1. It’s What You Can’t See That Will Sink You
Enhance Network Security and Increase Your Visibility

2. Quotation
"We have to build our systems on the assumption that adversaries will get in.”
~Deborah Plunkett, Head of the US National Security Agency’s
Information Assurance Directorate

3. Improving Network Security
You can’t find what you can’t see…
Network Security is all about seeing what is on your network.
As has often been said: You can’t find what you can’t see.

4. Improving Network Security
Improved Reliability for Out-of-Band Monitoring and Analysis
Application Performance
Network Management
Security
LEGEND
Network Management
Security
CENTRALIZED
TOOLS
Application Performance

5. Improving Network Security
Improved Reliability for Inline Protection
Inline Device Vendors:
The primary differentiator between an inline device and an out-of-band deployment is that the inline device has the ability to allow or deny a connection in progress. An out-of-band solution learns about the event around the same time as it occurred.
<click> Each of the vendors shown on are partnered with Gigamon for their inline analyzers. Joint Solution Briefs are available now, or will be available soon.

6. Improving Network Security
Improved Reliability for Out-of-Band Monitoring and Analysis
Out-of-Band Device Vendors:
Out-of-band devices obtain duplicate copies of packets for analysis via either TAPs or from switch SPAN or Mirror ports. Since the original conversation is undisturbed, these solutions are primarily used for reporting and do not have the ability to prevent activity from occurring.
<click>
This group of vendors are partnered with Gigamon for their out-of-band solutions. Again, joint Solution Briefs are available now, or will be available soon.

7. Improving Network Security
Best Practices:
Conventional
Best Practice
Protect with Inline Security
Aggregate from SPAN / Mirror Ports
Monitor Critical Links
Provide All Traffic to All Tools
Analyze Traffic at Edge with Distributed Tools
Replace All Tools with Every Network Speed Upgrade
Limit Access Via Login Restrictions to Ensure Compliance & Confidentiality
Inline Security with Bypass Protection
Aggregate from TAPs
Aggregate Entire Network
Send Critical Traffic Flows to Monitors
Deliver Only Relevant Traffic Flows to Each Monitoring Device
Aggregate Low Utilization Edge Links to Centralized High Performance Tools
Load-Balance Traffic to Existing Tools, Adding or Upgrading Where Needed
Use Packet Slicing and Data Masking to Sanitize Traffic Before Reaching Tools
This table represents a simplified list of some Best Practices related to network visibility:
<click> Use Bypass switches to provide enhanced reliability and flexibility for inline protection.
<click> SPAN or Mirror ports are often necessary, but should not be a first choice where security is involved, as they oversubscribe easily. TAPs are better because a standard tap with separate outputs for TX and RX provides a complete traffic stream.
<click> All critical paths, whether you are now ready to monitor them or not, should be provisioned with TAPs or SPANs either at the time of installation, or during a regularly scheduled maintenance window. If traffic is available but unanalyzed then it can be redirected for analysis in minutes, rather than waiting for either the next maintenance window or equipment to be ordered.
<click> Forwarding all traffic to analyzers is good. Forwarding only traffic each solution is optimized for improves analysis efficiency, and permits traffic from more segments to be analyzed.
<click> Low utilization does not mean unimportant. Rather than deploy multiple minimally featured monitoring and analysis tools throughout the infrastructure, aggregate low-utilization links together for monitoring by high performance tools.
<click> If the only limitation is that the interface changed, then bridge and load balance upgraded links to existing tools in order to extend their useful life. Augment the existing tool pool with higher speed additions as traffic volume dictates.
<click> More network monitoring and management is being turned over to contracted services, and more traffic is accessible by people lacking a “need to know”. The requirements for compliance and confidentiality grow more stringent. Rather than relying solely upon login account restrictions within multiple monitoring and analysis solutions, where possible apply traffic slicing and masking prior to traffic delivery. Compliance is more certain when the infrastructure sanitizes traffic before it reaches monitoring and analysis solutions.

8. Improving Network Security
Important Questions
Could your inline security become a point of failure?
Are all critical paths monitored?
Does each solution owner know about network topology changes?
Can suspicious traffic be forwarded to analyzers rapidly enough?
Incomplete traffic visibility is a key area where security may be improved.
<click> Inline security, such as Intrusion Prevention Systems are important, but since they are securing live production traffic, they could also become a point of failure in not only your security defenses but also your network.
<click> Core network segments as well as uplinks from the edges, inter-site links, inter-server links and cloud traffic all carries business critical data. If the link wasn’t important it would not have been installed.
<click> As the network becomes larger and more distributed the probability increases that growth, moves, and changes occur without the knowledge of independent or silo’ed tool managers. Coverage may have been complete at the time of initial deployment, but unless diligent efforts are made coverage is less than complete today.
<click> How quickly are you setup to react to suspicious traffic? In the event of an attack, you want the agility to be able to direct it to the appropriate monitoring and analysis solution within minutes. However, if your change management policy isn’t that reactive, how long could an attacker be inside your network before you catch them?
These are all real problems that the deployment of a Traffic Visibility Fabric architecture can solve.

9. Improving Network Security
Improved Reliability for Out-of-Band Monitoring and Analysis
Replace SPAN Connections with TAPs
Another reason to use TAPs over SPANs is that many Switches rate limit the SPAN port as utilization increases. This is especially prevalent at 10Gb link speeds, where SPAN traffic can be throttled by as much as 85%.
To illustrate this, here are quotes from the user manuals of two popular switches:
If you are relying on SPAN ports to feed your security devices, you may be missing as much as 85% of the traffic!
“Use SPAN for troubleshooting. Except in carefully planned topologies, SPAN consumes too many switch and network resources to enable permanently.”
“[Switch Vendor] recommends that you do not mirror more than 15% of your total transit traffic. On Ten Gigabit Ethernet interfaces or bundle interfaces there is a limit of 1.5G on each ingress amount to be mirrored and 1.5G on each egress amount to be mirrored.”
The entire basis for security depends on 100% traffic visibility, and yet the primary source of traffic is the SPAN or Mirror port. For link speeds up to 1 gigabit the oversubscription problem has already been demonstrated.
At 10gigabit and higher speeds a new problem is found: the typical switch is unable to keep up with forwarded traffic and either rate limits the output traffic by default, or rate limits the traffic based on volume.
In either case, up to 85 percent of the traffic destined for your security tools fails is often discarded by the switch before it exits the SPAN or Mirror port.
If you are depending on your security tools in 10gigabit and faster environments then the traditional approach of using SPAN ports is creating a gigantic new blind spot.

10. Gigamon – Enabling a Security Visibility Fabric™
Security Infrastructure you deploy today must be strong, resilient and adaptable to the dynamic threats which confront your business on a continual basis.
The deeper the visibility you have, the greater your ability to defend cyber-attacks.
Gigamon refers to this as a Visibility Fabric
The network that was once fixed is now mobile. Users are demanding high mobility.
Servers that were once physical are now virtualized.
Applications that were in house are now being considered for, if not already moved into the cloud.
Data that was contained is now limitless - explosive growth in data.
And devices that were once owned by IT, configured, supported and managed by the IT organization are now being provisioned, purchased, deployed and owned by users.
So inside of this new world all of the static management and monitoring security tools are being challenged to try and maintain the visibility that you require to secure your environment from cyber attacks as your infrastructure scales in the dynamic world.

11. Enabling Best of Breed Security & Monitoring
Improves the solutions you are already selling
Analytics
Network
Performance
Management
Application
Performance
Management
Network
Forensics
Security
Router/Switch & Server Farm

12. Visibility: The Enabler for Security
Anatomy of an Attack
Attack
commences
Information
extraction
Cloning &
‘go mobile’
Cloaking
complete
Assessing the
infrastructure
Pilot probe
attack
Cloaking
starts
Data extraction or manipulation
Identifying
targets
Intrusion
commences
Window of Exposure
Security ‘Baseline’
established
Elimination
The “Golden Hour”
Alert &
notification
Early stage
containment
Damage & scale
assessment
Infrastructure
wide response
Second-wave
detection
Anomaly
detected
Attack
identified
Over the course of time, you deploy a security environment. And with confidence you continue to maintain and support and enhance that security environment. But you are under continuous attack.
Your infrastructure is being assessed continuously from the outside. And targets are being identified as users are watching from the outside.
A pilot attack starts. They find a crack, they find a hole, they find targets that are probe-able so they start probe and explore the possibility of true attack.
And now the intrusion commences; a penetration point has been found; and your infrastructure is now compromised. However your security systems are still working just fine. And still looking all green.
The attack is now underway. Now the game is really on. Now that golden hour starts from when that first attack starts to when you can understand what is going on.
So immediately as the attack is underway cloaking is in place. They will cover their trail as close as fast as they possibly can.
And information extraction or modification or manipulation or damage is already underway.
Now you detect it, your team has realized there is something going on. You’re seeing a characteristic of the network you haven't seen before. Infrastructure is performing in a different way. You’re seeing a different profile of behavior. So the anomaly is now detected. Your team is now starting to identify and can see the characteristics of the attacker, uniquely identifying it.
However the attackers are not standing still. They are cloning themselves. They’re going mobile. They may have cloaked it and are going mobile throughout your infrastructure. As fast as your team is trying to respond.
Now your team starts to raise the alert. They start to notify people, users, infrastructure owners, different departments that there is attack underway and characterize it as best as they can.
You start contain what you originally saw as being the first attack. Your team has contained and starts to maintain the continuous spread of that virus. Now from the outside they may have cloaking complete. Now the virus is almost undetectable. The attack is almost invisible. You start to run the damage, the scale and the assessment of what has happened, how far did they get and what impact is going on.
You now execute the infrastructure wide response. You may lock down, you may modify changes, you may modify configurations, you may update or change the configuration or behavior of the environment. And now you look at the second wave from that first move that you saw and detected to where it went mobile. You’ve now detected that second wave and you can now start to respond to it.
However during this whole time the outside attacker is modifying, extracting, manipulating or changing the data whilst you continue to work the process. Your team works towards full elimination. The challenge here or really the opportunity, is to reduce that window of exposure from the initial attack commencing through to the total elimination to reduce that time window. And visibility is the enabler to help you do that.

13. Threat Detection: Two Architectures, Two Approaches
“Inline and Out of Band”
“In Band”
“Out of Band”
Stop at the front door
Intrusion Prevention (IPS)
Data Loss Prevention (DLP)
Block the known attacks
Monitor traffic profiles
Alert to anomalies
Passive Monitoring
Forensics / Recorders / Analytics
Broader scale
Longer time
Leverage multiple measures
Highly available architecture
Line-rate performance
Infrequent configuration changes
Requirements
Powerful filtering capability
Multi-point triangulation
The more pervasive, the greater the value
Limitations
Single point of failure
Potential bottleneck
Dependent upon “Maintenance windows”
Risk of over-subscription
Famine or Feast: SPAN or TAP
Increasing tooling demand & expanding network scale
So there are two approaches. We refer to them as the wall or the watch approach. Let’s look at them.

14. Threat Detection: Two Architectures, Two Approaches
“In-Band and Out of Band”
“Inline”
“Out of Band”
Highly available architecture
Line-rate performance
Infrequent configuration changes
Requirements
Powerful filtering capability
Multi-point triangulation, greater visibility
The more pervasive, the greater the value
Single point of failure
Potential bottleneck
Dependent upon “Maintenance windows”
Limitations
Risk of over-subscription (dropped packets, loss of visibility)
Detection & Remediation is after the fact
Increasing tool demand & expanding network scale
So the first approach, the wall approach that’s in-band. That is monitoring and providing walls between demarcation points within your network or from your network out into the public market. The objective here is to limit what comes in from the outside or what transits through a particular point.
The environment needs to be highly reliable because it’s inline. It needs to be line rate. Anything that you do here could potentially impact or bottleneck performance. And it needs to be a reasonably static configuration. You can’t be continuously manipulating or modifying inline configurations for risks of operational outages and reliability problems.
The second approach is what we refer to as “watch.” That’s out of band. So this is where you’re holding a much pervasive view across the infrastructure. You’re trying to look for characteristic change. You’re signaturing the behavior of your network. Signaturing the behavior of users. Signaturing the behavior of traffic. Signaturing the behavior of threats when they arrive inside your environment. It really represents the frontline against the unknown – it’s not looking for the bad, it’s watching for the good.
And so that requires a much more pervasive, and much more broad-spread capability. You need to be able to filter out relevant from irrelevant. You really need to also be able to have multiple points of triangulation. No one point may give you the insight you require to understand an attack is underway.
And fundamentally the more pervasive the visibility and more pervasive your ability to watch, the greater the value you can bring to your organization and the faster you will be able to detect and react to that threat.
So with these requirements, what are some of the limitations that come with it? Unfortunately with the wall environment, as soon as you go inline you start to create impact and start to create limitations. So it is a single point of failure. It’s a slow point in your network. Your devices may be running at Gig and your network at 10 Gig. Your devices 10 Gig and your network 40 Gig. You have to continuously maintain performance of these inline activities to maintain the performance of the overall architecture.
You're also dependent upon maintenance windows. So when you want to modify, change, you may have a threat underway, you may have an attack going on, you may have a different characteristic occurring, you may have a new environment coming up, all of the changes that occur to these inline devices – they need to occur in a specific window unless you are in a disaster recovery scenario.
And within the watch world, although the pervasive visibility gives you much greater value, you also suffer the risk of oversubscription. There is a lot of traffic out there, a lot of information that you can watch, a lot of data and trying to separate the good from the bad, the relevant from the irrelevant, the meaningful of meaningless is a substantial challenge. And you have fundamentally two tools from which you can extract network traffic these days. There is the SPAN port or the mirror port or there is network TAPs. And they refer to famine or feast.
The SPAN is fundamentally a capable device, but it is going to limit the traffic that you get provided into your management tools. While the TAP is basically a deluge of traffic. Everything that goes past that point will get sent on into the tools. No logic, no intelligence, no filtering, no control. And with this the increasing demand as your traffic scales, as your network scales, as users are going mobile, as more and more users wind up with more and more devices. There's a huge increase in demand for more traffic to come in, this is driving greater tooling, and greater expansion of your network scale.

15. Threat Detection: Two Architectures, Two Approaches
“Inline and Out of Band”
“Inline”
“Out of Band”
Limitations
Limitations
Single point of failure
Potential bottleneck
Dependent upon “Maintenance windows”
Risk of over-subscription (dropped packets, loss of visibility)
Detection & Remediation is after the fact
Increasing tool demand & expanding network scale
So at Gigamon we saw these limitations. And we realized that there must be a different and better approach. So we took the approach that we refer to as “The Visibility Fabric.” It’s a capability to address both aspects and both sets of limitations of the wall and watch, or the in-band and out-of-band threat detection and threat management.
So let’s take a pragmatic view of what this looks like.

16. Gigamon & Maximum Visibility
How Does Gigamon enable Maximum Visibility into the Network?
The network that was once fixed is now mobile. Users are demanding high mobility.
Servers that were once physical are now virtualized.
Applications that were in house are now being considered for, if not already moved into the cloud.
Data that was contained is now limitless - explosive growth in data.
And devices that were once owned by IT, configured, supported and managed by the IT organization are now being provisioned, purchased, deployed and owned by users.
So inside of this new world all of the static management and monitoring security tools are being challenged to try and maintain the visibility that you require to secure your environment from cyber attacks as your infrastructure scales in the dynamic world.

17. Without Gigamon… Many links to monitor; many tools required DMZ
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor
IDS
(Intrusion Detection System) $ $ $ $ $ $ $
No Aggregation: Many tools required
Capital investment in tools increases

18. With Gigamon… Simplicity. Efficient. Scalable. DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor $ $
With Aggregation: Many links to fewer tools
Capital investment in tools decreases

19. Without Gigamon…
All packets to all tools; tools are over oversubscribed or provisioned.
DMZ
Physical Server
all packets
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor
DLP
(Data Loss Prevention) $ $ $ $ $ $ $
Without Filtering: All packets are sent for inspection
Capital investment in tools increases

20. With Gigamon… Simplicity. Efficient. Scalable. DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor $ $
With Aggregation: Many links to fewer tools
Capital investment in tools decreases

21. With Gigamon… Simplicity. Efficient. Scalable. DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor
packets
packets $ $
With Filtering: Only traffic is sent for inspection
Capital investment in tools decreases

22. Without Gigamon… Span Port Contention… DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor
NEW
NEW
APM
IDS
APM
IDS
SPAN Port Contention: 2 ports to 2 tools SPAN port not available for new tool—Visibility decreases

23. With Gigamon… Simplicity. Efficient. Scalable. DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
Hypervisor
APM
IDS
NEW
Eliminate SPAN Port Contention: Replicate SPAN ports to new tools —Visibility Increases

24. Without Gigamon… 10 Gb Network with 1 Gb Tools… DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
10 Gb
Hypervisor
APM
IDS
1 Gb Tools
10Gb Core or Perimeter: 1Gb tools won’t work
Expensive Tool Upgrades Necessary

25. With Gigamon… Extend the life of your 1 Gb tools DMZ Perimeter Network
Physical Server
Perimeter
Network
Server Farm
Core Network
Virtual
Servers
10Gb
Hypervisor
APM
IDS
1 Gb Tools
10Gb Core or Perimeter: Convert 10Gb to 1Gb
Expensive Tool Upgrades Avoided

26. The Fabric Intelligence
Extending Visibility across Networks
Physical
Application
Performance
Network
Management
Security
Packet Modification
GigaSMART®
Deduplication
ABACCABACB
ABC
Packet Slicing
A B C
A B C
Virtual
Thank you Ted.
At the heart of our Visibility Fabric is the intelligent and proprietary software that resides on our purpose built hardware appliances.
As our customers deploy, expand and upgrade their networks they are challenged to manage an increasing volume of traffic from an increasing breadth of network to a limited <click> number of management, monitoring and security tools. They turn to the Gigamon Visibility Fabric that delivers unique technology to <click> intelligently select and control the the traffic to ensure the appropriate traffic – and only the appropriate traffic – is <click> forwarded to the relevant tool or tools. We call this technology Flow Mapping.
However, with the expanding variety of traffic, the need to be able to tune and enhance networks and user experiences and the need to protect the confidentially of the information while the management of the network itself is not constrained, we expanded the Visibility Fabric with <click> Smart Intelligence. This provides a platform to allow customers to modify, manipulate and transform network traffic as it traverses the Visibility Fabric. Whether our customers are looking to <click> remove any duplicates of traffic to minimize the volume of data delivered to a tool, or <click> the removal of irrelevant parts of the traffic to extend the life of lower-performance tools or <cick> the ability to add timing information to network traffic enabling accurate and ongoing performance tuning, our GigaSMART technology delivers the platform to meet their requirements.
And <click> with the move to the virtual world and cloud, we provided <click> a virtual-machine version of our technology to allow our customers to seamlessly extract information from the virtual world.
Header Stripping
Tunneling
Time Stamp
Network
Flow Mapping®
Tools
Packet Identification, Filtering, and Forwarding

27. Inline Bypass for Inline Security Tools
Why use Gigamon for Inline Bypass?
Use 1Gb monitoring tools on 10Gb links
Filter traffic on inline tool to avoid oversubscription
Do maintenance on monitoring tool without disrupting production links
Bi-directional heartbeat to insure monitoring tool is active
Replicate traffic from production link to other monitoring tools
1Gb or 10Gb Network Link
1Gb or 10Gb Inline Monitoring Tools
1Gb or 10Gb Network Link
8 x 1Gb Inline Monitoring Tools
1Gb Copper
A/B
1Gb Optical
WAF
IDS
DLP
G-Secure-0216

28. Advantages of Gigamon Inline Bypass
Traffic offload – Application-aware traffic profile
And for those of you that are more pragmatic in the room, here’s one example of how the Visibility Fabric can connect between a network and your Intrusion Protection System. The Fabric is able to identify particular types of traffic. So rather than have the tools suffer from a huge deluge of information you're able to intelligently select particular types of traffic to send into the tool and particular types that may be irrelevant for that tool and only send on the relevant. Thereby getting far greater utilization from your infrastructure tools and also at the same time being able to dynamically change and modify the profile of traffic that gets sent on should you require.

29. In Summary Addressing the Limitations “Inline” “Out of Band”
Heartbeat monitoring
Intelligent traffic distribution
Establishes a ‘Dynamic DMZ’ enabling rapid response
Limitations
Single point of failure
Potential bottleneck
Dependent upon “Maintenance windows”
“Out of Band”
So in summary, the Visibility Fabric, when you look at your two approaches of wall which is in-band, and watch, which is out of band, both have limitations. But with the Visibility Fabric we provide solutions that can address these challenges and requirements, providing pervasive visibility with the flexibility and scalability needed without impacting network reliability or performance.
YOU MAY WANT TO GO INTO FURTHER DETAIL AND READ FROM THE SLIDE.
Flow Mapping™
Selective traffic forwarding
Scalability to serve some of the largest networks on the planet
Limitations
Risk of over-subscription
Famine or Feast: SPAN or TAP
Increasing tooling demand and expanding network scale

30. The Visibility Fabric – A Deeper Look
So there are two approaches. We refer to them as the wall or the watch approach. Let’s look at them.

31. Thank you