How a Network Packet Broker Can Stretch the Life of Security and Monitoring Tools

After a string of high-profile hacks, security remains one of the biggest items in IT budgets, and because it is so expensive it can quickly consume money that is already tight. Keith Bromley, Senior Solutions Marketing Manager at Keysight Technologies, argues that organisations can spend less without putting the business at risk. One way is to buy fewer new security and monitoring tools by keeping existing ones in service for longer and deploying them more strategically. With a single tool typically costing between $50K and $200K, he says the savings can be considerable, and efficiency is what makes them possible.

Visibility first

Using tools more efficiently starts with what Bromley calls a visibility architecture. It shows what data is moving across the network, trims the traffic passed to security tools, and helps decide where on the network those tools should sit.

According to Bromley, this removes much of the waste that puts needless load on security tools and wears them out sooner, and it also prevents organisations from buying tools they do not need. He adds that the architecture need not be complex: adding a few taps and a network packet broker (NPB) to the existing setup can be enough. He gives three examples of how it cuts IT costs.

Spreading a faster link across older tools

Being able to divide traffic between several tools can matter a great deal. Suppose a company upgrades its network core from 10GE to 40GE. Its existing monitoring tools cannot handle the higher data rate, so they become obsolete overnight and must be replaced, which means a large up-front bill.

An NPB can put that spending off. It can split 40GE of traffic across several 10GE tools, a technique known as bandwidth load balancing. The older tools stay in use until the budget allows new ones to be bought, the equipment lasts longer, and IT spending can be phased.

N+1 load balancing for reliability

Bromley describes N+1 load balancing as an affordable way to improve reliability. Whatever the traffic load, one tool more than necessary is added to the processing stream. Provided the setup is sized correctly, if a security or monitoring appliance fails, the network packet broker shares its load evenly among the tools that remain.

In his example, 40GE of traffic is divided across five 10GE security tools, so each handles 8GE. If one fails, the packet broker sends 10GE to each of the four still running. When the fault is repaired, the broker spreads the load across all five again, with no manual intervention at any point. This gives a high level of survivability for a fraction of what a fully redundant system would cost. Organisations wanting more resilience can add further tools for n+2, n+3 and so on, up to full redundancy.

Taking non-core work off the tools

Security and monitoring tools work best when they can concentrate on protecting the network. Too often, Bromley says, their processing power goes on secondary tasks such as filtering data, deduplication and SSL decryption, or analysis time is wasted on traffic that is of no interest at all.

NPBs can filter traffic so that security tools receive only the data they need to spot threats. They can also decrypt data before passing it to the relevant monitoring tools, leaving the security devices free to defend the network. With encrypted traffic now so widespread, this also means older tools that have no built-in decryption can keep working and do not sit unused. Bromley's conclusion is that NPBs take unnecessary load off devices, extend their working life and help organisations get the most from what they have paid for their tools.