ExtraHop Remote Working

Saying this year has been strange is, obviously, something of an understatement. Back in January I don’t expect anyone at Zoom expected their brand to become a genuine household name by now. IT professionals will have been exceptionally busy not just supporting business transformation from office to home working, but helping friends and families keep in touch.  There’s no escape once you are the go-to technical guru in your extended family!  I’ve ended up giving advice on Zoom / Skype meetings for school governors in Liverpool and helping a nephew build his first gaming PC (all socially distanced of course!).

Whilst family quizzes on Zoom and Skype sessions with grandparents have been essential for beating the boredom and retaining a degree of contact, they are also just two of the things which might be impacting on business remote access.  Are those family calls routing across a corporate connection as somebody forgot to disconnect their VPN into the office?  Visibility at protocol level can help identify gremlins such as retransmission timeouts and zero windows.  Likewise, analysis can help identify traffic destinations – if we don’t use Zoom in the business, why is it transiting my network?  A combination of these metrics can also aid help desks who, by default, now troubleshoot home broadband connections.  Is a user’s poor virtual desktop or application experience down to an issue in the datacentre or because they are competing for bandwidth with Netflix, Disney+ and Fortnite on their home WiFi?

Utilisation Metrics can provide critical information on capacity and associated bottlenecks.  If more capacity is needed, then you have hard facts to backup a business case for an upgrade.  On the other hand, if things are running smoothly, you can provide information to management to show previous investment has been money well spent and any considerations of reducing bandwidth to save money would impact on productivity.

Another impact of the current business climate is that budgets are being scrutinised more then ever now, so any new IT project must offer the highest amount of value to the business.  Thus, a platform such as ExtraHop Reveal(x), which builds on ExtraHop’s experience in Performance Analytics but adds industry leading Security Detection and Response becomes much more attractive.

The rush to home working in the UK led to a shortage of laptops and PCs.  To stay productive, some staff have been using their own home computing equipment.  Home networks and PCs are notorious for being a security nightmare, with unpatched routers, unsupported OSes, outdated AV and the like.  It is more important then ever to watch the activities of these devices when they are connected to a corporate Network.

VPN policies may have been relaxed but even so, some events represent actionable findings.  If a member of UK staff connects to the VPN from a North American IP address, are they perhaps using a commercial VPN service to access a US streaming service which has geo-location restrictions?  Or is it an attacker making use of compromised credentials?  Similarly, should a user be connected to the VPN from two different countries at the same time?

Further insight into Network traffic, obtained through Reveal(x)’s ability to decode over 50 Enterprise protocols, can also enhance Network Security.  If there is a sudden spike in Active Directory accounts being locked out, is this a sign of a brute force attack in progress?  By linking Security Detections, Reveal(x) can present alerts using the MITRE ATT&CK framework, enabling a responder to understand if the lockouts are user error or part of a more dangerous attack.

In summary, ExtraHop Reveal(x) can play an important part in assisting businesses to cope with the “new normal”.  Reveal(x) can help Operation and Security teams gain valuable insight into their Domains, with a wide range of off-the-shelf and custom integrations ensuring it is not just another siloed tool.  Take a look at ExtraHop’s Datasheet to find out tips for ensuring the availability and securing of remote access.

Call us today on 01782 752 369
KedronUK, Kern House, Stone Business Park, Stone, Staffordshire ST15 0TL