4 min read
The argThe argument is an old one; are you better off with a network-based detector, assuming all hosts will eventually communicate, or should you look at each host to determine what they are up to?ument is an old one; are you better off with a network-based detector, assuming all hosts will eventually communicate, or should you look at each host to determine what they are up to?
Over five years ago, the network was far simpler. There was a clear perimeter – us versus them, if you will. You could examine all traffic at the egress point (so-called North/South traffic) for potentially hostile patterns while pretty much ignoring local traffic (so-called called East/West traffic) as usually benign. This is usually done with the help of attack signatures which are updated periodically. In other words, classic network-based, signature-driven detection.
This applied to firewalls. You could be network-based and/or have one for each host. The attraction of the network-based firewall is simplicity; one device to deploy and manage versus the hassle of configuring one firewall per host. Notice that this depends on the traditional (simple) network with a clear us/them perimeter. But that is a pretty simple, traditional model that is vanishing fast. Applications are moving to the cloud and the perimeter is porous. You pretty much need a micro-fortress around a host or location.
So, what arguments are the network-based passive monitoring solutions making for themselves? And how do they stack up against a host-based managed solution? Let me count the ways…
| Claim | Response |
| Passive network monitoring has no impact on endpoint performance | A well-designed, user-space host-based solution has virtually no impact on the endpoint |
| A network-based solution is transparent to system users | The host-based sensor runs as a service and is also invisible to users |
| Network monitoring is invisible to attackers | Insiders know of its existence because they have access to the network diagram; every external attacker assumes that network traffic is being monitored and seeks to be stealthy |
| Network-based monitoring can listen to all endpoints, regardless of type; no specific sensor is needed | A host-based sensor must be provided for each endpoint type; the common ones are Windows and Linux |
| Passive network monitoring devices are easy to install | When host-based sensors are provided as a managed service, they are also simple to install |
| When monitoring at the egress point only, endpoints can move or be added with no extra effort | Endpoints are usually not added/moved randomly, but through a defined process; extending this process to accommodate sensor deployment is no more work than deploying patches or anti-virus |
And then here are challenges with network based monitoring…
| Challenge | Problem |
| Network-based signatures are always out-of-date or lagging | Zero-day attacks are not detected, maybe worse; detection is limited to attacks with signatures only |
| Packet inspection is blind to encrypted traffic | North/south network traffic is increasingly encrypted |
| Packet inspection is hard to scale as network speeds increase | OTOH host-based approaches scale neatly both up and down; we’re going to need a bigger boat |
| Network monitors can’t handle switched networks; it requires span ports | Now you need span ports, more hardware, and networking skills |
| Network monitors usually can only see north/south traffic | Insider threat, anyone? Remember Nyety? It spread laterally. Here’s an article about how to detect. |
| Network monitoring is blind to host activity; new processes, removable media | Remember Edward Snowden? |
| Network monitoring does no log collection; therefore, it can’t meet compliance requirements | PCI-DSS, NIST 800-171, and all other compliance standards mandate log collection and retention for 1+ years to be able to perform forensics |
And now, the advantages of a host-based solution…
| Advantage of a Host-based Solution |
| Collect audit trail; meets compliance needs |
| Develop detailed understanding of user behavior; fight insider attacks |
| Scales well; no single choke point |
| Detect subtle patterns of misuse which can’t be seen at a higher layer (first-time-seen, zero day) |
| Effective for encrypted traffic as well |
| Sees all actions including east/west |
| Effective against removable media |
| Works even in switched networks |
And to be fair, how to address the challenges…
| Challenge | Response |
| Sensor deployment to nodes | Our solution is a managed service; leave the deployment/configuration to us |
| Sensor can impact node performance | The EventTracker Windows sensor consumes 0.1% of memory/CPU resources and 0.001% network bandwidth |
| Adding nodes means adding sensors | It’s no more complicated than deploying anti-virus |
| Can’t see all network traffic; only those where a sensor is installed | The next-gen firewall you already paid for does see this traffic; we get all of its logs, so why duplicate effort/cost |
| Sensor must be available for chosen platform | An EventTracker endpoint sensor is available for Windows, Linux, AS/400, and IBM iSeries |
Don’t bring a knife to a gunfight. Passive network monitoring may be attractive because of deployment simplicity, and the fit and forget promise, but it is not capable of solving today’s network security ad compliance challenges.
