Network visibility is critical for cybersecurity and compliance, but that means going way beyond IP address tracking, given how many network layers are at issue.<\/p>\n
As much as cloud usage is soaring and that presents a wide range of new issues, the reality is that most enterprise networks\u2013to varying degrees\u2013went to the cloud a very long time ago.<\/p>\n
That includes discovering software-defined networks (SDN) such as Cisco ACI or SD-WANs including Cisco Miraki or Cisco Viptela. Remote sites in particular mean that enterprises must enhance and unify hybrid IPAM visibility.<\/p>\n
In short, this allows for network staff to quickly search for IP addresses, find device names, what types they are, what vendors or models or versions or even chassis serial numbers they have. This all enables far greater forensic insights and context.<\/p>\n
Those searches facilitate the critical goal of detecting and remediating rogue and\/or compromised assets while also reconciling networks to any IPAM conflicts and collecting firmware information to help with updates and patches.<\/p>\n
With cybersecurity defenses as well as compliance rules, it\u2019s essential to have easy access to adhoc and standardized reports to have visibility into any access and to see if anything significant has changed. For example, when a staffer engages in some shadow IT and throws onto the network a router they picked up at Target, that forces the question: Is it in compliance? Almost certainly not.<\/p>\n
Another problematic network element are switches. Having deep and current visibility into the discovery of a switch port is an urgent need, especially with tracking free, available and unused ports or those that are connected to wired or wireless end hosts.<\/p>\n
Delving into switches can deliver a world of helpful data, including IP and Mac addresses, the admin and operations status, the switch port description, VLAN configurations, their IDs, their names, the data VLANs, the voice VLANs, the beginning and ending of those ranges, along with metadata and metatags associated with switches and ports.
\nToday\u2019s enterprise networks are inherently more complex, featuring a large number of vendors working off of multiple operating systems.<\/p>\n
“IT needs visibility into all of that, along with the ability to convert IP networks and address into managed objects. Discovery needs to be a lot more than a simple ping sweep,” said Bob Rose, senior product marketing manager at Infoblox. “IT needs robust information on DNS, DHCP, host objects, devices (both physical and virtual), models, OS, versions, interfaces, along with current data on routers, subnets and VLANs.”<\/p>\n
That VLAN issue is critical given the sharply increasing number of assets and data moving to clouds controlled by third-parties, where IT may not truly know where the data and assets are physically located. But with the right systems in place, all of that information is still discoverable, especially in regards to VM instances. It\u2019s not only being able to determine Layer 2 physical and Layer 3 logical devices, but to understand how these complex components actually are connected on the network.<\/p>\n
That is because if IT understands how those elements are actually connected, it helps to manage the changes and the configurations both for traditional networks and virtualized networks using technologies like VRF (virtual routing and forwarding). VRF allows for multiple routing tables and multiple forwarding instances on the same router. All of this also gives visibility into end hosts connected to physical switches and that can deliver both a current view and an historical view. The historical view is essential for effective forensic investigations.<\/p>\n
Too many security products today just share the information about this endpoint and this endpoint and this server. But they don\u2019t typically answer the important question: how did the problem move between them? It\u2019s important to know how they are connected because that\u2019s when you start realizing that in order for it to get from Point A to Point B, it had to compromise something else. These threats will compromise devices, do what they need to do with them and then clean up after themselves and then move on. We\u2019ve even seen some that were able to take advantage of a device because the firmware hadn\u2019t been properly updated. Before they moved on, they updated the firmware. If you weren\u2019t tracking your firmware revisions, you wouldn\u2019t have known that.<\/p>\n
How do you understand how the network constructs fit together so that you can see a topology view, visualize how those devices are connected and then drill down to see how specific devices are operating on your network. It\u2019s all about being to have all of this information all in one place, in an IPAM database.<\/p>\n
Another consideration is data-sharing. That\u2019s why OpenAPIs are so useful, as they can give easy access to perhaps a threat-hunting tool, a SIEM or even SOAR for automation. The more context your systems have, the better it is for both cybersecurity and compliance.<\/p>\n
Networks also need to track end of life and end of service of different types of devices. How can you eliminate device vulnerabilities with automated security and lifecycle management? Integrate with DNS, DHCP and IPAM.<\/p>\n","protected":false},"excerpt":{"rendered":"
Network visibility is critical for cybersecurity and compliance, but that means going way beyond IP address tracking, given how many network layers are at issue. As much as cloud usage is soaring and that presents a wide range of new issues, the reality is that most enterprise networks\u2013to varying degrees\u2013went to the cloud a very […]<\/p>\n","protected":false},"author":332,"featured_media":1635,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[2],"tags":[668,478,671,672,673],"class_list":{"0":"post-7633","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security","8":"tag-network-visibility","9":"tag-ip-address-management","10":"tag-enterprise-network","11":"tag-vlan","12":"tag-dns-dhcp-ipam","13":"entry"},"acf":[],"yoast_head":"\n