NashTech builds a Protocol Surveillance tool to enhance network security

NashTech builds a protocol surveillance tool to enhance network security

Industry

Technology

Introduction

We built a Protocol Surveillance tool to enhance network security. Discover how we reduced their Mean Time to Detect & Resolve breaches. 

About our client

Our partner organisation is a mid-size cybersecurity organisation headquartered in the US. The firm specialises in network traffic analysis and its products help clients to have a secure experience over their networks by detecting and preventing malicious activity & security threats. It taps into the power of Machine Learning and Threat Intelligence to analyse millions of exchanges on networks and is amongst the top 10 for its robust security solutions.

Impact

• Enhanced network visibility: System administrators could now track and analyse network activity of the devices present on the network.
• Reduced MTTD: Significant reduction in Mean Time to Detect (MTTD) and Mean Time to Resolve (MTTR) of potential threats
• Timely Prevention: Better prevention mechanism of malicious activities

The challenge

Our partner organisation wanted to enhance its network monitoring solutions with a protocol surveillance tool. System administrators were trying to find a solution so that they didn’t have to manually extract and analyse activity log files generated by these protocols on the server.

Monitoring the running activities of the protocols

• The Active Directory does not make available the file location of the logs in the local file system which poses a technical challenge to access these logs.
• When Apache Kafka was used on the Windows server, it was found to be incompatible with the Rust programming language and was unable to produce logs on the message queue.
• There were unavoidable roadblocks while compression of logs before they could be produced on Kafka topic.

Why network monitoring?

In today’s world where everything is happening digitally, an unreliable network can literally bring a business to a standstill. For maintaining a healthy data center, network monitoring solutions are important so that companies can have better management and control over their networks.

These solutions can give companies the flexibility to keep track of and analyse their networks for troubleshooting & detecting any mistrustful activities in real-time.

Solution

The solution came in the form of Prolance, a protocol surveillance tool that NashTech built on the Rust programming language. Let’s understand what this project enabled:

1. Monitoring the running activities of the protocols

Prolance was built to monitor the activities of the following network protocols:

• Dynamic Host Configuration Protocol (DHCP) – This is a network management protocol that can dynamically assign IP addresses to client devices.

• Active Directory (AD) – This is a Microsoft technology that allows network administrators to generate & manage domains, users, and objects along with their permissions and access control within a network.
• Prolance automated the extraction and analysis of the DHCP audit logs which monitor the network devices and prove to be an invaluable diagnostic tool when security is compromised over the network. Similarly, AD logs provide an insight into possible abuse of access rights & privileges.

2. Filtering out the logs as per monitoring requirements

Once we started processing these logs, we had two scenarios – either the user requires raw logs of the protocol or logs can be filtered as per the monitoring requirements. Take, for instance, the scenario where the user is interested in obtaining only the IP addresses and the device name from thousands of DHCP logs. Filtration will be required so that only the relevant pieces of information (like Discovery, Offer Request & Acknowledge phases) are extracted as per user requirements.

3. Continuous streaming of the logs onto the Kafka Topic after compression

Whether the logs are filtered or used raw, they go through the process of compression before being produced onto the Kafka topic. Apache Kafka has been used here for message queuing which lets you scale your processing. This happens as Kafka enables you to divide the processing over multiple consumer instances. We used the gzip compression technique and enabled the user to schedule this process as per requirement

The outcome 

1. Enhanced network visibility as system administrators could now track and analyse network activity of the devices present on the network.
2. Timely prevention of potential harm to the network as Prolance allowed keeping a check on malicious logins on workstations or illegitimate software installations/data transfers.
3. Significant reduction in the Mean Time to Detect (MTTD) and Mean Time to Resolve (MTTR) as security teams were able to respond faster to security breaches