ExtraHop Remote Working

ExtraHop Remote Working

Saying this year has been strange is, obviously, something of an understatement. Back in January I don’t expect anyone at Zoom expected their brand to become a genuine household name by now. IT professionals will have been exceptionally busy not just supporting business transformation from office to home working, but helping friends and families keep in touch.  There’s no escape once you are the go-to technical guru in your extended family!  I’ve ended up giving advice on Zoom / Skype meetings for school governors in Liverpool and helping a nephew build his first gaming PC (all socially distanced of course!).

Whilst family quizzes on Zoom and Skype sessions with grandparents have been essential for beating the boredom and retaining a degree of contact, they are also just two of the things which might be impacting on business remote access.  Are those family calls routing across a corporate connection as somebody forgot to disconnect their VPN into the office?  Visibility at protocol level can help identify gremlins such as retransmission timeouts and zero windows.  Likewise, analysis can help identify traffic destinations – if we don’t use Zoom in the business, why is it transiting my network?  A combination of these metrics can also aid help desks who, by default, now troubleshoot home broadband connections.  Is a user’s poor virtual desktop or application experience down to an issue in the datacentre or because they are competing for bandwidth with Netflix, Disney+ and Fortnite on their home WiFi?

Utilisation Metrics can provide critical information on capacity and associated bottlenecks.  If more capacity is needed, then you have hard facts to backup a business case for an upgrade.  On the other hand, if things are running smoothly, you can provide information to management to show previous investment has been money well spent and any considerations of reducing bandwidth to save money would impact on productivity.

Another impact of the current business climate is that budgets are being scrutinised more then ever now, so any new IT project must offer the highest amount of value to the business.  Thus, a platform such as ExtraHop Reveal(x), which builds on ExtraHop’s experience in Performance Analytics but adds industry leading Security Detection and Response becomes much more attractive.

The rush to home working in the UK led to a shortage of laptops and PCs.  To stay productive, some staff have been using their own home computing equipment.  Home networks and PCs are notorious for being a security nightmare, with unpatched routers, unsupported OSes, outdated AV and the like.  It is more important then ever to watch the activities of these devices when they are connected to a corporate Network.

VPN policies may have been relaxed but even so, some events represent actionable findings.  If a member of UK staff connects to the VPN from a North American IP address, are they perhaps using a commercial VPN service to access a US streaming service which has geo-location restrictions?  Or is it an attacker making use of compromised credentials?  Similarly, should a user be connected to the VPN from two different countries at the same time?

Further insight into Network traffic, obtained through Reveal(x)’s ability to decode over 50 Enterprise protocols, can also enhance Network Security.  If there is a sudden spike in Active Directory accounts being locked out, is this a sign of a brute force attack in progress?  By linking Security Detections, Reveal(x) can present alerts using the MITRE ATT&CK framework, enabling a responder to understand if the lockouts are user error or part of a more dangerous attack.

In summary, ExtraHop Reveal(x) can play an important part in assisting businesses to cope with the “new normal”.  Reveal(x) can help Operation and Security teams gain valuable insight into their Domains, with a wide range of off-the-shelf and custom integrations ensuring it is not just another siloed tool.  Take a look at ExtraHop’s Datasheet to find out tips for ensuring the availability and securing of remote access.

Chris Booth

Chris Booth

Solutions Architect

Listens to your problems, then identifies the best tools and products to build solutions.

Who monitors the monitoring and manages the management?

Who monitors the monitoring and manages the management?

Chris Booth, Solution Architect at KedronUK, considers how organisations and enterprises can get the most out of their Network Monitoring/Management System.

As an enterprise management consultancy, we might be biased, but we believe that for large or enterprise-size organisations, network monitoring is critical. A Network Management/Monitoring System (NMS) needs to provide functions such as pro-active altering, metrics to aid troubleshooting (e.g. root cause analysis), configuration management and reporting. When considering what tool to purchase, important factors such as functionality, cost and scalability will often drive the decision-making process.

However, it is important to also consider who will monitor and manage the NMS. This could be in the form of general administration and day-to-day support to ensure it is available and performing as expected. There is little point in having an NMS which isn’t working properly and thus unable to deliver timely alerts about infrastructure problems – the initial investment in the NMS has effectively been wasted. 

The NMS might also have some form of High Availability (HA), so data replication and integrity need to be monitored so that it can correctly fail-over to an alternative DC when needed. On a more irregular basis, this could be upgraded to the NMS and it’s supporting infrastructure (e.g. an SQL database back-end). To answer the title of this post, the answer is KedronUK’s Technical Team. 

We monitor and manage the NMS for a number of our customers, removing this workload from the IT operations team and making use of our extensive product knowledge. 

We know that to ensure a smooth upgrade, a particular version upgrade needs to be staged via an intermediate point release. In fact, we monitor the products we provide to our customers with the same products! Each service/support package is bespoke to the customer’s requirements, but typically includes system governance and our Technical Team holding regular calls to offer advice on best practice or to discuss any open support tickets. A contracted package from KedronUK helps fix the TCO and maximise the ROI for the NMS.

The quality of the data in the NMS can also become a challenge. When multiple team members can add, edit or remove devices, the adherence to standards can become somewhat variable. For instance, when a new network switch is on-boarded, is it named correctly and tagged with a location to help identify the datacentre, rack or office location? 

In response to this, KedronUK has developed a bespoke web portal which integrates with the NMS tools we offer such as Infosim StableNet and SolarWinds. The portal provides data validation rules and drop-down choices to remove free-form text input and the impact that has on the data. Role-Based Access Control (RBAC) is also supported, allowing a junior team member to onboard but not delete devices. Thus, administrative tasks can be controlled, ensuring the NMS data is meeting the defined standards.

For more information, contact us here.

 

Chris Booth, Solution Architect at KedronUK, considers how organisations and enterprises can get the most out of their Network Monitoring/Management System.

As an enterprise management consultancy, we might be biased, but we believe that for large or enterprise-size organisations, network monitoring is critical. A Network Management/Monitoring System (NMS) needs to provide functions such as pro-active altering, metrics to aid troubleshooting (e.g. root cause analysis), configuration management and reporting. When considering what tool to purchase, important factors such as functionality, cost and scalability will often drive the decision-making process.

However, it is important to also consider who will monitor and manage the NMS. This could be in the form of general administration and day-to-day support to ensure it is available and performing as expected. There is little point in having an NMS which isn’t working properly and thus unable to deliver timely alerts about infrastructure problems – the initial investment in the NMS has effectively been wasted. 

The NMS might also have some form of High Availability (HA), so data replication and integrity need to be monitored so that it can correctly fail-over to an alternative DC when needed. On a more irregular basis, this could be upgraded to the NMS and it’s supporting infrastructure (e.g. an SQL database back-end). To answer the title of this post, the answer is KedronUK’s Technical Team. 

We monitor and manage the NMS for a number of our customers, removing this workload from the IT operations team and making use of our extensive product knowledge. 

We know that to ensure a smooth upgrade, a particular version upgrade needs to be staged via an intermediate point release. In fact, we monitor the products we provide to our customers with the same products! Each service/support package is bespoke to the customer’s requirements, but typically includes system governance and our Technical Team holding regular calls to offer advice on best practice or to discuss any open support tickets. A contracted package from KedronUK helps fix the TCO and maximise the ROI for the NMS.

The quality of the data in the NMS can also become a challenge. When multiple team members can add, edit or remove devices, the adherence to standards can become somewhat variable. For instance, when a new network switch is on-boarded, is it named correctly and tagged with a location to help identify the datacentre, rack or office location? 

In response to this, KedronUK has developed a bespoke web portal which integrates with the NMS tools we offer such as Infosim StableNet and SolarWinds. The portal provides data validation rules and drop-down choices to remove free-form text input and the impact that has on the data. Role-Based Access Control (RBAC) is also supported, allowing a junior team member to onboard but not delete devices. Thus, administrative tasks can be controlled, ensuring the NMS data is meeting the defined standards.

For more information, contact us here.

 

Chris Booth

Chris Booth

Solutions Architect

Listens to your problems, then identifies the best tools and products to build solutions.