Traffic Analysis

Actively Monitoring Network Traffic

In cybersecurity, the attacker has the advantage

Hackers are growing more sophisticated and are frequently finding ways to penetrate or circumvent firewalls

As part of the defense-in-depth security strategy, ProStratus is not content to assume that firewall protections are enough to thwart attackers. We recognize that hackers are growing more sophisticated and are frequently finding ways to penetrate or circumvent firewalls to find their way past the network defenses of outer boundaries.

We understand that in cybersecurity, the attacker has the advantage and only has to be successful once in order to cripple your organization. That is why we use traffic analysis as a part of our layered defense.

By establishing baselines of behavior and configuring settings for acceptable levels of traffic, ProStratus is able to develop alerts and deploy monitors that will tip us off when something within your network does not seem normal.

What is traffic analysis?

ProStratus will monitor the amount and type of traffic on your network. This includes activity like emails, file transfers and downloads. Both internal and external traffic is logged and monitored so that we can review it while establishing a baseline of normal behavior.

Once that is established, we can set parameters in consultation with you, to determine what would be alarming behavior. Do you not have anyone in the office on the weekends? We can establish alerts that would tell us if someone was moving a lot of files off of the network during downtime.

Why is it important?

Unusual traffic, whether it be traffic through ports that are normally not used or increases in traffic at times when users are not logged in, are key indicators of an attacker’s presence on your network.

Threat actors do not just steal data. They also hack in to networks to install software so that bandwidth and other network resources can be used to mine cryptocurrency. This is extremely costly for organizations and can often go unnoticed if network traffic is ignored.

How does analyzing traffic make my network more secure?

By alerting ProStratus of unusual traffic, we can investigate it and figure out the source of the traffic. It is very possible that the unusual traffic is a user doing something that are authorized to do in a different way. But we would rather verify that information than assume that all traffic is legitimate.