Application and Threat Intelligence (ATI) Blog

What does a data breach cost a company? This is a question that is asked daily and many analyst and research groups are continuously trying to provide an answer. In fact, it seems like we hear as many reports unveiling the cost of a data breach, as we do about actual data breaches. The problem is that we have so many different answers to this question that it becomes difficult to find a number that is accurate for your particular business.

The other day I actually had a bit of time on my hands to sit down and have a sandwich at lunch, so I figured I would jump online. After I had iwconfig‚d ath0 with my SSID and WPA2 Key, associated with my access point, and sent my DHCP request to the broadcast address of my Linksys router, I bothered Comcast's DNS server with a CNAME query to get a handful of viable IP Addresses that are, for all intents and purposes, mirrors of Yahoo.

According to Cisco CTO Padmasree Warrior, the number of devices connected to the Internet will reach 1 trillion in 2013. That is up from 500 million in 2007. Walking around during the last few conferences I've attended and seeing all the iPads, iPhones and Androids in the hands of folks, I would have thought that number had already been reached. And although this interconnectivity can help us in a variety of ways, whether for work or fun, it also increases the risk landscape. During the past several weeks I've been privy to several conversations about mobile network security and performance, through analyst briefings, press meetings, our recent webcast and more. The topic has been on my mind a lot and not surprisingly the news is filled with stories. Two came across my feeds just this morning.

People tend to make a lot of noise about “real-world traffic” whether hitting on application protocol collections, capacity planning, number of available connections per second or other facets. And each play a role in simulating real-world traffic. However, there is another side to what constitutes the protocol mix representative of the outside world and your network – malformed traffic. In my inaugural blog post I thought I would pass along a tip I provide users to measure performance in the face of malformed traffic.

We are all aware of what is going on, in fact we've written about it here on the blog many times. Global networks are under attack from a wide range of enemies, including nation-states, criminal gangs and hackers. At the same time, this network infrastructure is being hit by high-stress application traffic that continues to evolve in complexity. Dig deeper and a vast problem emerges. Our global network infrastructure is rotting from the core.

Mobile broadband use is growing nearly as fast as complaints about mobile broadband connectivity and security. And it is no surprise. The next generation of mobile broadband is being transported using the same infrastructure put in place for wireline communication and it simply cannot hold up much longer.

A few two weeks ago I sat down and moderated a conversation with BreakingPoint's Dennis Cox and Brent Cook on IPv6. We spent nearly an hour talking about different aspects of IPv6 including removing some of the hype, security concerns and some of the vast benefits that can be had from IPv6. Not surprisingly IPv6 was a big topic at RSA Conference last week, particularly in conversations I had with people on the floor. In many cases they have the same questions we discussed during the webcast.

Having worked with networking gear for many years I thought it was about time to jump in and post something to our blog, and why not start by talking about pcap files. As most of you already know, when testing and providing support of networking products, it is common that you will get a big pcap file. Often the file can be so big that it is at best slow when opening in Wireshark, or at worst it may be impossible. Make no mistake, I am a big fan of Wireshark and can not remember a day here on the job where I didn't use this wonderful tool. But the question is, how do you complete tasks such as "grab some TCP sessions where there is no data from server" if opening a 200MB pcap file crashes Wireshark every time?