Dealing with Unknown Threats

The cybersecurity threat landscape facing every organization is constantly changing. Cybercriminals are always looking for new vulnerabilities to exploit or changing existing attack methods to bypass protections. They also go to great lengths to hide their activities within regular network traffic and application activity. The attack surface that organizations present to attackers is also in a constant state of flux.

Due to this ever-changing threat landscape and attack surface, it’s almost impossible for traditional siloed cybersecurity tools to detect threat vectors that are unknown to them in advance. Flowmon’s detection and security analytics solution makes it possible to detect unknown and emerging attacks and threats. It achieves this by piecing together all detected anomalies to zone in on their causes, delivering a clear picture of the risks, and providing possible root cause advice. 

Dealing with Unknown Threats

Anyone who has worked in IT will recognize a scenario close to the following. It’s a seemingly ordinary day, but then reports start to come in from users that applications are not working as they should.

Troubleshooting applications that are running abnormally from an end-user perspective is usually a time-consuming and challenging process. And as the system admins investigate, internal users get more frustrated, and their productivity gets impacted. It’s even worse when the issue affects external customers on a shopping application or business clients using B2B applications. The former will lead to lost sales as customers give up if they can’t perform the task they wanted to, and the latter has a measurable impact on the reputation of your business. An impact that can lead to negative results when the time comes to renew business relationships.

It can take time for IT to diagnose and fix reported issues like this. All the while, as IT looks at the problem, they will have management (and sales if it’s an e-commerce app) breathing down their necks to get it fixed. Quick fixes (like the perennial favorite of rebooting the servers) are often temporary fixes that only hide underlying issues for a while. 

The Unknown Root Cause

Many network monitoring tools don’t provide IT teams with the joined-up picture needed to find the root cause of issues that are not well defined. Is it something on the network? Is it an application server problem? Or is it something specific to the application itself? Finding out and eliminating causes takes time. A period during which the impact of the issue continues to play out and impact operations and productivity.

The scenario above is exactly what used to happen to a Flowmon customer before they deployed our Anomaly Detection System (ADS). A few years ago, a malware infection picked up on a laptop during an employee’s overseas business trip started to spread when the employee returned to the office and connected their laptop. It took time to identify the root cause, clean up the infected systems, and return everything to normal.

Flowmon Has Your Back

Flowmon ADS does not rely on signatures of known malware and other threats. It uses detection technologies based on machine learning, adaptive baselining, heuristics, behavior patterns, and reputation data from across the industry to monitor networks and identify anomalous behavior. These multiple detection methods draw on data sources from across the network:

• Propriety Enriched Network Telemetry.
• 3rd-party NetFlow/IPFIX data and compatible standards.
• Raw network packet data (when required).
• User identity information.
• Intrusion Detection System (IDS) signatures.
• Built-in custom threat intelligence.

These methods and data sources allow Flowmon to detect both known and unknown attack vectors that signatures for anti-malware and other protective solutions do not include.  

After the Flowmon solution gets deployed, a scenario like the one outlined previously would play out differently. One that detected the infected laptop, meaning the fledgling attack impacted neither internal nor external users. Now when a malware-infected device is attached to the network (even one that has a new unknown malware variant), the following occurs:

• Flowmon ADS detects the unusual behavior on the network as the malware looks for other systems and tries to spread.
  
• Flowmon immediately informs the IT team that it has detected an infected device.
  
• System admins can then isolate any malware-infected devices from the network.
  
• Engineers can restore the infected device (or devices) to a clean state.
  
• The malware, or other attack vectors, can be analyzed and steps taken to prevent it from infecting systems in the future.

Find Out More

Flowmon’s early detection of anomalous network behavior means a much lower chance of users getting impacted by a known or unknown cyberattack method that impacts them via financial and reputational damage. By extension, this also means that business operations are less likely to be affected. Plus, IT teams will have to spend less time troubleshooting, giving them more time to spend on activities that drive the business forward. 

Visit the Flowmon ADS website for more information about anomaly detection and our other network and security operations features. Or to get more info, a demo, or a free trial of Flowmon 12 so you can quickly see how it will make your network monitoring easier and more informative.