Bro at Scale: A Network Monitoring Solution for Nationally and Globally Distributed Critical Infrastructure

To protect against sophisticated cyber attacks, many critical infrastructure environments have deployed Bro, an open-source network security platform with capabilities that far exceed conventional intrusion detection solutions. Originally pursued as research platform at Lawrence Berkeley National Laboratory, Bro is now protecting thousands of organizations world-wide, including U.S. government agencies, Fortune 10 enterprises, banks, telecommunications carriers, most national laboratories, and many universities. While powerful, today’s Bro deployments typically remain small in scope—consisting of just a few individual installations monitoring an organization’s major upstream links. Increasingly, though, critical infrastructure operators realize the potential of pushing Bro much deeper into their networks. Deploying large numbers of Bro sensors across their entire network fabric would allow them to monitor, and correlate, activity occurfing anywhere inside a widely distributed environment. Unfortunately, there exists no scalable solution today for managing a large footprint of Bro sensors. Broala, LLC proposes to fill this gap by developing a robust solution for operating Bro at scale. Founded by the creators of Bro to bring the system’s power to enterprises and government, Broala will develop technology that harnesses Bro’s best-of-class capabilities for comprehensively protecting the nation’s largest critical infrastructure networks—making it easy to deploy fleets of Bro sensors across an infrastructure, easily manageable from a central location and adaptable to the environment’s changing needs and constraints within minutes. The foundation for Broala’s solution will come from a commercial Bro appliance that the company recently announced. Our initial reference environment for this project will be the U.S. Department of State, which is seeking to deploy hundreds of Bro sensors across its locations around the world. Broala expects the new technology to become commercially attractive to many other U.S. critical infrastructure sectors as well, including banks and telecommunications carriers. As such, this work has the potential to vastly improve the protection and resilience of the nation’s most critical resources across industry and government. While many critical infrastructure environments depend on the open-source ’Bro’ software for protection against sophisticated cyber attacks, no scalable solution exists today for rolling out large numbers of Bro sensors across globally distributed infrastructure. Broala, LLC, will fill this gap by developing a robust solution for operating Bro at scale.