learn linux and unix commands - unix shell scripting

Data Loss Prevention: Is really necessary to record all IP Traffic?


 
Thread Tools Search this Thread
# 1  
Old 11-19-2008
Data Loss Prevention: Is really necessary to record all IP Traffic?

Due to Data Loss Prevention (aka DLP) some companies are requested to keep records of the traffic that enters and leaves his networks. The main issue nowdays is that is almost impossible to store all this traffic, per example lets assume a scenario of a 1Gigabit of inbound/outbound traffic link. This will generate something like 6.000 Terabytes of traffic. Obviously a very expensive storage is need.

The point is:

Is really need to store all this traffic? I don't think so.

The main point here is to extract only the valuable information from the traffic and then storage it. Some techonogies available today (all DPI based) uses complex data filtering algorithms to instead of store all layers of info, extract the necessary content and associate it with the Metadata needed. This will reduce storage and also will reduce processing.

Let's take by example the HTTP Traffic

HTTP is supported by many different applications (browsers, editors, generators, etc). But what really interests is the content itself and not all the data that comes togueter. So to reduce storage is necessary to extract this content, separating it from the application-level information that is of lesser interest, along with just the necessary meta-data (ip source, ip dest, time, etc.).

More than finantial and military institutions, all companies that deals with high confidential data or classified customers info will be requested to be compliant with Data Loss Prevention requirements.

Conclusion

In a DLP project it's always very important to understant wich type of traffic is being generated in the newtork. Understand exactly what needs to be stored (don't forget that you need to remain compliant with regulations), for how long this data need to be stored and them finaly start to specify the solution you need. This can solve time, problems and money.


Image
Image

More...
Login or Register to Ask a Question

Previous Thread | Next Thread

6 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

awk --> math-operation in data-record and joining with second file data

Hi! I have a pretty complex job - at least for me! i have two csv-files with meassurement-data: fileA ...... (2 Replies)
Discussion started by: IMPe
2 Replies

2. Solaris

HBA data traffic monitor in Solaris 10.

Hi All We have T4-4 Server with 2 HBA configured for SAN connectivity. We want to monitor Data traffice going through these HBA. On other AIX system we have that capability with nmon. Following screen shows nmon HBA monitoring can we achieve same in Solaris 10. ... (1 Reply)
Discussion started by: uxravi
1 Replies

3. Shell Programming and Scripting

Replace field in one file with whole record data of another

Hello Group, I need to replace the city field in “File 1 (fileld 3), with the entire record line of “File 2” (including delimiters) where the “city” field (File 1, Field 3)matches city field (File 2, Field1). All of the other data in “File 1” should remain intact(Fields 1,2,4,5,6). Only field... (1 Reply)
Discussion started by: vestport
1 Replies

4. Programming

Help with sort and keep data record to calculate N50 in c

Input_file_1 #content_1 A #content_2 AF #content_3 AAR #content_4 ASEI #content_5 AS #content_6 ADFSFGS Rules: 1. Based on c program to calculate content of each "#". Result getting from the above Input_file_1 are 1,2,3,4,2,7; 2. Sort length on reverse order (descending order).... (5 Replies)
Discussion started by: cpp_beginner
5 Replies

5. Cybersecurity

Anyone knows any prevention against identity theft?

I have recently been victimized by the theft of my credit card. But, due to favorable situations I could prevent it from being miss-used and was able to make thins go in the right way.Anyways , I would like to know that if there any services which keeps your financial information safe and make you... (4 Replies)
Discussion started by: levi
4 Replies

6. Shell Programming and Scripting

Detecting data loss during FTP

Hi, How we can detect that there has been a data loss during FTP, throught Shell scripting? I have gone through FTP return codes, but, none indicate that there has been any data loss. Can we use FTP return code 226 as an indication that during file transfer there has been no data loss? If,... (4 Replies)
Discussion started by: sameerbo
4 Replies
Login or Register to Ask a Question