How do we monitor a second office or site without a second security team?
Put a sensor in each office and send all alerts to the same people and the same dashboard. A second site usually has its own switch and internet line, so traffic there never passes the first office's sensor. One agent on a mirror port at the new site covers its local segment; staff at head office read its alerts alongside the others. Make sure the link between the sites, often a VPN, is also watched, because that is how an infection spreads from one site to the other. Write down who is the local contact at the second site for physical tasks such as unplugging a device. With NetSenX, one agent on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port per site counts as one device, and all sites appear in one account.
Read next
Related questions
- How many NetSenX devices do we need for two sites?
- Can an attacker move from a branch office to the head office over the VPN?
- Should card terminals be on a separate network from office PCs?
- How can we check that office computers cannot reach our tills?
- What happens if an office PC infected with malware can reach the shop tills?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.