fbpx

The Importance of Network Traffic Analysis in Threat Detection and Response Programs

Details
Category: Cybersecurity PRISM
Network Traffic Analysis is a critical piece of modern threat detection and response practices because many operational and security issues can be investigated by implementing NTA at both the network edge and the network core. With a traffic analysis tool, you can spot things like large downloads, streaming, or suspicious inbound or outbound traffic.
 
 
 
 
NTA also provides an organization with more visibility into threats on their networks, beyond the endpoint. With the rise in mobile devices, IoT devices, smart TV’s, etc., you need something with more intelligence than just the logs from firewalls. Firewall logs are also problematic when a network is under attack. You may find that they are inaccessible due to resource load on the firewall or that they’ve been overwritten (or sometimes even modified by hackers), resulting in the loss of vital forensic information.
 
Use cases for analyzing and monitoring network traffic include:
  • Detection of ransomware activity
  • Monitoring data exfiltration/internet activity
  • Monitor access to files on file servers or MSSQL databases
  • Track a user’s activity on the network, though User Forensics reporting
  • Provide an inventory of what devices, servers and services are running on the network
  • Highlight and identity root cause of bandwidth peaks on the network

 

This Article Was Written & published by Meena R,  Senior Manager - IT, at Luminis Consulting Services Pvt. Ltd, India. 

Over the past 16 years, Meena has built a following of IT professionals, particularly in Cybersecurity, Cisco Technologies, and Networking...

She is so obsessed with Cybersecurity domain that she is going out of her way and sharing hugely valuable posts and writings about Cybersecurity on website, and social media platforms. 

34,000+ professionals are following her on Facebook and mesmerized by the quality of content of her posts on Facebook. 

If you haven't yet been touched by her enthusiastic work of sharing quality info about Cybersecurity, then you can follow her on Facebook:

Click Here to follow her: Cybersecurity PRISM