MD2 Understand network traffic: The importance of network traffic flows Flashcards
What is network traffic?
Network traffic is the amount of data that moves across a network.
What is network data?
Network data is the data that’s transmitted between devices on a network.
How do you know what’s normal behaviour in terms of high traffic network activity, or what’s unusual and requires investigation as a potential security incident?
Imagine being stuck in unexpected traffic during your regular drive to work. And, as you move along, you realize something unusual caused the traffic, like a minor vehicle collision which slowed down the expected flow. On the road, we have certain expectations about traffic flows based on our commuting experience. Peak traffic patterns like morning and evening rush are normal and expected, while abnormal traffic during off-peak times reveals that something unexpected has happened, like a vehicle collision.
Network traffic works in the same way. By understanding how data should be flowing across the network, you can develop an understanding of expected network traffic flow. By knowing what’s normal, you can easily spot what’s abnormal. We can detect traffic abnormalities through observation to spot indicators of compromise, also known as IoC, which are observable evidence that suggests signs of a potential security incident.
Data Exfiltration
Take, for instance, data exfiltration, which is the unauthorized transmission of data from a system. Attackers use data exfiltration to steal or leak data such as user names, passwords, or intellectual property.
By observing network traffic, we can determine if there’s any indicators of compromise, such as large volumes of outbound traffic leaving a host. This is a sign of possible data exfiltration which can be further investigated.
