Overview

One of the challenges with the traditional approach to enterprise security is that it primarily focuses on preventing breaches. Once the perimeter has been penetrated, there’s no foolproof way to detect or remediate threats. This happens for a number of reasons, including lack of consistent network visibility, proliferation of security tools, and contention for access to network traffic.

GigaSECURE is the industry’s first Security Delivery Platform that provides pervasive visibility of network traffic, users, applications and suspicious activity – across physical and virtual networks – and delivers it to multiple security devices simultaneously without impacting network availability. As a direct result, third party security appliances are more effective at protection and remediation, and cost and complexity of security infrastructure is reduced.

Specifically, GigaSECURE enhances the deployment architecture of security systems and third party security applications through capabilities that include:
• Providing network wide reach, including cloud and virtual environments;
• Offering scalable metadata extraction for improved forensics;
• Isolation of applications for targeted inspection;
• Delivering visibility to encrypted traffic for threat detection; and
• Supporting inline and out-of-band security device deployments.

Key features of GigaSECURE include:
• Infrastructure-wide reach via GigaVUE-VM and GigaVUE® nodes. (GigaVUE is Gigamon’s portfolio of high availability and high-density network traffic visibility offerings.)
• High-fidelity, un-sampled Netflow/IPFIX generation;
• Application Session Filtering (ASF);
• SSL decryption; and
• Inline bypass capabilities.

ASF, a new, patent-pending GigaSMART® application, provides a powerful filtering engine that identifies applications based on signature or patterns that appear within a packet or packets that form the application flow of network traffic.

Once positively identified, ASF extracts the entire session corresponding to the matched application flow from the initial packet to the last packet of the flow, even if the match occurs well after the first packet. This allows an administrator to forward specific “traffic of interest” to security appliances thereby optimizing their operational efficiency and improving overall performance.