Gigamon 2004: The Visibility Revolution Begins Amidst the MyDoom Outbreak

This is the second post in a series celebrating 20 years of Gigamon.

In the early 2000s, the internet was in its formative years, rapidly expanding its reach and influence. Broadband adoption was accelerating, and the world was embracing digital communication like never before. Emails flew back and forth with a newfound ease, and businesses were increasingly reliant on interconnected networks.

But it wasn’t all smooth sailing. A storm was brewing in the digital realm. A storm called MyDoom.

MyDoom wasn’t just another virus; it was a digital pandemic, exposing the vulnerabilities of an increasingly interconnected world. Its rapid spread through email systems, coupled with its ability to open backdoors on infected machines, caused widespread disruption and fear.

Traditional security tools like firewalls and intrusion detection systems (IDS) were struggling to keep up. They focused primarily on perimeter defense, leaving the internal network largely in the dark. Once an attacker breached the perimeter, their movements within the network were often shrouded in mystery.

The Gigamon Answer: Illuminating the Network

The Gigamon solution was deceptively simple yet profoundly impactful: provide complete visibility into network traffic. Its flagship product, GigaVUE^®, offered a powerful combination of features:

• Traffic aggregation: GigaVUE could tap into multiple network segments, aggregating traffic from various sources into a single stream for analysis 
• Intelligent filtering: This aggregated traffic could then be filtered based on specific criteria, such as IP addresses, protocols, or application types, enabling security teams to focus on the most relevant data 
• Tool empowerment: Filtered traffic could be sent to multiple security and monitoring tools simultaneously, maximizing their effectiveness and providing a holistic view of network activity 

Gigamon in Action: Empowering Security Tools Against MyDoom

During the MyDoom crisis, Gigamon technology would have been a crucial ally, providing the critical visibility needed to combat the worm effectively:

• Early detection: By capturing and aggregating all network traffic, GigaVUE would have provided security tools like intrusion detection systems (IDS) with a comprehensive view of the network, enabling them to quickly detect the abnormal patterns associated with the worm, such as the sudden surge in email traffic and the presence of the worm’s signature. 
• Rapid response: GigaVUE’s ability to filter and deliver specific traffic to the right security tools in real time would have enabled a swift and targeted response. Security teams could have used this visibility to pinpoint infected machines and isolate them from the network, preventing the worm from spreading further. 
• Forensic analysis: GigaVUE’s ability to capture and store network traffic would have provided invaluable forensic data for security analysts. By feeding this data into analysis tools, they could gain deeper insights into the worm’s behavior, identify its vulnerabilities, and develop effective countermeasures. 

A Catalyst for Deeper Security

The MyDoom outbreak was a turning point for Gigamon. It proved the value of network visibility in a real-world crisis, and it spurred the company to further innovate and expand its capabilities.

The early success of Gigamon in providing crucial visibility during the MyDoom incident highlighted the need for more advanced security solutions that could leverage this visibility. This realization laid the groundwork for the development of integrations with tools like data loss prevention (DLP), threat detection systems, and application performance monitoring solutions. By feeding these tools with the right network traffic data, Gigamon would empower organizations to not only react to threats but also proactively defend against them.

The Legacy of MyDoom

The MyDoom worm may be a distant memory now, but its impact on the cybersecurity landscape is still felt today. It highlighted the critical need for network visibility, a principle that remains at the core of our mission at Gigamon. As cyber threats continue to evolve, the Gigamon commitment to providing organizations with the tools they need to see, understand, and secure their networks has never been more important.

In my next post I will explore how Gigamon deep packet inspection revealed data exfiltration in the CardSystems breach of 2005.