General
Drobo Announces New SMB Storage Devices
Ever since launch of the PC, and increasingly more now, organizations have been dealing with users who bring technology into the company that they had started out using personally. One of those is the Drobo storage device, which gives users the ability to set up a redundant array of independent disks (RAID) system by mixing and matching a variety of disk drives. Faced with the fact that as many as a quarter of its sales were to small to midsize businesses rather than to consumers, the company is announcing three models of its device--two eight bays and a 12 bay--that are actually intended for business use.
Jeffrey Cochran, senior enterprise network engineer for the Nebraska Book Co., says his company, which sells textbooks and operates college bookstores, uses Drobo devices for more flexible storage needs, such as Websites, compared with the EMC SANs the Lincoln company also uses.
"It sounds a little funny, because we have these itty-bitty Drobos in a rack next to the EMCs," he says.Cochran says he can "go out and buy a couple of terabytes for a couple of hundred bucks," while buying 4TBytes for the EMC SAN could cost him up to $30,000. While the Drobo will never replace EMC because of the space and speed the SAN can provide, "for lower-level administrative tasks or storage, Drobo certainly fits the bill perfectly," Cochran says.
New features in the Drobo devices include thin provisioning to help SMBs deal with capacity and utilization planning, says Kevin Epstein, VP of marketing and product management for the Santa Clara, Calif., company. Users can tell an application such as Microsoft Exchange that the device has 20TBytes, but put in just 8Bytes, and the device will let the user know when it's getting full, he says.
With the new products specifically targeting the SMB space, Drobo is looking to move into a growing market that has historically made do with either stripped-down enterprise offerings or higher-end personal storage products -- neither of which really satisfied the SMB storage demand: higher-end features and capacity with an ease of use and price point similar to consumer products, says Liz Conner, senior research analyst for storage systems and personal storage at IDC, a Framingham, Mass., consultancy.
She was particularly interested in the 12-bay model because that is a "sweet spot" for SMBs. Though she noted that other vendors already have 12-bay versions on the market, features such as management tools, data tiering and 24/7 support really tailor it to small businesses, which typically have small or minimal IT staff and may not have someone with storage-specific knowledge, she says.
The new models of the devices start at $2,199 and consist of an eight-bay file-sharing Drobo with remote backup and an eight-bay iSCSI-attached storage area network Drobo, each of which are available now. A 12-bay iSCSI SAN version with expanded redundancy, support for thin provisioning and deprovisioning, and data-aware tiering is expected to be available in the second quarter.
See more on this topic by subscribing to Network Computing Pro Reports Research: 2011 State of Storage (subscription required).
Jeffrey Cochran, senior enterprise network engineer for the Nebraska Book Co., says his company, which sells textbooks and operates college bookstores, uses Drobo devices for more flexible storage needs, such as Websites, compared with the EMC SANs the Lincoln company also uses.
"It sounds a little funny, because we have these itty-bitty Drobos in a rack next to the EMCs," he says.Cochran says he can "go out and buy a couple of terabytes for a couple of hundred bucks," while buying 4TBytes for the EMC SAN could cost him up to $30,000. While the Drobo will never replace EMC because of the space and speed the SAN can provide, "for lower-level administrative tasks or storage, Drobo certainly fits the bill perfectly," Cochran says.
New features in the Drobo devices include thin provisioning to help SMBs deal with capacity and utilization planning, says Kevin Epstein, VP of marketing and product management for the Santa Clara, Calif., company. Users can tell an application such as Microsoft Exchange that the device has 20TBytes, but put in just 8Bytes, and the device will let the user know when it's getting full, he says.
With the new products specifically targeting the SMB space, Drobo is looking to move into a growing market that has historically made do with either stripped-down enterprise offerings or higher-end personal storage products -- neither of which really satisfied the SMB storage demand: higher-end features and capacity with an ease of use and price point similar to consumer products, says Liz Conner, senior research analyst for storage systems and personal storage at IDC, a Framingham, Mass., consultancy.
She was particularly interested in the 12-bay model because that is a "sweet spot" for SMBs. Though she noted that other vendors already have 12-bay versions on the market, features such as management tools, data tiering and 24/7 support really tailor it to small businesses, which typically have small or minimal IT staff and may not have someone with storage-specific knowledge, she says.
The new models of the devices start at $2,199 and consist of an eight-bay file-sharing Drobo with remote backup and an eight-bay iSCSI-attached storage area network Drobo, each of which are available now. A 12-bay iSCSI SAN version with expanded redundancy, support for thin provisioning and deprovisioning, and data-aware tiering is expected to be available in the second quarter.
See more on this topic by subscribing to Network Computing Pro Reports Research: 2011 State of Storage (subscription required).
Categories: General
Dell's New Lineup Combines Consumer Features With Enterprise IT
Dell introduced on Tuesday a sweeping new lineup of laptop, desktop and workstation computers designed to welcome the "consumerization of IT," while still serving enterprise demands for support of virtualization, cloud computing, security and other IT priorities.
The computer maker unveiled 39 new products or related IT solutions for business users to be released during the next year, including a revamped line of Dell Latitude laptops, a new OptiPlex family of desktop computers and new Dell Precision workstations. The strategy behind the development of these new products is to incorporate designs and features that today's knowledge workers have come to expect in computers because they grew up with them, says Steve Lalla, VP and general manager of Dell's commercial client products group.
"In some instances, employees have been bringing their own laptops, tablet computers or smartphones into work, a phenomenon called the 'consumerization of IT,'" Lalla said at a launch event held in San Francisco. Dell has found that enterprise customers want to give workers lightweight and stylish laptops, and allow social networking apps and collaboration capabilities, but still manage and secure their IT.
"It's about how to bring all of this new technology together, how to contemplate what compute gets done at the end point, what compute is done in the data center and how to tie that all together seamlessly," he says. All products incorporate Dell Data Protection security, including automatic data encryption and Remote Data Delete for the laptops in the event a machine is lost or stolen.
The laptops and desktops have been designed for, among other things, convenient maintenance by IT staff, adds Ken Musgrave, director of industrial design at Dell. Even though Latitude laptops come in different sizes with different-sized screens, they all have the same-size keyboards for simpler replacement if necessary. The OptiPlex desktop computer comes with the machine and the monitor built as one unit to avoid cabling hassles. Also, the laptops are protected against scrapes and scuffs with a cover made of the same material as the liner used in pickup truck beds, Musgrave says.
"[Dell's] new lineup is probably one of the strongest that they've had in years," says Tim Bajarin, principal analyst with the research firm Creative Strategies, "and most likely will help them maintain a pretty strong position in the enterprise space." In the past, enterprises acquired technology that workers used only to get their work done, Bajarin says, but that has changed as people use technology for their work and personal lives simultaneously.
"Now, with the whole issue of people taking their work home and the device being a central part of their personal as well as business lifestyle, [enterprises] have no choice," he says. "They can control the corporate entity part of the technology, but they have really got to give flexibility to [workers] to let them use these devices for consumer purposes, as well."
Dell also teased the upcoming release of a new tablet computer with a 10-inch screen that will run Microsoft's Windows 7 and be targeted at business users. It already markets two models of the Dell Streak tablet that runs Google's Android operating system.
Dell said pricing for the Latitude laptops starts at $859, for the OptiPlex desktops at $650 and for the Precision workstation line at $840. More details on availability of the new products is expected in the next few weeks.
See more on this topic by subscribing to Network Computing Pro Reports Informed CIO: Mobile Device Security (subscription required).
The computer maker unveiled 39 new products or related IT solutions for business users to be released during the next year, including a revamped line of Dell Latitude laptops, a new OptiPlex family of desktop computers and new Dell Precision workstations. The strategy behind the development of these new products is to incorporate designs and features that today's knowledge workers have come to expect in computers because they grew up with them, says Steve Lalla, VP and general manager of Dell's commercial client products group.
"In some instances, employees have been bringing their own laptops, tablet computers or smartphones into work, a phenomenon called the 'consumerization of IT,'" Lalla said at a launch event held in San Francisco. Dell has found that enterprise customers want to give workers lightweight and stylish laptops, and allow social networking apps and collaboration capabilities, but still manage and secure their IT.
"It's about how to bring all of this new technology together, how to contemplate what compute gets done at the end point, what compute is done in the data center and how to tie that all together seamlessly," he says. All products incorporate Dell Data Protection security, including automatic data encryption and Remote Data Delete for the laptops in the event a machine is lost or stolen.
The laptops and desktops have been designed for, among other things, convenient maintenance by IT staff, adds Ken Musgrave, director of industrial design at Dell. Even though Latitude laptops come in different sizes with different-sized screens, they all have the same-size keyboards for simpler replacement if necessary. The OptiPlex desktop computer comes with the machine and the monitor built as one unit to avoid cabling hassles. Also, the laptops are protected against scrapes and scuffs with a cover made of the same material as the liner used in pickup truck beds, Musgrave says.
"[Dell's] new lineup is probably one of the strongest that they've had in years," says Tim Bajarin, principal analyst with the research firm Creative Strategies, "and most likely will help them maintain a pretty strong position in the enterprise space." In the past, enterprises acquired technology that workers used only to get their work done, Bajarin says, but that has changed as people use technology for their work and personal lives simultaneously.
"Now, with the whole issue of people taking their work home and the device being a central part of their personal as well as business lifestyle, [enterprises] have no choice," he says. "They can control the corporate entity part of the technology, but they have really got to give flexibility to [workers] to let them use these devices for consumer purposes, as well."
Dell also teased the upcoming release of a new tablet computer with a 10-inch screen that will run Microsoft's Windows 7 and be targeted at business users. It already markets two models of the Dell Streak tablet that runs Google's Android operating system.
Dell said pricing for the Latitude laptops starts at $859, for the OptiPlex desktops at $650 and for the Precision workstation line at $840. More details on availability of the new products is expected in the next few weeks.
See more on this topic by subscribing to Network Computing Pro Reports Informed CIO: Mobile Device Security (subscription required).
Categories: General
Falconstor Eases Disaster Recovery Woes
Falconstor Software has added functionality to its Continuous Data Protector (CDP) and Network Storage Server (NSS) data replication products that make it easier for organizations to use those products for disaster recovery. Moreover, the RecoverTrac software is heterogeneous among platforms, networks, arrays and hypervisors, meaning that organizations would not need to have identical implementations in different parts of the company to be able to restore data, as is typically required today.
Data can also be recovered from physical to virtual, physical to physical, and physical to virtual infrastructures. In addition, there is no per-server or per-client charge for the functionality.
With the announcement, Falconstor is differentiating between disaster recovery and remote replication, says Bobby Crouch, product marketing manager for the Melville, N.Y., company. Remote replication is simply a remote copy of the data, without the application and the infrastructure that enables users in the organization to make use of the data.
"When there's a disaster, customers don't care that you have a remote copy," he says. "They can't access the application that uses that data." In addition to providing copies of data, the software enables users to resume servers, storage, networks and applications, and works with most operating systems, virtual machines and networks. This is required because business applications increasingly have an awareness of transaction integrity, with applications such as SAP behaving differently from applications such as Oracle, says Crouch.
The software has three modes: Recover, or recovering data; Test, or a non-disruptive testing function that lets users create recover jobs and refine them to ensure that they're correct; and Clone, which creates a tertiary copy of the data that can be used for functions such as data mining and analysis, Crouch says.
RecoverTrac means that the disaster recovery features in Falconstor's CDP and NSS products are now more practical and easier for organizations to use and implement because many disaster recovery solutions today are not really ready to do turn-key disaster recovery, but instead require testing or professional services to set up, says Jerome Wendt, president and lead analyst at the Datacenter Infrastructure Group, an Omaha, Neb., consultancy.
The product is particularly appropriate for two sets of users: existing FalconStor users who have already implemented Falconstor's CDP and NSS, as well as users who are willing to implement NSS and CDP in their environment to use RecoverTrac, he says. On the other hand, there is nothing to prevent FalconStor from taking and applying RecoverTrac's technology and using it to manage other storage vendors' storage virtualization and CDP/replication offerings to achieve the same thing, though Wendt was not aware of any plans on FalconStor's part to do so.
The RecoverTrac functionality is included in Falconstor's CDP and NSS products now for no additional charge. Those products range in price from $2,000 per terabyte to $6,000 per terabyte, depending on volume. RecoverTrac is integrated both with VMware's Site Recovery Manager and Microsoft's Cluster Adapter, and supports both the VMware and Microsoft Hyper-V hypervisors.
See more on this topic by subscribing to Network Computing Pro Reports Strategy: Deduplication for Disaster Recovery (subscription required).
Data can also be recovered from physical to virtual, physical to physical, and physical to virtual infrastructures. In addition, there is no per-server or per-client charge for the functionality.
With the announcement, Falconstor is differentiating between disaster recovery and remote replication, says Bobby Crouch, product marketing manager for the Melville, N.Y., company. Remote replication is simply a remote copy of the data, without the application and the infrastructure that enables users in the organization to make use of the data.
"When there's a disaster, customers don't care that you have a remote copy," he says. "They can't access the application that uses that data." In addition to providing copies of data, the software enables users to resume servers, storage, networks and applications, and works with most operating systems, virtual machines and networks. This is required because business applications increasingly have an awareness of transaction integrity, with applications such as SAP behaving differently from applications such as Oracle, says Crouch.
The software has three modes: Recover, or recovering data; Test, or a non-disruptive testing function that lets users create recover jobs and refine them to ensure that they're correct; and Clone, which creates a tertiary copy of the data that can be used for functions such as data mining and analysis, Crouch says.
RecoverTrac means that the disaster recovery features in Falconstor's CDP and NSS products are now more practical and easier for organizations to use and implement because many disaster recovery solutions today are not really ready to do turn-key disaster recovery, but instead require testing or professional services to set up, says Jerome Wendt, president and lead analyst at the Datacenter Infrastructure Group, an Omaha, Neb., consultancy.
The product is particularly appropriate for two sets of users: existing FalconStor users who have already implemented Falconstor's CDP and NSS, as well as users who are willing to implement NSS and CDP in their environment to use RecoverTrac, he says. On the other hand, there is nothing to prevent FalconStor from taking and applying RecoverTrac's technology and using it to manage other storage vendors' storage virtualization and CDP/replication offerings to achieve the same thing, though Wendt was not aware of any plans on FalconStor's part to do so.
The RecoverTrac functionality is included in Falconstor's CDP and NSS products now for no additional charge. Those products range in price from $2,000 per terabyte to $6,000 per terabyte, depending on volume. RecoverTrac is integrated both with VMware's Site Recovery Manager and Microsoft's Cluster Adapter, and supports both the VMware and Microsoft Hyper-V hypervisors.
See more on this topic by subscribing to Network Computing Pro Reports Strategy: Deduplication for Disaster Recovery (subscription required).
Categories: General
RingCube Targets 'VDI Ghetto'
At first glance, desktop virtualization is the poster child for the problem of satisfying an increasingly mobile workforce with increasingly scarcer resources. However, despite the proliferation of vendors entering the VDI market--including Citrix, MokaFive, Pano Logic, Ring Cube, Symantec, Oracle and VMware--the reality has been both technically challenging and more expensive than expected.
RingCube Technologies is tackling what it calls the "VDI ghetto"--namely, personalization--with a new solution that expands an organization's VDI user base, enables faster and more efficient VDI rollouts, reduces VDI infrastructure costs, and lowers a VDI project's cost per user while increasing its return on investment (ROI). vDesk VDI Edition for VMware View and Citrix XenDesktop is available today with pricing starting at $95.
RingCube's new offering addresses the current practice of restricting personalization to keep costs and complexity down, as well as limiting the technology to structured task workers. The company says that there are almost 600 million enterprise PCs in use, but today's VDI can address only 10 to 20 percent of them, ignoring campus (30 to 40 percent), mobile (30 to 40 percent) and remote worker (10 to 20 percent).
The biggest challenge to widespread VDI use has been user acceptance, which has left most enterprise VDI implementations in pilot mode, says RingCube. What vDesk VDI Edition does is provide the personal desktop experience on top of VDI for reduced costs. The company says that it is leveraging the infrastructure that VMware, Citrix and Microsoft provide today, adding a layer to their offerings.
This integration with existing VDI implementations is a primary strength of vDesk VDI Edition, says analyst Steve Brasen, Enterprise Management Associates. The ability to customize for individual users makes the VDI investment more applicable to business requirements while simplifying management and reducing infrastructure costs. The product also broadens the appeal of the VDI platforms with which it integrates.
"Traditional VDI implementations are valuable only in specific use cases--enterprises that include a workforce that utilize a common system environment. It has not been particularly useful in environments where end users require extensive customization in their desktops to achieve the disparate requirements of their individual roles. vDesk VDI Edition specifically addresses this problem by allowing individual users to overlay environment settings and customizations on top of a common desktop environment. This provides a "best of both worlds" scenario, achieving minimal storage requirements while allowing flexible user environments. This provides a distinct advantage to VDI platforms that integrate with vDesk VDI Edition over those that are unable to achieve similar capabilities. RingCube cleverly orchestrated this solution so that it enhances existing VDI solutions, rather than competing against them.
George Hamilton, an analyst with Yankee Group, says the company is "able to support a cool model but maintain customization for the end users. It allows you to extend pooled resources for tethered works."
Brasen says there are a number of drivers for desktop virtualization adoption, but the three that are most common are workforce mobility (users need to access their data from multiple different workstations, such as work laptops, home desktops and mobile devices); simplified client management (with all user environments managed on a single centralized platform, administrative tasks are significantly reduced, and processes for patching, configuration, system updates, backups and other maintenance practices are far less time-consuming and simpler to implement; and cost reduction (since physical endpoint requirements such as CPU, memory and disk size are minimized, substantial capex savings can be achieved). Additionally, the reduced client management requirements diminishes administrative operating expenses.
While he thinks the VDI market is too immature for this announcement to have significant impact, at least on the other vendors, Hamilton says they're seeing more organizations looking to get out of the desktop-support business. "You can buy a device for $500 to 700, but then have to spend $2,000 to $3,000 or more to support it." It becomes further complicated when employees buy their own machines, including Apple Macs. "Even my own organization is starting to do that. We're using a combination of cloud-based and local installations." This evolution is starting to get more traction, he says, with users getting PC support from a variety of sources. "So this is just another option on how I can deliver apps to a machine I don't necessarily own or manage."
See more on this topic by subscribing to Network Computing Pro Reports ">Research: VDI Adoption 2010 (subscription required).
RingCube Technologies is tackling what it calls the "VDI ghetto"--namely, personalization--with a new solution that expands an organization's VDI user base, enables faster and more efficient VDI rollouts, reduces VDI infrastructure costs, and lowers a VDI project's cost per user while increasing its return on investment (ROI). vDesk VDI Edition for VMware View and Citrix XenDesktop is available today with pricing starting at $95.
RingCube's new offering addresses the current practice of restricting personalization to keep costs and complexity down, as well as limiting the technology to structured task workers. The company says that there are almost 600 million enterprise PCs in use, but today's VDI can address only 10 to 20 percent of them, ignoring campus (30 to 40 percent), mobile (30 to 40 percent) and remote worker (10 to 20 percent).
The biggest challenge to widespread VDI use has been user acceptance, which has left most enterprise VDI implementations in pilot mode, says RingCube. What vDesk VDI Edition does is provide the personal desktop experience on top of VDI for reduced costs. The company says that it is leveraging the infrastructure that VMware, Citrix and Microsoft provide today, adding a layer to their offerings.
This integration with existing VDI implementations is a primary strength of vDesk VDI Edition, says analyst Steve Brasen, Enterprise Management Associates. The ability to customize for individual users makes the VDI investment more applicable to business requirements while simplifying management and reducing infrastructure costs. The product also broadens the appeal of the VDI platforms with which it integrates.
"Traditional VDI implementations are valuable only in specific use cases--enterprises that include a workforce that utilize a common system environment. It has not been particularly useful in environments where end users require extensive customization in their desktops to achieve the disparate requirements of their individual roles. vDesk VDI Edition specifically addresses this problem by allowing individual users to overlay environment settings and customizations on top of a common desktop environment. This provides a "best of both worlds" scenario, achieving minimal storage requirements while allowing flexible user environments. This provides a distinct advantage to VDI platforms that integrate with vDesk VDI Edition over those that are unable to achieve similar capabilities. RingCube cleverly orchestrated this solution so that it enhances existing VDI solutions, rather than competing against them.
George Hamilton, an analyst with Yankee Group, says the company is "able to support a cool model but maintain customization for the end users. It allows you to extend pooled resources for tethered works."
Brasen says there are a number of drivers for desktop virtualization adoption, but the three that are most common are workforce mobility (users need to access their data from multiple different workstations, such as work laptops, home desktops and mobile devices); simplified client management (with all user environments managed on a single centralized platform, administrative tasks are significantly reduced, and processes for patching, configuration, system updates, backups and other maintenance practices are far less time-consuming and simpler to implement; and cost reduction (since physical endpoint requirements such as CPU, memory and disk size are minimized, substantial capex savings can be achieved). Additionally, the reduced client management requirements diminishes administrative operating expenses.
While he thinks the VDI market is too immature for this announcement to have significant impact, at least on the other vendors, Hamilton says they're seeing more organizations looking to get out of the desktop-support business. "You can buy a device for $500 to 700, but then have to spend $2,000 to $3,000 or more to support it." It becomes further complicated when employees buy their own machines, including Apple Macs. "Even my own organization is starting to do that. We're using a combination of cloud-based and local installations." This evolution is starting to get more traction, he says, with users getting PC support from a variety of sources. "So this is just another option on how I can deliver apps to a machine I don't necessarily own or manage."
See more on this topic by subscribing to Network Computing Pro Reports ">Research: VDI Adoption 2010 (subscription required).
Categories: General
Solera Networks Adds Network Traffic Classification, Granular Application Awareness
Solera Networks has introduced traffic classification and identification with deep packet inspection, including highly detailed application information and visualized geolocation, to its network analysis platform. Solera OS 5, supporting the DeepSee suite of tools, also features an improved database engine for better performance and dynamic updating of dashboard displays.
Solera is among a handful of vendors that capture, store and analyze all network traffic. These capabilities are generally focused on security, but have considerable value for network operations as well, as they help ops teams determine the cause of network outages and performance issues.
"The goal is to catch an incident before anyone sees a problem, before it impacts a user," says the security administrator for a large government contractor. "But, if there's an incident or a machine is acting slowly, you can immediately go back--we're currently configured to go back a full month--to trace the problem to the point of origin."
This class of tools is designed to literally see everything that goes on across the network and enable enterprises to spot problems and investigate issues quickly. Solera describes its capabilities as network forensics. Forrester Research has labeled it network analysis and visibility (NAV), maintaining it is essential to enforce a "zero trust" approach to enterprise security (trust no one, see everything). Without this ability to capture, store and analyze many terabytes of network data, enterprises have to rely primarily on manual log review and "snapshot " packet capture that doesn't provide historical data and may not "see" malicious activity, such as a botnet "phoning home" to a command-and-control server.
This kind of capability is designed in large part to dramatically reduce time to resolution of security and network incidents, getting business systems back on line and fully functional.
Full network analysis and visibility has become increasingly important in the face of what Solera characterizes as next-generation threats, such as Stuxnet, advanced persistent threats (APTs), bots, sophisticated malware and massive insider incidents, such as WikiLeaks.
"Advanced persistent threats is the whole reason to be for network forensics," says Pete Schlampp, Solera VP of marketing and product management. "Once they get on your network, they have multistage and multivector capabilities and can morph identify." Network forensics allow organizations to analyze the changes over time, identify the root causes and remediate.
The new DPI capabilities enable Solera to identify 500 applications, which it organizes into 28 families. Solera says that it extracts some 5,000 descriptive details to support its analysis and reporting. The 5.0 engine automatically generates high levels of detail about applications. For example, previously you had to deconstruct an e-mail message to obtain the address and other information. Now, you can automatically extract information such as sender, recipient, subject line and attachments from Gmail.
The geolocation feature creates visual maps of traffic between IP addresses, enabling operators and analysts to quickly begin to identify and address issues.
"The geolocation piece has increased productivity insanely," says the defense contractor security administrator. "Before, I had to load another tool to trace where the IP was. Now it's all integrated in one." Data can be exported in a file to Google Earth.
The new database engine release supports what Solera says is real-time classification of network traffic on an enterprise scale. Solera says that one customer's average network utilization on a one Gbit network produces 36TBytes of data in a month. Dashboard displays are updated dynamically to reflect current traffic or frozen to begin an investigation.
Solera also provides native integration for several products to move from alerts generated into investigations and provide additional data. Current partners include Sourcefire and SonicWALL for IPS; Palo Alto and QOSMOS for DPI/classification; Splunk and ArcSight for SIEM; and lgo management and FireEye for malware analysis.
See more on this topic by subscribing to Network Computing Pro Reports Research: WAN Security (subscription required).
Solera is among a handful of vendors that capture, store and analyze all network traffic. These capabilities are generally focused on security, but have considerable value for network operations as well, as they help ops teams determine the cause of network outages and performance issues.
"The goal is to catch an incident before anyone sees a problem, before it impacts a user," says the security administrator for a large government contractor. "But, if there's an incident or a machine is acting slowly, you can immediately go back--we're currently configured to go back a full month--to trace the problem to the point of origin."
This class of tools is designed to literally see everything that goes on across the network and enable enterprises to spot problems and investigate issues quickly. Solera describes its capabilities as network forensics. Forrester Research has labeled it network analysis and visibility (NAV), maintaining it is essential to enforce a "zero trust" approach to enterprise security (trust no one, see everything). Without this ability to capture, store and analyze many terabytes of network data, enterprises have to rely primarily on manual log review and "snapshot " packet capture that doesn't provide historical data and may not "see" malicious activity, such as a botnet "phoning home" to a command-and-control server.
This kind of capability is designed in large part to dramatically reduce time to resolution of security and network incidents, getting business systems back on line and fully functional.
Full network analysis and visibility has become increasingly important in the face of what Solera characterizes as next-generation threats, such as Stuxnet, advanced persistent threats (APTs), bots, sophisticated malware and massive insider incidents, such as WikiLeaks.
"Advanced persistent threats is the whole reason to be for network forensics," says Pete Schlampp, Solera VP of marketing and product management. "Once they get on your network, they have multistage and multivector capabilities and can morph identify." Network forensics allow organizations to analyze the changes over time, identify the root causes and remediate.
The new DPI capabilities enable Solera to identify 500 applications, which it organizes into 28 families. Solera says that it extracts some 5,000 descriptive details to support its analysis and reporting. The 5.0 engine automatically generates high levels of detail about applications. For example, previously you had to deconstruct an e-mail message to obtain the address and other information. Now, you can automatically extract information such as sender, recipient, subject line and attachments from Gmail.
The geolocation feature creates visual maps of traffic between IP addresses, enabling operators and analysts to quickly begin to identify and address issues.
"The geolocation piece has increased productivity insanely," says the defense contractor security administrator. "Before, I had to load another tool to trace where the IP was. Now it's all integrated in one." Data can be exported in a file to Google Earth.
The new database engine release supports what Solera says is real-time classification of network traffic on an enterprise scale. Solera says that one customer's average network utilization on a one Gbit network produces 36TBytes of data in a month. Dashboard displays are updated dynamically to reflect current traffic or frozen to begin an investigation.
Solera also provides native integration for several products to move from alerts generated into investigations and provide additional data. Current partners include Sourcefire and SonicWALL for IPS; Palo Alto and QOSMOS for DPI/classification; Splunk and ArcSight for SIEM; and lgo management and FireEye for malware analysis.
See more on this topic by subscribing to Network Computing Pro Reports Research: WAN Security (subscription required).
Categories: General
