Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Aurora Reaches for Security Rx

Monitoring tool collects data normally left to intrusion detection or intrusion prevention systems

When your business is diagnosing and treating disease, you understand the importance of seeing a problem down to the most granular level. But up until recently, the IT security team at Aurora Health Care -- Wisconsin's largest integrated health services provider -- couldn't fully assess the systems in some of its clinics and smaller offices.

Aurora, which supports some 30,000 users and nearly 1,000 applications, needed a way to look for security vulnerabilities in clients, remote networks, and other downstream devices in its geographically-dispersed, statewide hub-and-spoke network. Without that visibility, the Aurora security team was blind to flaws and risky behavior that were occurring in the farthest reaches of the network.

"We had no vision down to the clinic level, unless the end station was making a call out to the Internet," says Dan Lukas, lead security architect at Aurora. "We couldn't see things happening on the local subnet."

Lukas and his staff looked into available intrusion detection systems (IDS) and intrusion prevention systems (IPS), but the cost and complexity of instrumenting those systems was prohibitive. "Most of those systems require you to deploy sensors locally to all of the devices you want to manage," he observes. "If I had made a proposal to buy 500 sensors or more, my management would have laughed me right out of the room."

After investigating some lower-cost products, Aurora discovered StealthWatch, a network monitoring appliance from Lancope Inc. that harvests data from Cisco Systems Inc.'s NetFlow IP traffic analysis tool and analyzes it to help identify security vulnerabilities. Like many enterprises, Aurora is an all-Cisco shop, so deploying StealthWatch was a relatively simple matter of installing the software and configuring key routers to collect data from downstream devices and share it with the Lancope application.

"It's one of the few products I've seen that just works," Lukas says. "You have to turn on NetFlow and set it up in the routers, but that's a whole lot simpler and cheaper than deploying sensors."

With StealthWatch in place, Aurora began to discover security hazards around the network that needed to be remedied. "We found worms, Trojans, and viruses on the end station," he recalls. "We nailed some users that were doing streaming media, which not only helped with security but it freed up some bandwidth. We analyzed traffic to find places where we suspected security flaws. We even found viruses on some of our physical security devices -- the DVR systems that we use for surveillance."

StealthWatch does have some limitations. It collects data about anomalies, but it doesn't analyze them in detail. "We're looking at buying vulnerability scanning tools so that we can take the events that come to the top in StealthWatch and run more detailed scans," Lukas says. "Otherwise you can't identify all the potential problems."

In addition, StealthWatch can only support 128 hosts per appliance, so it doesn't scale well to every device in a large enterprise network. "We just put it on our hub routers, the ones that handle the most traffic," Lukas says. "Otherwise it can get pretty expensive and you start running up against that maximum."

There is an entry-level StealthWatch product starting at $9,995, but most large enterprises will need the more scaleable StealthWatch Xe appliance, which starts at $29,995. The pricing goes up based on the number of routers used.

"It's not free, but compared to the alternatives, it's a pretty good solution," Lukas says.

— Tim Wilson, Site Editor, Dark Reading

Organizations mentioned in this article:

  • Aurora Health Care
  • Cisco Systems Inc. (Nasdaq: CSCO)
  • Lancope Inc.

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Data Leak Week: Billions of Sensitive Files Exposed Online
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
    Lessons from the NSA: Know Your Assets
    Robert Lemos, Contributing Writer,  12/12/2019
    4 Tips to Run Fast in the Face of Digital Transformation
    Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
    Register for Dark Reading Newsletters
    White Papers
    Current Issue
    The Year in Security: 2019
    This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2019-12-15
    In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
    PUBLISHED: 2019-12-15
    python-requests-Kerberos through 0.5 does not handle mutual authentication
    PUBLISHED: 2019-12-15
    CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
    PUBLISHED: 2019-12-15
    jersey: XXE via parameter entities not disabled by the jersey SAX parser
    PUBLISHED: 2019-12-15
    JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.