

Open Networking is already making its mark across various industries. Cloud service providers, for example, rely heavily on Open Networking principles to build scalable and flexible data center networks. Telecom operators also embrace Open Networking to deploy virtualized network functions, enabling them to offer services more efficiently and adapt to changing customer demands.

**Role of SDN and NFV**

Moreover, adopting software-defined networking (SDN) and network function virtualization (NFV) further accelerates the realization of the benefits of open networking. SDN separates the control plane from the data plane, providing centralized network management and programmability. NFV virtualizes network functions, allowing for dynamic provisioning and scalability. 

A. Use Cases and Real-World Examples: 

Data Centers and Cloud Computing: Open networking has gained significant traction in data centers and cloud computing environments. By leveraging open networking principles, organizations can build scalable and flexible data center networks that seamlessly integrate with cloud platforms, enabling efficient data management and resource allocation.

**Separate Control from Data Plane**

Software-Defined Networking (SDN): SDN is an example of open networking principles. By separating the control plane from the data plane, SDN enables centralized network management, automation, and programmability. This approach empowers network administrators to dynamically configure and optimize network resources, improving performance and reducing operational overhead.

B. Key Open Networking Projects:

Open Network Operating System (ONOS): ONOS is a collaborative project that focuses on creating an open-source, carrier-grade SDN (Software-Defined Networking) operating system. It provides a scalable platform for building network applications and services, facilitating innovation and interoperability.

OpenDaylight (ODL): ODL is a modular, extensible, open-source SDN controller platform. It aims to accelerate SDN adoption by providing developers and network operators with a common platform to build and deploy network applications.

FRRouting (FRR): FRR is an open-source IP routing protocol suite that supports various routing protocols, including OSPF, BGP, and IS-IS. It offers a flexible and scalable routing solution, enabling network operators to optimize their routing infrastructure.

The Role of Transformation

Infrastructure: Embrace Transformation:

To undertake an effective SDN data center transformation strategy, we must accept that demands on data center networks come from internal end-users, external customers, and considerable changes in the application architecture. All of these factors put pressure on traditional data center architecture.

Dealing effectively with these demands requires the network domain to become more dynamic, potentially introducing Open Networking and Open Networking solutions. For this to occur, we must embrace digital transformation and the changes it will bring to our infrastructure. Unfortunately, keeping current methods is holding back this transition.

Modern Network Infrastructure:

In modern network infrastructures, as has been the case on the server side for many years, customers demand supply chain diversification regarding hardware and silicon vendors. This diversification reduces the Total Cost of Ownership because businesses can drive better cost savings. In addition, replacing the hardware underneath can be seamless because the software above is standard across both vendors.

Leaf and Spine Architecture:

Further, as architectures streamline and spine leaf architecture increases from the data center to the backbone and the Edge, a typical software architecture across all these environments brings operational simplicity. This perfectly aligns with the broader trend of IT/OT convergence.  

Working with Open Source Software

Linux Networking

One remarkable aspect of Linux networking is the abundance of powerful tools available for network configuration. From the traditional ifconfig and route commands to the more recent ip command, this section will introduce various tools and their functionalities.

Virtual Switching: Open vSwitch

What is Open vSwitch?

Open vSwitch is a multilayer virtual switch that enables network automation and management in virtualized environments. It bridges virtual machines (VMs) and the physical network, allowing seamless communication and control over network traffic. With its extensible architecture and robust feature set, Open vSwitch offers a flexible and scalable networking solution.

Open vSwitch offers many features, making it a popular choice among network administrators and developers. Some of its key capabilities include:

1. Virtual Network Switching: Open vSwitch can create and manage virtual switches, ports, and bridges, creating complex network topologies within virtualized environments.

2. Flow Control: With Open vSwitch, you can define and control network traffic flow using flow rules. This enables advanced traffic management, filtering, and QoS (Quality of Service) capabilities.

3. Integration with SDN Controllers: Open vSwitch seamlessly integrates with various Software-Defined Networking (SDN) controllers, providing centralized management and control of network resources.

Containers & Docker Networking

Docker networking revolves around containers, networks, and endpoints. Containers are isolated environments that run applications, while networks act as virtual channels for communication. Endpoints, on the other hand, are unique identifiers attached to containers within a network. Understanding these fundamental concepts is crucial for grasping Docker network connectivity.

Docker Networking Fundamentals

Docker networking operates on a virtual network that allows containers to communicate securely. Docker creates a bridge network called “docker0” by default and assigns each container a unique IP address. This isolation ensures that containers can run independently without interfering with each other.

The default bridge network in Docker is an internal network that connects containers running on the same host. Containers within this network can communicate with each other using IP addresses. However, containers on different hosts cannot directly communicate over the bridge network.

Orchestrator: Understanding Docker Swarm

Docker Swarm, a native clustering and orchestration tool for Docker, allows the management of a cluster of Docker nodes as a single virtual system. It provides high availability, scalability, and ease of use for deploying and managing containerized applications. With its intuitive user interface and powerful command-line interface, Docker Swarm simplifies managing container clusters.

Related: For pre-information, you may find the following posts helpful:

  1. OpenFlow Protocol
  2. Software-defined Perimeter Solutions
  3. Network Configuration Automation
  4. SASE Definition
  5. Network Overlays
  6. Overlay Virtual Networking

Open Networking Solutions

Open Networking: The Solutions

Now, let’s look at the evolution of data centers to see how we can achieve this modern infrastructure. To evolve and keep up with current times, you should use technology and your infrastructure as practical tools. You will be able to drive the entire organization to become digital. Of course, the network components will play a key role. Still, the digital transformation process is an enterprise-wide initiative focusing on fabric-wide automation and software-defined networking.

A. Lacking fabric-wide automation:

One central pain point I have seen throughout networking is the necessity to dispense with manual work lacking fabric-wide automation. In addition, it’s common to deploy applications by combining multiple services that run on a distributed set of resources. As a result, configuration and maintenance are much more complex than in the past. You have two options to implement all of this.

Undertaking Manual or Automated Approach

First, you can connect these services by manually spinning up the servers, installing the necessary packages, and SSHing to each one. Alternatively, you can go toward open network solutions with automation, particularly Ansible automation with Ansible Engine or Ansible Tower with automation mesh. As automation best practice, use Ansible variables for flexible playbook creation that can be easily shared and used amongst different environments.  

B. Fabric-wide automation and SDN:

However, deploying a VRF or any technology, such as an anycast gateway, is a dynamic global command in a software-defined environment. We now have fabric-wide automation and can deploy with one touch instead of numerous box-by-box configurations. 

We are moving from a box-by-box configuration to the atomic programming of a single entity’s distributing fabric. This allows us to carry out deployments with one configuration point quickly and without human error.

C. Configuration management:

Manipulating configuration files by hand is tedious, error-prone, and time-consuming. Equally, performing pattern matching to make changes to existing files is risky. The manual approach will result in configuration drift, where some servers will drift from the desired state. 

Configuration Drift: Configuration drift is caused by inconsistent configuration items across devices, usually due to manual changes and updates and not following the automation path. Ansible architecture can maintain the desired state across various managed assets.

Storing Managed Assets: Managed assets, which can range from distributed firewalls to Linux hosts, are stored in an inventory file, which can be static or dynamic. Dynamic inventories are best suited for a cloud environment where you want to gather host information dynamically. Ansible is all about maintaining the desired state for your domain.

Challenge: The issue of Silos

To date, the networking industry has been controlled by a few vendors. We have dealt with proprietary silos in the data center, campus/enterprise, and service provider environments. The major vendors will continue to provide a vertically integrated lock-in solution for most customers. They will not allow independent, 3rd party network operating system software to run on their silicon.

Required: Modular & Open

Typically, these silos were able to solve the problems of the time. The modern infrastructure needs to be modular, open, and straightforward. Vendors need to allow independent, 3rd party network operating systems to run on their silicon to break from being a vertically integrated lock-in solution. Cisco has started this for the broader industry regarding open networking solutions with the announcement of the Cisco Silicon ONE. 

The Rise of Open Networking Solutions

New data center requirements have emerged; therefore, the network infrastructure must break the silos and transform to meet these trending requirements. One can view the network transformation as moving from a static and conservative mindset that results in cost overrun and inefficiencies to a dynamic routed environment that is simple, scalable, secure, and can reach the far edge. For effective network transformation, we need several stages. 

**Routed Data Center Design**

Firstly, transition to a routed data center design with a streamlined leaf-spine architecture and a standard operating system across cloud, Edge, and 5G networks. A viable approach would be to do all this with open standards, without proprietary mechanisms. Then, we need good visibility.

**Networking and Visibility**

As part of the transformation, the network is no longer considered a black box that needs to be available and provide connectivity to services. Instead, the network is a source of deep visibility that can aid a large set of use cases: network performance, monitoring, security, and capacity planning, to name a few. However, visibility is often overlooked with an over-focus on connectivity and not looking at the network as a valuable source of information.

**Monitoring at a Flow level**

For efficient network management, we must provide deep visibility for the application at a flow level on any port and device type. You would deploy a redundant monitoring network if you want something comparable today. Such a network would consist of probes, packet brokers, and tools to process the packet for metadata.

**Packet Brokers: Traditional Tooling**

Traditional network monitoring tools like packet brokers require life cycle management. A more viable solution would integrate network visibility into the fabric and would not need many components. This would enable us to do more with the data and aid in agility for ongoing network operations.

Note: Observability: Detecting the unknown

There will always be some requirement for application optimization or a security breach, where visibility can help you quickly resolve these issues. Monitoring is used to detect known problems and is only valid with pre-defined dashboards that show a problem you have seen before, such as capacity reaching its limit.

On the other hand, we have the practices of Observability that can detect unknown situations and are used to aid those in getting to the root cause of any problem, known or unknown: 

Example Visibility Technology: sFlow

What is sFlow?

sFlow is a network monitoring technology that allows for real-time, granular network traffic analysis. By sampling packets at high speeds, sFlow provides a comprehensive view of network behavior, capturing key data such as source and destination addresses, port numbers, and traffic volumes. This invaluable information serves as the foundation for network optimization and security.

Evolution of the Data Center

**Several Important Design Phases**

We are transitioning, and the data center has undergone several design phases. Initially, we started with layer 2 silos, suitable for the north-to-south traffic flows. However, layer 2 designs hindered east-west communication traffic flows of modern applications and restricted agility, which led to a push to break network boundaries.

**Layer 3 Routing & Overlay Networking**

Hence, routing at the top of the rack (ToR) with overlays between ToR is moved to drive inter-application communication. This is the most efficient approach, which can be accomplished in several ways. 

The demand for leaf and spine “clos” started in the data center and spread to other environments. A closed network is a type of non-blocking, multistage switching architecture.

This network design extends from the central/backend data center to the micro data centers at the EdgeEdge. Various parts of the edge network, PoPs, central offices, and packet core have all been transformed into leaf and spine “clos” designs. 

The network overlay

When increasing agility, building a complete network overlay is common to all software-defined technologies. An overlay is a solution abstracted from the underlying physical infrastructure. This means separating and disaggregating the customer applications or services from the network infrastructure. Think of it as a sandbox or private network for each application on an existing network.

Example: Overlay Networking with VXLAN

The network overlay is more often created with VXLAN. The Cisco ACI uses an ACI network of VXLAN for the overlay, and the underlay is a combination of BGP and IS-IS. The overlay abstracts a lot of complexity, and Layer 2 and 3 traffic separation is done with a VXLAN network identifier (VNI).

The VXLAN overlay

VXLAN uses a 24-bit network segment ID, called a VXLAN network identifier (VNI), for identification. This is much larger than the 12 bits used for traditional VLAN identification. The VNI is just a fancy name for a VLAN ID, but it now supports up to 16 Million VXLAN segments. 

Challenge: Traditional VLANs

This is considerably more than the traditional 4094-supported endpoints with VLANs. Not only does this provide more hosts, but it also enables better network isolation capabilities, with many little VXLAN segments instead of one large VLAN domain.

Required: Better Isolation and Scalability

The VXLAN network has become the de facto overlay protocol and brings many advantages to network architecture regarding flexibility, isolation, and scalability. VXLAN effectively implements an Ethernet segment that virtualizes a thick Ethernet cable.

Use Case: – **VXLAN Flood and Learn**

Flood and learn is a crucial mechanism within VXLAN that enables the dynamic discovery of VXLAN tunnels and associated endpoints. When a VXLAN packet reaches a switch, and the destination MAC address is unknown, the switch utilizes flood and learns to broadcast the packet to all its VXLAN tunnels. The receiving tunnel endpoints then examine the packet, learn the source MAC address, and update their forwarding tables accordingly.

Traditional policy deployment

Traditionally, deploying an application to the network involves propagating the policy to work through the entire infrastructure. Why? Because the network acts as an underlay, segmentation rules configured on the underlay are needed to separate different applications and services.

This creates a rigid architecture that cannot react quickly and adapt to changes, therefore lacking agility. The applications and the physical network are tightly coupled. Now, we can have a policy in the overlay network with proper segmentation per customer.

1. Virtual Networking & ToR switches

Virtual networks and those built with VXLAN are built from servers or ToR switches. Either way, the underlying network transports the traffic and doesn’t need to be configured to accommodate the customer application. Everything, including the policy, is done in the overlay network, which is most efficient when done in a fully distributed manner.

2. Flexibility of Overlay Networking

Now, application and service deployment occurs without touching the physical infrastructure. For example, if you need to have Layer 2 or Layer 3 paths across the data center network, you don’t need to tweak a VLAN or change routing protocols.  Instead, you add a VXLAN overlay network. This approach removes the tight coupling between the application and network, creating increased agility and simplicity in deploying applications and services.

**Key Point: Extending from the data center**

Edge computing creates a fundamental disruption among the business infrastructure teams. We no longer have the framework where IT only looks at the backend software, such as Office365, and OT looks at the routing and switching product-centric elements. There is convergence.

Therefore, you need many open APIs. The edge computing paradigm brings processing closer to the end devices, reducing latency and improving the end-user experience. It would help if you had a network that could work with this model to support this. Having different siloed solutions does not work. 

3. Required: Common software architecture

So the data center design went from the layer 2 silo to the leaf and spine architecture with routing to the ToR. However, there is another missing piece. We need a standard operating software architecture across all the domains and location types for switching and routing to reduce operating costs. The problem remains that even on one site, there can be several different operating systems.

I have experienced the operational challenge of having many Cisco operating systems on one site through recent consultancy engagements. For example, I had an IOS XR for service provider product lines, IOS XE for enterprise, and NS OX for the data center, all on a single site.

4. Challenge: The traditional integrated vendor

Traditionally, networking products were a combination of hardware and software that had to be purchased as an integrated solution. Conversely, open networking disaggregates hardware from software, allowing IT to mix and match at will.

With Open Networking, we are not reinventing how packets are forwarded or routers communicate. With Open Networking solutions, you are never alone and never the only vendor. The value of software-defined networking and Open Networking is doing as much as possible in software so you don’t depend on delivering new features from a new generation of hardware. If you want a new part, it’s quickly implemented in software without swapping the hardware or upgrading line cards.

5. Required: Move intelligence to software.

You want to move as much intelligence as possible into software, thus removing the intelligence from the physical layer. You don’t want to build in hardware features; you want to use the software to provide the new features. This is a critical philosophy and is the essence of Open Networking. Software becomes the central point of intelligence, not the hardware; this intelligence is delivered fabric-wide.

As we have seen with the rise of SASE, customers gain more agility as they can move from generation to generation of services without hardware dependency and without the operational costs of constantly swapping out the hardware.

**SDN Network Design Options**

We have both controller and controllerless options. With a controllerless solution, setup is faster, agility increases, and robustness in single-point-of-failure is provided, particularly for out-of-band management, i.e., connecting all the controllers.

SDN Controllerless & Controller architecture:

A controllerless architecture is more self-healing; anything in the overlay network is also part of the control plane resilience. An SDN controller or controller cluster may add complexity and impede resiliency. Since the network depends on them for operation, they become a single point of failure and can impact network performance. The intelligence kept in a controller can be a point of attack.

So, there are workarounds where the data plane can continue forward without an SDN controller but always avoid a single point of failure or complex ways to have a quorum in a control-based architecture.

We have two main types of automation to consider: day 0 and days 1-2. First and foremost, day 0 automation simplifies and reduces human error when building the infrastructure. Days 1-2 touch the customer more. This may include installing services quickly, e.g., VRF configuration and building Automation into the fabric. 

A. Day 0 automation

As I said, day 0 automation builds basic infrastructures, such as routing protocols and connection information. These stages need to be carried out before installing VLANs or services. Typical tools that software-defined networking uses are Ansible or your internal applications to orchestrate the building of the network.

Fabric Automation Tools

These are known as fabric automation tools. Once the tools discover the switches, the devices are connected in a particular way, and the fabric network is built without human intervention. It simplifies traditional automation, which is helpful in day 0 automation environments.

  • Configuration Management: Ansible is a configuration management tool that can help alleviate manual challenges. Ansible replaces the need for an operator to tune configuration files manually and does an excellent job in application deployment and orchestrating multi-deployment scenarios.  
  • Pre-deployed infrastructure: Ansible does not deploy the infrastructure; you could use other solutions like Terraform that are best suited for this. Terraform is infrastructure as a code tool. Ansible is often described as a configuration management tool and is typically mentioned along the same lines as Puppet, Chef, and Salt. However, there is a considerable difference in how they operate.

Most notably, the installation of agents. Ansible automation is relatively easy to install as it is agentless. The Ansible architecture can be used in large environments with Ansible Tower using the execution environment and automation mesh. I have recently encountered an automation mesh, a powerful overlay feature that enables automation closer to the network’s edge.

Ansible ensures that the managed asset’s current state meets the desired state. It is all about state management. It does this with Ansible Playbooks, more specifically, YAML playbooks. A playbook is a term Ansible uses for a configuration management script that ensures the desired state is met. Essentially, playbooks are Ansible’s configuration management scripts. 

B. Day 1-2 automation

With day 1-2 automation, SDN does two things.

Firstly, installing or provisioning services automatically across the fabric is possible. With one command, human error is eliminated. The fabric synchronizes the policies across the entire network. It automates and disperses the provisioning operations across all devices. This level of automation is not classical, as this strategy is built into the SDN infrastructure. 

Secondly, it integrates network operations and services with virtualization infrastructure managers such as OpenStack, VCenter, OpenDaylight, or, at an advanced level, OpenShift networking SDN. How does the network adapt to the instantiation of new workloads via the systems? The network admin should not even be in the loop if, for example, a new virtual machine (VM) is created. 

A signal that a VM with specific configurations should be created should be propagated to all fabric elements. When the virtualization infrastructure managers provide a new service, you shouldn’t need to touch the network. This represents the ultimate agility as you remove the network components. 

Summary: Open Networking

Networking is vital in bringing people and ideas together in today’s interconnected world. Traditional closed networks have their limitations, but with the emergence of open networking, a new era of connectivity and collaboration has dawned. This blog post explored the concept of open networking, its benefits, and its impact on various industries and communities.

What is Open Networking?

Open networking uses open standards, open-source software, and open APIs to build and manage networks. Unlike closed networks that rely on proprietary systems and protocols, open networking promotes interoperability, flexibility, and innovation. It allows organizations to customize and optimize their networks based on their unique requirements.

Benefits of Open Networking

Enhanced Scalability and Agility: Open networking enables organizations to scale their networks more efficiently and adapt to changing needs. Decoupling hardware and software makes adding or removing network components easier, making the network more agile and responsive.

Cost Savings: With open networking, organizations can choose hardware and software components from multiple vendors, promoting competition and reducing costs. This eliminates vendor lock-in and allows organizations to use cost-effective solutions without compromising performance or reliability.

Innovation and Collaboration: Open networking fosters innovation by encouraging collaboration among vendors, developers, and users. Developers can create new applications and services that leverage the network infrastructure with open APIs and open-source software. This leads to a vibrant ecosystem of solutions that continually push the boundaries of what networks can achieve.

Open Networking in Various Industries

Telecommunications: Open networking has revolutionized the telecommunications industry. Telecom operators can now build and manage their networks using standard hardware and open-source software, reducing costs and enabling faster service deployments. It has also paved the way for the adoption of virtualization technologies like Network Functions Virtualization (NFV) and Software-Defined Networking (SDN).

Data Centers: Open networking has gained significant traction in the world of data centers. Data center operators can achieve greater agility and scalability using open standards and software-defined networking. Open networking also allows for better integration with cloud platforms and the ability to automate network provisioning and management.

Enterprise Networks: Enterprises are increasingly embracing open networking to gain more control over their networks and reduce costs. Open networking solutions offer greater flexibility regarding hardware and software choices, enabling enterprises to tailor their networks to meet specific business needs. It also facilitates seamless integration with cloud services and enhances network security.

Open networking has emerged as a powerful force in today’s digital landscape. Its ability to promote interoperability, scalability, and innovation makes it a game-changer in various industries. Whether revolutionizing telecommunications, transforming data centers, or empowering enterprises, open networking connects the world in ways we never thought possible.

Cisco ACI

ACI Cisco

by Publications

Cisco ACI Components

In today's rapidly evolving technological landscape, organizations are constantly seeking innovative solutions to streamline their network infrastructure. Enter Cisco ACI Networks, a game-changing technology that promises to redefine networking as we know it. In this blog post, we will explore the key features and benefits of Cisco ACI Networks, shedding light on how it is transforming the way businesses design, deploy, and manage their network infrastructure.

Cisco ACI, short for Application Centric Infrastructure, is an advanced networking solution that brings together physical and virtual environments under a single, unified policy framework. By providing a holistic approach to network provisioning, automation, and orchestration, Cisco ACI Networks enable organizations to achieve unprecedented levels of agility, efficiency, and scalability.

Simplified Network Management: Cisco ACI Networks simplify network management by abstracting the underlying complexity of the infrastructure. With a centralized policy model, administrators can define and enforce network policies consistently across the entire network fabric, regardless of the underlying hardware or hypervisor.

Enhanced Security: Security is a top concern for any organization, and Cisco ACI Networks address this challenge head-on. By leveraging microsegmentation and integration with leading security platforms, ACI Networks provide granular control and visibility into network traffic, helping organizations mitigate potential threats and adhere to compliance requirements.

Scalability and Flexibility: The dynamic nature of modern business demands a network infrastructure that can scale effortlessly and adapt to changing requirements. Cisco ACI Networks offer unparalleled scalability and flexibility, allowing businesses to seamlessly expand their network footprint, add new services, and deploy applications with ease.

Data Center Virtualization: Cisco ACI Networks have revolutionized data center virtualization by providing a unified fabric that spans physical and virtual environments. This enables organizations to achieve greater operational efficiency, optimize resource utilization, and simplify the deployment of virtualized workloads.

Multi-Cloud Connectivity: In the era of hybrid and multi-cloud environments, connecting and managing disparate cloud services can be a daunting task. Cisco ACI Networks facilitate seamless connectivity between on-premises data centers and various public and private clouds, ensuring consistent network policies and secure communication across the entire infrastructure.

Cisco ACI Networks offer a paradigm shift in network infrastructure, empowering organizations to build agile, secure, and scalable networks tailored to their specific needs. With its comprehensive feature set, simplified management, and seamless integration with virtual and cloud environments, Cisco ACI Networks are poised to shape the future of networking. Embrace this transformative technology, and unlock a world of possibilities for your organization.

Matt Conran

Highlights: Cisco ACI Components

The ACI Fabric

Cisco ACI is a software-defined networking (SDN) solution that integrates with software and hardware. With the ACI, we can create software policies and use hardware for forwarding, an efficient and highly scalable approach offering better performance. The hardware for ACI is based on the Cisco Nexus 9000 platform product line. The APIC centralized policy controller drives the software, which stores all configuration and statistical data.

–The Cisco Nexus Family–

To build the ACI underlay, you must exclusively use the Nexus 9000 family of switches. You can choose from modular Nexus 9500 switches or fixed 1U to 2U Nexus 9300 models. Specific models and line cards are dedicated to the spine function in ACI fabric; others can be used as leaves, and some can be used for both purposes. You can combine various leaf switches inside one fabric without any limitations.

a) Cisco ACI Fabric: Cisco ACI’s foundation lies in its fabric, which forms the backbone of the entire infrastructure. The ACI fabric comprises leaf switches, spine switches, and the application policy infrastructure controller (APIC). Each component ensures a scalable, agile, and resilient network.

b) Leaf Switches: Leaf switches serve as the access points for endpoints within the ACI fabric. They provide connectivity to servers, storage devices, and other network devices. With their high port density and advanced features, such as virtual port channels (vPCs) and fabric extenders (FEX), leaf switches enable efficient and flexible network designs.

c) Spine Switches: Spine switches serve as the core of the ACI fabric, providing high-bandwidth connectivity between the leaf switches. They use a non-blocking, multipath forwarding mechanism to ensure optimal traffic flow and eliminate bottlenecks. With their modular design and support for advanced protocols like Ethernet VPN (EVPN), spine switches offer scalability and resiliency.

d) Application Policy Infrastructure Controller (APIC): At the heart of Cisco ACI is the APIC, a centralized management and policy control plane. The APIC acts as a single control point, simplifying network operations and enabling policy-based automation. It provides a comprehensive view of the entire fabric, allowing administrators to define and enforce policies across the network.

e) Integration with Virtualization and Cloud Environments: Cisco ACI seamlessly integrates with virtualization platforms such as VMware vSphere and Microsoft Hyper-V and cloud environments like Amazon Web Services (AWS) and Microsoft Azure. This integration enables consistent policy enforcement and visibility across physical, virtual, and cloud infrastructures, enhancing agility and simplifying operations.

–ACI Architecture: Spine and Leaf–

To be used as ACI spines or leaves, Nexus 9000 switches must be equipped with powerful Cisco CloudScale ASICs manufactured using 16-nm technology. The following figure shows the Cisco ACI based on the Nexus 9000 series. Cisco Nexus 9300 and 9500 platform switches support Cisco ACI. As a result, organizations can use them as spines or leaves to utilize an automated, policy-based systems management approach fully. 

Cisco ACI Components
Diagram: Cisco ACI Components. Source is Cisco

**Hardware-based Underlay**

Server virtualization helped by decoupling workloads from the hardware, making the compute platform more scalable and agile. However, the server is not the main interconnection point for network traffic. So, we need to look at how we could virtualize the network infrastructure similarly to the agility gained from server virtualization.

**Mapping Network Endpoints**

This is carried out with software-defined networking and overlays that could map network endpoints and be spun up and down as needed without human intervention. In addition, the SDN architecture includes an SDN controller and an SDN network that enables an entirely new data center topology.

**Specialized Forwarding Chips**

In ACI, hardware-based underlay switching offers a significant advantage over software-only solutions due to specialized forwarding chips. Furthermore, thanks to Cisco’s ASIC development, ACI brings many advanced features, including security policy enforcement, microsegmentation, dynamic policy-based redirect (inserting external L4-L7 service devices into the data path), or detailed flow analytics—besides the vast performance and flexibility.

Related: For pre-information, you may find the following helpful:

  1. Data Center Security 
  2. VMware NSX

Cisco ACI Components

 Introduction to Leaf and Spine

The Cisco SDN ACI works with a Clos architecture, a fully meshed ACI network. Based on a spine leaf architecture. As a result, every Leaf is physically connected to every Spine, enabling traffic forwarding through non-blocking links. Physically, a leaf switch set creates a leaf layer attached to the spines in a full BIPARTITE graph. This means that each Leaf is connected to each Spine, and each Spine is connected to each Leaf. 

The ACI uses a horizontally elongated Leaf and Spine architecture with one hop to every host in an entirely messed ACI fabric, offering good throughput and convergence needed for today’s applications.

The ACI fabric: Does Not Aggregate Traffic

A key point in the spine-and-leaf design is the fabric concept, like a stretch network. One of the core ideas around a fabric is that it does not aggregate traffic. This does increase data center performance along with a non-blocking architecture. With the spine-leaf topology, we are spreading a fabric across multiple devices.

Required: Increased Bandwidth Available

The result of the fabric is that each edge device has the total bandwidth of the fabric available to every other edge device. This is one big difference from traditional data center designs; we aggregate the traffic by either stacking multiple streams onto a single link or carrying the streams serially.

Challenge: Oversubscription

With the traditional 3-tier design, we aggregate everything at the core, leading to oversubscription ratios that degrade performance. With the ACI Leaf and Spine design, we spread the load across all devices with equidistant endpoints, allowing us to carry the streams parallel.

Required: Routed Multipathing

Then, we have horizontal scaling load balancing.  Load balancing with this topology uses multipathing to achieve the desired bandwidth between the nodes. Even though this forwarding paradigm can be based on Layer 2 forwarding ( bridging) or Layer 3 forwarding ( routing), the ACI leverages a routed approach to the Leaf and Spine design, and we have Equal Cost Multi-Path (ECMP) for both Layer 2 and Layer 3 traffic. 

**Overlay and Underlay Design**

Mapping Traffic:

So you may be asking how we can have Layer 3 routed core and pass Layer 2 traffic. This is done using the overlay, which can map different traffic types to other overlays. So, we can have Layer 2 traffic mapped to an overlay over a routed core.

L3 active-active links: ACI links between the Leaf and the Spine switches are L3 active-active links. Therefore, we can intelligently load balance and traffic steer to avoid issues. We don’t need to rely on STP to block links or involve STP in fixing the topology.

Challenge: IP – Identity & Location

When networks were first developed, there was no such thing as an application moving from one place to another while it was in use. So, the original architects of IP, the communication protocol used between computers, used the IP address to indicate both the identity of a device connected to the network and its location on the network. Today, in the modern data center, we need to be able to communicate with an application or application tier, no matter where it is.

Required: Overlay Encapsulation

One day, it may be in location A and the next in location B, but its identity, which we communicate with, is the same on both days. An overlay is when we encapsulate an application’s original message with the location to which it needs to be delivered before sending it through the network. Once it arrives at its final destination, we unwrap it and deliver the original message as desired.

The identities of the devices (applications) communicating are in the original message, and the locations are in the encapsulation, thus separating the place from the identity. This wrapping and unwrapping is done on a per-packet basis and, therefore, must be done quickly and efficiently.

**Overlay and Underlay Components**

The Cisco SDN ACI has an overlay and underlay concept, which forms a virtual overlay solution. The role of the underlay is to glue together devices so the overlay can work and be built on top. So, the overlay, which is VXLAN, runs on top of the underlay, which is IS-IS. In the ACI, the IS-IS protocol provides the routing for the overlay, which is why we can provide ECMP from the Leaf to the Spine nodes. The routed underlay provides an ECMP network where all leaves can access Spine and have the same cost links. 

ACI overlay
Diagram: Overlay. Source Cisco

Underlay & Overlay Interaction

Example: 

Let’s take a simple example to illustrate how this is done. Imagine that application App-A wants to send a packet to App-B. App-A is located on a server attached to switch S1, and App-B is initially on switch S2. When App-A creates the message, it will put App-B as the destination and send it to the network; when the message is received at the edge of the network, whether a virtual edge in a hypervisor or a physical edge in a switch, the network will look up the location of App-B in a “mapping” database and see that it is attached to switch S2.

It will then put the address of S2 outside of the original message. So, we now have a new message addressed to switch S2. The network will forward this new message to S2 using traditional networking mechanisms. Note that the location of S2 is very static, i.e., it does not move, so using traditional mechanisms works just fine.

Upon receiving the new message, S2 will remove the outer address and thus recover the original message. Since App-B is directly connected to S2, it can easily forward the message to App-B. App-A never had to know where App-B was located, nor did the network’s core. Only the edge of the network, specifically the mapping database, had to know the location of App-B. The rest of the network only had to see the location of switch S2, which does not change.

Let’s now assume App-B moves to a new location switch S3. Now, when App-A sends a message to App-B, it does the same thing it did before, i.e., it addresses the message to App-B and gives the packet to the network. The network then looks up the location of App-B and finds that it is now attached to switch S3. So, it puts S3’s address on the message and forwards it accordingly. At S3, the message is received, the outer address is removed, and the original message is delivered as desired.

App-A did not track App-B’s movement at all. App-B’s address identified It, while the switch’s address, S2 or S3, identified its location. App-A can communicate freely with App-B no matter where It is located, allowing the system administrator to place App-B in any area and move it as desired, thus achieving the flexibility needed in the data center.

Multicast Distribution Tree (MDT)

We have a Multicast Distribution Tree MDT tree on top that is used to forward multi-destination traffic without having loops. The Multicast distribution tree is dynamically built to send flood traffic for specific protocols. Again, it does this without creating loops in the overlay network. The tunnels created for the endpoints to communicate will have tunnel endpoints. The tunnel endpoints are known as the VTEP. The VTEP addresses are assigned to each Leaf switch from a pool that you specify in the ACI startup and discovery process.

Normalize the transports

VXLAN tunnels in the ACI fabric normalize the transports in the ACI network. Therefore, traffic between endpoints can be delivered using the VXLAN tunnel, resulting in any transport network regardless of the device connecting to the fabric. 

So, using VXLAN in the overlay enables any network, and you don’t need to configure anything special on the endpoints for this to happen. The endpoints that connect to the ACI fabric do not need special software or hardware. The endpoints send regular packets to the leaf nodes they are connected to directly or indirectly. As endpoints come online, they send traffic to reach a destination.

Bridge Domains and VRF

Therefore, the Cisco SDN ACI under the hood will automatically start to build the VXLAN overlay network for you. The VXLAN network is based on the Bridge Domain (BD), or VRF ACI constructs deployed to the leaf switches. The Bridge Domain is for Layer 2, and the VRF is for Layer 3. So, as devices come online and send traffic to each other, the overlay will grow in reachability in the Bridge Domain or the VRF. 

Direct host routing for endoints

Routing within each tenant, VRF is based on host routing for endpoints directly connected to the Cisco ACI fabric. For IPv4, the host routing is based on the /32, giving the ACI a very accurate picture of the endpoints. Therefore, we have exact routing in the ACI.  In conjunction, we have a COOP database that runs on the Spines and offers remarkably optimized fabric to know where all the endpoints are located.

To facilitate this, every node in the fabric has a TEP address, and we have different types of TEPs depending on the device’s role. The Spine and the Leaf will have TEP addresses but will differ from each other.

COOP database
Diagram: COOP database

The VTEP and PTEP

The Leaf’s nodes are the Virtual Tunnel Endpoints (VTEP), which are also known as the physical tunnel endpoints (PTEP) in ACI. These PTEP addresses represent the “WHERE” in the ACI fabric where an endpoint lives. Cisco ACI uses a dedicated VRF and a subinterface of the uplinks from the Leaf to the Spines as the infrastructure to carry VXLAN traffic. In Cisco ACI terminology, the transport infrastructure for VXLAN traffic is known as Overlay-1, which is part of the tenant “infra.” 

**The Spine TEP**

The Spines also have a PTEP and an additional proxy TEP, which are used for forwarding lookups into the mapping database. The Spines have a global view of where everything is, which is held in the COOP database synchronized across all Spine nodes. All of this is done automatically for you.

**Anycast IP Addressing**

For this to work, the Spines have an Anycast IP address known as the Proxy TEP. The Leaf can use this address if they do not know where an endpoint is, so they ask the Spine for any unknown endpoints, and then the Spine checks the COOP database. This brings many benefits to the ACI solution, especially for traffic optimizations and reducing flooded traffic in the ACI. Now, we have an optimized fabric for better performance.

The ACI optimizations

**Mouse and elephant flow**

This provides better performance for load balancing different flows. For example, in most data centers, we have latency-sensitive flows, known as mouse flows, and long-lived bandwidth-intensive flows, known as elephant flows. 

The ACI has more precisely load-balanced traffic using algorithms that optimize mouse and elephant flows and distribute traffic based on flow lets: flow let load-balancing. Within a Leaf, Spine latency is low and consistent from port to port.

The max latency of a packet from one port to another in the architecture is the same regardless of the network size. So you can scale the network without degrading performance. Scaling is often done on a POD-by-POD basis. For more extensive networks, each POD would be its Leaf and Spine network.

**ARP optimizations: Anycast gateways**

The ACI comes by default with a lot of traffic optimizations. Firstly, instead of using an ARP and broadcasting across the network, that can hamper performance. The Leaf can assume that the Spine will know where the destination is ( and it does via the COOP database ), so there is no need to broadcast to everyone to find a destination.

If the Spine knows where the endpoint is, it will forward the traffic to the other Leaf. If not, it will drop it.

**Fabric anycast addressing**

This again adds performance benefits to the ACI solution as the table sizes on the Leaf switches can be kept smaller than they would if they needed to know where all the destinations were, even if they were not or never needed to communicate with them. On the Leaf, we have an Anycast address too.

These fabric Anycast addresses are available for Layer 3 interfaces. On the Leaf ToR, we can establish an SVI that uses the same MAC address on every ToR; therefore, when an endpoint needs to route to a ToR, it doesn’t matter which ToR you use. The Anycast Address is spread across all ToR leaf switches. 

**Pervasive gateway**

Now we have predictable latency to the first hop, and you will use the local route VRF table within that ToR instead of traversing the fabric to a different ToR. This is the Pervasive Gateway feature that is used on all Leaf switches. The Cisco ACI has many advanced networking features, but the pervasive gateway is my favorite. It does take away all the configuration mess we had in the past.

ACI Cisco: Integrations

  • Routing Control Platform

Then came along Cisco SDN ACI, the ACI Cisco, which operates differently from the traditional data center with an application-centric infrastructure. The Cisco application-centric infrastructure achieves resource elasticity with automation through standard policies for data center operations and consistent policy management across multiple on-premises and cloud instances.

  • Extending & Integrating the fabric

What makes the Cisco ACI interesting is its several vital integrations. I’m not talking about extending the data center with multi-pod and multi-site, for example, with AlgoSec, Cisco AppDynamics, and SD-WAN. AlgoSec enables secure application delivery and policy across hybrid network estates, while AppDynamic lives in a world of distributed systems Observability. SD-WAN enabled path performance per application with virtual WANs.

Cisco Multi-Pod Design

Cisco ACI Multi-Pod is part of the “Single APIC Cluster / Single Domain” family of solutions, as a single APIC cluster is deployed to manage all the interconnected ACI networks. These separate ACI networks are named “pods,” Each looks like a regular two-tier spine-leaf topology. The same APIC cluster can manage several pods, and to increase the resiliency of the solution, the various controller nodes that make up the cluster can be deployed across different pods.

ACI Multi-Pod
Diagram: Cisco ACI Multi-Pod. Source Cisco.

ACI Cisco and AlgoSec

With AlgoSec integrated with the Cisco ACI, we can now provide automated security policy change management for multi-vendor devices and risk and compliance analysis. The AlgoSec Security Management Solution for Cisco ACI extends ACI’s policy-driven automation to secure various endpoints connected to the Cisco SDN ACI fabric.

These simplify network security policy management across on-premises firewalls, SDNs, and cloud environments. They also provide visibility into ACI’s security posture, even across multi-cloud environments. 

ACI Cisco and AppDynamics 

Then, with AppDynamics, we are heading into Observability and controllability. Now, we can correlate app health and network for optimal performance, deep monitoring, and fast root-cause analysis across complex distributed systems with numbers of business transactions that need to be tracked.

This will give your teams complete visibility of your entire technology stack, from your database servers to cloud-native and hybrid environments. In addition, AppDynamics works with agents that monitor application behavior in several ways. We will examine the types of agents and how they work later in this post.

ACI Cisco and SD-WAN 

SD-WAN brings a software-defined approach to the WAN. These enable a virtual WAN architecture to leverage transport services such as MPLS, LTE, and broadband internet services. So, SD-WAN is not a new technology; its benefits are well known, including improving application performance, increasing agility, and, in some cases, reducing costs.

The Cisco ACI and SD-WAN integration makes active-active data center design less risky than in the past. The following figures give a high-level overview of the Cisco ACI and SD-WAN integration. For pre-information generic to SD-WAN, go here: SD-WAN Tutorial

SD WAN integration
Diagram: Cisco ACI and SD-WAN integration

The Cisco SDN ACI with SD-WAN integration helps ensure an excellent application experience by defining application Service-Level Agreement (SLA) parameters. Cisco ACI releases 4.1(1i) and adds support for WAN SLA policies. This feature enables admins to apply pre-configured policies to specify the packet loss, jitter, and latency levels for the tenant traffic over the WAN.

When you apply a WAN SLA policy to the tenant traffic, the Cisco APIC sends the pre-configured policies to a vManage controller. The vManage controller, configured as an external device manager that provides SDWAN capability, chooses the best WAN link that meets the loss, jitter, and latency parameters specified in the SLA policy.

Openshift and Cisco SDN ACI

OpenShift Container Platform (formerly known as OpenShift Enterprise) or OCP is Red Hat’s offering for the on-premises private platform as a service (PaaS). OpenShift is based on the Origin open-source project and is a Kubernetes distribution, the defacto for container-based virtualization. The foundation of the OpenShift networking SDN is based on Kubernetes and, therefore, shares some of the same networking technology along with some enhancements, such as the OpenShift route construct.

Other data center integrations

Cisco SDN ACI has another integration with Cisco DNA Center/ISE that maps user identities consistently to endpoints and apps across the network, from campus to the data center. Cisco Software-Defined Access (SD-Access) provides policy-based automation from the edge to the data center and the cloud.

Cisco SD-Access provides automated end-to-end segmentation to separate user, device, and application traffic without redesigning the network. This integration will enable customers to use standard policies across Cisco SD-Access and Cisco ACI, simplifying customer policy management using Cisco technology in different operational domains.

OpenShift and Cisco ACI

OpenShift does this with an SDN layer and enhances Kubernetes networking to create a virtual network across all the nodes. It is made with the Open Switch standard. For OpenShift SDN, this pod network is established and maintained by the OpenShift SDN, configuring an overlay network using a virtual switch called the OVS bridge. This forms an OVS network that gets programmed with several OVS rules. The OVS is a popular open-source solution for virtual switching.

OpenShift SDN plugin

We mentioned that you could tailor the virtual network topology to suit your networking requirements, which can be determined by the OpenShift SDN plugin and the SDN model you select. With the default OpenShift SDN, several modes are available. This level of SDN mode you choose is concerned with managing connectivity between applications and providing external access to them. Some modes are more fine-grained than others. The Cisco ACI plugins offer the most granular.

Integrating ACI and OpenShift platform

The Cisco ACI CNI plugin for the OpenShift Container Platform provides a single, programmable network infrastructure, enterprise-grade security, and flexible micro-segmentation possibilities. The APIC can provide all networking needs for the workloads in the cluster. Kubernetes workloads become fabric endpoints, like Virtual Machines or Bare Metal endpoints.

Cisco ACI CNI Plugin

The Cisco ACI CNI plugin extends the ACI fabric capabilities to OpenShift clusters to provide IP Address Management, networking, load balancing, and security functions for OpenShift workloads. In addition, the Cisco ACI CNI plugin connects all OpenShift Pods to the integrated VXLAN overlay provided by Cisco ACI.

Cisco SDN ACI and AppDynamics

AppDynamis overview

So, an application requires multiple steps or services to work. These services may include logging in and searching to add something to a shopping cart. These services invoke various applications, web services, third-party APIs, and databases, known as business transactions.

The user’s critical path

A business transaction is the essential user interaction with the system and is the customer’s critical path. Therefore, business transactions are the things you care about. If they start to go, your system will degrade. So, you need ways to discover your business transactions and determine if there are any deviations from baselines. This should also be automated, as learning baseline and business transitions in deep systems is nearly impossible using the manual approach.

So, how do you discover all these business transactions?

AppDynamics automatically discovers business transactions and builds an application topology map of how the traffic flows. A topology map can view usage patterns and hidden flows, acting as a perfect feature for an Observability platform.

AppDynamic topology

AppDynamics will automatically discover the topology for all of your application components. It can then build a performance baseline by capturing metrics and traffic patterns. This allows you to highlight issues when services and components are slower than usual.

AppDynamics uses agents to collect all the information it needs. The agent monitors and records the calls that are made to a service. This is from the entry point and follows executions along its path through the call stack. 

Types of Agents for Infrastructure Visibility

If the agent is installed on all critical parts, you can get information about that specific instance, which can help you build a global picture. So we have an Application Agent, Network Agent, and Machine Agent for Server visibility and Hardware/OS.

  • App Agent: This agent will monitor apps and app servers, and example metrics will be slow transitions, stalled transactions, response times, wait times, block times, and errors.  
  • Network Agent: This agent monitors the network packets, TCP connection, and TCP socket. Example metrics include performance impact Events, Packet loss, and retransmissions, RTT for data transfers, TCP window size, and connection setup/teardown.
  • Machine Agent Server Visibility: This agent monitors the number of processes, services, caching, swapping, paging, and querying. Example Metrics include hardware/software interrupts, virtual memory/swapping, process faults, and CPU/DISK/Memory utilization by the process.
  • Machine Agent: Hardware/OS – disks, volumes, partitions, memory, CPU. Example metrics: CPU busy time, MEM utilization, and pieces file.

Automatic establishment of the baseline

A baseline is essential, a critical step in your monitoring strategy. Doing this manually is hard, if not impossible, with complex applications. It is much better to have this done automatically. You must automatically establish the baseline and alert yourself about deviations from it.

This will help you pinpoint the issue faster and resolve it before it can be affected. Platforms such as AppDynamics can help you here. Any malicious activity can be seen from deviations from the security baseline and performance issues from the network baseline.

Summary: Cisco ACI Components

In the ever-evolving world of networking, organizations are constantly seeking ways to enhance their infrastructure’s performance, security, and scalability. Cisco ACI (Application Centric Infrastructure) presents a cutting-edge solution to these challenges. By unifying physical and virtual environments and leveraging network automation, Cisco ACI revolutionizes how networks are built and managed.

Understanding Cisco ACI Architecture

At the core of Cisco ACI lies a robust architecture that enables seamless integration between applications and the underlying network infrastructure. The architecture comprises three key components:

1. Application Policy Infrastructure Controller (APIC):

The APIC serves as the centralized management and policy engine of Cisco ACI. It provides a single point of control for configuring and managing the entire network fabric. Through its intuitive graphical user interface (GUI), administrators can define policies, allocate resources, and monitor network performance.

2. Nexus Switches:

Cisco Nexus switches form the backbone of the ACI fabric. These high-performance switches deliver ultra-low latency and high throughput, ensuring optimal data transfer between applications and the network. Nexus switches provide the necessary connectivity and intelligence to enable the automation and programmability features of Cisco ACI.

3. Application Network Profiles:

Application Network Profiles (ANPs) are a fundamental aspect of Cisco ACI. ANPs define the policies and characteristics required for specific applications or application groups. By encapsulating network, security, and quality of service (QoS) policies within ANPs, administrators can streamline the deployment and management of applications.

The Power of Network Automation

One of the most compelling aspects of Cisco ACI is its ability to automate network provisioning, configuration, and monitoring. Through the APIC’s powerful automation capabilities, network administrators can eliminate manual tasks, reduce human errors, and accelerate the deployment of applications. With Cisco ACI, organizations can achieve greater agility and operational efficiency, enabling them to rapidly adapt to evolving business needs.

Security and Microsegmentation with Cisco ACI

Security is a paramount concern for every organization. Cisco ACI addresses this by providing robust security features and microsegmentation capabilities. With microsegmentation, administrators can create granular security policies at the application level, effectively isolating workloads and preventing lateral movement of threats. Cisco ACI also integrates with leading security solutions, enabling seamless network enforcement and threat intelligence sharing.

Conclusion:

Cisco ACI is a game-changer in the realm of network automation and infrastructure management. Its innovative architecture, coupled with powerful automation capabilities, empowers organizations to build agile, secure, and scalable networks. By leveraging Cisco ACI’s components, businesses can unlock new levels of efficiency, flexibility, and performance, ultimately driving growth and success in today’s digital landscape.

zero trust network design

Zero Trust SASE

by Publications

Zero Trust SASE

In today's digital age, where remote work and cloud-based applications are becoming the norm, traditional network security measures are no longer sufficient to protect sensitive data. Enter Zero Trust Secure Access Service Edge (SASE), a revolutionary approach that combines the principles of Zero Trust security with the flexibility and scalability of cloud-based architectures. In this blog post, we will delve into the concept of Zero Trust SASE and explore its benefits and implications for the future of network security.

Zero Trust is a security model that operates on "never trust, always verify." It assumes that no user or device should be granted automatic trust within a network, whether inside or outside the perimeter. Instead, every user, device, and application must be continuously authenticated and authorized based on various contextual factors, such as user behavior, device health, and location.

SASE is a comprehensive security framework that combines networking and security capabilities into a single cloud-based service. It aims to simplify and unify network security by providing secure access to applications and data, regardless of the user's location or device.

SASE integrates various security functions, such as secure web gateways, cloud access security brokers, and data loss prevention, into a single service, reducing complexity and improving overall security posture.

Matt Conran

Highlights: Zero Trust SASE

Innovative Security Framework

Zero Trust SASE is an innovative security framework that combines Zero Trust principles with Secure Access Service Edge (SASE) architecture. It emphasizes continuous verification and validation of every user, device, and network resource attempting to access an organization’s network, regardless of location. By adopting a zero-trust approach, organizations can enhance security by eliminating the assumption of trust and implementing stricter access controls.

1. Note: Zero Trust SASE is built upon several key components to create a robust and comprehensive security framework. These components include identity and access management, multi-factor authentication, network segmentation, encryption, continuous monitoring, and threat intelligence integration. Each element is crucial in strengthening network security and protecting against evolving cyber threats.

2. Note: Both SASE and ZTNA are essential components of modern security architecture. However, they are two different solutions. SASE provides a comprehensive, multi-faceted security framework, while ZTNA is a more narrowly focused model focused on limiting resource access, which is a part of SAS

**Challenge: The Lag in Security** 

Today’s digital transformation and strategy initiatives require speed and agility in I.T. However, there is a lag, and that lag is with security. Security can either hold them back or not align with the fluidity needed for agility. As a result, we have decreased an organization’s security posture, which poses a risk that needs to be managed. We have a lot to deal with, such as the rise in phishing attacks, mobile malware, fake public Wi-Fi networks, malicious apps, and data leaks. Therefore, we have new requirements that SASE can help with.

Zero Trust Security

Zero Trust Security is a paradigm shift from the traditional perimeter-based security model. It operates on the principle of “never trust, always verify.” Unlike the old approach, where users and devices were granted broad access once inside the network, Zero Trust Security treats every user, device, and network segment as potentially untrusted. This enhanced approach minimizes the risk of unauthorized access and lateral movement within the network.

Continuous Verification & Strict Access Control

Zero Trust is a security model that operates on the principle of never trusting any network or user by default. It emphasizes continuous verification and strict access control to mitigate potential threats. With Zero Trust, organizations adopt a granular approach to security, ensuring that every user, device, and application is authenticated and authorized before accessing any resources.

Challenge: Large Segments with VLANs

Example Technology: Network Endpoint Groups

**Understanding Micro-segmentation**

Microsegmentation is a critical strategy in modern network management, providing a method to improve security by dividing a network into smaller, isolated segments. This approach ensures that any potential security breaches are contained and do not spread across the network. In the context of Google Cloud, NEGs can be effectively used to implement microsegmentation. By creating smaller, controlled segments, you can enforce security policies more rigorously, reducing the risk of unauthorized access and enhancing the overall security posture of your applications.


network endpoint groups

**The SASE Concept**

Gartner coined the SASE concept after seeing a pattern emerge in cloud and SD-WAN projects where full security integration was needed. We now refer to SASE as a framework and a security best practice. SASE leverages multiple security services into a framework approach.

The idea of SASE was not far from what we already did, which was integrating numerous security solutions into a stack that ensured a comprehensive, layered, secure access solution. By calling it a SASE framework, the approach to a complete solution somehow felt more focused than what the industry recognized as a best security practice.

The security infrastructure and decisions must become continuous and adaptive, not static, that formed the basis of traditional security methods. Consequently, we must enable real-time decisions that balance risk, trust, and opportunity. As a result, security has beyond a simple access control list (ACL) and zone-based segmentation based on VLANs. In reality, no network point acts as an anchor for security.

Example Technology: IPv6 Access Lists 

Many current network security designs and technologies were not designed to handle all the traffic and security threats we face today. This has forced many to adopt multiple-point products to address the different requirements. Remember that for every point product, there is an architecture to deploy, a set of policies to configure, and a bunch of logs to analyze. I find correlating logs across multiple-point product solutions used in different domains hard.

For example, a diverse team may operate the secure web gateways (SWG) to that of the virtual private network (VPN) appliances. It could be the case that these teams work in silos and are in different locations.

Zero Trust SASE requirements:

  1. Information hiding: SASE requires clients to be authenticated and authorized before accessing protected assets, regardless of whether the connection is inside or outside the network perimeter.
  2. Mutually encrypted connections: SASE uses the full TLS standard to provide mutual, two-way cryptographic authentication. Mutual TLS provides this and goes one step further to authenticate the client.
  3. Need to know the access model: SASE employs a need-to-know access model. As a result, SASE permits the requesting client to view only the resources appropriate to the assigned policy.
  4. Dynamic access control: SASE deploys a dynamic firewall that starts with one rule – deny all. Then, requested communication is dynamically inserted into the firewall, providing an active firewall security policy instead of static configurations.
  5. Identity-driven access control: SASE provides adaptive, identity-aware, precision access for those seeking more precise access and session control to applications on-premises and in the cloud.

Starting Zero Trust

Endpoint Security 

Understanding ARP (Address Resolution Protocol)

ARP is a vital network communication protocol that maps an IP address to a physical MAC address. By maintaining an ARP table, endpoints can efficiently communicate within a network. 

Routes and gateways act as the pathways for data transmission between networks. Safeguarding these routes is crucial to ensure network integrity. We will discuss the significance of secure routing protocols, such as OSPF and BGP, and how they contribute to endpoint security. 

Netstat, short for Network Statistics, is a powerful command-line tool providing detailed information about network connections and statistics. This section will highlight the importance of using netstat for monitoring endpoint security. From identifying active connections to detecting suspicious activities, netstat empowers administrators to protect their networks proactively.

Understanding SELinux

SELinux is a robust security framework built into the Linux kernel. It provides fine-grained access control policies and mandatory access controls (MAC) to enforce system-wide security policies. Unlike traditional Linux discretionary access controls (DAC), SELinux operates on the principle of least privilege, ensuring that only authorized actions are allowed.

Organizations can establish a robust security posture for their endpoints by combining SELinux with zero trust principles. SELinux provides granular control over system resources, enabling administrators to define strict policies based on user roles, processes, and system components. This ensures that even if an endpoint is compromised, the attacker’s lateral movement and potential damage are significantly limited.

### Understanding Authentication in Vault

Authentication is the process of verifying the identity of a user or system. In Vault, this is achieved through various authentication methods such as tokens, AppRole, LDAP, GitHub, and more. Each method serves different use cases, allowing flexibility and scalability in managing access. Vault ensures that only authenticated users can access sensitive data, thus mitigating the risk of unauthorized access.

—

### The Role of Authorization

While authentication verifies identity, authorization determines what authenticated users can do. Vault uses policies to define the actions that users and applications can perform. These policies are written in HashiCorp Configuration Language (HCL) or JSON, and they provide a fine-grained control over access to secrets. By segregating duties and defining clear access levels, Vault helps prevent privilege escalation and minimizes the risk of data exposure.

—

### Managing Identity with Vault

Vault’s identity management capabilities allow organizations to unify identities across various platforms. By integrating with identity providers and managing roles and entities, Vault simplifies user management and enhances security. This integration ensures that user credentials are consistently verified and that access rights are updated as roles change, reducing the risk of stale credentials being exploited.

—

Vault

Use Case: WAN Edge Performance Routing

SASE & Performance-Based Routing

Performance-based routing is a dynamic routing technique that selects the best path for network traffic based on real-time performance metrics. Traditional routing protocols often follow static routes, leading to suboptimal network performance. However, performance-based routing leverages latency, packet loss, and bandwidth availability metrics to make informed routing decisions. By continuously evaluating these metrics, networks can adapt and reroute traffic to ensure optimal performance.

Google Cloud & IAP

**Understanding the Basics of IAP**

At its core, Identity-Aware Proxy is a security service that acts as a gatekeeper for applications and resources. It ensures that only authenticated and authorized users can access specific web applications hosted on cloud platforms. Unlike traditional security models that rely on network-level access controls, IAP takes a user-centric approach, verifying identity and context before granting access. This method not only strengthens security but also simplifies access management across distributed environments.

**The Role of IAP in Google Cloud**

Google Cloud offers a versatile and integrated approach to using IAP, making it an attractive option for organizations leveraging cloud services. With Google Cloud’s IAP, businesses can secure their web applications and VMs without the need for traditional VPNs or complex network configurations. This section will delve into how Google Cloud implements IAP, highlighting its seamless integration with other Google Cloud services and the ease with which it can be deployed. By utilizing Google Cloud’s IAP, businesses can streamline their security operations and focus on delivering value to their customers.

**Benefits of Using Identity-Aware Proxy**

The advantages of implementing IAP are manifold. Firstly, it enhances security by enforcing granular access controls based on user identity and context. This reduces the risk of unauthorized access and potential data breaches. Secondly, IAP simplifies the user experience by enabling single sign-on (SSO) capabilities, allowing users to access multiple applications with a single set of credentials. Additionally, IAP’s integration with existing identity providers ensures that businesses can maintain a consistent security policy across their entire IT ecosystem.

Identity aware proxy

Related: For pre-information, you may find the following helpful:

  1. SD-WAN SASE
  2. SASE Model
  3. SASE Solution
  4. Cisco Secure Firewall
  5. SASE Definition

Zero Trust SASE

Many challenges to existing networks and infrastructure create big security holes and decrease security posture. In reality, several I.T. components give the entity more access than required. We have considerable security flaws with using I.P. addresses as a security anchor and static locations; the virtual private networks (VPN) and demilitarized zone (DMZ) architectures used to establish access are often configured to allow excessive implicit trust.  

##Challenge 1: The issue with a DMZ

The DMZ is the neutral network between the Internet and your organization’s private network. It’s protected by a front-end firewall that limits Internet traffic to specific systems within its zone. The DMZ can have a significant impact on security if not appropriately protected. Remote access technologies such as VPN or RDP, often located in the DMZ, have become common targets of cyberattacks. One of the main issues I see with the DMZ is that the bad actors know it’s there. It may be secured, but it’s visible.

##Challenge 2: The issue with the VPN

In basic terms, a VPN provides an encrypted server and hides your IP address. However, the VPN does not secure users when they land on a network segment and is based on coarse-grained access control where the user has access to entire network segments and subnets. Traditionally, once you are on a segment, there will be no intra-filtering on that segment. That means all users in that segment need the same security level and access to the same systems, but that is not always the case. 

GRE without IPsec GRE with IPsec

##Challenge 3: permissive network access

VPNs generally provide broad, overly permissive network access with only fundamental access control limits based on subnet ranges. So, the traditional VPN provides overly permissive access and security based on I.P. subnets. Note: The issue with VLAN-based segmentation is large broadcast domains with free-for-all access. This represents a larger attack surface where lateral movements can take place. Below is a standard VLAN-based network running Spanning Tree Protocol ( STP ).

## Challenge 4: Security-based on trust

Much of the non-zero trust security architecture is based on trust, which bad actors abuse. On the other hand, examining a SASE overview includes zero trust networking and remote access as one of its components, which can adaptively offer the appropriate trust required at the time and nothing more. It is like providing a narrow segmentation based on many contextual parameters continuously assessed for risk to ensure the users are who they are and that the entities, either internal or external to the network, are doing what they are supposed to do.

**Removes excessive trust**

A core feature of SASE and Zero Trust is that it removes the excessive trust once required to allow entities to connect and collaborate. Within a zero-trust environment, our implicit trust in traditional networks is replaced with explicit identity-based trust with a default denial. With an identity-based trust solution, we are not just looking at IP addresses to determine trust levels. After all, they are just binary, deemed a secure private or a less trustworthy public. This assumption is where all of our problems started. They are just ones and zeros.

## Challenge 5: IP for Location and Identity 

To improve your security posture, it would be best to stop relying primarily on IP addresses and network locations as a proxy for trust. We have been doing this for decades. There is minimal context in placing a policy with legacy constructs. To determine the trust of a requesting party, we need to examine multiple contextual aspects, not just IP addresses.

And the contextual aspects are continuously assessed for security posture. This is a much better way to manage risk and allows you to look at the entire picture before deciding to enter the network or access a resource.

Example: Firewall Tagging

Firewall tags

1) SASE: First attempt to 

Organizations have adopted different security technologies to combat these changes and include them in their security stack. Many of the security technologies are cloud-based services. Some of these services include the cloud-based secure web gateway (SWG), content delivery network [CDN], and web application firewall [WAF].

A secure web gateway (SWG) protects users from web-based threats and applies and enforces acceptable corporate use policies. A content delivery network (CDN) is a geographically distributed group of servers that works together to deliver Internet content quickly. A WAF, or web application firewall, helps protect web applications by filtering and monitoring HTTP traffic between them and the Internet.

The data center is the center of the universe.

However, even with these welcomed additions to security, the general trend was that the data center is still the center of most enterprise networks and network security architectures. Let’s face it: These designs are becoming ineffective and cumbersome with the rise of cloud and mobile technology. Traffic patterns have changed considerably, and so has the application logic.

2) SASE: Second attempt to

The next attempt was for a converged cloud-delivered secure access service edge (SASE) to accomplish this shift in the landscape. And that is what SASE architecture does. As you know, the SASE architecture relies on multiple contextual aspects to establish and adapt trust for application-level access. It does not concern itself with significant VLANs and broad-level access or believe that the data center is the center of the universe. Instead, the SASE architecture is often based on PoPs, where each PoP acts as the center of the universe.

The SASE definition and its components are a transformational architecture that can combat many of these discussed challenges. A SASE solution converges networking and security services into one unified, cloud-delivered solution that includes the following core capabilities of sase.

From the network side of things: SASE in networking:

    1. Software-defined wide area network (SD-WAN)
    2. Virtual private network (VPN)
    3. Zero Trust Network ZTN
    4. Quality of service (QoS)
    5. Software-defined perimeter (SDP)

Example SDP Technology: VPC Service Controls

VPC Security Controls VPC Service Controls

From the security side of things, SASE capabilities in security:

    1. Firewall as a service (FWaaS)
    2. Domain Name System (DNS) security
    3. Threat prevention
    4. Secure web gateways
    5. Data loss prevention (DLP)
    6. Cloud access security broker (CASB)

Example Technology: The Web Security Scanner

security web scanner

SASE changes the focal point to the identity of the user and device. With traditional network design, we have the on-premises data center, considered the universe’s center. With SASE, that architecture changes this to match today’s environment and moves the perimeter to the actual user, devices, or PoP with some SASE designs. In contrast to traditional enterprise networks and security architectures, the internal data center is the focal point for access. 

Example Product: Cisco Meraki

### What is Cisco Meraki?

Cisco Meraki is a suite of cloud-managed IT solutions that include wireless, switching, security, EMM (Enterprise Mobility Management), and security cameras, all centrally managed from the web. The Meraki dashboard provides powerful and intuitive tools to manage your entire network from a single pane of glass. This holistic approach ensures that businesses can maintain robust security protocols without compromising on ease of management.

### Key Features of Cisco Meraki

#### Cloud-Based Management

One of the standout features of Cisco Meraki is its cloud-based management. This allows for real-time monitoring, configuration, and troubleshooting from anywhere in the world. With automatic updates and seamless scalability, businesses can ensure their network is always up-to-date and secure.

#### Advanced Security Features

Cisco Meraki offers a range of advanced security features designed to protect your network from various threats. These include intrusion detection and prevention systems (IDS/IPS), advanced malware protection (AMP), and content filtering. By leveraging these tools, businesses can safeguard their data and maintain the integrity of their network.

#### Simplified Deployment

Deploying a traditional network can be a complex and time-consuming task. Cisco Meraki simplifies this process with zero-touch provisioning, which allows devices to be pre-configured and managed remotely. This reduces the need for on-site technical expertise and accelerates the deployment process.

### Benefits of Using Cisco Meraki for Network Security

#### Centralized Control

The centralized control offered by the Meraki dashboard enables IT teams to manage multiple sites from a single interface. This not only streamlines operations but also ensures consistent security policies across all locations.

#### Scalability

As businesses grow, their network needs evolve. Cisco Meraki’s scalable solutions allow for easy expansion without the need for significant infrastructure changes. This flexibility ensures that businesses can adapt to changing demands without compromising on security.

#### Cost Efficiency

By reducing the need for on-site hardware and simplifying management, Cisco Meraki can lead to significant cost savings. Additionally, the reduced need for technical expertise can lower operational costs, making it an attractive option for businesses looking to optimize their IT budget.

VPN Security Scenario 

  • Challenge: Traditional remote access VPNs

Remote access VPNs are primarily built to allow users outside the perimeter firewall to access resources inside the perimeter firewall. As a result, they often follow a hub-and-spoke architecture, with users connected by tunnels of various lengths depending on their distance from the data center. Traditional VPNs introduce a lot of complexity. For example, what do you do if you have multiple sites where users need to access applications? In this scenario, the cost of management would be high. 

  • Challenge: Tunnel based on I.P

What’s happening here is that the tunnel creates an extension between the client device and the application location. The tunnel is based on IP addresses on the client device and the remote application. Now that there is I.P. connectivity between the client and the application, the network where the application is located is extended to the client.

However, the client might not sit in an insecure hotel room or from home. These may not be sufficiently protected, and such locations should be considered insecure. The traditional VPN has many issues to deal with. It is user-initiated, and policy often permits split-tunnel VPNs without Internet or cloud traffic inspection.

SASE: A zero-trust VPN solution

A SASE solution encompasses VPN services and enhances the capabilities of operating in cloud-based infrastructure to route traffic. On the other hand, with SASE, the client connects to the SASE PoP, which carries out security checks and forwards the request to the application. A SASE design still allows clients to access the application, but they can only access that specific application and nothing more, like a stripped-down VLAN known as a micro-segmentation.

Restricting Lateral Movements

Clients must pass security controls, and no broad-level access is susceptible to lateral movements. Access control is based on an allowlist rather than the traditional blocklist rule. Also, other variables present in the request context are used instead of using I.P. addresses as the client identifier. As a result, the application is now the access path, not the network.

Simplified Management & Policy Control

So, no matter what type of VPN services you use, the SASE provides a unified cloud to connect to instead of backhauling to a VPN gateway—simplifying management and policy control. Well-established technologies such as VPN, secure web gateway, and firewall are being reviewed and reassessed in Zero Trust remote access solutions as organizations revisit approaches that have been in place for over a decade. 

A recommendation: SASE and SD-WAN

The value of SD-WAN is high. However, it also brings many challenges, including new security risks. In some of my consultancies, I have seen unreliable performance and increased complexity due to the need for multiple overlays. Also, these overlays need to terminate somewhere, and this will be at a hub site.  However, when combined with SASE, the SD-WAN edge devices can be connected to a cloud-based infrastructure rather than the physical SD-WAN hubs. This brings the value of interconnectivity between branch sites without the complexity of deploying or managing physical Hub sites.

Zero Trust SASE: Vendor considerations

SASE features converge various individual components into one connected, cloud-delivered service, making it easy to control policies and behaviors. The SASE architecture is often based on a PoP design. When examining the SASE vendor, the vendor’s PoP layout should be geographically diverse, with worldwide entry and exit points. 

Also, considerations should be made regarding the vendor’s edge/physical infrastructure providers or colocation facilities. We can change your security posture, but we can’t change the speed of light and the laws of physics.

Consider how the SASE vendor routes traffic in their PoP fabric. Route optimization should be performed at each PoP. Some route optimizations are for high availability, while others are for performance. Does the vendor offer cold-potato or hot-potato routing? The cold-potato routing means bringing the end-user device into the provider’s network as soon as possible. On the other hand, “hot-potato routing” means the end user’s traffic traverses more of the public Internet.

The following is a list of considerations to review when discussing SASE with your preferred cybersecurity vendor:

A. Zero Trust SASE requirements: Information hiding:

Secure access service requires clients to be authenticated and authorized before accessing protected assets, regardless of whether the connection is inside or outside the network perimeter. Then, real-time encrypted connections are created between the requesting client and the protected asset. As a result, all SASE-protected servers and services are hidden from all unauthorized network queries and scan attempts.

You can’t attack what you can’t see.

The base for network security started by limiting visibility – you cannot attack what you cannot see. Public and private IP addresses range from separate networks. This was the biggest mistake we ever made as I.P. addresses are just binary, whether they are deemed public or private. If a host were assigned a public address and wanted to communicate with a host with a private address, it would need to go through a network address translation (NAT) device and have a permit policy set.

Understanding Port Knocking

Port knocking is a technique that enables secure and controlled access to network services. Traditionally, network ports are open and accessible, leaving systems vulnerable to unauthorized access. However, with port knocking, access to specific ports is only granted after a predefined sequence of connection attempts is made to other closed ports. This sequence acts as a virtual “knock” on the door, allowing authorized users to gain access while keeping malicious actors at bay.

To fully comprehend port knocking, let’s explore its inner mechanics. When users wish to access a specific service, they must first send connection attempts to a series of closed ports in a particular order. This sequence acts as a secret handshake, notifying the server that the user is authorized. Once the correct sequence is detected, the server dynamically opens the desired port, granting access to the requested service. It’s like having a hidden key that unlocks the door to a secure sanctuary.

Security based on the visibility

Network address translation is mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. Limiting visibility this way works to a degree, but we cannot ignore the fact that a) if you have someone’s IP address, you can reach them, and b) if a port is open, you can potentially connect to it.

Therefore, the traditional security method can open your network wide for compromise, especially when bad actors have all the tools. However, finding, downloading, and running a port scanning tool is not hard.

“Nmap,” for Network Mapper, is the most widely used port scanning tool. Nmap works by checking a network for hosts and services. Once found, the software platform sends information to those hosts and services, responding. Nmap reads and interprets the response and uses the data to create a network map.

Example: Understanding Lynis

Lynis is an open-source security auditing tool for discovering vulnerabilities on Unix, Linux, and macOS systems. It comprehensively analyzes the system’s configuration and provides valuable insights into potential security weaknesses. By scanning the system against a vast database of known security issues, Lynis helps identify areas for improvement.

Lynis runs a series of tests and audits on the target system. It examines various aspects, including file permissions, system settings, available software packages, and network configurations. Lynis generates a detailed report highlighting any identified vulnerabilities or potential security gaps by analyzing these factors. This report becomes a valuable resource for system administrators and security professionals to take necessary actions and mitigate risks.

Example: Single Packet Authorization

Zero-trust network security hides information and infrastructure through lightweight protocols such as single-packet authorization (SPA). No internal IP addresses or DNS information is shown, creating an invisible network. As a result, we have zero visibility and connectivity, only establishing connectivity after clients prove they can be trusted to allow legitimate traffic. Now, we can have various protected assets hidden regardless of location: on-premise, public or private clouds, a DMZ, or a server on the internal LAN, in keeping with today’s hybrid environment.

Default-drop dynamic firewall

This approach mitigates denial-of-service attacks. Anything internet-facing is reachable on the public Internet and, therefore, susceptible to bandwidth and server denial-of-service attacks. The default-drop firewall is deployed, with no visible presence to unauthorized users. Only good packets are allowed. Single packet authorization (SPA) also provides for attack detection.

If a host receives anything other than a valid SPA packet or similar construct, it views that packet as part of a threat. The first packet to a service must be a valid SPA packet or similar security construct.

If it receives another packet type, it views this as an attack, which is helpful for bad packet detection. Therefore, SPA can determine an attack based on a single malicious packet, a highly effective way to detect network-based attacks. Thus, external network and cross-domain attacks are detected.

B. Zero Trust SASE architecture requirements: Mutually encrypted connections:

Transport Layer Security ( TLS ) is an encryption protocol that protects data when it moves between computers. When two computers send data, they agree to encrypt the information in a way they both understand. Transport layer security (TLS) was designed to provide mutual device authentication before enabling confidential communication over the public Internet. However, the standard TLS configuration validates that the client is connected to a trusted entity. So, typical TLS adoptions authenticate servers to clients, not clients to servers. 

Mutually encrypted connections

SASE uses the full TLS standard to provide mutual, two-way cryptographic authentication. Mutual TLS provides this and goes one step further to authenticate the client. Mutual TLS connections are set up between all components in the SASE architecture. Mutual Transport Layer Security (mTLS) establishes an encrypted TLS connection in which both parties use X. 509 digital certificates to authenticate each other.

MTLS can help mitigate the risk of moving services to the cloud and prevent malicious third parties from imitating genuine apps. This offers robust device and user authentication, as connections from unauthorized users and devices are mitigated. Secondly, forged certificates, which are attacks aimed at credential theft, are disallowed. This will reduce impersonation attacks, where a bad actor can forge a certificate from a compromised authority.

C. Need to know the access model: Zero Trust SASE architecture requirements

Thirdly, SASE employs a need-to-know access model. As a result, SASE permits the requesting client to view only the resources appropriate to the assigned policy. Users are associated with their devices, which are validated based on policy. Only connections to the specifically requested service are enabled, and no other connection is allowed to any other service. SASE provides additional information, such as who made the connection, from what device, and to what service.

This gives you complete visibility into all the established connections, which is hard to do without an IP-based solution. So now we have a contextual aspect of determining the level of risk. As a result, it makes forensics easier. The SASE architecture only accepts good packets; bad packets can be analyzed and tracked for forensic activities.

Key Point: Device validation

Secondly, it enforces device validation, which helps against threats from unauthorized devices. We can examine the requesting user and perform device validation. Device validation ensures that the machine runs on trusted hardware and is used by the appropriate user.

Finally, suppose a device becomes compromised. In that case, lateral movements are entirely locked down, as a user is only allowed access to the resource it is authorized to. Or they could be placed into a sandbox zone where human approval must intervene and assess the situation.

D. Dynamic access control: Zero Trust SASE architecture requirements

This traditional type of firewall is limited in scope as it cannot express or enforce rules based on identity information, which you can with zero trust identity. Attempting to model identity-centric control with the limitations of the 5-tuple, SASE can be used alongside traditional firewalls and take over the network access control enforcement that we try to do with conventional firewalls. SASE deploys a dynamic firewall that starts with one rule – deny all.

Then, requested communication is dynamically inserted into the firewall, providing an active firewall security policy instead of static configurations. For example, every packet hitting the firewall is inspected with a single packet authentication (SPA) and then quickly verified for a connection request. 

Key Point: Dynamic firewall

Once established, the firewall is closed again. Therefore, the firewall is dynamically opened only for a specific period. The connections made are not seen by rogues outside the network or the user domain within the network. Allows dynamic, membership-based enclaves that prevent network-based attacks.

The SASE dynamically binds users to devices, enabling those users to access protected resources by dynamically creating and removing firewall rules.  Access to protected resources is facilitated by dynamically creating and removing inbound and outbound access rules. Therefore, we now have more precise access control mechanisms and considerably reduced firewall rules.

**Micro perimeter**

Traditional applications were grouped into VLANs whether they offered similar services or not. Everything on that VLAN was reachable. The VLAN was a performance construct to break up broadcast domains, but it was pushed into the security world and never meant to be there. 

Its prime use was to increase performance. However, it was used for security in what we know as traditional zone-based networking. The segments in zone-based networks are too large and often have different devices with different security levels and requirements.

Key Points:

A. Logical-access boundary: SASE enables this by creating a logical access boundary encompassing a user and an application or set of applications. And that is it—nothing more and nothing less. Therefore, we have many virtual micro perimeters specific to the business instead of the traditional main inside/outside perimeter. Virtual perimeters allow you to grant access to the particular application, not the underlying network or subnet.

B. Reduce the attack surface: The smaller micro perimeters reduce the attack surface and limit the need for excessive access to all ports and protocols or all applications. These individualized “virtual perimeters” encompass only the user, the device, and the application. They are created and specific to the session and then closed again when it is over or if the risk level changes and the device or user needs to perform setup authentication.

C. Software-defined perimeter (SDP): SASE only grants access to the specific application at an application layer. The SDP part of SASE now controls which devices and applications can access distinctive services at an application level. Permitted by a policy granted by the SDP part of SASE, machines can only access particular hosts and services and cannot access network segments and subnets.

**Reduced: Broad Network Access**

Broad network access is eliminated, reducing the attack surface to an absolute minimum. SDP provides a fully encrypted application communication path. However, the binding application permits only authorized applications to communicate through the established encrypted tunnels, thus blocking all other applications from using them. This creates a dynamic perimeter around the application, including connected users and devices. Furthermore, it offers a narrow access path—reducing the attack surface to an absolute minimum.

E. Identity-driven access control: Zero Trust SASE architecture requirements

Traditional network solutions provide coarse-grained network segmentation based on someone’s IP address. However, someone’s IP address is not a good security hook and does not provide much information about user identity. SASE enables the creation of microsegmentation based on user-defined controls, allowing a 1-to-1 mapping, unlike with a VLAN, where there is the potential to see everything within that VLAN.

Identity-aware access: SASE provides adaptive, identity-aware, precision access for those seeking more precise access and session control to applications on-premises and in the cloud. Access policies are primarily based on user, device, and application identities. The procedure is applied independent of the user’s physical location or the device’s I.P. address, except where it prohibits it. This brings a lot more context to policy application. Therefore, if a bad actor gains access to one segment in the zone, they are prevented from compromising any other network resource.

Detecting Authentication Failures in Logs:

Syslog: Useful Security Technology

Syslog, short for System Logging Protocol, is a standard for message logging within computer systems. It collects various log entries from different sources and stores them in a centralized location. Syslog is a valuable resource for detecting security events as it captures information about system activities, errors, and warnings.

Auth.log is a specific type of log file that focuses on authentication-related events in Unix-based operating systems. It records user logins, failed login attempts, password changes, and other authentication activities. Analyzing auth.log can provide vital insights into potential security breaches, such as brute-force attacks or suspicious login patterns.

Now that we understand the importance of syslog and auth.log, let’s delve into some effective techniques for detecting security events in these files. One widely used approach is log monitoring, where automated tools analyze log entries in real time, flagging suspicious or malicious activities. Another technique is log correlation, which involves correlating events across multiple log sources to identify complex attack patterns.

Summary: Zero Trust SASE

Traditional security measures are no longer sufficient in today’s rapidly evolving digital landscape, where remote work and cloud-based applications have become the norm. Enter Zero Trust Secure Access Service Edge (SASE), a revolutionary approach that combines network security and wide-area networking into a unified framework. In this blog post, we explored the concept of Zero Trust SASE and its implications for the future of cybersecurity.

Understanding Zero Trust

Zero Trust is a security framework that operates under the “never trust, always verify.” It assumes no user or device should be inherently trusted, regardless of location or network. Instead, Zero Trust focuses on continuously verifying and validating identity, access, and security parameters before granting any level of access.

The Evolution of SASE

Secure Access Service Edge (SASE) represents a convergence of network security and wide-area networking capabilities. It combines security services, such as secure web gateways, firewall-as-a-service, and data loss prevention, with networking functionalities like software-defined wide-area networking (SD-WAN) and cloud-native architecture. SASE aims to provide comprehensive security and networking services in a unified, cloud-delivered model.

The Benefits of Zero Trust SASE:

a) Enhanced Security: Zero Trust SASE brings a holistic approach to security, ensuring that every user and device is continuously authenticated and authorized. This reduces the risk of unauthorized access and mitigates potential threats.

b) Improved Performance: By leveraging cloud-native architecture and SD-WAN capabilities, Zero Trust SASE optimizes network traffic, reduces latency, and enhances overall performance.

c) Simplified Management: A unified security and networking framework can streamline organizations’ management processes, reduce complexity, and achieve better visibility and control over their entire network infrastructure.

Implementing Zero Trust SASE

a) Comprehensive Assessment: Before adopting Zero Trust SASE, organizations should conduct a thorough assessment of their existing security and networking infrastructure, identify vulnerabilities, and define their security requirements.

b) Architecture Design: Organizations must design a robust architecture that aligns with their needs and integrates Zero Trust principles into their existing systems. This may involve deploying virtualized security functions, adopting SD-WAN technologies, and leveraging cloud services.

c) Continuous Monitoring and Adaptation: Zero Trust SASE is an ongoing process that requires continuous monitoring, analysis, and adaptation to address emerging threats and evolving business needs. Regular security audits and updates are crucial to maintaining a solid security posture.

Conclusion: Zero Trust SASE represents a paradigm shift in cybersecurity, providing a comprehensive and unified approach to secure access and network management. By embracing the principles of Zero Trust and leveraging the capabilities of SASE, organizations can enhance their security, improve performance, and simplify their network infrastructure. As the digital landscape continues to evolve, adopting Zero Trust SASE is not just an option—it’s necessary to safeguard our interconnected world’s future.