Pivot2Pcap: a new approach to optimzing cybersecurity operations by tightly coupling the big-picture view provided by Netflow with the in-depth resolving power of PCAP.
SkyDogCon 2012

Peter Shaw

In large networks, it helps to work from the big picture on down when planning for defense. This allows security professionals to watch over the entire network (breadth) for anomalous or suspicious activity. When any such activity is observed, it can then be investigated deeply (depth) to determine the nature of the threat. Once the behavior is fully understood, a switch back to the broad view can reveal whether this same pattern of activity is visible elsewhere in the network. In this way, it is possible to quickly determine how widespread a threat might be, and when and where it began.

Two common types of network data provide these broad and deep views: network flow data (Netflow) and packet capture (PCAP). Pivot2Pcap allows cybersecurity analysts to pivot back and forth between the broad view provided by the flow index, and the deep, drill-down view of the packet store. Both perspectives have complementary value in isolating and resolving cybersecurity operations issues.

Peter Shaw is one of the co-founders of nPulse Technologies. His 23 years of experience in the computing, telecommunications, networking and security industries include leadership roles in business strategy, product management and marketing in the US, Europe and Asia. Peter has held global, VP-level positions at Endace, Allied Telesyn, Agilent Technologies and Hewlett Packard. He holds a degree in electrical engineering and computer science from the University of Auckland, and has also completed post-graduate business studies programs in the US.
 

Back to SkyDogCon 2 video list