Case study: NBA as a Service at GÉANT

Transcription

1 Case study: NBA as a Service at GÉANT Part of project NSHaRP Artur Kane kane@flowmon.com

2 Our starts-liberouter Liberouter project 2002 ( acceleration of high-speed network application (IPv6 router) Usage of programmable hardware - FPGA development of hardware accelerators COMBO based on FPGA technology Goal achieved: dual stack IPv4 IPv6 router using commodity PC and hardware acceleration FPGA card Cisco was in the end of the day better in the routing

3 Our starts-scampi SCAMPI (IST ) Network monitoring of 10Gbps lines with HW accelerated cards functional prototype developed first 10GE monitoring board in academic environment (based on the FPGA cards) successful review, final recommendation -> commercialize outputs of the project in practice, recommendation to start a spin-off

4 Our starts-geánt2 GEÁNT2 (contract No ) Cooperation of 26 NRENs from 34 countries Functional prototype of HW accelerated multigigabit (4x1GE, 1x10GE) NetFlow probe - FlowMon Final recommendation monitor EU networks by the FlowMon(NetFlow) probe GEÁNT2 Security Toolset FlowMon Probes & NfSen collector

5 How to commercialize? Commercialization discussion 2005 idea sell technology to a big technology company Issue 1 hard to transfer technology according law Issue 2 hard to transfer technology without people Final result discussions with commercial vendors failed 2006 idea do it ourselves, start small technology company Issue 1 technology transfer from CESNET Issue 2 universities participation Final result INVEA-TECH was established in June 2007

6 Flowmontoday 60 person company + 60 in R&D 600+ customers in 30+ countries First 100 Gbpsprobes in the world Gartner recognized since x Deloitte CE Technology Fast 50 Now in MQ!

7 GÉANT Association GÉANT is the pan- European research and education network that interconnects Europe s National Research and Education Networks (NRENs). Together, we connect over 50 million users at 10,000 institutions across Europe. Operating at speeds of up to 500Gbps, and offering unrivalled geographical coverage, GÉANT remains the most advanced research network in the world.

8 Project NSHaRP GEANT maintains process as part of GEANT IP Provides mechanism to quickly and effectively inform parties An Automated Incident Notification & Handling System Extends NRENs detection and mitigation capability to GEANT borders

9 GÉANT Challenges Provide Security as a Service to their customers Most commercial solutions don t cater for backbone networks Netflowv9, IPFIX... & IPv6 support is a MUST have Collector + forwarder + analysis Adapt the chosen solution to work for NRENs needs New ticketing system migration running in parallel

10 FlowmonChallenges Massive throughputs and volume of processed data (50M users in Europe) Collectingdata fromvastrangeofactivedevices across Europe Two collectors in parallel Custom supplementary development detection methods and filters

11 Solution FlowMon Collector and ADS plugin Predefined security event categories, configurable parameters and criticality IntegrationintoOTRS TTS not a part of FM! Different queues for automated / manual tickets Custom supplementary development detection methods and filters

12 Pilot Choosing between 14 different vendors Testing took3 months, March -May, going livein June 2015 Participants:REDIRIS, GRNET, LITNET, CESNET, FCCN Outcomes Very little false positives Precise detection Seamless integration into a ticketing tool NREN s would like to manage their own profiles!

13 Case Study GEANT Wayne Routly, Head of Information & Infrastructure Security at GÉANT : We have been choosing vendor of flow monitoring and Network Behavior Analysis solution among 14 different companies. Three months of an intensive testing proved that FlowMon was the right product due to its performance, comprehensiveness, scalability and simplicity. We are very keen that our users can rely and our security incident reporting as we haven t come across any false positive alerts so far.

14 References csirt/meeting45/tf- CSIRT%20presentation%20NSHaRP_v3.pdf

15 Artur Kane FlowmonNetworksa.s. U Vodárny 2965/ Brno, Czech Republic