New EMA Research Report Amplifies Need for a Strong Network Visibility Architecture

 

The ongoing COVID-19 pandemic and continued threat of cyber-attacks has put the IT and security industry on high alert, resulting in many organizations having to push their network infrastructure into the cloud. This adoption to support remote work has created challenges in seeing security threats and maintaining performance. As a way to further explore the industry’s response to current visibility initiatives, EMA released a brand new report today sponsored by Keysight Technologies. The report provides an important look at how IT and security organizations use network visibility architectures to deliver network packets to critical performance and security analysis tools as well as how organizations need to evolve their network visibility architectures as they adopt hybrid, multi-cloud architectures.

Visibility architectures are essential for IT and network security personnel to be able to take a holistic look at an enterprise’s entire network followed by a better understanding of what tools you have, where the network is accessed, and what data feeds into those tools. In line with this focus, a website (www.getneworkvisibility.com) helps network and security engineers explore the various findings from the report. This includes: visibility architecture benefits and challenges, requirements from companies for using network packet brokers (NPBs), and how to support hybrid, multi-cloud networks.

Visibility Architecture Benefits and Challenges

I’ve seen firsthand the benefits of having a visibility architecture in place from top global brands. By implementing visibility solutions, IT teams can expose hidden problems and therefore eliminate blind spots, improve efficiency, reduce costs and optimize troubleshooting efforts. The EMA report findings further support these benefits, stating that organizations that use a network visibility architecture will improve IT and security productivity and reduce overall security risk. 25.2% of survey respondents said that using visibility solutions improved capacity management, 22.5% reported optimized cloud migration and 21.9% said it resulted in network and application performance and resiliency. Other opportunities from using a visibility architecture include better cross-team collaboration, reduced compliance risk, and extended life of analysis tools.

As with any IT solution, there are going to be challenges to adoption and implementation. In the case of visibility architectures, organizations have stated that scalability and complexity (as well as insufficient budget, architectural complexity, and limited cloud visibility) are some of their top concerns. In most cases, the benefits of visibility architecture end up outweighing any potential disadvantages. The first task is to choose a solution that fits your enterprise needs.

Budget concerns are not to be taken lightly. The reality is there are ways to cut costs even when it comes to visibility architectures. Many application and network performance and security tools are charged by their use. Filtering out unnecessary traffic and deduplicate traffic, along with other smart filtering functions, can bring that cost down and more than pay for the use of taps and packet brokers, while allowing for a more scalable, future proof approach.

The Architectural Core: Network Packet Brokers

The gold standard in network visibility is the use of packet brokers. The EMA report found that advanced features (such as packet filtering, manipulation, and metadata generation) are the top characteristics of a network packet broker that are most important to earning a return on investment in the technology. Secondary characteristics were listed as resilience/reliability with the tertiary priority noted as manageability and automation.

Adding credibility to its findings, the report included a quote from an enterprise systems monitoring engineer with a Fortune 500 healthcare company: “Performance is number one for me. Then it’s ease of upgrades. We think about the longevity and stability of the company, too. I also want to know if their customer support is any good. Packet broker management tools are also very important if you have an enterprise-scale deployment.”

Network packet brokers from Keysight have several advantages over its competitors such as no dropped packets, use of FPGA-based hardware acceleration, ease of use and multiple features that can run concurrently on the same packet broker. More specific benefits include: processing at line rate, parallel Zero-loss packet processing (something Gigamon’s CPU based solutions can't provide), patented ZERO-errors fully automated filter compiler, and a GUI drag and drop interface that makes configuring your network fast and simple. In addition, NPBs can load balance and optimize the flow of network data to the right tool at the right time.

The report also confirmed the importance of packet brokers when it comes to cybersecurity, citing that the most valued packet manipulation or data generation feature in a packet broker is threat intelligence. In fact, EMA said “organizations that are the most successful with visibility architecture were the most likely to value threat intelligence, suggesting that it’s a best practice to seek this capability from packet broker vendors.”

Supporting Hybrid, Multi-Cloud Visibility

The EMA report confirmed what we already know - packet data is essential to cloud operations, especially for security monitoring and analysis. In fact, nearly 65% of respondents say this data is important for security monitoring and analysis in the cloud.

Newer virtual packet brokers like Keysight’s CloudLens can cost effectively provide private, public, and/or hybrid cloud packet data to tools for analysis. This includes east-west traffic visibility. These advances will allow operational personnel to think of the cloud as just another extension of their physical network and move towards alignment with their security colleagues.

Another standout statistic from the report is that 99% of companies are making at least some attempt to collect packet data in the cloud and supply it to performance and security analysis tools. An infrastructure analyst with a Fortune 500 energy company was quoted as saying within the report, “[Network visibility architecture solutions] can definitely offer value in the cloud, because you need that network traffic when you’re doing end-to-end transactions. Without a packet broker in the cloud, I could deploy a fleet of Linux servers in the cloud running TCPDUMP, but that would be too costly.”

The research from EMA has made it abundantly clear that network visibility architectures are essential to a company’s success. By implementing solutions such as Keysight Technologies’ network packet brokers, your enterprise will be strategically positioned for exceptional network visibility with no traffic loss or dropped packets. Take a look at the entire report from EMA to get a comprehensive download on how enterprises can benefit from a network visibility architecture.

For more information on understanding network visibility and resources on how to implement the tools, check out everything the www.getnetworkvisibility.com community has to offer. You can download a copy of the EMA report here.

Investigating Loops

 Troubleshooting the most common “things are slow” complaint is one of the most difficult calls I get since there are many scenarios and variables to consider.

Root causes range from the malicious (like DDOS or viruses) to the unintentional (like equipment misconfigurations), and everything in between.

I found the most effective approach is trying to eliminate the possible root causes that are easy to prove or disprove. For example, starting up your protocol analyzer of choice connected to any port on the client VLAN could identify layer 2 loops, devices sending out a lot of broadcast multicast packets and misconfigured load balancing.

In this example, when I got the call and performed this check, I got lucky and there it was a layer 2 loop. Many analysts skip this check because they rely on Spanning Tree or Rapid Spanning Tree to prevent this from happening.

In the video below I walk you through how I figured this out and what the issue was.

Why do you need a “REAL” TAP in today's Security, Performance, and compliance-focused network?

 

We have entered into the era of Data Security Legal Compliance and Lawful Intercept which requires that we must monitor all of the data and not just “sample” the data, with the exception of certain very focused monitoring technologies (e.g., application performance monitoring). These demands will continue to grow since we have become a very digitally-focused society. With the advent of VoIP and digital video we now have revenue-generating data that is connection-oriented and sensitive to bandwidth, loss, and delay. The older methods need reviewing and the aforementioned added complexity requires that we change some of the old habits to allow for “real” 100% Full Duplex real-time access to the critical data.

It's time to evaluate our network access points. If you are still using SPAN ports, you will be neglecting compliance regulations. As we know the top priority for a switch, of course, is to direct network traffic. Therefore, as the switch reaches capacity, packets to the SPAN port will be dropped. This problem is critical because, just as a need for switch traffic analysis presents itself (packets overrunning switch capacity), so does the condition when the SPAN port will not provide accurate switch traffic information.

Even in low utilization environments, there are certain packets such as undersized or error packets that can be filtered on the switch and never make it to the SPAN port. If the analysis requires 100% of packets to be submitted to the appliance, SPAN cannot guarantee such accuracy.

On the other hand, network TAPs (Test Access Points) make an exact copy of all of the traffic that flows between two end-points in a network. This simple device is able to document 100% capture with no packet manipulation. Once the data is copied, it can be used for monitoring, security, and analytic use.

In summary, being able to provide “real” access is not only important for Data Compliance Audits and Lawful Intercept events, it is the law (keeping our bosses out of jail has become a very high priority these days).

CORE-IT PROS- Accelerate The Learning Process

 There is no other way to say it so here it is, you cannot troubleshoot a network proficiently unless you have proper training and practice.

Part of the learning process is to take a course, read, watch others and then adapt any techniques to own style. Most analysts I speak to agree that having someone show you how to do something is the best approach. No time is wasted on the history of networking or topics that don’t apply to your situation or network.

Over the years I’m sure you have found your ‘favorite’ analyst, website, youtube channel, etc where you go to get information and help. Every site and presenter will have their own style that you gravitate to.

For example there are sites that have a lot of background info, footnotes and references for you to go through when explaining a topic. These sites may even have videos that are over 30 minutes long to dig into the nitty gritty. Then there are others that are short and sweet.

One of the unique things about the conference is that attendees will see three different troubleshooting and training approaches. In this video Laura covers this point.

Attend the www.COREITPROS.com conference with Laura Chappell, Mike Pennachi, Tony Fortunato August 22 - 26, 2022