A financial institution has redundant firewalls and an asymmetrical routing pattern within their network. This means that in order to see traffic that enters one side of the network and exits via the other side, numerous analysis and security devices are required. If an examiner is trying to collect information about a virus or attack that is coming in one path and exiting another, that information is gathered by two analysis tools. The trace files from those tools would need to be merged manually, or consolidated at another console to see the entire conversation. To collect Intrusion Detection data on conversations traversing two network segments, two IDS sensors are required. Again, this information traffic from each sensor needs to be collected and consolidated, a

Join for free to read