‘Tis the season for tech bloggers to prognosticate and pontificate about the trends for the next year.  This is also the time of year when we fondly reflect on the amazing rate of innovation during the past year and try to imagine how the pace of new technology will continue to accelerate. 

When publicly making these types of predictions, it is prudent to write about trends that are probable, and it is unwise to write about things that are too far-reaching. Along these lines, here are six network and security technology predictions that are probable for 2017.

1. Malware will continue to evolve

Malware has been the most effective way for attackers to reach targets globally.  Malware propagation has been the definitive attack method for the past few years, and now the effectiveness of most antivirus products is called into question. More and more security vendors offer malware defenses, but not all of these vendor’s solutions are completely effective as malware continues to metamorphize.

To read this article in full, please click here

More and more enterprise organizations are planning and deploying into cloud platforms. This trend is occurring despite organizations' historical push-back on cloud services claiming that they are less secure than private on-premises data centers.  Even though there is evidence to suggest that cloud application attacks are on the rise, there are best practice methods to secure cloud services. 

To read this article in full, please click here

It is often said, "the Internet is running out of phone numbers," as a way to express that the Internet is running out of IPv4 addresses, to those who are unfamiliar with Internet technologies. IPv4 addresses, like phone numbers are assigned hierarchically, and thus, have inherent inefficiency. The world’s Internet population has been growing and the number of Internet-connected devices continues to rise, with no end in sight. In the next week, the American Registry for Internet Numbers (ARIN) will have exhausted their supply of IPv4 addresses. The metaphorical IPv4 cupboards are bare. This long-predicted Internet historical event marks opening a new chapter of the Internet’s evolution. However, it is somehow anti-climactic now that this date has arrived. The Internet will continue to operate, but all organizations must now accelerate their efforts to deploy IPv6.

To read this article in full, please click here

Many people anticipated that enterprise organizations would adopt Software Defined Network (SDN) technologies later than service providers or multi-tenant data centers and cloud service providers.  We are now seeing more use of Network Functions Virtualization (NFV) within enterprises and some enterprises are starting SDN pilot projects.  As enterprises consider how to utilize SDN technologies in their data center environments, they start to consider what new security capabilities SDN can provide.  SDN switches can drop packets for flows that are not permitted by the controller.  This article explores if SDN switches can behave like a traditional firewall.

To read this article in full, please click here

In order to gain intelligence about the threats that may be directed to our organizations we need to tune into what is happening on the Internet.  By reading the latest annual security reports we can learn from what others have experienced and broaden our perspective on the current threat landscape.  Security practitioners should be sharing information about threats and attacks just as readily as the attackers share information, exfiltrated data and access to botnets.  We can learn from recent security reports and anticipate what we can expect to occur in 2015 and try to adapt our defensive strategies to protect our enterprises.

IT Security is Like Dental Floss

Parallels can be drawn between IT security and using dental floss.  We know that using dental floss can add years to your life expectancy but it requires discipline and a small time commitment every day.  Similarly, IT security requires a relatively small capital investment and a relatively small investment in time to configure granular policies and be vigilant.  Good security is a result of taking time to configure prudent security and then spending the time to establish situational awareness of the environment.  The papers are full of news about companies that have not invested enough time into their security programs.

To read this article in full, please click here

As enterprises look to adopt Software Defined Networking (SDN), the top of mind issue is the concern for security. Enterprises want to know how SDN products will assure them that their applications, data and infrastructure will not be vulnerable. With the introduction of SDN, new strategies for securing the control plane traffic are needed. This article will review the attack vectors of SDN systems and share ways to secure the SDN-enabled virtualized network infrastructure. This article will then discuss the methods currently being considered to secure SDN deployments.

To read this article in full, please click here

OpenFlow is a Software-Defined Networking (SDN) protocol used for southbound communications from an SDN controller to and from a network device. OpenFlow is the protocol used to inform the topology of network switches on which flows should be added to their flow tables and advise switches how they should handle traffic flows that are not in the current flow tables. Initially, OpenFlow did not have any definition for handling IPv6 communications. Now, newer OpenFlow versions have IPv6 capabilities and more vendors are deploying products that use the newer OpenFlow versions. This article goes over the IPv6 functions within the OpenFlow protocol and describes how these are being used.

To read this article in full, please click here

The way we have created IT systems over the years has been very linear with each individual component being statically configured.  If a human makes an error in any one of the many configurations, then the whole system breaks down.  Over the years, IT systems have become increasingly complex with multiple layers of abstraction and virtualization making it difficult to enforce stability and gain scalability.  Promise theory provides a new way to think about how IT systems rely on each other to form an entire system that businesses can depend.  This article will cover the foundation concept of promise theory and give examples of how it is used.

To read this article in full, please click here

在前一篇文章中，我们介绍了如何使用NetFlow, IPFIX和其他流量导出协议为我们提供一些应用程序流量可见性。然而，没有什么比原始数据包解码提供更多的细节。一个名为AppFlow的新协议可能会给管理员提供他们需要的数据，同时仍然在混合拓扑环境中工作。如果与IPFIX兼容，AppFlow将提供这些应用程序协议细节，随着越来越多的供应商接受该协议，它将变得更加流行。AppFlow可能在提供应用程序层细节与流导出协议的性能和灵活性之间取得了正确的平衡。

//m.amiribrahem.com/article/2226572/not-your-father-s-flow-export-protocol--part-2-.html#tk.rss_corenetworkingandsecurity. 思科系统 应用绩效管理 数据泄露 星期五，2014年3月14日11:34:11 -0700 斯科特·霍格 斯科特·霍格 <文章>

Many enterprises use OSPF version 2 for their internal IPv4 routing protocol. OSPF has gone through changes over the years and the protocol has been adapted to work with IPv6. As organizations start to contemplate how they will deploy IPv6 at their Internet perimeters and within their enterprise networks they should be aware of OSPF version 3 and how it differs from what they are familiar with. This article reviews the differences between OSPF version 2 and OSPF version 3 and how they can be configured to work with IPv4, IPv6 and both protocols.

To read this article in full, please click here

Good engineering practices dictate that when we prepare to build something we must plan for the long-term operations. Having the ability to properly manage the technology after it is deployed will ensure its longevity. If the system is neglected, it will become unreliable and eventually fail. There are many organizations that have deployed IPv6 at their Internet perimeters, yet they lack the ability to manage the usage of this new protocol. Having the right IPv6-capable management tools will give us the visibility to our IPv6 deployments.

External Visibility

Many organizations have deployed IPv6 at their Internet perimeter. Other organizations may have IPv6 traffic traversing their DMZs and they do not even realize it. There could be 6in4 tunnels in use that allows the IPv6 traffic to be transported within IPv4 encapsulation. Both of these types of organizations have a need to be able to maintain their IPv6-enabled systems and be able to troubleshoot IPv6-related problems. These organizations will be operating a dual-protocol environment for many years and they must develop in the capability to maintain both protocols.

To read this article in full, please click here

Many networks use 1500-byte MTU size, but the MTU size can be reduced by encapsulation, tunneling or other overlay network protocols. These situations reduce the end-to-end effective MTU size which reduces throughput and network efficiency and sometimes causes application problems. Many network devices now support larger sizes of Ethernet frames and use of Jumbo Frames is becoming more common. This article covers how to determine if your network is capable of using Jumbo Frames and if you should enable this feature.

Compensate by Increasing the MTU Size

A previous article on "MTU Size Issues" discussed the issues of MTU size, how Path MTU Discovery (PMTUD) is performed and the results of fragmentation. Today, the vast majority of data networks use a default 1500-byte MTU size. This is because this is the default Ethernet MTU size for hosts and switches. Frequently, links between enterprise routers and the upstream ISP routers only support 1500-byte MTU. This is also true on the links between MPLS CE routers and PE routers. The primary issue with MTU size occurs when encapsulation is taking place between sites that only support 1500 byte MTU.

To read this article in full, please click here

The Maximum Transmission Unit (MTU) is the largest number of bytes an individual datagram can have on a particular data communications link. When encapsulation, encryption or overlay network protocols are used the end-to-end effective MTU size is reduced. Some applications may not work well with the reduced MTU size and fail to perform Path MTU Discovery. In response, it would be nice to be able to increase the MTU size of the network links.

MTU Size

The Maximum Transmission Unit (MTU) is the largest possible frame size of a communications Protocol Data Unit (PDU) on an OSI Model Layer 2 data network. The size is governed based on the physical properties of the communications media. Historical network media were slower and more prone to errors so the MTU sizes were set smaller. For most Ethernet networks this is set to 1500 bytes and this size is used almost universally on access networks. Ethernet Version 2 networks have a standard frame size of 1518 bytes (including the 14-byte Ethernet II header and 4-byte Frame Check Sequence (FCS)). It should also be mentioned that other communications media types have different MTU sizes. For example, T3/DS3 (or E3) and SONET/SDH interfaces have an MTU size of 4470 bytes (4474 with header).

To read this article in full, please click here