運用 PacketX 可視化技術增加網路能見度技術、優化網路安全防禦機制

|
流量監控之完整性
出口 vs. 內網
實體 vs. 虛擬
所有流量之收容匯聚機制 |
安全分析功能降載
排除重複封包或低風險連線
再精準遞送至多台多種網路安全設備 |
情資驅動型防禦
匯入百萬筆威脅情資
(IoC types: IP/Domain/URL)
執行阻斷或偵測 |
|
安全分析功能降載
Deduplicate & App-based Filtering

情資驅動型防禦
|
Traditional Model
- Import IP to Firewall
- Import Domain to IPS/NG-FW
Max entries: 10K-100K |
PacketX Model
Import IP/Domain to GRISM with H/W bypass switch
Max entries: 0.5-5 Million |
|

|
Filtering and Distribution
- Many-to-Many port mapping and aggregation
- L2-L7 matching and filtering
- Session-based Load Balance
- Fair Distribution(non ACL-style)
Out-of-band processing
- De-Tagging (VLAN/QinQ/VxLAN/GTP/GRE…) & Tag Adding(VLAN)
- Packet Deduplication
- Packet Slicing: cut TCP/UDP payload or reserve a fixed length
- Sensitive Data Mask (matching by RegEX and masking)
In-line processing
- Link aggregation
- Distribute to parallel in-line devices : LB or Filter
- In-line device chain
- Application-based in-line bypass: ex. bypass YOUTUBE
|
|
Massive Blocking
- 3rd party Threat Intelligence Import
- Block IP address: Max 3M entries
- Block Domain: Max 2.5M entries
Metadata Extraction
- Netflow V5/V9/V10
- Application Flow Log *: HTTP/HTTPS/DNS
Traffic Recording
- Local PCAP recording
- Remote PCAP stream
VM traffic monitoring
- VM: KVM & VMWARE
- VM management: OpenStack and vCenter
|
|
節省資安設備及網路分析設備支出
