Threats Hiding Inside the Network, and How Inline Security Exposes Them

Barb Rigel, senior manager for network visibility at Keysight Technologies, compares the typical security breach to discovering that a dangerous intruder has been living in your house for six months, and hearing about it from a neighbour. Hard as that is to picture, she argues, it is roughly what happens to many organisations.

She cites the Ponemon Institute's 2020 Cost of a Data Breach Report, which found organisations take an average of 206 days to spot a breach and a further 73 days to contain it. Many learn of the breach from someone outside the company altogether: a customer, a partner or the police.

Blind spots and alert fatigue

Malware, viruses and trojans can slip into a network without the security tools noticing. Rigel points out that attackers know many enterprises cannot properly monitor and inspect all of their SSL traffic, particularly as volumes grow. Criminals are betting on that gap, she says, and too often the bet pays off.

Even when tools do flag possible threats, IT and SecOps teams often suffer from alert fatigue, a problem affecting more than 80% of them. Rigel refers to Sumo Logic research showing that 56% of companies with over 10,000 employees get more than 1,000 security alerts a day, and 93% say they cannot deal with every alert on the day it arrives. Attackers know this too, and rely on IT teams letting many alerts go unanswered.

Good monitoring, in her view, needs complete visibility of traffic on every network link, virtual and encrypted traffic included, without losing any packets. There is more traffic to watch than ever. Globalisation, the Internet of Things, cloud, virtualisation and mobile devices push the edge of the network outwards, often into places that are difficult to monitor, and those places become dangerous blind spots.

The bigger and more complex a network is, the more likely it is to have them. Rigel likens a blind spot to a dark alley where threats can hide until the damage is done.

Why she favours an inline architecture

Her recommended way to cut the risk and remove blind spots is an inline security architecture, which lets an organisation inspect bad traffic and block it at once, before it reaches the production network.

A strong visibility layer is the base of that architecture, Rigel says, because the huge volume of data moving across the network has to be inspected fast so that packets can be identified and filtered for closer analysis.

She sees the network packet broker (NPB) as a key part of the design. An NPB optimises the traffic passing between a network tap or SPAN port and the organisation's monitoring and security tools. Placed between bypass switches and inline security appliances, it adds another useful layer of visibility.

Built on dedicated hardware acceleration, NPBs also bring intelligence and context through software that handles aggregation, deduplication, load balancing, data masking, packet trimming, geolocation and tagging. Because more threats now arrive inside encrypted packets, some products go further: Rigel gives the example of Keysight Vision NPBs with SecureStack, which can decrypt all SSL/TLS traffic and inspect it quickly.

She describes the NPB as an intermediary that lets security appliances connect smoothly and safely without bringing the network down. It takes load off the tools, gets rid of blind spots and shortens mean time to repair (MTTR) by speeding up troubleshooting.

Rigel accepts that an inline design will not stop every threat. What it gives, she argues, is a clear view and secure access to data. She calls data the lifeblood of a network, and warns that feeding the wrong data to security tools, or losing data completely through dropped packets, can leave an organisation believing it is safe and protected when it is not.