When it comes to business security, network data is the best source

MANILA, Philippines —The Philippines experienced two major cybersecurity breaches in the past 60 days.

One involved the exposure of customer information of a big membership shopping club; the other happened a few days ago when a number of customers in one of the biggest banks in the country reported missing money in their bank accounts.

We are entering a new era where majority of transactions are happening digitally, and it is not money, but trust, that is the most valuable currency. Unfortunately, a number of companies have to learn this the hard way.

Since most transactions happen in the digital world, it is also the place where threat actors, both known and unknown to companies, thrive and persist to catch their payload. It is an inconvenient truth that companies are simply either aware or not that they are breached, or not. It is just a matter of the extent of breach that differs, and a matter of time until the adverse effects are tangibly realized.

It is the IT departments who bear the most burden in this challenge, as they have now shifted mandates from traditional provisioners of computer equipment to being business enablers.

IT organizations have to do the delicate juggle of enabling company growth and optimizing costs, all while keeping business and customer information secure. Security of these information assets is no longer an afterthought but is now a fundamental building block to ensure trust and confidence in the business.

Traditionally, IT organizations would deploy endpoint solutions to protect workstations and servers, places where attackers are expected to exploit the most. To complement this, perimeter solutions are deployed to define a protected area for the IT network.

Unfortunately, as they serve as a gate to the network, there are still malicious transactions that can pass through the gate checks. Recently, there is an emergence of a new method of gaining insights about the data passing across the different nodes in the IT infrastructure, and that is through network visibility.

What is network visibility?

Network visibility refers to the ability (facilitated by a specialized network tool) to understand the structure of network traffic in such a way that enables network admins to see bottlenecks, sources of degradation, or the activity of network-borne threats.

The last item, in particular, has been gaining in importance recently. The rising incidences of active attacks designed to explore and exploit vulnerabilities in a company’s IT network, have demonstrated the dire need to complement traditional security solutions with another layer of protection that covers a gap between the perimeter and endpoints and uses behavior analysis, rather than signatures, to detect malicious activity.

Detect and respond

This approach to detecting anomalies in network traffic with the goal of exposing threat activity on the network is called Network Detection and Response (, or NDR). The term is related to a shift from the traditional prevent and protect mindset to detect and respond, which focuses on hunting down those threats that fly under the radar of traditional security tools.

NDR is of particular relevance under the new norm; the expansion of company infrastructures beyond company premises has increased the attack surface considerably. While best security practices still need to be observed, you cannot always count on known signatures to detect an incoming attack. In such a reality, security solutions based on behavioral analysis become a necessity.

NDR solutions used to be the domain of big companies, due to the considerable budgetary demands of these tools. But now the market is becoming much more accessible to small and medium businesses as well.

Kemp Flowmon is one such solution. It analyzes network telemetry and provides insights about network issues as well as the activity of threat actors. Detected security events are then visualized and provide context-rich detail to facilitate accurate situational awareness and enable direct response.

Kemp Flowmon fits the company security ecosystem seamlessly and offers integration options with other tools such as SIEMs or firewalls for automated inline blocking. Its AI-driven detection engine is among the most powerful on the market and capable of picking up anomalies in both normal and encrypted traffic, yet the solution is lightweight and flexible enough to be available to businesses of any size and structure.

The trait of scalability is key here because the target base of cyberattacks is increasing. You no longer need to be big or vulnerable to attract a breach. As long as you are in the cyber space, you are already a potential target.

Do not wait for your breach

Kemp currently offers a free network assessment during which an expert network engineer deploys the solution and assesses it for operational and security issues for no cost at all.

Have your network assessed and be able to know what is happening in your network before the threats disrupt your business.