Network data holds an immutable truth when it comes to cybersecurity. Unlike logs and other records that can and are altered by cyber attackers, network data cannot. To understand more about this, I spoke with Karl Van den Bergh, CMO of Gigamon.
Van den Bergh commented, “The whole premise of our technology is to be able to capture this massive volume of network traffic and distil it down to what’s most essential for the particular security tool.”
Reducing the data is not just about removing duplication. As Van den Bergh pointed out, there is a lot of traffic, such as users listening to podcasts or going to Netflix, which is of no value to security tools.
Another challenge is that of encryption. The majority of network traffic today uses encryption and that has benefits and risks. The benefit is that data is protected. The risk is that organisations need to know what is in the encrypted traffic. Van den Bergh points out that in a recent Gigamon survey, “three-quarters of the participants trust encrypted data, trust encrypted traffic.”
Importantly, it is not just traffic moving in and out of the network that is encrypted. Van den Bergh points out that an increasing amount of traffic moving through the network is encrypted. It is something that attackers are aware of and taking advantage of. That makes it difficult for organisations to spot not just lateral movement by an attacker but also when they are exfiltrating data.
To help customers get a better understanding of what is being encrypted as it moves in and around the network, Gigamon has introduced precryption. It allows an organisation to see the traffic in clear text form and pass it to security tools. It increases the visibility of what is happening on the network and helps spot attacks.
The podcast also looked at the challenges CISOs face and, importantly, the role of different types of CISOs. Van den Bergh commented, “The complexity of that job is really challenging because nobody recognises the value of the CISO.”
Where can I get it?
You can listen to the podcast by clicking on the player below. Alternatively, click on any of the podcast services below and go to the Enterprise Times podcast page.
