SOT

SOT

SOAR
Security Orchestration, Automation and Response

Automation of response to information security incidents using dynamic playbooks and information security tools, building an attack chain and with an object-oriented approach

NG SOAR
Next Generation SOAR

Automation of response to information security incidents with built-in basic correlation (SIEM), vulnerability Scanner (VS), collection of raw events directly from information security tools, dynamic playbooks, building an attack chain and an object-oriented approach. AM and VM are included

AM
Asset Management

Description of the IT landscape, detection of new objects on the network, categorization of assets, inventory, life cycle management of equipment and software on automated workstations and servers of organizations

VS
Vulnerability Scanner

Scanning information assets with enrichment from any external services (additional scanners, The Data Security Threats Database and other analytical databases) to analyze the security of the infrastructure.

VM
Vulnerability Management

Building a process for detecting and eliminating technical vulnerabilities, collecting information from existing security scanners, update management platforms, expert external services and other solutions

FinCERT
Financial Computer Emergency Response Team

Bilateral interaction with the Central Bank, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

GovCERT
Government Computer Emergency Response Team

Bilateral interaction with the state coordination center for computer incidents, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

Mail us to sales@securityvision.ru or get demo presentation

Why and how to build data networks

Why and how to build data networks
16.10.2023


|   Listen on Mave  |   Listen on Yandex Music  |  


Ruslan Rakhmetov, Security Vision


Constant data transfer from one place to another is the key to stability of people's lives and business functioning. With the help of a network you are reading this article, you can congratulate a person from another city or country on a holiday, and if you are in orbit inside a space station, you can contact your team and relatives. In this article we will talk about different approaches to creating Wide Area Networks ( WAN) and discuss the differences between such networks and Local Area Networks ( LAN).


To begin with, it is important to say that the main difference is the scale of the networks:


- A LAN is designed to connect devices within a single location and serves typically tens, hundreds, or sometimes thousands of devices. This could be a network of a smart kettle, an outlet, a TV or speaker with Alice, as well as other devices in your smart home. LAN technologies are often used to build connections in computer clubs (remember those?), university dormitories and sometimes even entire LCDs where there is a common local area network for file sharing. Of course, the individual company offices inside also ensure that their devices are linked into a single LAN.


- A WAN is already designed to connect many LANs and provide service to millions of devices. Such networks often cover large geographical distances and can connect computers and other devices that are thousands of kilometres apart. The global Internet is designed in this way.


Both types of networks allow the transmission of data from one point to another, but because of differences in scale and geography, they use different technologies and approaches to do so and have different properties, which are discussed below.


- Latency (signal delay) in LANs is less than in WANs.

Data transmission sometimes seems instantaneous, sometimes it takes forever. The greater the distances between metro stations, cities and countries, the longer it takes to get from one place to another - all logical not only for travelling, but also for data exchange on both types of networks. The speed of traffic and the delay between sending a signal and receiving a response sometimes determine not only the convenience of communication or the stability of an application, but also profit. So, for example, when trading on the stock exchange, receiving responses from traders a fraction of a second faster than competitors, you can build an entire business, as in the film ‘Operation Kolibri’ 2018.


- The cost of data transmission and infrastructure building for localised networks is also lower than for wide area networks.


This is due to the ease of maintenance and use of local equipment. For example, LAN networks are often budgeted on a CAPEX model, while for WANs of a particularly wide geography, OPEX costs (ISP fees and associated maintenance costs) are likely to be additionally applicable, in addition to significant investments in the equipment itself.


- Network security is organised differently: physically securing a LAN network within the premises is certainly easier than WAN cables that stretch across the country and are not monitored 24x7. Despite this, an attacker, when gaining access to one point in the local infrastructure, can connect to everything else fairly quickly. He can use the simple password from your home Wi-Fi router and then not only go online (to watch a YouTube video), but also change the router's settings, connect to unprotected smart home devices, enter a unified network with personal computers, etc.


Despite the scale of a LAN network and the apparent simplicity of its protection, failure to follow basic cyber hygiene rules can make a LAN less secure. WAN networks, on the other hand, allow you to organise security for web applications and protection against DDoS attacks, because filtering data on central corners around the world is more effective than on each site individually, as we have already discussed here and here.


- The proprietary nature and organisation of the two types of networks is also different. LANs are usually not just geographically confined to a single room or building, but are maintained by one person, while WANs usually require the involvement of not only a technical administrator, but also an architect, an analyst, a communications service provider and are generally more complex.


The proprietary nature of the two networks can be compared with operating systems for smartphones:


Apple offers the use of iPhones and independently maintains a single operating system used only on these devices. The result is a smooth, well-organised system operation that is impossible to apply to devices outside the Apple ecosystem. The high proprietary nature of the technology makes it easier to use, but more difficult to customise and modify.


On the other hand, there are Microsoft or Google vendors, whose operating systems are supported by almost all manufacturers, used on devices of various kinds, from smart watches and TVs to smartphones, ATMs and computers. It's easier to add custom functionality to these vendors' systems, and sometimes it's even possible to use open source code and create your own system. The result is greater flexibility at the expense of less proprietary features.


In this comparison, LANs are more like iOS and WANs are more like Android (not the most accurate comparison, but close enough): a single provider and simplicity on the one hand and adaptability and the ability to combine anything into a single network on the other.


- Technologies and organisation of communication for LAN-networks are faster and more reliable. These are usually Ethernet, Wi-Fi and gigabit switches. WANs often require the use of different technologies and protocols to enable long distance data transfer. This can include the use of the Internet, MPLS (MultiProtocol Label Switching), cellular networks and other technologies.


Compare these approaches to electromagnetic waves: a single radio or television tower can broadcast to an entire city and transmit music and video through walls, buildings and small barriers. Bluetooth technology also transmits data wirelessly, but works better and faster within a short distance.


LAN and WAN networks, of course, differ from each other in terms of data rate and signal delay, security and cost of use, but they are not competitors. Each network has its own challenges. The use of both technologies is usually possible in companies with several offices or to organise uninterrupted video communication over the Internet. LANs typically focus on services such as large file sharing, printing, videoconferencing and shared document storage in a single location, while WANs provide the ability to connect multiple LANs and scale services over long distances, including remote access, cloud computing, global Internet sharing and more

Recommended

XDR - eXtended Detection and Response
XDR - eXtended Detection and Response
Gamification and human resource management
Gamification and human resource management
SSDL: Know your opensource vendor by sight and more
SSDL: Know your opensource vendor by sight and more
Webinars on object, menu and role builders on the Security Vision platform
Webinars on object, menu and role builders on the Security Vision platform
Security automation with the MITRE matrix variety
Security automation with the MITRE matrix variety
Information security terms and definitions
Information security terms and definitions
IRP/SOAR by law. GIS, PDN, GOST project
IRP/SOAR by law. GIS, PDN, GOST project
What Kerberos authentication is, what NTLM is and how they work
What Kerberos authentication is, what NTLM is and how they work
Review of the publication NIST SP 800-161 Rev. 1 (Draft) "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations"
Review of the publication NIST SP 800-161 Rev. 1 (Draft) "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations"
Measuring the effectiveness of cybersecurity processes. IS metrics. Part 2
Measuring the effectiveness of cybersecurity processes. IS metrics. Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
Principles of information security
Principles of information security

Recommended

XDR - eXtended Detection and Response
XDR - eXtended Detection and Response
Gamification and human resource management
Gamification and human resource management
SSDL: Know your opensource vendor by sight and more
SSDL: Know your opensource vendor by sight and more
Webinars on object, menu and role builders on the Security Vision platform
Webinars on object, menu and role builders on the Security Vision platform
Security automation with the MITRE matrix variety
Security automation with the MITRE matrix variety
Information security terms and definitions
Information security terms and definitions
IRP/SOAR by law. GIS, PDN, GOST project
IRP/SOAR by law. GIS, PDN, GOST project
What Kerberos authentication is, what NTLM is and how they work
What Kerberos authentication is, what NTLM is and how they work
Review of the publication NIST SP 800-161 Rev. 1 (Draft) "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations"
Review of the publication NIST SP 800-161 Rev. 1 (Draft) "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations"
Measuring the effectiveness of cybersecurity processes. IS metrics. Part 2
Measuring the effectiveness of cybersecurity processes. IS metrics. Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #3 ‘Align your SOC structure to your company's needs’. Part 2
Principles of information security
Principles of information security

Other articles

Biometric personal data, changes in regulation of its processing and market impact
Biometric personal data, changes in regulation of its processing and market impact
How the technical side of data leakage protection is organised
How the technical side of data leakage protection is organised
FSTEC Threat Model
FSTEC Threat Model
DLP systems (Data Loss Prevention, DLP) - what it is
DLP systems (Data Loss Prevention, DLP) - what it is
Information security terms and definitions
Information security terms and definitions
Information security tools overview: endpoint protection
Information security tools overview: endpoint protection
Asset Management and Inventory module on the Security Vision platform: even more possibilities
Asset Management and Inventory module on the Security Vision platform: even more possibilities
Penetration testing
Penetration testing
MITRE publication ‘11 World-Class SOC Centre Strategies’. Strategy #8 ‘Use automation tools to support the work of SOC analysts’
MITRE publication ‘11 World-Class SOC Centre Strategies’. Strategy #8 ‘Use automation tools to support the work of SOC analysts’

Other articles

Biometric personal data, changes in regulation of its processing and market impact
Biometric personal data, changes in regulation of its processing and market impact
How the technical side of data leakage protection is organised
How the technical side of data leakage protection is organised
FSTEC Threat Model
FSTEC Threat Model
DLP systems (Data Loss Prevention, DLP) - what it is
DLP systems (Data Loss Prevention, DLP) - what it is
Information security terms and definitions
Information security terms and definitions
Information security tools overview: endpoint protection
Information security tools overview: endpoint protection
Asset Management and Inventory module on the Security Vision platform: even more possibilities
Asset Management and Inventory module on the Security Vision platform: even more possibilities
Penetration testing
Penetration testing
MITRE publication ‘11 World-Class SOC Centre Strategies’. Strategy #8 ‘Use automation tools to support the work of SOC analysts’
MITRE publication ‘11 World-Class SOC Centre Strategies’. Strategy #8 ‘Use automation tools to support the work of SOC analysts’