3 ms·
It absolutely has to be more nuanced than "there's exabytes of pcaps somewhere" because cloning repositories, pushing branches, backups, these things would basi
by opello 3y ago
It absolutely has to be more nuanced than "there's exabytes of pcaps somewhere" because cloning repositories, pushing branches, backups, these things would basically end up being nasty amplification attacks against the ability to store this data. And block dedupe can work for some storage loads, but it's not solving this problem, especially when that git clone came over ssh or https.
Data from employee devices all being captured and stored? That seems plausible. All data on the corporate network? Less so to my naive mind. I'd love to hear exactly how that works and what kind of retention exists for it.
What seems far more likely is that there's a rules engine that can see all the traffic and makes a decision about if it trips an event to be logged or looks strange enough to be captured (along with some amount of surrounding context, if possible).
- bongodongobob 3y agoYeah you plug holes so you don't have to audit everything. Disable USB ports, alert on large file transfers, audit file access and device logins, no access to local network shares off-site, etc. That's probably good enough for 99% of the world. Capturing all network traffic is absurd and I doubt that's even a thing. You'd need a department the size of the existing company to be able to manage and do anything meaningful with it. Maybe if you had a super secure jump box you could consider monitoring all the traffic on that, but there are much much easier ways to audit behavior than network traffic. Monitor the devices instead.