IT networks within government offices, military agencies and commercial enterprises in the United States are under relentless attack by nation-states and cyber-criminal groups determined to seize confidential data, disrupt business operations, steal intellectual property or demand ransom after encrypting critical information.
In a 2021 study of a number of publicised ransomware attacks worldwide in 2021, the government sector is the most targeted sector, followed by education, with most of those attacks in the U.S. Many agencies’ security strategies continue to be based on a fortress mindset: protect the network and end devices from attacks by securing access and exit. While this level of security is necessary, it is inadequate in the current climate.
As attackers get more innovative, cyber risks inside organisations are also rising, either through intentional or unintentional actions of employees and business partners, successful zero-day attacks or dormant malware that already infiltrated the network. Additional approaches are urgently needed if a malicious party has entered the network.
An increasing number of government and military agencies are making a shift to packet capture to increase visibility and better stay ahead of relentless network attacks. PCAP is an application programming interface that provides access to network packet data that has been recorded while the network is in use.
PCAP offers total visibility of the endpoint, application and network interaction, both before and after an event and provides back-in-time analysis. It offers comprehensive packet information. Additionally, packets are unchangeable, in contrast to logs, which are commonly used by security solutions to investigate occurrences.
Along with collecting and analysing data at network boundaries, agencies must also record and review internal activity to discover unusual network activity and threats flowing laterally among users and servers. In data centres, this type of traffic is often referred to as east-west traffic.
If an adversary enters the network, an agency can examine the detailed packet flow to determine the location and time of the incident, where it originated, what other targets in the network have already been compromised and what malware has been deployed.
Agencies are striving to visualise the network and its inherent threats, using packet data, captured across all sites, for external and internal communication alike. This requires packet capture and analysis capabilities that far exceed most commercially available solutions in a small enough form factor to be viable for deployment across sites.
Agencies are looking for reliable 100 Gbps capture and storage to perform active, deep packet inspection in near real-time to produce an accurate network topology and threat detection. The goal is to record every packet of traffic traversing the DOS’ network border for later analysis and reconstruction, to combat the next generation of Internet-based threats, including zero-day and targeted Advanced Persistent Threat (APT) attacks.
Storage requirements between 30 and 180 days of packet storage, including local storage on remote sites in case of network outages, will require hundreds of terabytes of storage. Support for third-party external storage solutions is seen as essential to keep the solutions scalable and economical.
Government agencies need to take a proactive approach in the cybersecurity arms race, engaging industry to help protect the nation’s infrastructure. In addition to RFPs and RFIs, a more collaborative approach between the government and the vendor community is needed that allows agencies to share their insights and observations so the security industry can provide more timely and comprehensive solutions. This shift to PCAP platforms will undoubtedly go a long way toward keeping military and federal government networks one step ahead of cyber adversaries for years to come.
