Automatic Cyber Defense Enabled by
Software Defined Networking

Increasingly sophisticated cyber-attacks are causing ever increasing damage worldwide. Survey data suggest that 80% of leaked information is obtained through external cyber-attacks. Viruses or malware can penetrate an enterprise network environment and steal information over a period of months, or even years, by cleverly concealing themselves. By the time the crime is uncovered, the important information has often already been leaked. Hacking methods are becoming increasingly devious and complex, making it extremely dif cult for individual companies to mount an effective response alone.

Solution

NEC’s ProgrammableFlow SDN is at the core of the Automatic Cyber Defense solution and it was the first commercially available Software-Defined Network solution to leverage the OpenFlow protocol. Network administrators leverage NEC’s SDN technology to achieve greater service agility through network automation and are able to control costs by consolidating network equipment. NEC’s ProgrammableFlow SDN solutions simplify network operation and increase network visibility, improving service levels by fine-grained control and visibility of network traffic.

A security appliance (e.g. Firewall or IDS) reduces risks of attacks and threats by providing perimeter protection, however does not ensure protection inside the perimeter. The organization is exposed to risks such as same-day attacks (that use vulnerabilities that are not yet detected by firewalls) or threats that originate inside the perimeter - attacks from workstations, from infested magnetic media brought from outside the perimeter.

ProgrammableFlow SDN allows the network to be virtually micro-segmented based on administrator defined criteria. Because of this unique network virtualization capability, network segments are independent from the physical layout of the network and can be modified as the network evolves. By combining the NEC ProgrammableFlow Controller with security appliances such as SonicWall and Palo Alto it is possible to enhance the protection inside the perimeter by identifying infected devices in one of two ways:

• An in-line security appliance identfies infected traffic from a device on the network
• TAP or SPAN traffic is sent to a security device for inspection

When the security device detects suspicious activity it instructs the ProgrammableFlow (using a dedicated software adapter) to isolate, redirect (to honeypot or other device), or drop traffic from the IP address of the workstation where it originated, thus preventing the damage from spreading. The network administrator is notified by E-mail of the action taken. This is achieved in seconds or tens or seconds (because of the automation) as opposed to minutes or days if done manually, without affecting other traffic in the network.

Software Defined Networking enabled Automatic Cyber Defense automates and enhances a network administration ability to protect against cyber attacks

• Reduces the risk of information leaks, system shut-down, Denial of Service attacks, ransom-ware
• Enables faster response to cyber-attacks by automatically blocking infested workstations
• Enables the enterprise network micro-segmenatation and installs virtual firewalls between segments, thus confining potential threats
• Allows quick identification of infested workstations
• Works in conjunction with leading firewalls and Intrusion Detection Systems such as SonicWall and Palo Alto
• Enhanced network management by using NEC ProgrammableFlow SDN controller