A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Search Irongeek.com:

Affiliates:
ISDPodcast Button
RootSecure Button
Social-engineer-training Button
Irongeek Button

Web Hosting:
Dreamhost Logo
Help Irongeek.com pay for bandwidth and research equipment:

paypalpixle


Pivot2Pcap: a new approach to optimzing cybersecurity operations by tightly coupling the big-picture view provided by Netflow with the in-depth resolving power of PCAP. SkyDogCon 2012 (Hacking Illustrated Series InfoSec Tutorial Videos)

Pivot2Pcap: a new approach to optimzing cybersecurity operations by tightly coupling the big-picture view provided by Netflow with the in-depth resolving power of PCAP.
SkyDogCon 2012


Peter Shaw

In large networks, it helps to work from the big picture on down when planning for defense. This allows security professionals to watch over the entire network (breadth) for anomalous or suspicious activity. When any such activity is observed, it can then be investigated deeply (depth) to determine the nature of the threat. Once the behavior is fully understood, a switch back to the broad view can reveal whether this same pattern of activity is visible elsewhere in the network. In this way, it is possible to quickly determine how widespread a threat might be, and when and where it began.

Two common types of network data provide these broad and deep views: network flow data (Netflow) and packet capture (PCAP). Pivot2Pcap allows cybersecurity analysts to pivot back and forth between the broad view provided by the flow index, and the deep, drill-down view of the packet store. Both perspectives have complementary value in isolating and resolving cybersecurity operations issues.

Peter Shaw is one of the co-founders of nPulse Technologies. His 23 years of experience in the computing, telecommunications, networking and security industries include leadership roles in business strategy, product management and marketing in the US, Europe and Asia. Peter has held global, VP-level positions at Endace, Allied Telesyn, Agilent Technologies and Hewlett Packard. He holds a degree in electrical engineering and computer science from the University of Auckland, and has also completed post-graduate business studies programs in the US.
 


Back to SkyDogCon 2 video list

Printable version of this article

15 most recent posts on Irongeek.com:


If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2014, IronGeek
Louisville / Kentuckiana Information Security Enthusiast