NBA: A network slam-dunk

With more organizations facing a barrage of security threats — worms, viruses, zero-day attacks and even insider abuse — a new category of security tool is expected to gain traction in the enterprise in 2007: network behavior analysis. NBA tools use traffic-monitoring techniques coupled with security intelligence to spot anomalous actions within the corporate network and mitigate threats quickly.

Offered by such vendors as Arbor Networks, Lancope, Mazu Networks, Q1 Labs and Cisco (with its Monitoring, Analysis and Response System), NBA tools quickly are becoming a key component of the network security toolbox.

Threat equity

Analysts say the key differentiator of NBA is that it treats all threats equally — whether they are known or unknown and whether they originate outside or inside the network. Because NBA tracks behavior, not identity, it provides an added layer of security that pinpoints potential threats far more quickly and efficiently than traditional security gear.

Most companies provide inside employees with a greater level of access and trust and limit outsiders. “It’s natural to implicitly trust the members of your own group, but unfortunately, it’s bad for security, because it's not based on rational risk analysis,” says Andreas Antonopoulos, senior vice president and founding partner of Nemertes Research. In fact, 75% of all security breaches come from network insiders, he says.