Importance of Network Traffic Analysis (NTA) for SOCs Survey

Network Traffic Analysis (NTA) is a new way to strengthen cybersecurity. According to Gartner Group, NTA uses a combination of machine learning, advanced analytics and rule-based detection to detect suspicious activities on enterprise networks. NTA tools continuously analyze raw traffic and/or flow records (for example, NetFlow) to build models that reflect normal network behavior. When the NTA tools detect abnormal traffic patterns, they raise alerts.

This survey is designed to explore the challenges, benefits, priorities and adoption patterns for NTA.

Thank you for participating in this survey.

Question Title

* 1. Are you familiar with Network Traffic Analysis (NTA)? (Select one)

Yes

Question Title

* 2. Do you think the use of Network Traffic Analysis (NTA) will ...

Increase

Decrease

Stay the same

Question Title

* 3. What are your plans regarding NTA? (Select one)

We already use NTA

We plan to deploy NTA within the next 12 months

We don’t plan to use NTA

Question Title

* 4. As part of an NTA solution, which applications are the most important? (Select all that apply)

Device detection

Malware detection

Detection of abnormal behavior

URL reputation

Phishing detection

Other (please specify)

Question Title

* 5. To build an NTA solution, which approach would you favor? (Select one)

Purchase, as much as possible, a complete turnkey NTA solution

Assemble your own, custom NTA solution based on technology from different specialized vendors

Question Title

* 6. For NTA, would you say that traffic information gathered by a DPI sensor is ...

Of crucial importance

Somewhat important

Not important at all

Question Title

* 7. What do you see as the main benefits of DPI sensors as part of NTA? (Select all that apply)

Information can be gathered from any type of equipment (Web, mail, VoIP, and application servers)

Provides factual, raw information directly from the network

Flexible software that can be installed anywhere transparently and independently from existing applications

Does not require access rights to install in a network

Other (please specify)

Question Title

* 8. What percentage of your NTA requires a DPI sensor presence? (Select one)

76% - 100%

51% - 75%

26% - 50%

0% - 25%

Question Title

* 9. What percentage of these sensors would be virtual? (Select one)

76% - 100%

51% - 75%

26% - 50%

0% - 25%

Question Title

* 10. How difficult is it to deploy sensors to all the collection points in your environment where you’d like visibility? (Select one)

Very difficult

Moderately difficult

Easy

Question Title

* 11. Which sources of information do you consider the most effective for cybersecurity? (Rank in order of importance with the most important source as number one)

Logs: from network equipment (routers, switches, firewalls, etc.)

Logs: from applications (Web server, email server, etc.)

Network traffic: application attributes (URLs, DNS requests) from Deep Packet Inspection (DPI) sensors

Notifications from endpoint agents

Network traffic: alerts from IDS

Question Title

* 12. How urgent is it to gain greater insight into encrypted traffic in your network environment? (Select one)

Very urgent

Moderately urgent

Not urgent

Question Title

* 13. Do you think the importance of Behavioral Analysis will ...

Increase

Decrease

Stay the same

Question Title

* 14. What are your plans regarding Behavioral Analysis? (Select one)

We already use Behavioral Analysis

We plan to deploy Behavioral Analysis within the next 12 months

We don’t plan to use Behavioral Analysis

Question Title

* 15. Do you use open source software in your SOC? (Select one)

Yes, for a significant part

Yes, but only for some specific tools

Question Title

* 16. What are the main challenges for you to use open source software in your SOC? (Rank in order of importance with the most important challenge as number one)

Limited internal expertise

Lack of maintenance and support for open source software

There is no open source version of the product I need

Question Title

* 17. Which of the following most helps you reduce Total Cost of Ownership? (Select one)

Integrating as much open source software as possible

Assemble a custom solution based on different specialized commercial products

Acquire a complete turnkey solution