Skip to content

What is a network monitoring system?

Network monitoring is a set of automatic processes that help to detect the status of each element of your network infrastructure.

We are talking about routers, switches, access points, specific servers, intermediate network elements, and other related systems or applications (such as web servers, web applications, or database servers).In other words, network monitoring can be understood as taking a look at all the connected elements that are relevant to you or your organization.

What is a network monitoring system?

A network monitoring system is that set of software tools that allows you to program those automatic polls.

That way you may constantly monitor your network infrastructure, doing systematic tests so that, if they find a problem, they notify you.

These systems makes monitoring the network easy, as they also allow you to see all the information in dashboards, generate reports on demand, see alerts and, of course, see graphs with the monitoring data relevant to you.

How does network monitoring work?

Network monitoring can be as simple as seeing devices respond to a simple command like ping. So you will see whether they are connected, switched on and “alive”.

If you do that every five minutes, you’ll be actively monitoring those machines.

We don’t care if they’re servers or routers. We’ll know that, at least, they’re there and they’re responding. When one stops responding, you’ll know something happened to it.

It can also be as basic as periodically interrogating a router for the number of bytes it has transferred, both up and down.

With that you may create network traffic graphs.

We could even add more data to it, like the number of lost packets, latency times…

These data can be combined in graphs that visually compare some values with others and even set thresholds that warn you whether a data exceeds a certain value, for example, if packet loss exceeds 10%.

If you apply that same philosophy to monitoring other data, such as the temperature in a power supply, the process will be the same: obtain the data every X time, draw it on a graph and set thresholds to generate alerts.

This is network monitoring and, as it is evident, it can be easily extended to server, application or database monitoring.

Usually network monitoring is done using remote methods, so that from one place, you may scan the network and get information from your devices.

What is a network monitoring protocol?

In order to perform these network surveys, you need what are known as network monitoring protocols. They define how communication inside a network (in order to monitor systems and devices) can be done.

There are several different monitoring protocols that allow these types of surveys to be carried out.

1. SNMP Protocol

The best known monitoring protocol is SNMP (Simple Network Management Protocol) which allows you to probe a computer and ask for different values. For example, the number of bytes you have transmitted or the temperature of your power supply.

These values are identified by a numeric code, called an OID.

For example, the OID for obtaining the temperature of a power supply on a CISCO computer is as follows: 1.3.6.1.4.1.9.9.13.1.3.1.3

2. ICMP Protocol

Another basic protocol is the ICMP, which allows to know whether the machine responds (commonly known as “pinging” or ping test).

This protocol can also be used to calculate latency times (find out how long it takes for a packet to arrive from one machine to another).

Certain network applications, such as IMAP, DNS or SMTP have their specific ports and finding out whether a service is working properly is directly related to protocol design, so more complex testing is needed.

Generally any service that is offered over the network exposes a TCP port, so monitoring that those ports are active and responsive can already be basic monitoring.

Network Monitor Basics

We could say that, in addition to the aforementioned pings, there are three methods for monitoring a network.

1. Bandwidth Monitoring

Network bandwidth is the amount of information that circulates through a network link at any given time.

This information is usually measured in bits per second and allows you to know how overloaded or underutilized your networks are.

In order to measure it, there are several tools that analyze the network bandwidth, the communication protocols used, and so on.

2. TRAP Monitoring

TRAPS are urgent notices that circulate through the network, thanks to a protocol that allows it and an emitter/collector that generates and/or collects them.

Virtually all network devices allow these urgent warnings to be sent to a trap collector.Be careful! The SNMP survey should not be mistaken with the SNMP traps.

The first is a server that asks the device regularly, using SNMP, and in the second case, it is the device that occasionally, when something happens, sends a trap to the server. Both devices can be seen as network monitors, as they perform monitoring tasks using network monitoring protocols.

3. Syslog monitoring

Another method used is log or report collection (usually via syslog).

For this, as with the traps, you must set in motion a syslog collection server that will collect logs from all the devices that you configured for this purpose.

What are the benefits of a network monitoring system?

Knowing the status of all equipment at a glance allows you to know if there are any problems and anticipate as much as possible their impact.

If something goes wrong, you’d better be the one to warn your clients or bosses, not the other way around.

If something goes wrong, in addition to knowing what went wrong, you will be able to answer questions such as:

  • Since when does it fail?
  • What other things are failing?
  • What was the normal performance?

What network monitoring tools are there?

From Pandora FMS we have done an analysis of the best network monitoring tools there are. We have compared them and here are our conclusions:

Best network monitoring tools

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

What is Packet Loss & How Can it Affect Your Network?

What is Packet Loss & How Can it Affect Your Network?

At Pandora FMS, we know that even the most minor of network issues can quickly throw a wrench in your company’s daily operations. One of the most common network issues many experience is known as packet loss.

Here, our team of network monitoring experts goes into detail about what packet loss is, as well as how to measure it and resolve it when necessary, so read on!

What is Packet Loss?

In the simplest terms, packet loss is when one or more “packets” fail to meet their destination. In most cases, it can be a minor issue that crops up in the background of your network from time to time. In fact, many applications are designed to manage package loss by relying on the built-in retransmission solutions available from transmission control protocols or by having a monitored acceptable level of packet loss.

Is there Acceptable Packet Loss?

As mentioned previously, packet loss can often be a minor issue, but that doesn’t mean it should go unaddressed. In terms of network monitoring, there is an acceptable level of packet loss (around %1 or so) that can happen and your operations will remain unaffected. This is because things like SIP or VoIP systems are designed to tolerate a small amount.

How is Packet Loss Caused?

One of the most common causes of packet loss is having links close to maximum throughput that start dropping packets, in other words, congestion. However, there are other causes as well, like general radio-based issues, faulty hardware and in some cases, a device will purposefully drop packets for routing purposes or to limit traffic throughput.

What are the Effects of Packet Loss?

Minimal packet loss isn’t likely to affect your network too much. However, extensive packet loss will greatly reduce the speed of any throughput connection, reducing the quality of applications like streaming video and voice-over IP services, as well as other latency-sensitive protocols. Since packet loss can increase the CPU load needed to process additional network overhead there may be some delays and issues.

How Do I Check for Packet Loss?

You can determine whether your network is experiencing packet loss by first performing a ping to identify the issue; you’ll then be able to determine the percentage of packet loss your network is experiencing. Often, there’s no single cause for packet loss, meaning you’ll need to monitor your system’s different processes, like port errors and congestion, to check it for packet loss symptoms.

  • Testing: To test for packet loss inside your network, you can provide extra capacity for links that are receiving more than 90% congestion. Additionally, check your router and CPU’s resources to ensure it’s not an issue with those components within your system. For issues occurring outside of your network, it can often be due to your ISP or another ISP between your path and your destination. In this case, you’ll need to provide your ISP provider with detailed information via a ping/MPR output to resolve the issue.

Reducing Packet Loss

One of the best ways to reduce packet loss is to employ network monitoring software that will monitor capacity and hardware failures throughout your network, alerting you as soon as an issue is perceived. Providing proper network maintenance is another good way to avoid packet loss issues and keep your system running at peak performance levels.

Our Network Monitoring Solutions

As one of today’s leading network and server monitoring companies, Pandora FMS ensures your network is functioning properly.

Remote Network Monitoring: Pandora FMS delivers remote network monitoring without external access via our cutting-edge satellite servers.

Our basic network monitoring features include:

  • Advanced Availability Reports
  • Remote Software & License Inventory
  • Polling SNMP v3 & Complete SNMP Trap Management
  • NetFlow for Network Capacity Management & Low-Level Performance
  • Integrated MIB Explorer, with Custom MIB Loading
  • Auto-Discovery of Networks at Levels 2 & 3
  • Integrated SSH & Telnet Console
  • Historical Graphs for Up to 3Years Back
  • High Availability
  • Integrated IPAM for IP Addressing Management (IPv4/IPv6)
  • Linux & Windows Monitoring
  • & More!

We’re Experts in Complex Networks & Environments

When it comes to working with complicated networks and environments, the team from Pandora FMS are proven experts. Since 2004, we’ve helped clients overcome complex network issues by offering a comprehensive tool and obtaining key insight into their systems.

Our monitoring software is designed to offer users high scalability, adapting as the needs of your business grow. Thanks to our satellite servers and Metaconsole, we enable horizontal growth that is designed to handle thousands of network queries and duties per second. In some cases, our clients operate thousands of network devices and our monitoring solutions help them manage any issue that’s thrown at them.

Contact Pandora FMS for comprehensive monitoring solutions and technology!

If you want to get a handle on your company’s daily operations and improve and secure your network, the team from Pandora FMS would love to tell you more about our offerings. In addition to our network and server monitoring solutions, we offer SAP monitoring capabilities, log collection, and many more services designed to improve your capabilities.

Pandora FMS is committed to helping companies implement horizontal and integrated monitoring, combining key insight from different departments and sources to provide companies with a single dashboard to supervise their technology. We work with clients located in more than 40 countries around the world and have experience working with businesses in any industry, of any size.

We also offer support and training services to ensure a seamless implementation at every level of your business.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Increasing Cloud Security with CIEM

Given the current context, post-covid-19, talking about cloud security with CIEM has become essential. This is because the pandemic motivated the adoption of remote work by most organizations, which resulted in a significant increase in the adoption of cloud-based infrastructure.

As you can imagine, this feature presents particularities when it comes to cybersecurity. To get a sense, Gartner predicts that companies will suffer at least 2,300 violations of privilege policies annually by 2024.

Also according to Gartner, multi-cloud environments introduce a large cyberattack surface that can be exploited by malicious agents. Thus, incorrectly configuring security and identity tools in cloud environments may have violations as a consequence. Therefore, it is not recommended that the settings and maintenance in the access policy be performed manually.

Added to this is the fact that conventional solutions, such as IGA and PAM, may not be efficient to manage this demand. In addition, with infrastructure as a service (IaaS), access management is the responsibility of the client company. According to Gartner, 99% of data breaches occurring in a cloud environment are the responsibility of the customer, not the Cloud Service Provider (CSP).

In this article, we share everything you need to know about cloud security with CIEM. To make our text more understandable, we divided the content by topics. These are:

  • History of Cloud Computing
  • What Are The Main Challenges of The Companies that Adopt this Service?
  • What Is CIEM?
  • Why Are CIEM Solutions Important?
  • Benefits of a CIEM Solution
  • How Can CIEM Be Used?
  • How Can CIEM Contribute to DevOps?
  • senhasegura CIEM
  • Conclusion

Follow our text to the end!

  • History of Cloud Computing

In the 1950s, computers were very expensive and companies had access to few machines. For this reason, in the following decade, cloud computing began to be discussed by experts.

The first person to suggest shared use of computers was American computer scientist John McCarthy, who named this concept Utility Computing.

In the following years, Joseph Carl Robnett Licklider studied different ways to use the computer and the Network of Advanced Research Project Agencies (Arpanet), which he helped develop, enabling two or more computers to share data, even in different locations, according to the principles of accessibility and availability. 

But the term “cloud computing” was only used for the first time in the second half of the 1990s, in an academic lecture given by the professor of information systems, Ramnath Chellappa. This expression is based on the symbol of the internet: the cloud. 

Today, we also have the concept of multi-cloud, which consists of the use of various cloud services. These services can be provided by third-party providers or include a private cloud, whose technology is in the organizations’ own data center.

This type of solution enables IT teams to perform individual operations efficiently, while companies reduce costs. 

There is also the hybrid cloud concept, which unites public cloud services with a private cloud, simplifying remote cloud operations and providing more flexibility for businesses. 

However, unlike cloud environment management, which must be managed in isolation, hybrid cloud management needs to be based on a unique strategy. 

  • What Are The Main Challenges of The Companies that Adopt this Service?

With the evolution of technology, cloud computing has become accessible, and remote work, adopted by many organizations after the beginning of the covid-19 pandemic, has made this resource widely used.

The big issue is that the larger the company, the more people will have access to cloud-based environments. Moreover, many permissions are granted to applications and machines that connect to other applications and databases to exchange information.

Thus, it is necessary to have a strategy that limits unnecessary access and prevents inadequate sharing of information, which can be achieved through CIEM.

 

  • What Is CIEM?

Cloud Infrastructure Entitlements Management (CIEM) has the function of managing access in cloud and multi-cloud environments. 

This is possible through the access principle of least privilege, which contributes to companies that need to avoid risks such as attacks by malicious users and information leaks, problems generated by excessive permissions on this type of infrastructure.

Thus, a CIEM solution allows you to remove these excessive permissions and centralize the visibility and control of permissions of a cloud environment. 

Through the use of artificial intelligence, a CIEM solution is also able to analyze exposure levels of a company’s cloud environments, enabling the identification and reduction of cybersecurity risks.

. Why Are CIEM Solutions Important?

Using cloud resources is very beneficial for businesses, as it allows them to simplify their operations and save time. 

However, traditional identity and access management (IAM) tools are aimed at protecting static applications and structures rather than cloud infrastructure, which is extremely dynamic.

So, cloud providers have launched their own resources to ensure cybersecurity in this type of environment. Despite this, the dynamism and diversity of cloud environments continue to pose challenges to ensure data protection and compliance with security policies.

After all, it is necessary to keep in mind that when a company uses the cloud to become more efficient, it can increase its attack surfaces with the excess of permissions in that environment. To make things worse, in such cases, it may not have the visibility and control necessary to apply the principle of least privilege. 

In this sense, CIEM solutions are essential to improve visibility, identify and correct incorrect access-related settings with minimal privileges in cloud and multi-cloud infrastructures, and thus ensure the organization’s cybersecurity.

  • Benefits of a CIEM Solution

A CIEM solution can generate several benefits for an organization. Check out the main ones below: 

  • It allows one to create and maintain an inventory with all permissions in the cloud environment;
  • It identifies normal operations in the cloud environment, also detecting abnormal operations;
  • This feature allows the identification of external or internal risks, which may be associated with human action, such as errors and disregard for the company’s security policies;
  • It points out incorrectly configured permissions, unused privileges, or rights that conflict with corporate policy;
  • By making it possible to differentiate the necessary permissions from the excessive ones, it helps to automate the process of excluding improper privileges;
  • It detects high priority problems and presents correction plans;
  • It reduces the attack surface through the implementation of the principle of least privilege; 
  • It enables the implementation of uniform protections across multi-cloud environments; and
  • It allows the DevOps team to review all permissions granted to users and machines. 

In the following topic, we approach these benefits from another perspective: by showing how CIEM can be used to ensure more cybersecurity for companies. 

  • How Can CIEM Be Used?

Good IT security requires discovering and classifying identities and recognizing permissions granted to people and machines in order to prevent data leaks and breaches. In this sense, CIEM can be used to:

  • Ensure that permissions are used appropriately, with separation of roles, which means the person controlling the keys to encrypt data should not have the role of decrypting such data. 

CIEM enables continuous monitoring of identities and permissions, including changes in rights;

  • Monitor whether someone has received more permissions than necessary to perform their activities, correcting this problem, which puts organizations at risk;
  • Ensure visibility of identities and rights, enabling more efficient management of these permissions. 

  • How Can CIEM Contribute to DevOps?

For DevOps teams, managing cloud computing while maintaining information security can be challenging, after all, their priorities are speed and innovation rather than security. 

This is because the services must be launched or provisioned with agility, which ends up causing an excessive granting of permissions. However, the manual blocking of these rights is complex and compromises the fundamental speed for this type of operation. 

With CIEM, one can eliminate excessive permissions automatically, without interrupting developers, who can deploy code quickly and securely. 

  • senhasegura CIEM

Check out the advantages of contracting the senhasegura CIEM service below:

  • This feature promotes access governance, since it grants visibility to unnecessary privileges, without interrupting or delaying the work of developers;
  • It allows organizations to comply with strict privacy policies, such as GDPR, LGPD, and CCPA;
  • It contributes to permissions risk management and helps prevent data breaches and theft in cloud environments;
  • The management of access keys generated in CSPs, carried out by senhasegura, makes it possible to minimize the attack surface for malicious users and open-source software from third parties;
  • This tool also allows adopting the principles of privileged access management (PAM) in cloud environments in order to reduce old and unnecessary permissions;
  • Senhasegura CIEM also enables automation in compliance with regulations such as GDPR, SOX, and PCI Data Security Standard.

 

. Conclusion

By reading this article, you saw that:

  • Cloud computing is a technology that began to be required in the 1950s, due to the high cost for companies to have access to computers;
  • CIEM is a resource that allows you to manage access in cloud and multi-cloud environments;
  • Traditional identity and access management (IAM) means are not suitable for cloud infrastructure, which has great dynamism, so CIEM is necessary in this case;
  • A CIEM solution has several advantages, such as reducing the attack surface through the principle of least privilege, thus avoiding data breaches;
  • Another great benefit is to enable more visibility and control of identities and rights, detecting excessive permissions and allowing them to be corrected.
  • It can also contribute to DevOps, providing security without compromising the speed of releases or provisioning;
  • To conclude, you learned about the senhasegura CIEM service, which can make all the difference in the cybersecurity of your company.

Did you like our article on CIEM solutions? Share it with someone who can benefit from this knowledge. 

 

ALSO READ IN SENHASEGURA’S BLOG

How to Create a Secure Password Policy?

Learn All About Passwordless Authentication

Password Strength: How to Create Strong Passwords for Credentials?

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

ATT&CK® Evaluations: Building on visibility to reach XDR

One of the main goals of MITRE Engenuity’s ATT&CK® Evaluations is to help organizations better understand the level of visibility that endpoint detection and response (EDR) solutions offer to investigate in real time sophisticated threats lurking in a network. Visibility is a crucial metric in any organization’s assessment of an EDR solution it is considering to adopt or when learning the ropes of using one for the first time.

ESET’S 2022 ATT&CK EVALUATION RESULTS

Obviously, visibility is not the only metric. The additional metrics considered in the ATT&CK Evaluations largely center around the context that accompanies the detection of specific adversarial techniques. These have a varying level of importance to each organization, depending on its level of maturity, the different regulations it needs to comply with, and a host of other sector-, company-, and site-specific needs. Yet there are other metrics, such as performance and resource requirements, alert fatigue, integration with other security software, and ease of use, that are unconsidered in the evaluations.

This rich palette of metrics in part reflects the success of EDR as a go-to tool for security defenders. Even organizations without dedicated security teams have gained interest in this type of defense tool. Yet the market is pushing EDR to become even better. Not infrequently, security defenders have been juggling between an EDR solution to hunt down threats and a security information and event management (SIEM) solution to sift through big data sets as complementary activities to defend their networks — the strategy being that what is lacking in one tool can be made up for by the other.

Some might think that if only a synthesis could be achieved between EDR and a security analytics platform, security defenders would have the ultimate tool in their hands. However, Forrester analysts see the situation differently. EDR needs to evolve into extended detection and response (XDR) by learning to ingest data feeds sourced beyond endpoints for analysis and response. Budding XDR solutions can then enter into a toe-to-toe competition with security analytics platforms in a race that appears destined for collision.

On the other side, to remain competitive, security analytics platforms need to be equipped with EDR features like higher-quality alerts and threat response capabilities and use resources more efficiently. The evolved solution that demonstrates better overall security is likely to become the increasingly favored tool for defenders. Our bet is that XDR has the winning odds because of its stronger foundation on EDR solutions that are designed for higher-quality detections with rich context, even if partially limited in overall visibility.

What does XDR mean for ESET?

ESET adopts Forrester’s understanding of XDR as the next generation of EDR that moves beyond endpoints to collect data also from network devices, email servers, cloud-based services, and other sources and allows security defenders to discover and respond to more threats. In order to achieve this increased level of data collection and response capability, XDR can use two integration strategies: hybrid and native.

A hybrid strategy focuses on integrations with third-party tools. A native strategy focuses on integrations with tools from the same vendor. Currently, no vendor offers a complete XDR solution, making it an ideal yet to be achieved.

ESET is committed to building out a full XDR solution by iteratively improving ESET Inspect (formerly ESET Enterprise Inspector) and continuing to add integrations both with ESET’s ecosystem of security tools and with third-party tools. Previously, as ESET Enterprise Inspector, ESET’s EDR solution was positioned for enterprise security teams. Now, as ESET Inspect, it has evolved into the XDR-enabling component of the ESET PROTECT platform, ready for both large enterprise and smaller security teams.

Before looking at the ESET PROTECT platform, let’s consider ESET Inspect a little more closely.

ESET Inspect: Enabling the pursuit of XDR

More than being a mere name change, ESET Inspect is a new version with increased visibility and remediation capabilities. ESET Inspect carries over the familiar features of previous versions, such as the referencing to the MITRE ATT&CK knowledge base in its rule set, a REST API for integration with security orchestration, automation, and response (SOAR), SIEM, ticketing and other similar tools, and the ability to run a remote PowerShell session on Windows machines for precise response and remediation options.

In the latest version of the product — version 1.7 — several major Linux distributions are now supported. This adds to the already existing support for Windows and macOS and marks an important milestone on the road to a complete XDR solution. ESET Inspect’s coverage for Linux machines works in concert with ESET Endpoint Antivirus for Linux and ESET Server Security for Linux (from versions 9.0) to support the following distributions:

Linux distributions supported by ESET Inspect
Red Hat Enterprise Linux 7.6+Ubuntu LTS 18.04Debian 10SUSE Linux Enterprise 15Amazon Linux 2
CentOS 7.6+Ubuntu LTS 20.04Debian 11Oracle Linux 8

ESET Inspect also features an expanded rule set currently consisting of almost 1,000 rules. The rules are used to analyze events happening on endpoints, firewall and network data, user account actions, and other data for potentially malicious behaviors to be investigated by security engineers.

ESET researchers have enhanced a selection of rules with automated responses, for instance, to isolate a computer or block an executable. The use of an automated response in specific rules is made visible in the “Active Rule Actions” column of the “Detection rules” view:

Figure 1. ESET Inspect’s rules can trigger automated responses

The continued growth of ESET Inspect’s rule set and its integration with ESET’s other security products is a good example of building a native XDR solution. For ESET, the core of this integration lies in ESET PROTECT, a management console for IT admins to deploy and configure ESET security products. The ESET PROTECT platform packages endpoint security, server security, encryption, cloud-based, and detection and response solutions with the console to provide businesses a scalable prevention, detection, and response capability.

Thus, positioning ESET Inspect more closely to ESET PROTECT helps create a more integrated experience for security defenders using ESET’s security ecosystem. As mentioned above, one of the key goals of an XDR solution is to incorporate threat data beyond just endpoints, meaning that continuing to extend ESET Inspect’s coverage to more platforms and data sources that are already integrated with ESET PROTECT puts it firmly on the road to that goal.

Lifting ESET PROTECT Enterprise toward XDR

ESET is building an XDR solution on the ESET PROTECT Enterprise platform, which packages ESET Inspect along with endpoint and server protection, cloud-based threat detection, and encryption to provide a comprehensive security capability.

XDR demands more data for ingestion, but this entails a need for greater database storage capacity that can hit performance hard if not adequately handled. Investing in more hardware to buttress on-premises database solutions is always possible, even if lacking some flexibility. This is why thinking ahead about the database needs for ESET PROTECT and the database needs for ESET Inspect is crucial.

With a cloud deployment, however, scaling up to meet this data storage demand is much more flexible as there is no need to buy new hardware. The cost lies rather in renting more storage space and possibly more powerful machines — a change that can be executed rapidly. The flexibility and scalability offered by the cloud are precisely the qualities required of an XDR solution, as Forrester points out.

Formerly, ESET PROTECT and ESET Inspect were only available for on-premises deployment, which could require considerable hardware investment, server maintenance costs, and on-site staff. While on-premises deployment remains an option, especially for organizations more desirous of keeping their data close to hand, both these solutions are also available in the cloud — a new capability for ESET Inspect since version 1.7 — and thus answer XDR’s call for cloud-native support.

Managed detection and response

In some cases, especially for smaller organizations or those whose core focus is outside of security, extracting value from an XDR solution can be too heavy of a lift to make unassisted. Similarly, managing ESET PROTECT Enterprise requires either full-time security staff or a managed detection and response (MDR) provider to take over some, if not all, of the daily security work.

For some time, the manufacturers and developers of complex products have recognized the need to increase the value of their products with a service offering. This is because at times customers struggled to see the value of their purchase when they did not have the expertise to use the product well, often misconfiguring it or failing to use all its features. More importantly, offering services reflects the type of relationship that providers wish to have with customers — for ESET that means engaging in a security partnership with customers.

ESET’s revamped MDR service assists security teams to set up ESET’s products with the best configuration and optimizations possible for their networks. The service also includes periodic health checks to address any poor security practices or misconfigurations that may have crept in over time. Critically, organizations can request the help of ESET security engineers for on-demand or proactive threat hunting with ESET Inspect.

Interested organizations (in select countries) can explore their options by reaching out via ESET’s MDR service web page.


Conclusion

This article started by discussing visibility and all the other metrics that organizations need to look at when considering a detection and response solution. For a snapshot of the depth of visibility that ESET Inspect can provide threat hunters, read the blogpost: Hunting down Sandworm and Wizard Spider: How ESET fared in the ATT&CK® Evaluations.

Designing a detection and response solution that balances all these metrics is by no means an easy task. The brief journey through XDR taken here has revealed a complexity of issues in developing native and hybrid integrations for EDR solutions and in scaling up data collection via cloud deployments, all while making detections of high quality and rich with context and maintaining high system performance.

While there are certainly mature organizations ready to wade through this complexity, the tough reality for most organizations is that they may have only one or two IT administrators … and they are managing security part time, along with their many other responsibilities. This can make the ATT&CK Evaluations, which concentrates on sophisticated threat groups, or even a discussion about XDR appear as somewhat of a niche focus.

However, both the evaluations and the pursuit of XDR speak to the gamut of security practices — from basic configurations and policies all the way to advanced fine-tuning and optimization — that should be in place to protect against even the most common threats. Furthermore, XDR’s demand for the cloud opens the door to improved security even for organizations without dedicated security teams. Such organizations may discover that their security practice falls short of industry standards when engaging in this discussion. At least in this way — by beginning the game of catch-up on their security — the ATT&CK Evaluations and the pursuit of XDR can provide actionable insight even to less mature organizations.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Need help? Our team is just a message away