Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/19/2013
08:27 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Using NetFlow Data For More Robust Network Security

NetFlow can prove a powerful tool for spotting dangerous traffic patterns

While NetFlow data may traditionally be seen as a network infrastructure tool, smart security teams can get tons of benefits out of the collection of IP traffic statistics, too.

"Security professionals should consider every NetFlow and IPFIX router a security camera that allows them to go back in time and investigate suspect traffic reported by any number of security appliances," says Michael Patterson, CEO of Plixer.

According to Dr. Vincent Berk, CEO of FlowTraq, security pros may have to battle to get their hands on the data if other infrastructure people—the ones 'responsible for moving packets but not securing them—are at all territorial. But it is worth the effort.

"This has created a climate where security professionals have increasingly had trouble getting their hands on streams of NetFlow throughout their organizations," Berk says. "However, the advanced values that a security professional can get from NetFlow is enormous. Patterns of traffic, such as scans, worm-propagation behavior and brute-force password attacks show up very clearly in NetFlow. So do DDoS attacks."

[Are you using your human sensors? See Using The Human Perimeter To Detect Outside Attacks.]

According to experts, just as log data analysis and SIEM help contextualize security events, so too can NetFlow data offer a safety net for catching unwanted behavior.

"Understanding who is talking to whom; how they are talking; and for how long; can all add a much needed dimension to network situational awareness," says Matt Webster, CTO for Lumeta.

NetFlow analytic data is particularly great at detecting anomalous "hot-spots" of activity that could indicate existing issues or an active breach, says Jody Brazil, president and CTO of FireMon

"For example, NetFlow data can be leveraged to isolate compromised hosts by identifying those communicating with botnet command and control machines, or to highlight those hosts utilizing unusual ports," Brazil says.

Similarly, NetFlow data can also help spot malicious server behavior indicating compromise there, says Nicole Pauls, director of product management at SolarWinds.

"It can help monitor for unexpected or unwanted server activity-since servers are going to have more well-known behavior patterns-looking for volume, ports and destinations unknown," Pauls says.

Brazil also says that NetFlow data can offer enough visibility into traffic to see how cloud-based applications are being used by showing which applications are being accessed over the network at any given time. This can be a huge benefit for security teams seeking to sniff out rogue IT functions that may not be handling data in a secure or compliant manner. And speaking of compliance, NetFlow data can also offer solid documentation to prove compliance with network-related security policies.

"Since flow data can be archived indefinitely, in many cases it allows companies to provide demonstrable evidence of IT compliance with internal governance policies, external regulations, and industry best practices," he says.

As organizations seek to up their security game through NetFlow data, Berk offers some friendly advice—don't just look at traffic at the network edge.

"People that only look at their border traffic will miss large ranges of visibility on what is happening inside the network," he says. "Data exfiltrations, theft and other intelligence gathering may be going on inside the network, and you will never see it if you only grab the NetFlow from your border devices. Deploy far and wide."

Of course, as with any security data stream, NetFlow data could pose the potential of overwhelming a security analyst. But there are ways to winnow down the stream and sift through that information to make it useful.

"One of the big challenges with NetFlow is that it can be like trying to watch every CCTV camera in a large city - it's overwhelming to consume, and most of the data is pretty boring," says Dwayne Melancon, CTO of Tripwire. "Smart enterprises watching suspicious changes in system state as a filter for NetFlow data - they monitor configuration changes, new executable 'payloads' showing up on a system, new listening ports being opened and then use that to focus on NetFlow."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...