4 min read

The argThe argument is an old one; are you better off with a network-based detector, assuming all hosts will eventually communicate, or should you look at each host to determine what they are up to?ument is an old one; are you better off with a network-based detector, assuming all hosts will eventually communicate, or should you look at each host to determine what they are up to?

Over five years ago, the network was far simpler. There was a clear perimeter – us versus them, if you will. You could examine all traffic at the egress point (so-called North/South traffic) for potentially hostile patterns while pretty much ignoring local traffic (so-called called East/West traffic) as usually benign. This is usually done with the help of attack signatures which are updated periodically. In other words, classic network-based, signature-driven detection.

This applied to firewalls. You could be network-based and/or have one for each host. The attraction of the network-based firewall is simplicity; one device to deploy and manage versus the hassle of configuring one firewall per host. Notice that this depends on the traditional (simple) network with a clear us/them perimeter. But that is a pretty simple, traditional model that is vanishing fast. Applications are moving to the cloud and the perimeter is porous. You pretty much need a micro-fortress around a host or location.

So, what arguments are the network-based passive monitoring solutions making for themselves? And how do they stack up against a host-based managed solution? Let me count the ways…

Passive network monitoring has no impact on endpoint performanceA well-designed, user-space host-based solution has virtually no impact on the endpoint 
A network-based solution is transparent to system usersThe host-based sensor runs as a service and is also invisible to users
Network monitoring is invisible to attackersInsiders know of its existence because they have access to the network diagram; every external attacker assumes that network traffic is being monitored and seeks to be stealthy
Network-based monitoring can listen to all endpoints, regardless of type; no specific sensor is neededA host-based sensor must be provided for each endpoint type; the common ones are Windows and Linux
Passive network monitoring devices are easy to installWhen host-based sensors are provided as a managed service, they are also simple to install
When monitoring at the egress point only, endpoints can move or be added with no extra effortEndpoints are usually not added/moved randomly, but through a defined process; extending this process to accommodate sensor deployment is no more work than deploying patches or anti-virus

And then here are challenges with network based monitoring…

Network-based signatures are always out-of-date or laggingZero-day attacks are not detected, maybe worse; detection is limited to attacks with signatures only
Packet inspection is blind to encrypted trafficNorth/south network traffic is increasingly encrypted
Packet inspection is hard to scale as network speeds increaseOTOH host-based approaches scale neatly both up and down; we’re going to need a bigger boat
Network monitors can’t handle switched networks; it requires span portsNow you need span ports, more hardware, and networking skills
Network monitors usually can only see north/south trafficInsider threat, anyone? Remember Nyety? It spread laterally. Here’s an article about how to detect.
Network monitoring is blind to host activity; new processes, removable mediaRemember Edward Snowden?
Network monitoring does no log collection; therefore, it can’t meet compliance requirements
PCI-DSS, NIST 800-171, and all other compliance standards mandate log collection and retention for 1+ years to be able to perform forensics

And now, the advantages of a host-based solution…

Advantage of a Host-based Solution
Collect audit trail; meets compliance needs
Develop detailed understanding of user behavior; fight insider attacks
Scales well; no single choke point
Detect subtle patterns of misuse which can’t be seen at a higher layer (first-time-seen, zero day)
Effective for encrypted traffic as well
Sees all actions including east/west
Effective against removable media
Works even in switched networks

And to be fair, how to address the challenges…

Sensor deployment to nodesOur solution is a managed service; leave the deployment/configuration to us
Sensor can impact node performanceThe EventTracker Windows sensor consumes 0.1% of memory/CPU resources and 0.001% network bandwidth
Adding nodes means adding sensorsIt’s no more complicated than deploying anti-virus
Can’t see all network traffic; only those where a sensor is installedThe next-gen firewall you already paid for does see this traffic; we get all of its logs, so why duplicate effort/cost
Sensor must be available for chosen platformAn EventTracker endpoint sensor is available for Windows, Linux, AS/400, and IBM iSeries

Don’t bring a knife to a gunfight. Passive network monitoring may be attractive because of deployment simplicity, and the fit and forget promise, but it is not capable of solving today’s network security ad compliance challenges.