The term “Virtual Blind Spot” has begun to fly around, but what does it mean? Basically, when you have resources and servers that are virtually moving between hardware boxes, the tried and true methods of monitoring traffic are unlikely to provide the required visibility for maintaining a secure and well-performing data center. After all, if I activate a SPAN to attach an IDS or an Application Monitor, great. But how the heck will I know whether the same traffic streams will be available to those tools over time?

Simple answer: I can’t.

What’s a security, operations, or application performance professional to do? It’s time to look at a different way of managing your monitoring assortment.

It’s time to adopt Monitoring Optimization.

Here are the switches, but where are the servers?

Physically-based monitoring has served us well over the years.  But times, they have already changed! For virtual environments, you need a very flexible, yet easy-to-use, monitoring solution. This is exactly what monitoring optimization provides.

In the past, you had to activate a SPAN (or place a Tap inline) to monitor key traffic streams. This was important, since the mirroring practice provided a safe place to monitor without introducing any latency or other risk into the live network segments on your network. The weakness with the old approach is that you can only have one tool for each SPAN or Tap. If you need more than two tools on a switch, tough luck. Go look for some point solutions to band-aid together, regardless of the management nightmare that would ensue. At least the data gets to the tools, right?

Wrong. Even in that scenario, the risks of dropped packets, misconfigured filters, and potential for human error during the “band-aid” process would be more than you may anticipate. Then something goes awry and you have to troubleshoot, and the problem becomes twice as complex. When you throw virtualization and moving resources into the mix, the whole model breaks.

Monitoring Optimization: Virtual Connections For Virtual Environments

Monitoring Optimization, the key technique that you get from the Anue 5200 Series Net Tool Optimizer, employs aggregation, replication, the most advanced filtering on the market, and the most intuitive interface to simplify this whole mess.

It is even more critical than ever to have visibility into all network segments where a virtualized resource may appear. Given the high cost of tools and limited number of available access points, it is impractical to think you can simply buy tools for every candidate network segment for whatever it is you need to monitor (not to mention the management overload you’d personally suffer through if you did choose to go that route).

Monitoring Optimization allows you to simply SPAN or Tap each segment a single time, route it to the Net Tool Optimizer, and leave all important tools attached to the box as well. Then you do all the connections and filtering “virtually”, i.e. right in the product’s fully-integrated GUI.

Simply drag and drop the segments to the tools that need to see the traffic, configure the filters in a matter of minutes using a simple Windows-like interface, and start monitoring. Heck, you could route all network segments to every tool if you like. Just filter down the data appropriately to keep the tools from overloading, and move on with your day.

If something goes wrong and you need to troubleshoot, no problem! Drag across a “virtual” connection from the segment(s) requiring diagnosis, set up the filter, and your diagnostic tool is off to the races. Notice that there’s no need to actually plug and unplug tools, because your connections are all virtual, just like your network! How’s that for minimizing MTTR?

All Virtualized Data Centers Should Have Monitoring Optimization

Yes, when I wrote it I meant it. Every. Single. Virtualized. Data. Center.

We are all squeezed for time. Why spend all day playing around with point solutions or plugging and unplugging tools to get this figured out? Just optimize it and move on! You also get the added benefits of monitoring more of the network without buying more tools, full integration to existing systems (SNMP, TACACS+, etc.), complete control to access based on groups, and a variety of other key features we included specifically to make your job easier.

Want to learn more? We are offering a $50 promotion for 30 minutes of your time to view a demo (for qualified respondents as indicated on the signup page). If virtualization is important to your business, you owe it to yourself to learn about the best monitoring optimization solution on the market.

The survey, which was conducted by Network Instruments the past two years (NetQoS and NI conducted it together in 2008), revealed some very interesting data points.

1. Virtualization, as we would have anticipated, has picked up a great deal of momentum both in the data center and on the desktop.
2. The primary reason for adopting virtualization is cost savings. Yet, they also revealed that implementation costs are too high.
3. The single biggest virtualization-related challenge is a lack of visibility to data streams, an inability to secure the infrastructure, and a lack of monitoring tools optimized for virtualized environments.

Based on the interplay of the first two key findings above, it is clear that high implementation cost is not a long-term problem. Obviously, today’s decision makers can see the “forest for the trees” so to say, in that the expected long-term cost savings will easily dwarf the high cost of entry.

What jumps out to me the most is the monitoring problem. This is not a unique challenge to virtualized environments, but rather, virtualization itself is causing some head-scratching regarding the monitoring itself. And really, for data centers that are already burdened with escalating tool costs, shrinking staffs, and a shortage of physical access points, it’s no wonder some of them might feel desperate to fix the monitoring quandary.

The reality of the situation is that there is a very easy answer to this problem: Monitoring Optimization. Monitoring optimization involves the adoption of an aggregation and replication switch, which can solve all of these problems if designed with a fully-integrated GUI. The key is to look at this as the monitoring of specific data flows or traffic, not specific links, switches, or access points.

With servers and other hardware switching over to “virtual” servers and hardware, one of the biggest issues is knowing where to place tools in the physical infrastructure. If you stick with the “old way” of placing a tool everywhere monitoring is required, you’ll need more tools than any reasonable enterprise can afford to buy or manage!

What you really need is a “virtual tool farm” to go with your virtual infrastructure. Don’t get me wrong; you’ll still be using the same hardware/software-based tools you have already deployed. But using Monitoring Optimization, you can extend a single tool to cover multiple data streams, and you can share traffic from a single data stream with any or all of the tools you desire. The best part is that you can do it all in a fully integrated GUI without ever having to use  some time-intensive, cryptic IOS-like CLI (likely in a proprietary coding language from the vendor, as most of our competitors offer) to manage your most challenging filtering…it’s all drag and drop and windows-esque form entry.

If you count yourself among those who said monitoring is their biggest headache, I urge you to learn more about the Anue 5200 Series Net Tool Optimizer. Then reach out to us via our Contact Me form, and we’ll show you exactly how much easier this can be, and you will see a positive impact to your tool use and staff effort immediately upon deploying our solution.

_____________________________

Article Source: http://EzineArticles.com/

_____________

For those of you who did make it to the show, I concluded the video by showing where you can go to find Anue Systems in Booth #329. If you are planning to be here today or tomorrow, please stop by and introduce yourself to me or one of my esteemed colleagues.

With that said, enjoy our video:

What Topics Do You Want to See on The Network View? Tell Us!!

In the past year plus, we’ve covered a wide gamut of topics on The Network View. We’ve done a series about how to calculate an ROI (or cost savings, more like it) for simplifying the complexity of passive monitoring tools in the data center. We spent many weeks sharing insights from SPoTs (Security Pros on Twitter), many of whom you already knew, and a few who were very likely new folks to some of you. We shared some key players at a few security tool vendors in our ALIST series. And we’ve covered research, trends, 2010 predictions, and even some network emulation topics.

As we enter our second month of 2010, we turn our attention to you, the faithful readers of this blog. I pose one simple question to you at this time: What’s on your mind?

We always want to keep this content relevant and engaging, so it makes sense to get a feel for what topics are of interest to you.

What has lacked coverage in your opinion?

What topics that we’ve already touched on might be worth revisiting from another angle or with more depth?

What hot topics have permeated many of your recent conversations, but have yet to get ample attention in the media?

This is a blog, and it’s here for all of us. Please comment below or contact us directly to chime in your opinion. If you prefer not to share publicly below, email me at tlandry (at) anuesystems (dot) com. We’d love to hear from you.

Thank you in advance for your valuable input.

Monitoring Optimization 2010 Report

A few days ago we announced the results of Monitoring Optimization 2010: Trends and Issues Surrounding Network and Security Monitoring from Enterprise Management Associates (EMA). We commissioned EMA for this study in mid-2009 because we found a significant shortage of available data regarding out-of-band / passive monitoring. Quite simply, we have been building out our product strategy with a particular approach in mind. This approach has been validated innumerable times by prospects and customers, but the smart strategist doesn’t build a product based strictly on anecdotal data or a myopic view of the world.

So we took matters into our own hands.

The most eye-opening findings from the study relate specifically to the widespread shortage of network visibility / coverage (81% reported they cannot achieve the visibility they need to monitor appropriately), and why your peers are unable to provide a complete view of network traffic to tools. Specifically, here is our take on the top three reasons for this problem:

1. Lack of access to important network traffic. This problem is primarily caused by the shortage of SPAN ports and Taps. With the “old” way, your peers have been forced to buy a new tool for every single network port that requires monitoring. However, you can only activate so many (typically two) before your switch performance degrades. When there is contention for ports, you either have to choose not to monitor certain protocols on some segments or trade off which tool gets access to the port. In the end, living with this problem, particularly in a down economy where budgets are tight, means you are volunteering to have a gap in your coverage.
2. Inability to Better Leverage Existing Tools. It amazed me to see that 72% of tools deployed by our respondents were either overloaded and dropping packets, or not used up to their potential. Let me say that again…72%. Nearly three-fourths. How much more could you do if you managed to save a quarter of a million USD? Finally upgrade some old switches? Hire another couple of employees? Come in under budget for a change? Make major strides in your transition to 10G? This really isn’t very hard to fix with Monitoring Optimization.
3. Lack of Staff or Key Skillsets. We heard this one loud and clear…your peers have been forced to take on multiple jobs, none of which they can focus on in as much detail as they’d like. Staffs have shrunk due to layoffs and attrition (often planned shrinkage), as well as a shortage of available qualified candidates when positions do come open. And the existing solutions to these problems are simply too difficult to set up, manage, and maintain for various reasons, not the least of which is a shortage of folks who can manage filtering within a command line interface. These trends are not short-term things; they’re here to stay. So you need to improve productivity and enable more of the team to take on tasks that only specialists owned in the past.

We were very pleased to see that EMA agreed with us about what is needed to fix this situation: Monitoring Optimization. But it’s not enough just to provide access to network traffic for your tools; there are several products out there that claim they can give you this benefit. The solution can’t be hard to use, particularly if can only be managed by network architects or other technical specialists. The CLI point is crucial, because while some of you are CLI advocates, most of us have neither the inclination nor the time to learn and master filter rule definition by line code.

Several competing solutions have followed our lead and come out with GUIs that claim to help make this easier. Just take caution, because not all GUIs are created equal. Most of the knock offs I’ve seen are simply pretty icing on a CLI cake.

Sure, you can do some easy dragging and dropping to manage connections and even set up simple filter sets in the GUI (most of which are only applicable if you are lucky enough to need them), but what happens when you really need to roll up your sleeves and do some heavy lifting?  Hello CLI.

Why inject further headaches into this process? CLI puts the onus on you to code all the filter rules, maintain the code as various things change in your monitoring assortment, and to manually identify and address any issues with data sharing between multiple tools. Only a fully integrated GUI solves this problem; not a “reactionary” quick-fix to a competing product.

Enough soapboxing. You can read another summary about the research itself on Network World:

The blind side: What network monitoring tools don’t see (By Denise Dubie, Network World)

Our friends at the Love My Tool blog also gave their take on the study as follows:

“Real” Issues Facing Today’s Network and Security Professionals (by Tim O’Neill, OldCommGuy)

Thanks for reading!

2010 State of the Data Center

Symantec recently released their third annual 2010 State of the Data Center report, and there were some especially important findings in the area of data center staff productivity. We’ve been talking about this important topic for a long time, and this seems like an ideal time to review the key findings, translate exactly what they mean for data centers, and tie it all together.

First, let’s start with the most relevant findings from the study.

1. 50% of data centers are understaffed
2. Data centers continue to grow in complexity, and as a result, are becoming progressively more difficult to manage
3. 31% of data centers reported a reduction in overall headcount in 2009 (up from 24% in 2008)
4. In the quest to do more with less, remaining staff members are forced to “wear many hats”; nearly half are already cross-training staff
5. Hiring is especially challenging because of a lack of money and a shortage of qualified applicants when job requisitions do come available
6. The top three initiatives for 2010 are security, backup/recovery, and continuous data protection

We first started talking about doing more with less early last year and about improving data center staff productivity shortly thereafter. This is a growing problem, and one that the economic challenges of the past 18-24 months have worsened.

The savvy vendor is looking at ways to help you in all of these important areas. Let’s look at some specific areas where you owe it to yourself to dig in while evaluating new products this year.

For understaffed data centers, you need the fastest and easiest way to manage your security and performance/SLA metrics. But you cannot speed up the process if you are managing important pieces of your monitoring assortment in piecemeal fashion. Where do you do your filtering? If you are still doing it at the SPAN port, via filtering taps, or in the tools themselves, why? There are excellent solutions on the market that offer a central point where all of this can be managed quickly and efficiently.

How much time do you spend troubleshooting? Many of the data center professionals we meet complain about being forced to wait in line for a Network Architect to come available to help configure the filter rules so they could do their jobs. Is CLI-based filter rule coding a challenge for you? Would you even know how to set up filters for every troubleshooting challenge if you were a whiz at CLI? If you answered “No” to either of those questions, there is room for improvement in this area. If you answered “Yes”, it is highly likely that someone else in the organization is dependent on your help to do their job. In either case, I contend that you should consider another way of managing your monitoring tools.

Here’s the kicker – many of you are now being forced to take on additional roles, responsibilities, and oftentime, additional jobs! Recent research has indicated that over 60% of you are being pushed into more of a generalist role, which was validated in the Symantec report. The data center is getting harder to manage, you’re being forced to be in three places at once, and the workweek simply isn’t getting any longer. Even if you get authorization to bring on new hires, where will you find them? Don’t underestimate the value of your own time and effort.

With important security concerns at the top of everyone’s priority list, you simply don’t have the luxury of cutting corners with your monitoring efforts. If you don’t find an easier way to aggregate, filter, and distribute network traffic to the most important tools, the onus will be on you to put in the effort to band-aid it all together.

This study is important, because it serves to validate several of the main points we have been evangelizing for a year now. We built our Monitoring Optimization solution specifically to help in three areas, network access (i.e. visibility/coverage), tool utilization (doing more with existing tools), and staff productivity, because this problem is not going away. Data centers will continue to have increasingly challenging demands placed on them, particularly in an environment where information security is threatened by not only your run-of-the-mill hackers, but sometimes cyberterrorists themselves (case in point: the recent Google announcement about reconsidering their presence in China).

Monitoring is a requirement, but it doesn’t have to be a burden. It’s important to take these results to heart and find a way to make your daily life easier.

Now the $50M question – are you seeing these trends in your data center? What are you doing about it? Please comment below or chime in @AnueSystems on Twitter!

If you want to read more analysis on this study, Network World offered their take in Half of all data centers understaffed, Symantec survey finds.

The following commentary is based on IDC’s top 10 tech predictions: cloud and analytics, which just recently appeared on NetworkWorld.com.

The Maturing of Cloud: SLA Implications on Service Providers will Improve and Emerge
We’ve commented and covered criticisms regarding cloud security quite a bit on The Network View, and there has been a great deal of debate about this topic. Performance is another crucial piece to this puzzle. For enterprises to truly take the cloud seriously, we need to get performance and uptime to reasonable SLA levels, we need to determine the best and least “crackable” method by which to encrypt traffic that moves into and back out of the cloud, and business continuity / disaster recovery practices must be much more buttoned-down. Sure, I think it will only be a matter of time before we get there, but I remain skeptical that we will take this major step within the next 12 months. If you are privy to some data that will change my mind, I’d love to read about it in the comments.

The Tipping Point: The Inevitable Adoption of Social Media in Enterprises
I, personally, love this prediction and truly hope it will come to pass. The open issue is exactly what “adoption of social media in the enterprise” means. In all likelihood, it will not be a full tolerance and acceptance across the organization due to security concerns, particularly in the most conservative and old school of the corporations. What I envision in the near term is that corporate communications teams will be authorized to spread only approved messages and topics, much like PR is currently managed, only in real-time. In reality, it will take another year or two before we can reach critical mass of knowledge among enterprises regarding the best ways to enforce security measures, monitoring behaviors, and incorporate such traffic-heavy activities into the day-to-day management and optimization of network performance. In the meantime, here’s to your company not blocking Twitter, blogs, or other social media until they can get it figured out.

Converged Fabric and the Evolving Data Center
Data Centers have already been evolving, there’s no question about it. Now, with a massive shift toward reducing footprint and power consumption, consolidating equipment and applications, and generally making the most of reduced budgets, network operations and architecture teams are forced to look at new ways of managing the network – and all of this is happening as we are smack dab in the middle of a migration to faster 10GbE architectures in many companies.

Virtualization technologies deployed across FCoE (Fiber Channel over Ethernet) will provide outstanding abilities to dynamically manage bandwidth and server cycles. The cost savings and productivity improvements in the long term are obvious, but we need to be absolutely positive that complementary training and skillset growth are taken into account to ensure full enjoyment of the expected benefits.

The Dawn of the Enterprise Appliance
I’m not so sure the word “dawn” is the right analogy, as we already have quite a few different single-purpose hardware-driven solutions for monitoring and other activities. The key here, in my mind anyway, is how this plays with virtualization technologies. Since we can virtually manage bandwidth and storage already, and virtual machines can dynamically relocate based on server load, I’m a bit dubious that this actually makes sense in the long run (vs. implementing these single-purpose activities virtually). That said, aggregation and distribution technologies like Monitoring Optimization solutions will be even more important in a virtualized environment, particularly one where appliances become commonplace.

Okay, that’s it for me and my soapbox today. Hit me with your thoughts, criticisms, embellishments, or questions. And as always, thanks for your time and attention.

ALIST: Bill Roth of Log Logic

Name: Bill Roth
Title/Role: EVP / Chief Marketing Officer
Company: LogLogic
Product Focus: Security, Log Management, Compliance
Twitter Handle: @loglogic

1. What is your company’s flagship product, and why is it important for security purposes?
Our flagship product is our Open Log Management Platform, which collects, normalizes, indexes, stores, and searches log data automatically with our easy-to-deploy appliances or hosted solutions. This provides a platform for collecting system information from a wide array of products and devices, especially those related to security. Our security products, on top of the platform, allow system admins and IT security staff to analyze and correlate diverse log data in real-time for identification and management of security events.

2. What areas of security are most important to you professionally, and which do you enjoy working with most?
Security event management. The only true way to detect a security breach is by tracking what actually happens in real time. In addition, it is crucial to be able to understand the security profile across many different devices, systems, and environments, and to be able to correlate those events to detect sophisticated security threats. Personally, I enjoy working on the areas of security which most closely align with public policy, especially in areas like HIPAA and HITECH.

3. What is the most common security challenge you are brought in on to help fix on behalf of customers?
Vsibility of security events in an environment. Most customers we encounter are unaware of the scale of security information they have or do not know the scope of the security issues they have occurring right in front of them. Many companies are stunned to learn the amount of simple, out-of-policy activities that are going undetected in their organizations, such as illegal P2P file sharing or employee-driven data-leakage.

4. How do you see Cloud Computing, virtualization, and Social Media affecting security in the coming months?
These are three very different topics, each with a different set of security issues surrounding them.

Cloud computing security will be the most vexing issue in the foreseeable future for two reasons. First, it will be vexing because the subject is so ill-defined. Second, because the fundamental essence of cloud computing is to trust your computing assets to “the network.” As soon as you begin to broadcast any of your bits to the internet, your security exposure goes up by several orders of magnitude. Much more attention will need to be paid to secure cloud computing in the future.

The juxtaposition of virtualization and security results in no new security issues, just more of the security issues we already know about. Virtualization is, at its core, about making the hardware boundaries more flexible so that you can run more “images” on the same amount of hardware. This means a proliferation of events to watch and an explosion of correlations to watch for.

Of the three topics mentioned, social media is the likeliest to be transformative. Social media is essentially a means of exposing fine-grained information about oneself, one’s assets, or one’s behavior. This implies a more fine-grained analysis of who has been granted what data, and in what context. The implication of this is that fine-grained authentication and authorization will be more important than ever.

5. Tell me what your most pressing security concern is over the next 1-2 years.
Providing people with the ability to comply with the suite of security and privacy laws around the world. With the major portions of the HITECH act coming into force this year in the US, and with federal penalties of up to $1.5M, my most pressing concern is being able to provide products to protect our customers. I have the same concerns for EU legal regimes.

6. How do you stay abreast of the latest market developments in your space? Shows, social media, RSS, etc.
Oddly enough, RSS via FireFox’s Live Bookmarks feature allows me to quickly scan the day’s news and to get up to date quickly on what is happening around the world. Using this feature, I can quickly scan 5 major newspapers (San Jose Mercury News, New York Times, Washington Post, Wall Street Journal, and USA Today) and 10-15 trade publications. I am a huge fan of CMO.com, from Adobe’s Omniture unit. To be honest, I do not get much information from Social Media. But that is another story for another time.

7. In closing, give us one idea you have about security that everyone should consider. Your “Golden Egg”, so to say.
While systems security is vitally important, security is not just about security products. It is about people, process, and products.

Several recent studies have shown that the greatest sources of security breaches are not from hackers or terrorists, but from people inside your organization. A holistic approach to security involves good systems monitoring, to be certain, but also involves making sure the right processes and people are in place as well.

_________________________________________________

Thank you for playing Bill!

For those of you who want to learn more about the people and process part of this equation, please view one of our archived Security Policy Webinars, courtesy of Erin Jacobs and Anue Systems. We also recommend you sign up for the next three so you can earn your certification in Security Monitoring Optimization!