Network Monitoring Amid the COVID-19 Lockdown

The global outbreak of COVID-19 has thrown a wrench in the works of many organizations, and governments in particular. How do you ensure public services remain available when offices must be empty?

The Province of Cuneo is a local government institution (6,905 sq. km) in the northwest of Italy with approximately 600,000 residents in 250 municipalities, which has the task of looking after the interests of the whole community, promoting social and economic development.

The Province of Cuneo performs the functions of coordination, planning, and service management, provides technical assistance to municipalities, promotes and coordinates activities, carries out public utility in various sectors, and coordinates the provision of services to people.

“In the first days of the sanitary emergency caused by COVID-19 we had to quickly provide our employees with remote access to a part of our infrastructure to enable them to work from home,” says Alessandro Risso, IT Director. “Many of them were connecting from home using their own PCs or laptops, so we needed a way to see what kind of traffic was coming from these devices and identify any possible security issue in a timely manner. Fortunately, we were already evaluating the Flowmon solution before the emergency, so we had no doubt it was what we needed to do the job.”

A few of months before the lockdown was issued in Italy, a one-month PoC, was carried out by implementation partner 3C Informatica SRL, who had showcased the solution and highlighted several problems that other tools did not detect, such as a misconfigured device, network spikes, attack on server exposed to Internet, or phishing attempts. All of these were discussed in a detailed report the partner created for the Province of Cuneo at the end of the testing period.

Thanks to the flexibility of Flowmon, a custom profile was created, in both FMC and ADS, in order to specifically monitor the traffic coming from and going to the VPN clients, providing the customer with the much-needed visibility. This profile will serve to quickly detect and highlight any potential performance and security issue coming from all these BYOD remote devices for the months to come, as the Italian government has stated to continue the remote working policy for most of its employees till the end of 2020 at minimum.

The solution is deployed in a virtual environment and consists of a virtual Collector with Flowmon ADS Business. Two Virtual Probes were deployed to collect data from the virtual switches of Provincia di Cuneo hosts, bringing full visibility even in the virtual environment. This combination provides insight into network traffic and detects network-borne threats. 3C Informatica provides consultancy for the customer, reviewing the data periodically and maintaining the solution.