A sensor strategy is the process of identifying strategic
locations on a network where we can place our sensors in order
to provide security analysts with the greatest network
visibility for the areas of concern.
This is a network diagram depicting the part of the Globomantics
network that I will use throughout this lesson.
Sensor placement is critical to gaining visibility on a network.
How many sensors would you need to monitor this
network, and where would you place them?
Would you place a sensor in front of the firewall?
What about in between the firewall and the router?
Another option is to place a sensor at every ingress and egress location.
Take a moment to think about what you would do in this scenario.
You can pause the video and come back and see how I will proceed.
Okay, so the answer depends on the security goals and hardware available.
For instance,
if the director of security operations decides to
only monitor the server network,
then we could simply place a sensor on a span port
on the Globomantics 01 switch.
However, what if the director wanted to monitor all three enclaves?
Well,
that is the scenario that I will use for the rest of this course, but
first, let us discuss some issues with sensor placement.
For the case of placing a sensor in front of the firewall,
we will indeed capture all traffic coming into the
Globomantics network; however,
traffic going outbound or responding to internal requests will
be obscured by what is called network address translation, or
NAT. Simply put, it will look like the firewall is responding
to all external requests.
If we place a sensor in between the router and firewall,
the same problem exists, except now the source and destination
addresses will only reflect the firewall and router,
since they will be handling various forms of address translations.
An ambitious decision to deploy many sensors across the environment could
introduce duplicate alerts and contribute to alert overload.
There must be a balance. Your sensor strategy should consider
things like locations of critical assets,
systems with high exposure,
such as web servers, and network paths that a malicious attacker would
need to traverse if they gained access to the network.
Now, to monitor all three enclaves,
a sensor will need to be placed on a span port for each switch
correspondent to the server, user, and DMZ networks.