© 2014 gigamon. all rights reserved. 1 it’s what you can’t see that will sink you enhance...

© 2014 Gigamon. All rights reserved.© 2014 Gigamon. All rights reserved. 1

It’s What You Can’t See That Will Sink YouEnhance Network Security and Increase Your Visibility

© 2014 Gigamon. All rights reserved. 2

Quotation

"We have to build our systems on the assumption that adversaries will get in.”

~Deborah Plunkett, Head of the US National Security Agency’s

Information Assurance Directorate


You can’t find what

you can’t see…

Improving Network Security


Application Performance

Network Management

SecurityLEG

EN

D

Improving Network SecurityImproved Reliability for Out-of-Band Monitoring and Analysis

Network Management

SecurityCENTRALIZEDTOOLS

ApplicationPerformance


Inline Device Vendors:

Improving Network SecurityImproved Reliability for Inline Protection


Out-of-Band Device Vendors:



Improving Network SecurityBest Practices:

Conventional Best Practice

Protect with Inline Security

Aggregate from SPAN / Mirror Ports

Monitor Critical Links

Provide All Traffic to All Tools

Analyze Traffic at Edge with Distributed Tools

Replace All Tools with Every Network Speed Upgrade

Limit Access Via Login Restrictions to Ensure Compliance & Confidentiality

Inline Security with Bypass Protection

Aggregate from TAPs

Aggregate Entire NetworkSend Critical Traffic Flows to Monitors

Deliver Only Relevant Traffic Flows to Each Monitoring Device

Aggregate Low Utilization Edge Links to Centralized High Performance Tools

Load-Balance Traffic to Existing Tools, Adding or Upgrading Where Needed

Use Packet Slicing and Data Masking to Sanitize Traffic Before Reaching Tools


Improving Network SecurityImportant Questions

Could your inline security become a point of failure? Are all critical paths monitored? Does each solution owner know about network topology changes? Can suspicious traffic be forwarded to analyzers rapidly enough?


Replace SPAN Connections with TAPsAnother reason to use TAPs over SPANs is that many Switches rate limit the SPAN port as utilization increases. This is especially prevalent at 10Gb link speeds, where SPAN traffic can be throttled by as much as 85%.

To illustrate this, here are quotes from the user manuals of two popular switches:

If you are relying on SPAN ports to feed your security devices, you may be missing as much as 85% of the traffic!


“Use SPAN for troubleshooting. Except in carefully planned topologies, SPAN consumes too many switch and network resources to enable permanently.”

“[Switch Vendor] recommends that you do not mirror more than 15% of your total transit traffic. On Ten Gigabit Ethernet interfaces or bundle interfaces there is a limit of 1.5G on each ingress amount to be mirrored and 1.5G on each egress amount to be mirrored.”

© 2014 Gigamon. All rights reserved.

Security Infrastructure you deploy today must be strong, resilient and adaptable to the dynamic threats

which confront your business on a continual basis.

The deeper the visibility you have, the greater your ability to defend cyber-attacks.

Gigamon – Enabling a Security Visibility Fabric™

10

Gigamon refers to this as a Visibility Fabric


Enabling Best of Breed Security & Monitoring

11

Improves the solutions you are already selling

Analytics NetworkPerformanceManagement

NetworkForensics

Security

Router/Switch & Server Farm

ApplicationPerformanceManagement

http://www.fireeye.com/

http://www.wireshark.org/


Threat Detection: Two Architectures, Two Approaches“Inline and Out of Band”

“Out of Band”“In Band”

Stop at the front door Intrusion Prevention (IPS) Data Loss Prevention (DLP) Block the known attacks Monitor traffic profiles Alert to anomalies

Passive Monitoring Forensics / Recorders / Analytics Broader scale Longer time Leverage multiple measures

Limitations

Single point of failure Potential bottleneck Dependent upon “Maintenance windows”

Risk of over-subscription Famine or Feast: SPAN or TAP Increasing tooling demand & expanding

network scale

Limitations

Highly available architecture Line-rate performance Infrequent configuration changes

Requirements Powerful filtering capability Multi-point triangulation The more pervasive, the greater the value

Requirements


Threat Detection: Two Architectures, Two Approaches“In-Band and Out of Band”

“Out of Band”“Inline”

Highly available architecture Line-rate performance Infrequent configuration changes

Requirements

Powerful filtering capability Multi-point triangulation, greater visibility The more pervasive, the greater

the value

Requirements


Limitations

Risk of over-subscription (dropped packets, loss of visibility)

Detection & Remediation is after the fact Increasing tool demand & expanding

network scale

Limitations


Threat Detection: Two Architectures, Two Approaches“Inline and Out of Band”

“Out of Band”“Inline”


Limitations Limitations

Risk of over-subscription (dropped packets, loss of visibility)

Detection & Remediation is after the fact Increasing tool demand & expanding

network scale


Gigamon & Maximum Visibility

16

How Does Gigamon enable Maximum Visibility into the Network?


Without Gigamon…Many links to monitor; many tools required

VirtualServers

Physical Server

Core Network

$ $ $ $ $ $

No Aggregation: Many tools requiredCapital investment in tools increases

IDS (Intrusion Detection System)

PerimeterNetworkServer

Farm

Hypervisor

$

DMZ


VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ

With Gigamon…Simplicity. Efficient. Scalable.

$ $

With Aggregation: Many links to fewer toolsCapital investment in tools decreases


VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ

Without Gigamon…All packets to all tools; tools are over oversubscribed or provisioned.

$ $ $ $ $ $$

all p

acke

ts

all p

acke

ts

all p

acke

ts

all p

acke

ts

all p

acke

ts

all p

acke

ts

all p

acke

ts

DLP(Data Loss Prevention)

Without Filtering: All packets are sent for inspectionCapital investment in tools increases


VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ


$ $

With Aggregation: Many links to fewer toolsCapital investment in tools decreases



Em

ail

pa

ckets

Em

ail

pa

ckets

With Filtering: Only email traffic is sent for inspectionCapital investment in tools decreases

VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ

$ $


VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ

Without Gigamon…Span Port Contention…

APM IDS APM IDS NEWNEW

SPAN Port Contention: 2 ports to 2 tools SPAN port not available for new tool—Visibility decreases


VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ


Eliminate SPAN Port Contention: Replicate SPAN ports to new tools —Visibility Increases

APM IDS APM IDS NEWNEW


VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ

Without Gigamon…10 Gb Network with 1 Gb Tools…

APM IDS APM IDS

1 Gb Tools 1 Gb Tools

10Gb Core or Perimeter: 1Gb tools won’t work Expensive Tool Upgrades Necessary

10 Gb10 Gb


With Gigamon…Extend the life of your 1 Gb tools

10Gb Core or Perimeter: Convert 10Gb to 1Gb Expensive Tool Upgrades Avoided

VirtualServers

Physical Server

Core Network


Farm

Hypervisor

DMZ

10Gb10Gb

APM IDS APM IDS

1 Gb Tools 1 Gb Tools


Packet Modification

GigaSMART®

The Fabric Intelligence

26

Extending Visibility across Networks

Packet Identification, Filtering, and Forwarding

ToolsNetwork Flow Mapping®

Phy

sica

lV

irtua

l

Application Performance

Network Management

Security

Deduplication

ABACCABACB ABC

Packet Slicing

A B C A B C

Header Stripping

Time Stamp

Tunneling


Use 1Gb monitoring tools on 10Gb links Filter traffic on inline tool to avoid oversubscription Do maintenance on monitoring tool without disrupting production links Bi-directional heartbeat to insure monitoring tool is active Replicate traffic from production link to other monitoring tools

Inline Bypass for Inline Security ToolsWhy use Gigamon for Inline Bypass?

1Gb or 10Gb Network Link1Gb or 10Gb Inline Monitoring Tools

1Gb or 10Gb Network Link8 x 1Gb Inline Monitoring Tools

1Gb CopperA/B

1Gb OpticalA/B

WAFIDS DLPIDS

G-Secure-0216


“Inline”

In SummaryAddressing the Limitations


Limitations

“Out of Band”

Risk of over-subscription Famine or Feast: SPAN or TAP Increasing tooling demand and

expanding network scale

Limitations

Heartbeat monitoring Intelligent traffic distribution Establishes a ‘Dynamic DMZ’

enabling rapid response

Flow Mapping™ Selective traffic forwarding Scalability to serve some of the largest

networks on the planet

© 2014 gigamon. all rights reserved. 1 it’s what you can’t see that will sink you enhance...

Documents

security devices

span traffic

inline security aggregate

tools slide

entire network

network resources

suspicious traffic

network topology changes