The Network View Rotating Header Image

Network Emulation and Monitoring: Call for Input

Good morning to all of our readers, and thank you for your time and attention here on our blog.

What Topics Do You Want to See on The Network View? Tell Us!!

What Topics Do You Want to See on The Network View? Tell Us!!

In the past year plus, we’ve covered a wide gamut of topics on The Network View. We’ve done a series about how to calculate an ROI (or cost savings, more like it) for simplifying the complexity of passive monitoring tools in the data center. We spent many weeks sharing insights from SPoTs (Security Pros on Twitter), many of whom you already knew, and a few who were very likely new folks to some of you. We shared some key players at a few security tool vendors in our ALIST series. And we’ve covered research, trends, 2010 predictions, and even some network emulation topics.

As we enter our second month of 2010, we turn our attention to you, the faithful readers of this blog. I pose one simple question to you at this time: What’s on your mind?

We always want to keep this content relevant and engaging, so it makes sense to get a feel for what topics are of interest to you.

What has lacked coverage in your opinion?

What topics that we’ve already touched on might be worth revisiting from another angle or with more depth?

What hot topics have permeated many of your recent conversations, but have yet to get ample attention in the media?

This is a blog, and it’s here for all of us. Please comment below or contact us directly to chime in your opinion. If you prefer not to share publicly below, email me at tlandry (at) anuesystems (dot) com. We’d love to hear from you.

Thank you in advance for your valuable input.

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Twitter Weekly Updates for 2010-02-05

Powered by Twitter Tools

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Twitter Weekly Updates for 2010-01-31

Powered by Twitter Tools

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Network and Security Monitoring: Study Shows Much Room For Improvement

Monitoring Optimization 2010 Report

Monitoring Optimization 2010 Report

A few days ago we announced the results of Monitoring Optimization 2010: Trends and Issues Surrounding Network and Security Monitoring from Enterprise Management Associates (EMA). We commissioned EMA for this study in mid-2009 because we found a significant shortage of available data regarding out-of-band / passive monitoring. Quite simply, we have been building out our product strategy with a particular approach in mind. This approach has been validated innumerable times by prospects and customers, but the smart strategist doesn’t build a product based strictly on anecdotal data or a myopic view of the world.

So we took matters into our own hands.

The most eye-opening findings from the study relate specifically to the widespread shortage of network visibility / coverage (81% reported they cannot achieve the visibility they need to monitor appropriately), and why your peers are unable to provide a complete view of network traffic to tools. Specifically, here is our take on the top three reasons for this problem:

  1. Lack of access to important network traffic. This problem is primarily caused by the shortage of SPAN ports and Taps. With the “old” way, your peers have been forced to buy a new tool for every single network port that requires monitoring. However, you can only activate so many (typically two) before your switch performance degrades. When there is contention for ports, you either have to choose not to monitor certain protocols on some segments or trade off which tool gets access to the port. In the end, living with this problem, particularly in a down economy where budgets are tight, means you are volunteering to have a gap in your coverage.
  2. Inability to Better Leverage Existing Tools. It amazed me to see that 72% of tools deployed by our respondents were either overloaded and dropping packets, or not used up to their potential. Let me say that again…72%. Nearly three-fourths. How much more could you do if you managed to save a quarter of a million USD? Finally upgrade some old switches? Hire another couple of employees? Come in under budget for a change? Make major strides in your transition to 10G? This really isn’t very hard to fix with Monitoring Optimization.
  3. Lack of Staff or Key Skillsets. We heard this one loud and clear…your peers have been forced to take on multiple jobs, none of which they can focus on in as much detail as they’d like. Staffs have shrunk due to layoffs and attrition (often planned shrinkage), as well as a shortage of available qualified candidates when positions do come open. And the existing solutions to these problems are simply too difficult to set up, manage, and maintain for various reasons, not the least of which is a shortage of folks who can manage filtering within a command line interface. These trends are not short-term things; they’re here to stay. So you need to improve productivity and enable more of the team to take on tasks that only specialists owned in the past.

We were very pleased to see that EMA agreed with us about what is needed to fix this situation: Monitoring Optimization. But it’s not enough just to provide access to network traffic for your tools; there are several products out there that claim they can give you this benefit. The solution can’t be hard to use, particularly if can only be managed by network architects or other technical specialists. The CLI point is crucial, because while some of you are CLI advocates, most of us have neither the inclination nor the time to learn and master filter rule definition by line code.

Several competing solutions have followed our lead and come out with GUIs that claim to help make this easier. Just take caution, because not all GUIs are created equal. Most of the knock offs I’ve seen are simply pretty icing on a CLI cake.

Sure, you can do some easy dragging and dropping to manage connections and even set up simple filter sets in the GUI (most of which are only applicable if you are lucky enough to need them), but what happens when you really need to roll up your sleeves and do some heavy lifting?  Hello CLI.

Why inject further headaches into this process? CLI puts the onus on you to code all the filter rules, maintain the code as various things change in your monitoring assortment, and to manually identify and address any issues with data sharing between multiple tools. Only a fully integrated GUI solves this problem; not a “reactionary” quick-fix to a competing product.

Enough soapboxing. You can read another summary about the research itself on Network World:

The blind side: What network monitoring tools don’t see (By Denise Dubie, Network World)

Our friends at the Love My Tool blog also gave their take on the study as follows:

“Real” Issues Facing Today’s Network and Security Professionals (by Tim O’Neill, OldCommGuy)

Thanks for reading!

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Twitter Weekly Updates for 2010-01-24

Powered by Twitter Tools

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Twitter Weekly Updates for 2010-01-24

Powered by Twitter Tools

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Twitter Weekly Updates for 2010-01-17

Powered by Twitter Tools

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Data Center Staffs Need Relief in 2010

2010 State of the Data Center Global Data

2010 State of the Data Center

Symantec recently released their third annual 2010 State of the Data Center report, and there were some especially important findings in the area of data center staff productivity. We’ve been talking about this important topic for a long time, and this seems like an ideal time to review the key findings, translate exactly what they mean for data centers, and tie it all together.

First, let’s start with the most relevant findings from the study.

  1. 50% of data centers are understaffed
  2. Data centers continue to grow in complexity, and as a result, are becoming progressively more difficult to manage
  3. 31% of data centers reported a reduction in overall headcount in 2009 (up from 24% in 2008)
  4. In the quest to do more with less, remaining staff members are forced to “wear many hats”; nearly half are already cross-training staff
  5. Hiring is especially challenging because of a lack of money and a shortage of qualified applicants when job requisitions do come available
  6. The top three initiatives for 2010 are security, backup/recovery, and continuous data protection

We first started talking about doing more with less early last year and about improving data center staff productivity shortly thereafter. This is a growing problem, and one that the economic challenges of the past 18-24 months have worsened.

The savvy vendor is looking at ways to help you in all of these important areas. Let’s look at some specific areas where you owe it to yourself to dig in while evaluating new products this year.

For understaffed data centers, you need the fastest and easiest way to manage your security and performance/SLA metrics. But you cannot speed up the process if you are managing important pieces of your monitoring assortment in piecemeal fashion. Where do you do your filtering? If you are still doing it at the SPAN port, via filtering taps, or in the tools themselves, why? There are excellent solutions on the market that offer a central point where all of this can be managed quickly and efficiently.

How much time do you spend troubleshooting? Many of the data center professionals we meet complain about being forced to wait in line for a Network Architect to come available to help configure the filter rules so they could do their jobs. Is CLI-based filter rule coding a challenge for you? Would you even know how to set up filters for every troubleshooting challenge if you were a whiz at CLI? If you answered “No” to either of those questions, there is room for improvement in this area. If you answered “Yes”, it is highly likely that someone else in the organization is dependent on your help to do their job. In either case, I contend that you should consider another way of managing your monitoring tools.

Here’s the kicker – many of you are now being forced to take on additional roles, responsibilities, and oftentime, additional jobs! Recent research has indicated that over 60% of you are being pushed into more of a generalist role, which was validated in the Symantec report. The data center is getting harder to manage, you’re being forced to be in three places at once, and the workweek simply isn’t getting any longer. Even if you get authorization to bring on new hires, where will you find them? Don’t underestimate the value of your own time and effort.

With important security concerns at the top of everyone’s priority list, you simply don’t have the luxury of cutting corners with your monitoring efforts. If you don’t find an easier way to aggregate, filter, and distribute network traffic to the most important tools, the onus will be on you to put in the effort to band-aid it all together.

This study is important, because it serves to validate several of the main points we have been evangelizing for a year now. We built our Monitoring Optimization solution specifically to help in three areas, network access (i.e. visibility/coverage), tool utilization (doing more with existing tools), and staff productivity, because this problem is not going away. Data centers will continue to have increasingly challenging demands placed on them, particularly in an environment where information security is threatened by not only your run-of-the-mill hackers, but sometimes cyberterrorists themselves (case in point: the recent Google announcement about reconsidering their presence in China).

Monitoring is a requirement, but it doesn’t have to be a burden. It’s important to take these results to heart and find a way to make your daily life easier.

Now the $50M question – are you seeing these trends in your data center? What are you doing about it? Please comment below or chime in @AnueSystems on Twitter!


If you want to read more analysis on this study, Network World offered their take in Half of all data centers understaffed, Symantec survey finds.

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Twitter Weekly Updates for 2010-01-10

Powered by Twitter Tools

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark

Security and IT in 2010

Heading into the New Year, we have seen a slew of reviews for 2009 and previews of what various experts and pundits think will happen this year. On this very blog, we have even chimed in on several of the more interesting takes that we’ve seen out in the blogosphere and on the web itself. But what we haven’t done is give our take on where we think the big stories will come in 2010, so let’s attack that angle now.

In 2010, I predict we will see more of…

1. Malware for Mobile. Mobile has yet to be seriously attacked by cybercriminals and hackers, and the most likely reason is that they do not share a common OS or platform like PCs do. However, in the past year, we have seen accelerated adoption of the iPhone, new models from Google itself, and continued fragmentation everywhere else but with Blackberry products. With so many developers creating literally thousands of applications for the iPhone platform, it is only a matter of time before we start to see scareware and other malware. It’s officially time for Apple to get serious about security.

2. Social Media Mayhem via Social Engineering. Unless you’ve been living under a rock, surely you’ve seen all the FUD out there about how insecure social networking sites are and how the problem will only get worse. Why haven’t we seen a barrage of problems in addition to the few big roadbumps we’ve encountered to date? Two words – Early Adopters. Those of us who have been on social media services for years are usually the most technically savvy users out there. Now that the masses have come, the floodgates of scams and other social engineering trickery has officially begun to open. In 2010, I can’t see any reason it won’t start to get worse, and quickly. At least enterprises can fall back on social media policies, but consumers are in for some unpleasant surprises.

3. Meet Mr. Botnet Alpha Prime. Remember our old friend Conficker? Well, to coin a cheesy old cliche, “You ain’t seen nothin’ yet.” We’ve already seen variants of this beast’s descendents that not only take over systems for spamming, but also ping back to servers in various third world countries for code updates. Yes, botnets have developed counterattack measures. Don’t get used to the decrease in SPAM we saw when we made it past April Fools’ Day, because the next generation will take it one step further. Sigh.

Will Social Engineering Make Social Media More Risky in 2010?

Will Social Engineering Make Social Media More Risky in 2010?

4. Taking Advantage of the Cloud. No, this won’t be another panic-laden diatribe about how the cloud is not secure enough and we’re all going to have our identities stolen. Rather, I’m concerned not just about the ability of skilled hackers to decrypt private data and sell it on the black market. The problem comes from a combination of techniques, perhaps where pay-as-you-go cloud services are manipulated in order to hold companies hostage by damaging performance and skyrocketing data transfer costs. Think of the security implications in this scenario, and you can see that privacy concerns are only one of many. Now imagine they can do this to online banking or other financial applications, and there’s a lot at risk. One day the cloud will be a godsend, but for now, it’s still merely a work-in-progress that will pose new challenges, many of which we may not have even fathomed yet.

5. Data Breaches Squared. Remember all those security breaches we saw in 2009? Did they scare you? What did you do within your own data center and WAN to avoid a similar fate? Wrong-doers are increasing their sophistication every day. The techniques we’ve witnessed in the past year may already be on the radar, and you’ve likely put in measures to prevent them in the future. Doesn’t matter. Someone somewhere is working on a new way to break in, and these guys are getting smarter and (believe it or not) more organized as cybercriminals. I see similar or even worse attacks on the horizon heading into the new year.

There you have it…five predictions for IT security in 2010. What predictions do you have? Share in the comments and let’s exchange some ideas. And as always, thanks for reading.

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark