This document discusses how to select a security visibility solution and outlines key considerations. It begins by highlighting the evolving security threat landscape and need for optimized packet flow. A packet flow switch is presented as an appliance that can optimize packet flow to centralized security and monitoring tools. Key questions are outlined to evaluate a solution's performance, scalability, inline security support, health checks, tool chaining abilities. A case study demonstrates how a packet flow switching solution provided complete visibility across a private cloud. The document emphasizes selecting a solution that supports existing security investments while enabling simplification and performance assurance.

1. How to Select a
Security Visibility
Solution
Are you asking the right
questions?
June 2016

2. AGENDA HIGHLIGHTS
• Why security visibility?
• The case for packet flow switching
• How to formulate your requirements
• Key requirements for inline security
• Case study and takeaways
Ksenia Coffman
Product Marketing Manager
NETSCOUT
SPEAKERS:
2©2016 NETSCOUT

3. SECURITY ATTACK TRENDS
3
Source: Arbor Networks (2016): Worldwide Infrastructure Security Report, vol. XI
©2016 NETSCOUT

4. EVOLVING NEEDS
©2016 NETSCOUT ° CONFIDENTIAL & PROPRIETARY 4
The need to
optimize packet flow
Complex security
scenarios
Active, passive
and hybrid security
Archiving and
spooling
New and more
security tools
Security threats: Bigger, faster, more complex

5. State of network security threats
Are we better off than
two years ago?

6. SECURITY WITHOUT VISIBILITY
• Individual silos of security and single points of failure
• Complex configuration and change management
6©2016 NETSCOUT

7. Why Security
Visibility: The
Case for Packet
Flow Switching

8. WHAT IS A PACKET FLOW SWITCH?
8
Network Centralized Tools
Application
Performance
Management
Network
Performance
Management
Customer
Experience
Management
Security
From the Network To the Tools
An Appliance to
Optimize Packet Flow
©2016 NETSCOUT

9. MATRIX SWITCHES
• Entry-level packet broker: NPB software + COTS
• Does not scale for advanced capabilities and performance
Application
Performance
Management
Network
Performance
Management
Customer
Experience
Management
Security
Packets Not Reaching Tools
ADVANCED FUNCTIONALITY
MISSING
9
Network Centralized Tools

10. SOFTWARE BASED MONITORING SWITCH
• The software based monitoring switch adds compute capabilities to matrix-switches
• Lack hardware acceleration behind every port
• Difficult and costly to scale
1010
PERFORMANCE
DEGRADES
Application
Performance
Management
Network
Performance
Management
Customer
Experience
Management
Security
Network Centralized Tools

11. TRUE PACKET FLOW SWITCHING
Network Centralized ToolsPFS
Security
NGFW
IDS
IPS

12. Network Centralized Tools
Application
Performance
Management
Network
Performance
Management
Customer
Experience
Management
Security
SLICING: Remove unnecessary payload
Slicing
PFS
Filtering
Replication
Slicing Stripping
Speed Conversion Aggregation Load Balance
De-Duplication
©2016 NETSCOUT

13. Network Centralized Tools
Application
Performance
Management
Network
Performance
Management
Customer
Experience
Management
Security
STRIPPING: Enable processing of encapsulated packets
Stripping
PFS
Filtering
Replication
Slicing Stripping
Speed Conversion Aggregation Load Balance
De-Duplication
©2016 NETSCOUT

14. Key Questions to
Ask About a
Security Visibility
Solution

15. WHAT ABOUT PERFORMANCE?
Traffic grows Performance degrades

16. CAN YOU HANDLE TRAFFIC GROWTH?
Traffic Grows
13
Tools overrun, limited load balancing

17. DO YOU SUPPORT INLINE SECURITY?
Inline tools Single Points of Failure
14©2016 NETSCOUT

18. WHAT ABOUT HEALTH CHECKS & TRIGGERS?
• Both positive and negative
health checks are required
• Conditional triggers are key
• Each security system in the
tool chain should have a
different trigger
17©2016 NETSCOUT

19. CAN YOUR SYSTEM SUPPORT TOOL CHAINING?
Inline Monitor
Inline
Network
Aggregated Traffic
2 4 6
7
1
3 5
Inline Tool Chain
NGFW
LB Group
1 Web
8
NGFW Web Gateway IPS
IPS
IN IN IN
18
IM IMIM IM IM IM
©2016 NETSCOUT

20. Case
study

21. CASE STUDY: Large Private Cloud
• Unified packet plane
achieves complete
visibility
21

22. PACKET FLOW SWITCHING FOR SECURITY VISIBILITY
Network Security Systems
Security
NGFW
IDS
IPS
PFS 2204
PFS 4204
Unified Packet Plane
TriggersNetwork bypass Health Check Tool chainingActive inline
Filtering
Replication
Slicing Stripping
Speed Conversion Aggregation Load Balance
De-Duplication
E N T E R P R I S E . N E T S C O U T. C O M

23. THE RIGHT SECURITY VISIBILITY SOLUTION:
• Helps retain investment in existing security systems
• Simplifies adds, tests and changes
• Supports both performance assurance and cybersecurity

24. Additional
Resources
E N T E R P R I S E . N E T S C O U T. C O M
• Listen to the live webinar here
• Enterprise Networks: No Tool Left Behind