Network Forensic
Despite all the network security measures taken, unforeseen scenarios are encountered. This is inherent in the nature of the job and is quite normal. Detecting and taking precautions when such an event occurs is a critical process. In the absence of network forensic devices, the detection of incidents can take a very long time (1-6 months) and become very costly.
Network forensic devices have the following features:
• Quick action in case of data breaches, pinpoint detection of infected systems. • Detection of malicious activities on the network with identifiable external IOCs (such as Usom, Sans, etc.). • Detection of network traffic anomalies. • Analysis of network performance status. • Continuous detection of undesired situations from a security perspective (such as simple password usage, tunneling traffics, weak algorithm accesses, etc.). • Integration with Pivot Integrations, Api, and Icap for Universal Sandbox integration.
These devices basically record a copy of network traffic and provide simultaneous analysis. They are passive devices, although they do not provide active protection, they are necessary for quick problem resolution. Data is stored in two ways: Meta and Raw. In the Meta part, there is a lot of data that can be parsed from a pcap file. These data can be kept for long periods (1-12 months), but Raw data is naturally kept for shorter periods (1-2 weeks), which are ideal values. For traffic analysis, clear text (http, ftp, smb, etc.) must be received by these devices. If encrypted traffic (https, ftps, smtps, etc.) is received, it cannot be analyzed. Therefore, it is important to capture traffic from the right place and position the devices in the network correctly. For example, if http traffic is captured behind an LTM device positioned in One-arm mode, unfortunately, the LTM IP address will be shown as the source IP in the copy. Searching for the relevant IP on Xff will be necessary, but if this is an attacker and the traffic needs to be analyzed, correlation becomes almost impossible or takes a very long time.