35:14This recording is not available yet.
Categories
Offensive Security & ExposureAttack Surface ManagementSecurity Operations & Incident ResponseDetection & HuntingNetwork Security & Zero Trust
Vendors and tools discussed
Sponsored by
About this session
Patrick Blais, a Netscout solutions engineer, argues that deep packet inspection (DPI) is an under-loved layer of defense-in-depth and makes the case for doing it at scale across an entire network. Using a pirate-ship analogy and citing a Mandiant statistic that 68% of attacks still get through existing controls, he argues packets are the most granular, hardest-to-fake data source available, since unlike logs or agent data they cannot be tampered with after the fact. He lists four requirements for DPI done properly: full packets rather than samples, optimized metadata generation so raw packets can eventually be discarded, a decentralized architecture that analyzes traffic close to its source rather than through a central choke point, and near real-time insight. He connects this to reducing alert fatigue, catching unknown and behavioral anomalies that signature-based detection misses, speeding forensic investigation, and feeding existing SIEM and ITSM dashboards rather than adding new ones. An audience Q&A digs into practical AWS packet-capture options, including VPC traffic mirroring, ingress routing and gateway load balancer, for a large single-VPC cloud environment.
Key takeaways
- Capture full packets rather than samples; sampling creates blind spots where malicious activity can slip through undetected.
- Generate optimized metadata from packet captures so raw packets can eventually be discarded once the useful signal is extracted, rather than trying to store everything indefinitely.
- Favor a decentralized packet-analysis architecture that processes traffic close to its capture point instead of routing everything through a single choke point that won't scale.
- Feed packet-derived alerts into the SIEM and ITSM dashboards you already use instead of adding another standalone dashboard; a one-to-one ratio of tools to analysts is not sustainable given staffing constraints.
- In AWS, evaluate VPC traffic mirroring, ingress routing and gateway load balancer as concrete options for east-west and north-south packet capture, especially when workloads are consolidated into a single VPC.
