Niksun - security, forensic analysis, compliance, traffic capture

NIKSUN's solutions are based on a holistic view of the problem areas. Typically, many security and network issues are dealt with in a disparate manner by disjointed teams. In most medium- to large-scale businesses, a typical incident affecting a business is addressed separately by the "networking", "security", "compliance", "client" and "application" teams without real coordination between these teams. The lack of coordination is not due to the lack of desire to cooperate, but rather due to the lack of a single integrated solution, which can be leveraged by the various teams. Therefore, each team uses their own tools relevant to their domain and usually the problem goes unresolved for significantly longer periods of time than necessary.

NIKSUN's approach to handling of such incidents is quite different. Recognizing the fact that different business units require different "information" and "intelligence" for their day-to-day operations, but each of the business units in reality leverage the same source of "information", NIKSUN has developed a very different integrated holistic approach.

By developing a scalable data warehouse which is an intelligent repository of information serving the needs of various organizations, NIKSUN's solutions address the first fundamental requirement, namely a common information source ensuring consistency of information between different business units. This common information source also serves as a "knowledge repository" which serves as a common knowledge base within the organization allowing for intelligent solutions to be developed over time. In addition, this model ensures that organizations continue to minimize their total cost of ownership.

On top of this knowledge data warehouse, NIKSUN has developed specific data mining applications which are specifically designed to leverage the common knowledge repository and provide specific solutions for various business requirements. For example, NIKSUN's NetDetector 2005 solution is a special data mining application suitable for security surveillance, detection , forensics and various other security related applications. Similarly, NetVCR 2005 is a data mining application suitable for network performance, quality of service, service level management, troubleshooting, etc. In addition, NIKSUN's enterprise solutions allow organizations to easily correlate and aggregate information for an enterprise wide view.

Having developed highly responsive remedies leveraging the wealth of knowledge in the NIKSUN knowledge base, NIKSUN's solutions have now evolved proactive solutions for its customers. These proactive solutions allow organizations to build effective triage solutions and to leverage the knowledge base to develop effective prevention solutions for various business applications such as: security, compliance, network and service performance, optimization , Multicast , etc.

To simplify problem resolution further, organizations can also leverage NIKSUN's expert solutions to help reduce the time taken to analyze and solve complex security , compliance and network issues.

Proactive Surveillance

NIKSUN provides a host of real-time alerting modules which are essential for proactive security, service and performance/availability monitoring:

NIKSUN's Anomaly and NetSLM modules provide behavioral tracking and alerting in real-time. These solution modules provide a real-time alert to any alert console, including via SNMP, Syslog, pagers, emails, etc. when behavioral changes are seen affecting security, service availability and performance. These modules are used by NIKSUN customers to ensure that their service is up 100% of the time; they are immediately notified when a service is impacted by a malicious user, misbehaving application, misconfigured device or for any other reason. Follow up expert analysis ensures that the situation can be remedied within seconds or minutes.
NetRTX and Snort Signature IDS modules provide for content and meta-data inspection within transactions, flows, sessions and packets. These modules provide specific alerts for various applications; integrated NIKSUN drill-down and forensics ensures that a potentially harmful event can be averted before it becomes customer impacting. Notifications can be immediately sent out via email, SNMP trap, or syslog to enable network and security personnel to quickly respond to incidents before they escalate into major problems. These same notifications contain the forensic signature of the event allowing quick and easy drill-down to identify root-cause.

The centerpiece of the Proactive Surveillance solution is NIKSUN's powerful Event Viewer. The Event Viewer offers event summarization and detail views, with convenient point-and-click filtering and correlation capabilities. Analysts can drill-down on events to apply the full gamut of NIKSUN's analysis features to quickly and completely investigate events while leveraging NIKSUN's unique historical network data repository.

back to to

Forensic Analysis

So you've been hacked! Or, let's say you just found out about a transient network slowdown that happened several hours ago. Now what? Can you quickly trace the incident to find the root cause and make sure it doesn't happen again?

The traditional paradigm relies on static disk dumps or portable probes deployed after the fact. What if the hacker carefully covered his tracks, or the incident doesn't happen again?

Enter the new paradigm - NIKSUN's flagship appliances. The NetDetector and NetVCR solutions offer unparalleled data-in-motion forensics to track attacks and performance problems as they occur the first time from the actual data that is causing them. Eliminate the guess work on your network!

Key Benefits

Extensive network data and meta-data warehousing
Drill down analysis from application layer to link level
Multi-level real-time and historical statistics
Advanced filtering at all levels, pre and post capture
Detailed packet level inspection with string search
Client/Server application analysis and reconstruction

Compliance/Audit

Recent events in politics and business have raised awareness surrounding the issues of privacy, fraud, liability, and corporate accountability -- to the point where we have entered an age of increased audit and regulation. The threat is aggressive enforcement and stiff penalties has forced diligent companies to adopt a proactive stance on monitoring their own networks for violations. New legislation such as the Sarbanes-Oxley Act in the USA is requiring corporate offices to vouch for the accuracy of financial records, and to monitor for and disclose instances of fraud. Similar government legislation covering client confidentiality and internal corporate governance procedures are increasing the need to retain and access data for many years.

NIKSUN's powerful surveillance, data warehousing, and data-mining solutions provide the ultimate safety net for ensuring compliance. Throughout the year, analysts can monitor for network activity related to fraud, information leakage, and inappropriate use. NIKSUN's storage, hashed export, and reconstruction capabilities can be applied for data retention and audit evidence. In short, NIKSUN's solutions can provide an early warning against non-compliance, solid proof of compliance during an audit, and data evidence when needed for self-regulated and federally regulated companies.

Data Warehousing and Mining

NIKSUN appliances can capture and warehouse all the data from anywhere on your network. NIKSUN's powerful data mining, replay, reconstruction and forensics capabilities enable you to rapidly analyze the root-cause the first time, eliminating the guesswork.

In addition to in-appliance storage, NIKSUN offers a high-speed unlimited external storage solution that enables you to quickly mine any piece of data from anywhere. By leveraging the latest in storage technologies, NIKSUN optimizes the throughput, capacity and overall performance of the total solution, to ensure the integrity, security, and ready availability of data.

Key Benefits

High-performance, High-bandwidth in Real-time
Secure and Reliable Storage of Data & Incidents
Scalable Modular Design with a Compact Footprint
Unlimited Storage to SAN (plug and grow)
High performance and maximum data availability in SAN and clustered environments
Scalable in multiple dimensions, enabling flexible configuration of capacity, performance and price
Maximum data accessibility and reliability

Expert Analysis

Proactive Real-time and Historical Expert Analysis

NIKSUN's expert analysis tools offer both proactive real-time alerting and historical analysis capabilities to solve network security and performance issues. Key applications include diagnosing causes of performance degradation, benchmarking of interactive applications before deployment, identifying usage violations, agreements/corporate policies and detecting potential intruders or attacks, and many more.

NIKSUN's powerful expert analysis solutions are built on NIKSUN's network data warehousing and mining strengths. The expert solution offers a large number of protocol decodes and advanced drill-down capabilities, which enable rapid root-cause analysis down to the packet level. Presentation reports provide a clear and concise picture of the analysis results to senior management. All the powerful benefits are accessible via an easy-to-use web interface.

Key Benefits

Fault management, policy management, interactive application benchmarking, application analysis, intrusion detection, policy management, etc.
Integrates intelligence into how statistics are viewed
Minimizes costs needed to discover or recover from issues (incidents)
Focuses on isolating and diagnosing chronic issues
Analyzes down to packet level: Integrated with Packet Viewer
Full packet decode allows in-depth analysis at the packet level
Ease-of-use protocol navigation with reporting facilities build-in
Intelligent Xperts locate and diagnose SLA/QoS and security issues
User customizable reports
Integrated trouble-shooting tools including ping, trace-route, etc.
Integrated and scalable for LAN, MAN and WAN platforms

The optional NetRTX and NetXperts modules bring powerful real-time experts to aid network operations and trouble-ticketing personnel to quickly resolve problems; whether at the network or application layers, client or server.

Triage incident handling

Responding to multiple simultaneous incidents can be a lot like managing an emergency room. You have to quickly sort through the flood of incidents and raw data to determine those that are most critical so you can appropriately assign the limited resources for remediation. Having prioritized the tasks, you now need to quickly find the root-cause and fix the problems. NIKSUN's solutions are ideal for this purpose.

Security

NIKSUN's NetDetector solution allows for quick inspection and correlation of anomalies and signatures through its Event Viewer. The summarized overview leads to a quick prioritization of suspicious sessions which can be investigated thoroughly in its reconstruction module. The reconstruction module provides a camcorder view of the incident - playing back all the incidents in their native format or analyzing content for covert channels. Very quickly the culprit is caught whether the intruder activities are crafted to fly under the radar or an insider uses what they thought were evasive tactics!

Performance

NIKSUN's NetVCR solution allows for quick analysis of all network activity. Acting like a hi-resolution VCR or really like a modern DVD player, all incidents are recorded for quick playback and analysis. In addition NetVCR pre-analyzes all sessions for various activities so finding the needle in the haystack becomes an easy task. The intuitive and easy GUI allows mining of the information including high-resolution network bursts using a variety of graphical, tabular and spreadsheet formats leading to root-cause analysis a reality. Additional solution modules for ensuring QoS such as NetSLM and content analysis modules such as NetRTX with seamless integration with management systems makes NetVCR the platform of choice for ensuring network, application and service performance.

Enterprise

NIKSUN's NetTrident 2005 solution provides a revolutionary capability for large scale enterprise deployments. With the ability to "virtualize" NIKSUN information sources, NetTrident 2005 ensures that asymmetric routing, dynamic paths, peering networks, can be as seamlessly analyzed as a single link! NetTrident works with all NIKSUN information sources, including NetVCR and NetDetector as well as with SNMP, RMON and NetFlow sources. NetTrident 2005 for the first time makes it possible to perform triage on a wide scale, and quickly dispatch resources and remediate where needed.

Performance troubleshooting

Another application with a poor response time? Is it a problem with the application or is it a network issue? What resources can be used to troubleshoot the problem?

NIKSUN provides a suite of performance measuring tools that can greatly alleviate your burden and provide 100% real time visibility into the network.

Within minutes and with easy to use web based user-interface, administrators can single out performance issues using the correlative analysis and superb data mining capabilities of NIKSUN NetVCR 2005.

NIKSUN NetSLM and NIKSUN NetReporter, add-on solution modules for NIKSUN NetVCR 2005, provide proactive alerts and highly granular and rich reports on any application and network performance metric such as session, RTT (Round-trip time), server response time, retransmissions, etc.

Key Benefits

100% visibility into your network in real-time
Capture network events the first time
End-to-end proactive network & application performance monitoring and troubleshooting
Superior drill-down forensic analysis
Integrated performance reports on all traffic (NIKSUN NetReporter add-on solution module)
Unlimited storage which you add as you grow
Secure and easy-to-use web interface
Extensive 3rd-party compatibility
All capabilities integrated into a turnkey solution

Multicast Performance Monitoring and Troubleshooting

NetMulticast monitors and troubleshoots multicast traffic on the network's Access, Distribution and Core layers. NetMulticast provides multicast application, traffic and protocol drill-down information for all sources and groups. NetMulticast alerts on utilization levels (including short spikes), retransmits, QoS level, etc. NetMulticast reports enable long-term trending and capacity planning. Optional reachability analysis tools are available for testing end-to-end reachability, path delay analysis, active source/groups, etc.

Key Benefits

Scalable solution module
Proactive alerting, performance monitoring, and troubleshooting capabilities for multicast enabled LAN, MAN, and WAN networks
Extends the capabilities of NIKSUN's proven NetVCR 2005 performance management solution
Real-time alerts on Service Levels (with NIKSUN NetSLM), application utilization, bit rates and so on ...
Trending and capacity planning on longer time scales
Optional active troubleshooting tools are available for Multicast reachability analysis

Optimisation

The complexity of enterprise networks has increased exponentially in recent years. The need to optimize network performance and maximize the return on network infrastructure has never been greater. Network planners require reliable solutions that provide 100% visibility in real-time, into their enterprise network. Ideally the monitoring solutions must be flexible to accommodate differing network topologies at a minimal cost. Also, today optimization of network resources can not ignore the applications themselves. Applications are so tightly coupled with network resources, that optimization solutions require complete network to application views.

NIKSUN provides layer two to layer seven integrated and scalable optimization solution for enterprises, service providers, and telecommunication companies:

NetVCR's vast data storage capability enables network administrators to generate reports and statistics on network or application traffic for the past weeks, months, and even years based on actual traffic data.
NIKSUN's enterprise solution, NetX 2005, allows administrators to aggregate data from across their enterprise and trend, baseline and extrapolate future network and application bandwidth requirements. Administrators can generate a large number of correlated configurable reports.
NIKSUN's integrated solution, NetTrident 2005 , allows a complete virtual real-time view of the network and services and provides 100% real time visibility in the network from a single console. Network planners and engineers can leverage this solution for optimization, troubleshooting, performance monitoring, capacity planning and post event analysis for the complete network from a single platform.

To find out more about Niksun products call Phoenix Datacom on 01296 397711 , send an email or use the Request More Info form.