Undetected for 10 months, the attacker extracted approximately 500 megabytes of data from 23 files, two of which contained information on the International Traffic in Arms Regulations related to the Mars Science Laboratory mission.

JPL uses its Information Technology Security Database (ITSDB) to track and manage physical assets and applications on its network; however, in this instance, a Raspberry Pi was attached to the network without the required OCIO review and approval. It seems somewhat ironic that an organization working with some of the world's most advanced technologies was thwarted by simple, credit-card-sized consumer hardware.

Simple technology can have a powerful impact when used incorrectly.

This event illustrates one of the ways an attacker and a security threat can go undetected—patience. It also underscores the need to capture connectivity and communication information for every single device, not just a select few. Moving 500 megabytes over 10 months certainly won't result in a device appearing in a Top-N report. But the fact remains that the same technology used for over two decades to produce Top-N reports has the potential to tell you:
• You have an unauthorized device on your network
• Where the device is connected
• Who you are communicating with

What is this technology? Flow data. That's right, our tried-and-true friend that's been around since Cisco introduced NetFlow in 1996. But wait, you might be saying that flow data is used for "counts and quantities" for my core conversations and protocols, not for providing detailed connectivity and communication information for negligible amounts of traffic.

viavi-grafico-1-wWhile this may have been true in the past, like many technologies, stream data has evolved as a data source and can now serve as a foundation for providing much more, including threat and security information. For example, stream logs can be augmented to include MAC addresses and physical connectivity information.

With the right techniques for collecting, storing, reporting, and visualizing data, flow data can be used to show you all the conversations that every device is carrying out on your network, even if it's a small device that generates a small amount of traffic.viavi-grafico-2-w

The key is to enrich this dataset, not to delete and summarize it until all its forensic value is lost.
Simple technology can have a powerful impact when used correctly.
If you're only using stream data for Top-N reports and expecting this to help you uncover suspicious or malicious behavior, this is not a sound approach.