There’s no question that ensuring enterprise network security is becoming increasingly difficult for IT and security teams. In the first half of 2021, cyberattackers launched 5.4 million distributed denial of service (DDoS) attacks—an 11 percent increase from the year before.
And cyberattacks equate to big paydays for attackers. In just the first half of 2021, one ransomware group collected $100 million in payments. The money gleaned from those attacks is then used to buy more expensive attack tools that can be used to further overwhelm enterprise IT and security teams.
Given the increase in attacks and the added stress they create for enterprises, the solution often is to add new security tools to address the biggest pain points of the moment. But that strategy creates additional headaches. Indeed, the average IT and security team now uses between 10 and 30 security monitoring solutions for applications, network infrastructures, and cloud environments.
But these disparate tools are creating more problems than they solve. In fact, 66 percent of infosec professionals express concern over their inability to effectively monitor multiple security technologies. And 30 percent of CIOs say it’s difficult to get an accurate status of network security because networking and security teams maintain separate tools and reports.
For security and network operations teams to work collaboratively, it’s vital that they adopt a common network security technology stack. To ensure the security and performance of enterprise networks, the common technology stack should provide the following:
- Stateless protection devices in front of stateful firewalls: Implementing stateless protection devices in front of stateful firewalls helps to block threats such as command-and-control (C2) traffic, state-exhaustion DDoS attacks, and known bad DNS domains. To be effective, these devices need be able to recognize abnormal traffic patterns and have timely and accurate threat intelligence that continually updates blocking lists in real time, enabling them to protect stateful network infrastructure, filter out known cyberattack traffic, and enable IT operations teams to maintain peak network performance for business requirements.
- Examination all east/west traffic: Security experts have come to rely on next-generation firewalls for security at network perimeters. Although such firewalls cover network ingress/egress, they leave internal networks open to attacks. To close this gap, network security needs to look at all east/west traffic in their legacy networks and hybrid cloud environments, enabling security teams to quickly and easily identify and filter out known threats moving laterally inside their environments.
- A common source of truth for network and cloud visibility: It’s not unusual for network and security teams to find that they’re using a multitude of disparate tools to collect the same network data. But what’s necessary to achieve holistic network and cloud visibility is a common source of network truth that’s derived from network packets and metadata. The right tool should have real-time packet analytics that create a robust set of locally stored, highly indexed metadata that can be quickly accessed and analyzed for more efficient incident detection, investigation, and mitigation—all of which are crucial for maintaining strong performance and detecting and responding to security incidents.
- Network traffic analysis capabilities: To ensure network performance and security, teams need to understand network traffic patterns, as well as the disposition of every device connected to the network before an incident occurs. Doing so helps them identify and remediate rogue devices, misconfigurations, and vulnerable systems, while maintaining application performance for business operations. Network traffic analysis capabilities deliver end-to-end visibility that allows teams to monitor normal network behavior to identify anomalies that might impact network security or performance.
- Network detection and response systems: Modern-day cyberattackers increasingly deploy anti-detection and forensics techniques to avoid being detected by endpoint detection and response (EDR) solutions. In addition to traffic analysis, teams need a way to analyze network data and threat intelligence in order to detect and investigate anomalous, suspicious, and malicious network activities that are hidden from other cybersecurity tools. Network detection and response systems can detect threats that EDR and log-based systems miss—while also providing access to a comprehensive source of metadata and network packets. Such data is crucial for triage and investigations.
To learn more about creating a common technology stack that better aligns IT and security teams, read the new white paper, Why Can’t We Be Friends? Enterprises Need Renewed Focus on Aligning IT and Cybersecurity, or reach out today to learn more from one of our security experts.