Under the Covers Vol 2 NSP brings a refined approach to network security posture analysis, focusing on deeper protocol inspection and edge-case detection. This update targets security teams that need precise visibility into encrypted traffic and lateral movement risks.
The release aligns with modern zero trust requirements, emphasizing continuous validation and evidence-based controls. Readers gain structured insights that bridge technical telemetry and executive risk reporting.
| Release | Key Focus | Coverage Scope | Primary Audience |
|---|---|---|---|
| Under the Covers Vol 1 | Baseline visibility | East-west traffic, asset tagging | Network engineers |
| Under the Covers Vol 2 NSP | Encrypted traffic analysis | Lateral movement, TLS inspection, policy drift | Security analysts, CISO office |
| Planned Vol 3 | Cloud workload segmentation | Kubernetes, serverless micro boundaries | DevSecOps, platform owners |
| Companion Tooling | Policy simulation | What-if modeling for microsegmentation | Risk management, compliance |
Encrypted Traffic Inspection Techniques
Under the Covers Vol 2 NSP introduces advanced encrypted traffic inspection techniques that preserve privacy while exposing malicious patterns. The solution combines metadata analysis, certificate transparency, and behavioral baselines to detect anomalies without breaking encryption.
Network sensors fingerprint handshake timing, packet sizes, and protocol negotiations to build session-level risk scores. These scores feed directly into the policy engine, enabling near real-time detection of command and control beacons hidden in legitimate TLS streams.
Lateral Movement Risk Modeling
Understanding lateral movement risk is central to Under the Covers Vol 2 NSP. The platform maps host relationships based on authentication logs, SMB signings, and Kerberos ticket flows to highlight improbable traversal paths.
By correlating authentication time stamps with endpoint telemetry, the system surfaces suspicious hops across administrative boundaries. Security teams receive ranked alerts that show the likely progression from initial access to high-value asset targeting.
Policy Drift and Continuous Validation
Policy drift monitoring compares intended segmentation rules with actual traffic matrix observations. Under the Covers Vol 2 NSP surfaces exceptions where permits, denies, or stealth paths deviate from the canonical zone design.
Continuous validation engines simulate attacker paths using graph-based reachability analysis. The resulting heat maps help architects close gaps before adversaries can exploit misconfigured trust relationships.
Key Takeaways and Recommendations
- Prioritize encrypted traffic visibility to detect modern adversary emulation techniques.
- Map authentication flows to compute realistic lateral movement risk scores.
- Run continuous what-if simulations to validate segmentation policies before changes.
- Tune baselines per workload profile to reduce false positives in diverse environments.
- Integrate findings into existing governance dashboards for executive risk tracking.
FAQ
Reader questions
How does Under the Covers Vol 2 NSP analyze encrypted traffic without breaking privacy?
The platform uses metadata extraction, certificate details, and behavioral baselines rather than full payload decryption, preserving confidentiality while exposing suspicious patterns.
Which environments does the current release support out of the box?
It supports hybrid data center, campus LAN, and cloud VPC environments, with adapters for major hypervisors and cloud provider VPC flow logs.
Can it integrate with existing SIEM and SOAR platforms?
Yes, it provides normalized telemetry via CEF and LEEF formats, plus RESTful APIs that allow seamless orchestration with leading SIEM and SOAR solutions.
What is the typical deployment timeline for a medium-sized organization?
Most engagements see core sensors and policy mapping completed within three to six weeks, depending on environment complexity and custom zone requirements.