It s Flow Time! The Role and Importance of Flow Monitoring in Network Operations and Security

Transcription

1 It s Flow Time! The Role and Importance of Flow Monitoring in Network Operations and Security Pavel Minařík, Chief Technology Officer Neutral Peering Days 2018, The Hague

2 Your customers depend on your services more than ever before You need proper set of tools to ensure reliability and service continuity There is an opportunity to transform from ISP to MSP or MSSP

3 85% of Enterprise customers expect their ISP to offer more comprehensive DDoS protection-as-a-service. Source: DDoS Impact and Opportunity in the Service Provider Environment by FierceMarkets

4 What is Flow Data? Modern network telemetry flow measurement Cisco standard NetFlow v5/v9, IETF standard IPFIX Focused on L3/L4 information and volumetric parameters Real network traffic to flow statistics reduction ratio 500:1 Flow data

5 Next Generation Network Traffic & Performance Monitoring (NetFlow/IPFIX) Provides visibility eyes into the network traffic Reduces mean-time to resolve, builds up efficiency Reduces downtimes and network operational costs Gartner: 80% of operational issues can be analyzed and solved by flow monitoring. Recommendation: Implement NetFlow/IPFIX to allow better measurement of user experience.

6 It s easy to start. You already have NetFlow sources with routers. It s only a matter of collection and interpretation of this data with Collector. This is all you need to ensure reliability and cost efficiency of your services via conducting traffic engineering, peering optimization and QoS Management.

7 Myth: Flow data do not provide sufficient level of detail when it comes to network troubleshooting, security or forensics. Full packet traces are absolute must to investigate on network issues and fight cyber crime.

8 Packet Analysis Flowmon SNMP Monitoring The complexity of such systems puts high demands on the knowledge/experience of administrators. These tools are simply to heavy for daily use and majority of use case. Packet analysis tools do not scale to current backbone bandwidth and available budget. Flow-based easy to use and affordable solution to enable network visibility and easy to use troubleshooting. Extendable to application monitoring and security means single platform and lower costs. Flow enriched with L7 visibility and on-demand packet capture is the future of Network Performance Monitoring and Diagnostics. Basic IT infrastructure monitoring to provide network, device and service status. Limited flow support technically inadequate commodity solution. Does not help to troubleshoot, track user experience or contribute to network security.

9 Packet Analysis 1 min 75 GB Flow Data 1 min 150 GB on 10G backbone Strong aspects + Full network traffic + Enough details for troubleshooting + Supports forensic analysis + Signature based detection 1 hour 4.5 TB + Works in high-speed networks + Resistant to encrypted traffic + Visibility and reporting + Network behavior analysis 1 hour 9 GB Weak aspects - Useless for encrypted traffic - Usually too much details - Very resource consuming 1 day 108 TB - No application layer data - Sometimes not enough details - Sampling (routers, switches) 1 day 216 GB Flow vs. Packet Analysis

10 Continuous full packet capture tools cannot scale with bandwidth explosion in corporate networks and companies are switching to flow technologies. Gartner notes that 80% of network troubleshooting can be solved with NetFlow. Flowmon combines best of breed: flow data enriched with L7 and performance metrics. This helps to solve 95% of all troubleshooting cases. In addition, Flowmon provides ondemand packet capture when flow visibility is not enough.

11 Flow Data and Security Volumetric DDoS detection Anomaly detection Incident reporting

12 Neil MacDonald, VP Distinguished Analyst Gartner Security & Risk Management Summit, London 2015

13 Use Case: Security as a Service DDoS Protection & Anomaly Detection provided by ISP

14 Core Infrastructure of ČD Telematika CORE CONNECTIVITY 6x10 Gb/s NIX.CZ 1x10 Gb/s NIX.SK 4x10 Gb/s global transit 4x10 Gb/s Google CONNECTED NETWORKS 220+ CONTRACTED TRAFFIC 135 Gb/s REAL PEAK TRAFFIC 65 Gb/s in 27 Gb/s out

15 Detection and Mitigation Orchestration of Volumetric DoS/DDoS Attacks Protect your business & customers satisfaction Easy, flexible and cost efficient way of DDoS Protection Saves costs on extra HW, mitigate with your network Mikulas Labsky, Head of Telecommunications dept. at CD- Telematika: As a service provider, in-line DDoS protection didn t fit our needs. Fast flow-based DDoS detection with out-ofpath mitigation is the ideal solution for any ISP.

16 Enterprises can only protect themselves up to a speed of their uplink!

17 Backbone Protection Strategy Backbone perimeter specifics Multiple peering points routers & uplinks Large transport capacity tens of gigabits easily In-line protection is close to impossible! flow export Flow-based detection and out-of-path mitigation Easy and cost efficient to deploy in backbone/isp Prevents volumetric DDoS to reach enterprise perimeter 1. Flow collection 2. DDoS detection 3. Routing control 4. Mitigation control

18 ČDT-ANTIDDOS Service Protects from volumetric attacks Attacks generated by known tools available on the internet Examples SYN FLOOD, TCP ACK + FIN FLOOD, TCP RST FLOOD, TCP SYN + ACK FLOOD, TCP fragmentation FLOOD, UDP FLOOD, ICMP FLOOD, IGMP FLOOD,

19 Out-of-Path Dynamic Protection Policy Deployment incl. baselines and attack characteristics Anomaly Detection Mitigation Enforcement Traffic Diversion via BGP Route Injection Scrubbing center Flow Data Collection Learning Baselines Attack Attack path Clean path Protected Object 1 e.g. Data Center, Organization, Service etc Internet Service Provider Core Protected Object 2

20 BGP Flowspec Anomaly Detection Mitigation Enforcement Sending specific Route advertisement via BGP FlowSpec Dynamic signature: Dst IP: /32 Dst Port: 135 Protocol IP: 17 (UDP) Discard Flow Data Collection Learning Baselines Attack Protected Object 1 e.g. Data Center, Organization, Service etc Internet Service Provider Core Protected Object 2 Dropped traffic for Dst IP: /32 Dst Port: 135 Protocol IP: 17 (UDP)

21 Next Generation Network Security - Behavior Analysis & Anomaly Detection Detects and alerts on abnormal behaviors Reports anomalies and advanced persistent threats Detect intrusions and attacks not visible by standard signature based tools Gartner: Blocking and prevention is not sufficient. After you deployed firewall and IPS, you should implement network behavior analysis to identify problems that are undetectable using other techniques.

22 Anomaly Detection Principles Flowmon ADS Machine Learning Adaptive Baselining Heuristics Behavior Patterns Reputation Databases

23 ČDT-MONITOR Service Reports on indicators of compromise detected in customer IP address space Fully automated flow analysis and reporting service Examples Attacks against network services Communication with botnet C&C

24 Sample Detected Incidents (1) Massive attack against SSH worldwide coming from infected device located in CZ

25 Sample Detected Incidents (2) Communication with botnet command & control serves typically reveals compromised networks

26 ČDT-MONITOR Sample Report

27 Summary many tasks, single solution

28 Transition from ISP to MSP ČD Telematika successfully transforms from internet service provider to managed service provider Single flow-based solution serves multiple purposes Network Performance Monitoring & Diagnostics Internal network operations, troubleshooting and reporting DDoS Protection as a service CDT-ANTIDDOS Customer offering for comprehensive protection against volumetric attacks Network Behavior Anomaly Detection as a service CDT-MONITOR Automated detection and reporting of indicators of compromise

29 Architecture and Principles of Operation Flow export from already deployed devices Flow data export + L7 monitoring Flow data collection, reporting, analysis Flowmon modules for advanced flow data analysis

30 Customer references is an international vendor devoted to innovative network traffic & performance & security monitoring 800+ customers 40+ countries First 100G probes in the world Strong R&D background European origin

31 Thank you Performance monitoring, visibility and security with a single solution Pavel Minarik, Chief Technology Officer pavel.minarik@flowmon.com, Flowmon Networks a.s. Sochorova 3232/ Brno, Czech Republic