Toolbox

How to Use Network Behavior Analysis Tools

Network behavior analysis tools can help tune operations as well as improve security. Here are five tips for getting the job done.

By Bob Violino

After tuning the zone behavior policies appropriate to the high-risk zones, "our alarm count was much more manageable and useful," Stewart says. "This information also allows us to properly plan WAN bandwidth growth, as we can determine how much legitimate network traffic is required for business."

5. Use NBA data to help determine network usage patterns.
Stewart says it was important that AirTran managers spend as much time as necessary reviewing the behavior data gathered to appropriately classify zones, zone policies and services.

"We discovered a great deal about ports, protocols and chattiness of third-party applications during this exercise," Stewart says. "Our zones include geographic segregation, allowing both security and networking to quickly review and treat WAN location issues. We defined server zones by behavior, allowing more granular control over alerting."

Also, in using NBA systems, it's important to create focused views and logical groupings within the tool that make sense, says Wasserman. "Strive for ease of use and an easy understanding of common sense nomenclature and device or host groupings," he says. "Limit the number of flows that need to be queried or viewed" in order to get useful network information on a more timely basis.

That way, NBA can provide not only greater network visibility, but an effective way to deal with trouble when it arises.

Other stories by Bob Violino

• Email
• Print
• Comments
• Digg This
• SlashDot

• How to Tell If You Have Bots
• The Global State of Information Security 2008
• Network Security: The Basics
• Algorithms to Calculate Unusual Behavior