Tag: Network Monitoring

Endace and Cisco in the SoC at RSAC™ 2025

Original Entry by : Endace

Endace and Cisco® are co-sponsors of the SOC at RSAC™ 2025: providing SOC services for the conference, and monitoring traffic on the Moscone wireless network for security threats.

Experts in the SOC will be running Cisco Security Cloud, with Cisco Breach Protection Suite, Cisco User Protection Suite, and Cisco Secure Firewall; with Splunk Enterprise Security as the SIEM platform. EndaceProbe will provide always-on packet capture, recording network traffic in real-time.

As a long-time member of the Cisco Security Technical Alliance, our EndaceProbe Analytics Platform integrates with Cisco Firewall, XDR, Secure Network Analytics and Splunk.

Book a Tour of the SoC at RSAC™ 2025

Tours are offered Tuesday, Wednesday and Thursday at the times listed below and advance registration is highly recommended.  An Expo Pass is all you need to join the tour.

Tour Times:

Tuesday, April 29 – 10:10am, 3:00pm and 4:30pm

Wednesday, April 30 – 10:10am, 3:00pm and 5:00pm

Thursday, May 1 – 10:10am and 1:00pm

Book a SoC Tour

Visit Endace’s Booth at RSAC™ 2025

In addition to being in the SoC, the Endace team is also exhibiting at RSAC™ 2025. Come and see us at Booth #5176, located in the North Hall.

We will be showcasing our highly-scalable, always-on packet capture solutions for private cloud, public cloud and on-prem environments. Come and find out about:

  • The value of Always-on packet capture as a definitive source of evidence
  • Why packets are a such a critical source of truth for cybersecurity and network reliability
  • How to integrate definitive packet-level network history into your SoC and NoC teams’ network security tools for faster, more accurate incident forensics.

Apple Airpods MaxPLUS

Enter our booth raffle and you could win a pair of Apple Airpods Max headphones (two pairs to be won).

 

Don’t miss PROTECTED:
The Findings Report from the SOC at RSAC™ 2025.

If you have a full Conference Pass, we encourage you to join Cary Wright, Endace VP Product, Jessica Oppenheimer, Cisco’s Director of Security Operations, and Steve Fink, CTO and CISO at Secure Yeti, as they share security observations from the SoC at RSAC™ 2025.

Every year, this is an extremely popular conference session.

Why everyone should care about FIPS 140, NIAP NDcPP, and DoDIN APL.

Original Entry by : Cary Wright

By Cary Wright, VP Product Management, Endace

Cary Wright, VP Product Management, Endace

Weak security plagues far too many of the IT products we use today. The problem is, there is no unified mandate to compel vendors to invest in security hardening their products. Vendors are free to choose how heavily to invest in security. So it’s no surprise that many vendors don’t invest heavily enough in thoroughly security hardening their products.
 
However, in many industries – such as Government, defense or critical infrastructure – the potential impact of a security vulnerability in a product is just too serious for organizations to leave it to vendors to decide how to secure their products. For this reason, organizations in many of these industries mandate that vendors must submit their products to rigorous testing and certification processes to ensure the security of their products is iron clad.
 
At Endace we found out first-hand how difficult and rigorous these standards are to comply with. The effort took us the better part of a year and significant investment in software development, testing and validation, and certification. Armor plated security is a good way to describe what these standards require. Our recent OSm 7.2.1 release includes everything we had to do to comply with these standards.
 
The good news for customers – regardless of the industry you are in – is that this rigorous testing and validation process doesn’t just benefit Government, Defense and critical infrastructure organizations. Any organization that adopts products that have passed these certification processes can be confident those products have been independently evaluated to minimize the risk of security vulnerabilities and are fit-for-purpose for deployment in high-security environments.
 
By selecting a product with DoD level security compliance you reap the benefit of millions of dollars of investment in security testing and hardening that goes way beyond standard penetration tests and security scans. The testing process for each of these certifications involves delving deep into the product – comprehensive testing, source code reviews, and independent validation that the security controls of the product are robust and well designed.
 
 

What are these standards, and what do they test?

Complying with FIPS 140-3 is the fundamental first step in certification. FIPS mandates that products must use robust and secure encryption. This is not a bolt-on. Products must implement a validated cryptography module as a central software pillar to ensure all encrypted communications meet the NIST standard for strong cryptography, including HTTPS, SSL, and SSH.
 
Just including encrypted HDDs in a system – as some vendors do to claim compliance with FIPS – is not sufficient. Every communication to and from the system must be secured with FIPS validated cryptography before the system can be FIPS certified. Independent testing confirms that products comply with the FIPS standards.
 
NIAP NDcPP 2.2e, also known as Common Criteria, is an international standard agreed by 18 nations. It builds on FIPS to define security requirements that are expected to be implemented by all network devices. It goes extremely deep to validate a product has robust security. By deep, I mean months of extensive testing, inspection, and independent code reviews, conducted and signed off by government signatories who are usually security experts in defense departments.
 
DoDIN APL stands for the US Department of Defense Information Network Approved Products List. With FIPS and NIAP certification in hand and a US DoD sponsor, a vendor’s final step is undergo product testing by a US DoD lab against DoD cybersecurity requirements. Being listed on the APL is the last big stage of a long and intensive project but it’s not the end of the story. Ongoing maintenance and revalidation ensures that a product remains secure throughout its life.

OSm 7.2.1 is released and available for download.

I am very proud of the team at Endace for having delivered a huge release with OSm 7.2.1 . This release has focused on meeting all the requirements for these intensive – but extremely valuable – security standards. And I am glad to say that every Endace customer will benefit from this huge investment in product security hardening.

Endace Packet Forensics Files: Episode #51

Original Entry by : Michael Morris

In this episode, Michael talks to Eric Buchaus, Director of Sales at Niagara Networks

By Michael Morris, Director of Global Business Development, Endace

Michael Morris, Director of Global Business Development, Endace

Are SPAN ports sufficient to provide network traffic visibility for high-quality security (NDR) and network (NPM) investigations? What about cloud workloads?  What do you need to gain insights into cloud network activity?

In this episode of the Endace Packet Forensic Files, I talk with Eric Buchaus, Director of Sales at Niagara Networks. Eric outlines potential pitfalls and challenges associated with SPAN ports and highlights situations where they may fall short for network and security analysts.

Eric walks us through some alternative options, discussing the merits of network TAPS, network packet brokers, and in-line bypass solutions which can offer NoC / SoC teams more reliable, efficient, and scalable ways to get network packet data to the right tools in large-scale and complex environments.  He discusses some of the specific challenges of network visibility in cloud infrastructures and suggests some practical ways to overcome these obstacles.

Eric suggests things organizations should consider when exploring different packet brokers or TAP vendors and outlines the management and scrutiny that needs to be applied to encrypted traffic to achieve in-depth visibility securely.

Finally, Eric talks about how TAPs and packet brokers can help in dynamic SDN environments with high traffic volumes. He emphasizes why they are important for organizations looking to implement zero-trust infrastructures – particularly environments with many walled gardens and lots of VLANs for IOT/IOTM devices and technologies.

Don’t miss this informative episode as Eric demystifies the complexities of network visibility and supplies some valuable guidance for navigating the challenges posed by evolving network landscapes.

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.

Combining Endace and Elastic delivers detailed visibility into real-time and historical network activity

Original Entry by : Cary Wright

By Cary Wright, VP Product Management, Endace

Cary Wright, VP Product Management, Endace

We’re pleased to announce our newest technical partnership with leading SIEM and observability platform provider, Elastic. By combining together EndaceProbe™ always-on Hybrid Cloud packet capture, Elastic™ Stack and Elastic™ Security, we’re providing the packet-level network visibility and detailed network metadata that Security and IT teams need when responding to security threats and network or application performance issues.

How Do We Work Together?

By combining Endace and Elastic Stack, organizations gain accurate, highly detailed visibility into both real-time and historical network activity. Security and IT analysts can search network metadata in Elastic, and quickly pivot to full packet data for forensic investigations when they need to. The result is faster, more accurate incident investigation and resolution. The combination of Elastic Stack and EndaceProbe gives cybersecurity and IT teams the ability to see exactly what’s happening on their network in real-time. EndaceProbes can record weeks or months of full packet capture across hybrid cloud networks to provide a complete and accurate record of all network activity. The detailed full packet capture data recorded by EndaceProbes is a perfect complement to the rich logs and metadata collected by Elastic Stack. When analysts need to go back-in-time to investigate any incident they have a complete record of that activity at their fingertips. Beyond this, the ability to pivot from anomalies or security alerts directly to forensic examination of packet-level data lets analysts see exactly what’s happening. They can quickly respond to incidents and dramatically mitigate threat risk to their organizations.

EndaceFlow and Elastic Stack

In addition, EndaceProbe appliances can host EndaceFlow™, which generates extremely high-fidelity NetFlow data at full line rate. This NetFlow data can be ingested by Elastic Stack to provide detailed metadata for monitoring the security and performance of the network and interrogating network activity. Pre-built integration between EndaceProbes and Elastic Stack enables streamlined investigation workflows. Analysts can click on alerts in the Elastic UI to go directly to the related full packet data recorded by EndaceProbe. Analysts can quickly view traffic right down to individual packet level to see precisely what occurred before, during and after any event, with absolute certainty.

For more information about our Fusion Partner integrations, please visit www.endace.com/fusion-partners.

To see a demonstration of this Elastic Security integration in action please visit the Elastic partner page at https://www.endace.com/elastic-security.

Introducing EndaceProbe Cloud

Original Entry by : Cary Wright

Scalable Packet Capture for Hybrid Cloud

By Cary Wright, VP Product Management, Endace

Cary Wright, VP Product Management, Endace

The rapid growth of cloud vulnerabilities, hijacked cloud credentials, APTs targeting cloud, and lack of network layer visibility in cloud has made one thing clear: recorded network packet data is just as essential in the cloud as it is in physical networks. 

Enterprises know the value of our packet capture solutions, and they have told us they need the power of packets in the cloud as well. In many cases, they have moved – or plan to move – workloads to the cloud but have been hampered by an inability to gain the same visibility into activity in their public cloud infrastructure as they are used to relying on in on-premise environments.

Leveraging our 20-plus years of experience in delivering accurate, reliable packet capture for some of the world’s largest organizations, Endace developed EndaceProbe Cloud as the first truly scalable, enterprise-class solution for providing always-on packet capture in public cloud environments.

Unlike many solutions on the market, we’ve done it in a way that scales easily and delivers truly unified visibility that lets security, network and IT teams analyze packet data from across hybrid cloud and multi-cloud environments quickly and easily from a central console. 

EndaceProbe Cloud delivers packet-level visibility for public cloud that is critical for threat hunting, incident response and performance management in those environments. It operates seamlessly with EndaceProbe hardware appliances to deliver always-on packet capture across on-premise, private and public cloud infrastructure, to provide unified visibility across the entire network.

See it in Action

The demo below shows how easy it is to quickly search for packet data across a multi-cloud – AWS and Azure – environment, recreate files from packet data and drill-in to analyze the full packets. All from a single console.

EndaceProbe Cloud is a full-featured EndaceProbe, purpose-built for deployment in AWS and Microsoft Azure environments that provides the following benefits to customers in cloud and hybrid cloud environments:  

    • Continuous, zero-loss, packet capture in public and hybrid cloud environments that provides weeks or months of visibility 
    • A unified console for fast global search and analysis across on-premise, private and public cloud environments.  
    • Full visibility into North-South and East-West traffic 
    • Secure packet storage within the customers’ own virtual network or virtual private cloud (VPC). 
    • Powerful traffic analysis and investigation tools including file extraction, log generation, and hosted Wireshark™ 
    • Seamless workflow integration with an open API and strong ecosystem of third-party network and security tools (https://www.endace.com/fusion-partners) 
    • Subscription-based pricing that offers flexibility and scalability  

EndaceProbe Cloud complements Endace’s hardware appliances to provide unified and seamless visibility across the entire network.

 

Data Sheet
Learn More
 

Network (In)Visibility Leads to IT Blame Game

Original Entry by : Mike Heumann

Significant changes in the structure and use of IT, including such seismic trends as Bring Your Own Device (BYOD), virtualization and cloud computing, have introduced new challenges to IT administrators and staff. Added layers of complexity require new skill sets and knowledge bases as well as tools to effectively run a modern enterprise network. This raises a few questions about how IT teams are coping with the changes.

Continue reading “Network (In)Visibility Leads to IT Blame Game”

Make Sure March Madness Doesn’t Live Up to its Name

Original Entry by : Mike Heumann

Last month, we talked about how to keep the Winter Olympics from clogging up your networks as employees raced to stream live events during the workday.  Well, in the U.S., today and tomorrow are two of the biggest sports streaming days of the year.  Although we’ve already seen some play-in games this week, when Ohio State and Dayton tip-off this afternoon in the NCAA Men’s Basketball Tournament, the annual “madness” repeats itself all over again. This is because this next slate of games will run almost continually over the coming 36 hours, mostly during regular business hours.  And let’s be honest, most of us want to sneak a peek at the scores and witness some of the thrilling upsets that happen every year.

Continue reading “Make Sure March Madness Doesn’t Live Up to its Name”

Application Delivery – Mean Time To Innocence

Original Entry by : Sri Sundaralingam

In the world of application delivery and performance management, it’s not easy on the applications or networking operations side to troubleshoot and resolve end-to-end issues. I‘m sure you have heard of Mean Time To Resolution (MTTR); frequently used for measuring how long it takes to resolve a particular problem from the time a trouble ticket is open to when the problem is resolved (i.e. when the ticket is closed). Have you heard of Mean Time To Innocence (MTTI), which is basically the metric for how long it takes to prove the issue wasn’t your responsibility?

Continue reading “Application Delivery – Mean Time To Innocence”