Discover the Top 5 XDR Use Cases for Today’s Cyber Threat Landscape
learn about common network flow analysis challenges and their effects on your
Over the last decade, cloud computing has become the backbone of modern business, transforming how organizations operate and scale.
Companies rely heavily on cloud services, with most of their applications and workloads migrating to efficient platforms like AWS due to the increased remote working requirements and demand for scalable, flexible, and cost-effective solutions that support business continuity and growth.
In this cloud setup, Amazon Virtual Private Cloud (VPC) enables businesses to create private network environments, giving them control over network setup, traffic management, and connections to on-site systems.
However, monitoring and securing the traffic within these environments can be challenging.
Why is that?
Monitoring, analyzing, and securing such complex environments is difficult because so much data flows to and from the cloud, as well as internally, including sensitive information. This makes the cloud, i.e., the VPCs, one of the prime targets for attacks.
This is where we need to consider cloud network traffic analysis, including traffic mirroring, and advanced security monitoring strategies.
Cloud network traffic analysis is significant and a must-have practice for organizations to identify and address security threats, prevent data loss, and ensure the smooth flow of cloud network traffic.
As more organizations adopt Infrastructure-as-a-Service (IaaS) solutions like virtual machines (VMs), effective monitoring of cloud network traffic becomes even more crucial to protect data, optimize operations, and ensure smooth workflow.
Network traffic analysis can be implemented using several techniques for capturing network traffic and analyzing data flow. Two common methods are:
Focuses on metadata (e.g., IP addresses, ports) to track traffic patterns.
To overcome these challenges, organizations should consider robust tools and methods like Netgate TNSR, Fidelis Network Sensors and VPC traffic mirroring to capture both inbound and outbound traffic via Elastic Network Interfaces (ENIs) and analyze it using advanced methodologies such as Deep Session Inspection and other techniques.
Uncover how leading organizations are leveraging advanced network traffic analysis to:
Now, let’s go through the process in detail.
VPC traffic mirroring works in AWS by allowing companies to capture and analyze network traffic from their Virtual Private Cloud (VPC). This gives them a detailed view of traffic for monitoring and troubleshooting. Essentially, it helps copy network traffic and sends it to a monitoring tool for analysis.
Netgate TNSR is an advanced, open-source platform designed to manage and route network traffic in a highly secure, scalable, and flexible way. It provides real-time traffic mirroring, network load balancer functionality, and analysis capabilities, enabling organizations to monitor network data without interrupting the flow of traffic. Amazon EC2 can be used to host the Netgate TNSR solution, which is capable of handling high-speed network traffic.
A traffic mirror session by Netgate TNSR handles the copying of packets from the traffic mirror source (where the traffic originates) to the traffic mirror target (usually a tool like Fidelis Network®), allowing deep analysis without disrupting the original traffic.
A Gateway Load Balancer can also be employed to distribute traffic more effectively across multiple virtual appliances during the mirroring process, ensuring scalability and improved performance in traffic analysis.
Additionally, traffic mirror resources, such as a traffic mirror filter, help determine which specific traffic should be copied and sent to your monitoring tool for analysis. This enables you to monitor performance without dealing with unnecessary data. The Instance Metadata Service (IMDS) can also provide specific information about the instance, offering deeper insights for your analysis.
Netgate TNSR sends the mirrored traffic to Fidelis Network® which is within its own VPC using GRE (Generic Routing Encapsulation) tunnels.
GRE tunnels encapsulate data packets, allowing them to be transmitted over networks that don’t support the original protocol. This process ensures secure, uninterrupted delivery to Fidelis Network® for further analysis. This process involves wrapping the data in a new packet header, which is removed at the receiving end, revealing the original data.
Once the mirrored traffic reaches Fidelis Network®, what happens next?
Fidelis Network® is a powerful security tool that protects against network threats both in the cloud and on-premises. Unlike traditional tools like firewalls and antivirus, it constantly monitors and analyzes network traffic in real-time to spot unusual activity and potential threats. Using advanced analytics and machine learning, it can detect threats within the network that other tools might miss, offering deep visibility across all ports and protocols.
It also features automated response technologies such as:
These capabilities make it a crucial addition to an organization’s security infrastructure for proactive, real-time threat detection and response.
Once the mirrored traffic reaches Fidelis Network®, it utilizes its powerful Deep Session Inspection (DSI) technology, along with other features, to provide a comprehensive analysis of cloud traffic. It goes beyond typical network monitoring to detect suspicious activity, potential breaches, and data loss, both in real-time and retrospectively.
Key cloud traffic monitoring features include:
Protecting AWS VPCs is a critical security priority to ensure the health of your organization’s overall cloud and network infrastructure. Traditional cloud network analysis has many limitations that are ineffective in today’s advanced cloud and network environments. To protect your AWS VPC and ensure real-time threat detection in the cloud network, integrating tools like Netgate TNSR and Fidelis Network® NDR is essential.
See Fidelis in action. Learn how our fast and scalable platforms provide full visibility, deep insights, and rapid response to help security teams across the World protect, detect, respond, and neutralize advanced cyber adversaries.