Rethinking perimeter defense and expanding visibility can deter modern day adversaries

IT networks within government offices, military agencies and commercial enterprises in the United States are under relentless assault by nation-states and cyber-criminal groups determined to seize confidential data, disrupt business operations, steal intellectual property or demand ransom after encrypting critical information. In a 2021 study of number of publicized ransomware attacks worldwide in 2021 by BlackFog, the government sector is the most targeted sector, followed by education, with most of those attacks in the U.S.

Many agencies’ security strategies continue to be based on a fortress mindset: protect the network and end devices from attacks by securing access and exit. While this level of security is necessary, it is woefully inadequate in the current climate.

As attackers get more innovative, cyber risks inside organizations are also rising, either through intentional or unintentional actions of employees and business partners, successful zero-day attacks or dormant malware that already infiltrated the network. Additional approaches are urgently needed if a malicious party has entered the network.

Revitalizing packet capture as a new solution to today’s problems

An increasing number of government and military agencies are making a shift to packet capture to increase visibility and better stay ahead of relentless network attacks. PCAP is an application programming interface that provides access to network packet data that has been recorded while the network is in use. PCAP offers total visibility of the endpoint, application and network interaction, both before and after an event and provides back-in-time analysis (when stored). It offers comprehensive packet information from the Ethernet header to the application payload. Additionally, packets are unchangeable, in contrast to logs, which are commonly used by security solutions to investigate occurrences.

Along with collecting and analyzing data at network boundaries, agencies must also record and review internal activity to discover unusual network activity and threats flowing laterally among users and servers. In data centers, this type of traffic is often referred to as east-west traffic.

If an adversary enters the network, an agency can examine the detailed packet flow to determine the location and time of the incident, where it originated, what other targets in the network have already been compromised and what malware has been deployed.

DOD at the forefront of PCAP analysis

The number of requests for information and proposals that include complete PCAP continues to rise. In 2020, the Enterprise Security Operations Center of the Department of Homeland Security asked contractors to provide input into next-generation full PCAP solutions, declaring that full PCAP is an essential tool for the agency.

In the same year, the Army’s Aberdeen Proving Ground issued an RFI for “Enhanced Network Visualization Environment Cyber Operations Infrastructure,” calling for “cyber capabilities and approaches to meet future strategic and protected cyber needs ... at a speed commensurate with the evolving cyberspace domain.” The State Department's Bureau of Diplomatic Security issued an RFQ for upgrading its full PCAP capability, looking for a “comprehensive defense-in-depth strategy” and “continuously looking to augment that strategy with new or upgraded cyber capabilities” in which packet analysis in real-time and historically is a key pilar.

In all those requests, agencies are striving to visualize the network and its inherent threats, using packet data, captured across all sites, for external and internal communication alike. This requires packet capture and analysis capabilities that far exceed most commercially available solutions in a small enough form factor to be viable for deployment across sites. Agencies are looking for reliable 100 Gbps capture and storage to perform active, deep packet inspection in near real-time to produce an accurate network topology and threat detection. As the State Department’s RFQ said, the goal is to “record every packet of traffic traversing the DOS’ network border for later analysis and reconstruction, to combat the next generation of Internet-based threats, including zero-day and targeted Advanced Persistent Threat (APT) attacks.” 

Storage requirements between 30 and 180 days of packet storage, including local storage on remote sites in case of network outages, will require hundreds of terabytes of storage. Support for third-party external storage solutions is seen as essential to keep the solutions scalable and economical.

With more than half of all agencies’ web traffic and over 80% of DNS traffic now based on IPv6,  the ability to monitor IPv6 protocols and their associated services is critical as those are increasingly targeted for malicious purposes.

Traditional log, flow and event data collection is still seen as essential; however, it requires correlation with the packet data while also ingesting third-party threat feeds and time-sensitive custom signature updates. In addition to improving detection and alerting capabilities, it also allows users to quickly investigate any event using the actual packet data surrounding the incident, providing valuable insight into the severity of the attack and how far it has already spread in the environment.

Of concern with this approach is certainly the increasing use of encryption, especially with Secure Socket Layer/Transport Layer Security (SSL/TLS) encryption moving from 512-bit to 1024-bit and 2048-bit certificates, which makes it impossible to read packet content without the key. Therefore, interoperability with solutions that intercept and decrypt SSL/TLS packets is vital to maintain full visibility.

Conclusion

Overall, it is encouraging that government agencies are taking a proactive approach in the cybersecurity arms race, engaging industry to help protect the nation’s infrastructure. In addition to RFPs and RFIs, a more collaborative approach between government and the vendor community is needed that allows agencies to share their insights and observations so the security industry can provide more timely and comprehensive solutions. This shift to PCAP platforms will undoubtedly go a long way toward keeping military and federal government networks one step ahead of cyber adversaries for years to come.