Solved

Monitoring and Identifying Data Leaving the Newtork

Posted on 2016-10-14
3
104 Views
Last Modified: 2016-11-24
Thinking specifically about an attack on our network, how could we monitor or what tools are out there for preventing data theft from our network?  I'm talking about suddenly a large amount of data leaving our network which may be as a result of a compromise.  Is there anything that could identify this?

We do use LANGaurdian here and there which has a quota function I believe but I'm not sure if this is for users.  I.e. it alerts when a user exceeds their daily quota, not necessarily when an unknown or external user is shifting vast amount of data from a file server.
0
Comment
Question by:jdc1944
3 Comments
 
LVL 6

Expert Comment

by:Niten Kumar
ID: 41843399
Try PRTG's free network sniffer
1
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 41843475
The issue is, you need to be context aware, and data doesn't have to leave all at once, it can be siphoned slowly which is actually how a lot of the elite groups do their exfiltration. You need to look into DLP technology, and into securing data that is vital. The first step is to ID your data, you can do that with DLP trials, where they sniff and scan for data they typically flag on (SSN, CC, DoB, PII) or you specify your own search terms. Second, securing that data, make sure there are ACL's and controls in place to prevent just anyone getting the data. Only allow those with the need to access the data, Then you can go into a full fledged DLP where it can try to stop or at least alert on the possible exfil of data. It can be quota based by the way. Have a look at the Gartner DLP Quadrant, I like ForcePpoint
https://digitalguardian.com/sites/default/files/2016-gartner-magic-quadrant-for-enterprise-data-loss-prevention-new.png
-rich
1
 
LVL 5

Expert Comment

by:Kimberley from Paessler
ID: 41843723
PRTG can help you detect a sudden increase in the amount of data leaving the network, or in the amount of data leaving a file server.  However, we don't look into the payload, so we can't tell you if the increased traffic is a security breach, or just an increase in traffic.
0
Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
O365 and Multi Factor Authentication 1 39
Configuring DNS Round Robin in Windows DNS server ? 8 63
ESXi vmnic Stand By Status 3 47
WDS can't PXE boot 3 26
February 24, 2017 — On February 23, Travis Ormandy, a vulnerability researcher at Google, reported on Twitter (https://twitter.com/taviso/status/834900838837411840) that massive stores of data have been leaked by CloudFlare, a company that provide…
The related questions "How do I recover the passwords for my Q-See DVR" and "How can I reset my Q-See DVR to eliminate a password" are seen several times a week.  Here we discuss the grim reality of the situation.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

680 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question