Automatic Noncompliance
Detection and Alerts

Ensuring network security is becoming only more crucial — and challenging — for large enterprises, as malicious actors seek to exploit any available security gap to infiltrate the network, steal data and launch their attacks. Adhering to network policy and ensuring devices remain in compliance is a critical step in preventing security events. Although everyone understands the importance of maintaining compliance, config drift is present in almost every network, meaning most of us are one ACL away from making headlines that nobody wants.

The risk of noncompliant devices isn’t simply poor network hygiene; config drift puts the entire organization at risk of violating government regulations such as PCI DSS, HIPAA, FedRAMP, FISMA, and NIST. Violating these regulations can lead to significant fines, damage to the organization’s brand, and loss of customer trust.

Security teams try to inoculate against this risk by conducting regular compliance and security audits. Because today’s enterprise networks are incredibly complex, with tens of thousands of devices running billions of lines of config, this is not a straightforward undertaking.

Conducting audits to ensure that components like routers, firewalls, load-balancers, and switches have up-to-date controls, are configured appropriately, and don’t pose a compliance or security risk, is a labor-intensive process that can take network operations teams days, weeks, or even longer. Also, the potential of overlooking a significant security issue, or even introducing new risks, is high. And if the audit is prompted by a forensic investigation, not moving fast enough could lead to serious and costly consequences for the enterprise, its employees, and its customers.

Most of the global customers we talk to have general knowledge of their network topology and a desired behavioral state. However, they are often working from a combination of tribal knowledge, outdated Visio diagrams, and spreadsheets in combination with their “golden config” to maintain compliance.

Once a bad configuration is entered, it’s almost impossible to find it unless there’s an event. Even when they’re supported by advanced tools and automation, network operations teams tasked with conducting an audit often struggle. They get mired in writing scripts for calling devices, showing and capturing data, extracting the information needed, generating reports, and more. And that’s true whether they’re using newer scripts like Python, or older scripts like Java. Neither process is efficient or error-free and without certainty, teams are left to hope that the network is in compliance or that they’ve found the actual cause of an incident.

Forward Networks is the industry leader in network assurance and intent-based verification. Our mathematical model creates a complete and always-current digital twin of your physical, virtual, and cloud network estate, including config and state information for all devices. The digital twin provides a complete view of all network behavior, with visibility into every possible path in your network. The digital twin brings mathematical certainty to compliance by enabling network and security engineers to:
VISUALIZE network topology and all traffic paths in a single-pane view for on-premises, Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform for Layers 2-4. Drill down to specific devices and traffic flows, including configuration and state data.

SEARCH the network as simply as a database. Our browser-like search feature performs complete end-toend path analyses across the network for both onpremises and cloud infrastructure.

VERIFY that the network is in compliance using purpose-built (custom) intent checks. Continuously audit the network and receive actionable alerts for noncompliance.

COMPARE network changes over time to understand how they impacted the network and prevent incidents from reoccurring. The network collector frequently scans the network taking and saving snapshots of network configurations, topology, and device state. These “snapshots” become a searchable historical record of network behavior and compliance at any point in time. The diffs feature makes it easy to identify changes that may have taken the network out of compliance or led to an incident.