|
|
Sponsored Content
Special Forums
Cybersecurity
IT Security RSS
Data Loss Prevention: Is really necessary to record all IP Traffic?
Post 302260033 by Linux Bot on Wednesday 19th of November 2008 12:50:01 PM
11-19-2008
Data Loss Prevention: Is really necessary to record all IP Traffic?
Due to Data Loss Prevention (aka DLP) some companies are requested to keep records of the traffic that enters and leaves his networks. The main issue nowdays is that is almost impossible to store all this traffic, per example lets assume a scenario of a 1Gigabit of inbound/outbound traffic link. This will generate something like 6.000 Terabytes of traffic. Obviously a very expensive storage is need.
The point is:
Is really need to store all this traffic? I don't think so.
The main point here is to extract only the valuable information from the traffic and then storage it. Some techonogies available today (all DPI based) uses complex data filtering algorithms to instead of store all layers of info, extract the necessary content and associate it with the Metadata needed. This will reduce storage and also will reduce processing.
Let's take by example the HTTP Traffic
HTTP is supported by many different applications (browsers, editors, generators, etc). But what really interests is the content itself and not all the data that comes togueter. So to reduce storage is necessary to extract this content, separating it from the application-level information that is of lesser interest, along with just the necessary meta-data (ip source, ip dest, time, etc.).
More than finantial and military institutions, all companies that deals with high confidential data or classified customers info will be requested to be compliant with Data Loss Prevention requirements.
Conclusion
In a DLP project it's always very important to understant wich type of traffic is being generated in the newtork. Understand exactly what needs to be stored (don't forget that you need to remain compliant with regulations), for how long this data need to be stored and them finaly start to specify the solution you need. This can solve time, problems and money.
More...
The point is:
Is really need to store all this traffic? I don't think so.
The main point here is to extract only the valuable information from the traffic and then storage it. Some techonogies available today (all DPI based) uses complex data filtering algorithms to instead of store all layers of info, extract the necessary content and associate it with the Metadata needed. This will reduce storage and also will reduce processing.
Let's take by example the HTTP Traffic
HTTP is supported by many different applications (browsers, editors, generators, etc). But what really interests is the content itself and not all the data that comes togueter. So to reduce storage is necessary to extract this content, separating it from the application-level information that is of lesser interest, along with just the necessary meta-data (ip source, ip dest, time, etc.).
More than finantial and military institutions, all companies that deals with high confidential data or classified customers info will be requested to be compliant with Data Loss Prevention requirements.
Conclusion
In a DLP project it's always very important to understant wich type of traffic is being generated in the newtork. Understand exactly what needs to be stored (don't forget that you need to remain compliant with regulations), for how long this data need to be stored and them finaly start to specify the solution you need. This can solve time, problems and money.
More...
|
|
6 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
Hi,
How we can detect that there has been a data loss during FTP, throught Shell scripting?
I have gone through FTP return codes, but, none indicate that there has been any data loss.
Can we use FTP return code 226 as an indication that during file transfer there has been no data loss? If,... (4 Replies)
Discussion started by: sameerbo
4 Replies
2. Cybersecurity
I have recently been victimized by the theft of my credit card. But, due to favorable situations I could prevent it from being miss-used and was able to make thins go in the right way.Anyways , I would like to know that if there any services which keeps your financial information safe and make you... (4 Replies)
Discussion started by: levi
4 Replies
3. Programming
Input_file_1
#content_1
A
#content_2
AF
#content_3
AAR
#content_4
ASEI
#content_5
AS
#content_6
ADFSFGS
Rules:
1. Based on c program to calculate content of each "#". Result getting from the above Input_file_1 are 1,2,3,4,2,7;
2. Sort length on reverse order (descending order).... (5 Replies)
Discussion started by: cpp_beginner
5 Replies
4. Shell Programming and Scripting
Hello Group,
I need to replace the city field in “File 1 (fileld 3), with the entire record line of “File 2” (including delimiters) where the “city” field (File 1, Field 3)matches city field (File 2, Field1). All of the other data in “File 1” should remain intact(Fields 1,2,4,5,6). Only field... (1 Reply)
Discussion started by: vestport
1 Replies
5. Solaris
Hi All
We have T4-4 Server with 2 HBA configured for SAN connectivity. We want to monitor Data traffice going through these HBA. On other AIX system we have that capability with nmon. Following screen shows nmon HBA monitoring can we achieve same in Solaris 10.
... (1 Reply)
Discussion started by: uxravi
1 Replies
6. Shell Programming and Scripting
Hi!
I have a pretty complex job - at least for me!
i have two csv-files with meassurement-data:
fileA
...... (2 Replies)
Discussion started by: IMPe
2 Replies
LEARN ABOUT DEBIAN
guessnet-scan
GUESSNET-SCAN(8) System Manager's Manual GUESSNET-SCAN(8) NAME
guessnet-scan - guess network configuration data by looking at network traffic SYNOPSIS
guessnet-scan [options] [ethernet_interface] DESCRIPTION
Guessnet-scan tries to deduce network configuration data by watching network traffic at a given Ethernet interface. After scanning network traffic for some time, guessnet-scan prints a configuration string suitable for inclusion in /etc/network/inter- faces. Note that guessnet-scan uses heuristics and wild guesses and that the resulting data is not guaranteed to be accurate. The program is intended to be used as a first try at getting network configuration data without bothering anyone. OPTIONS
Options follow the usual GNU conventions, --debug Print debugging messages. --help Show a brief summary of commandline options. --init-time=int Time in seconds to wait for the interface to initialize when it is not found already up at program startup. Default: 3 seconds. -t, --timeout=int Time in seconds to watch for network traffic. Default: 5 seconds. -v, --verbose Operate verbosely. --version Show the version number of the program. SCANNING REQUIREMENTS
To correctly identify all data of the local network, guessnet-scan needs to see traffic related to a host in the local network and to the local gateway, if any. To be able to identify the network gateway, guessnet-scan also needs to see some traffic directed to the external network: you can help the detection by generating some outbound IP traffic during the scan, for example by browsing a web page (without proxy) or using telnet to open a connection to some remote host. Note that if you are connected to a switch, guessnet-scan won't probably be able to work, since the switch will isolate it from the network traffic that the other machines are generating. SEE ALSO
guessnet(8), interfaces(5). AUTHOR
Guessnet-scan was written by Enrico Zini <enrico@debian.org>. 10 October 2004 GUESSNET-SCAN(8)