Enterprise technology is evolving at a break-neck pace, and one of the areas seeing the greatest transformation is the next-generation firewall (NGFW) market. Gone are the days of a single enterprise data center protected by firewalls only capable of basic packet inspection. NGFWs are converging networking and security to offer cutting-edge features powered by machine learning (ML) and artificial intelligence (AI) that can delve deeper into network traffic than ever before.
The other day I was talking to an analyst about trends in networking and how important the zero-trust security model has become. With zero trust, a user or device is only trusted after confirming their identity or status. It moves security away from implied trust that is based on network location and evaluates trust on a per-transaction basis.
Many organizations are incorporating zero-trust strategies into their architectures, replacing implicit trust for network edges and remote users with consistent convergence of networking and security. This change in mindset has led to specific projects that involve zero trust, such as zero-trust network access (ZTNA) initiatives.
According to the Fortinet Work-from-Anywhere Global Study, 60% of respondents continue to accommodate employees who work from home and 55% have a hybrid work strategy. It’s clear that most organizations will continue to operate a hybrid network that combines a traditional infrastructure with a cloud-based system well into the future. But this increase in work-from-anywhere has also introduced new risks. According to the study, over the past 2 to 3 years, 62% of companies had a breach that was at least partially attributable to vulnerabilities related to work-from-anywhere. Threat actors continue to exploit security gaps arising from remote work.
Organizations worldwide are digitizing their products, services, and operations and moving applications to the cloud as quickly as possible. This forced—though often not well-planned— acceleration to the cloud is happening for a number of reasons, both internally and externally driven.
IT leaders within organizations are pushing the “go digital” movement because they know it can lead to improvements in product innovation, customer experience, and operational efficiency.
As for external drivers of this digital push, the recent past has the COVID-19 pandemic with the hybrid workforce as the most obvious one. However, there have also been dynamic business issues such as responding to board-of-directors directives or the specter of increased competition that have compelled organizations to ratchet up the use of the cloud to better defend and acquire market share.
For many employees, the traditional workplace has evolved over the past 20+ years into today’s work-from-anywhere (WFA) environment. And recently, this evolution—with a boost from 2020’s global pandemic shutdowns—has accelerated at breakneck speed. Currently, many organizations and their IT cybersecurity teams are struggling to keep up with the pace of change.
While IT leadership is desperately trying to provide consistent support and protection for their WFA people, there’s never been a more opportune time for cybercriminals to take advantage of the new challenges, vulnerabilities, and expansion of the attack surface. Evidence of the increase in cyberattacks can be found in a recent global survey commissioned by Fortinet for a WFA study.
The ever-evolving business needs of today’s organizations and their work-from-anywhere (WFA) hybrid workforces are compelling IT leadership to redesign their networks. It is clear that network architectures must be agile to meet all traditional and new business needs. Because of this evolution, changes to the status quo are inevitable.
Physical, virtual, and cloud infrastructures are converging and changing the nature of on-premises data centers. Some even believe this trend toward hybrid networks spells the end of the data center as well as traditional data center security—but they aren’t dead yet.
When cellular phones first came out, all you could do with it was make a call. Over time, as more features were added, such as cameras and internet connectivity, those capabilities became an expected part of the phone itself. Today, even the cheapest $20 retro flip phone includes a camera, texting capabilities, GPS, music, and even the ability to (still) make a phone call.
I think a similar transition is going to happen to zero trust network access (ZTNA). Right now, many ZTNA solutions are offered as an extra service, so that organizations pay per user to access applications in addition to their existing security solutions. But over time, ZTNA will become expected, much like you expect your phone to have a built-in camera. Going forward, ZTNA will simply become a standard part of cybersecurity.
As the speed of business increases, enterprises often require new hybrid network architectures that combine on-premises data centers with hybrid clouds to improve productivity. With users working from anywhere and applications distributed across multi-cloud/SaaS environments, traditional network design can lead to poor user experiences. Security is vitally important not just in terms of protecting resources and assets, but also to enable the network to accelerate and adapt without introducing unknown risks. To be truly successful, organizations that are expanding their digital transformation efforts need reliable, energy-efficient, and secure underlying technologies.
When it comes to Secure Access Services Edge (SASE), there’s still a lot of confusion in the marketplace. Organizations with remote offices and hybrid workers need to make sure users have a good work experience both on and off the network, and at the same time ensure that security policies are being applied and enforced consistently. A SASE architecture helps address these issues by extending secure access and high-performance connectivity to users anywhere.
Secure Access Service Edge (SASE) solutions offer a reliable and flexible method for providing your hybrid, work-from-anywhere (WFA) employees with safe, authenticated access to critical applications and resources.
The best SASE solutions combine secure remote access, advanced per-session and per-application authentication, and enterprise-grade security in a single cloud-based solution. They extend the same protections and performance to remote workers that they experience when working from traditional on-premises locations.
Often, it can be difficult to sell the C-suite on security solutions because quantifying the return on investment (ROI) of cybersecurity solutions often dives into murky waters. But because Secure SD-WAN replaces more expensive and cumbersome WAN technology, it has been easier to make the case for it. With SD-WAN, large organizations can connect their branch offices to the applications and resources they need. However, because there are so many options, deciding which solution is the right one can be challenging.
Today it’s critical for organizations to support a work-from-anywhere workforce. Employees need consistent security whether they’re located on-premises, at home, or anywhere else. To meet this need, many organizations have already adopted a secure access service edge (SASE) solution or plan to implement one soon.
For direct sales companies, success is relative. Many thrive by offering direct-to-consumer marketing strategies. Some achieve a global reach. One company falls into the latter category. Manufacturing and distributing a wide range of kitchen and home products, it operates in nearly 40 countries worldwide across 70 locations.
Securing the Wide-Area Network
For any company of this size, securing the enterprise network is a significant challenge. Over the years, the company had built a distributed wide-area network (WAN) that connected over 65 remote offices and used more than 40 internet service providers (ISPs) to link additional sales offices, manufacturing plants, and regional offices across its international operations.
During the pandemic, many employees transitioned to working remotely or in hybrid environments. Now, many of these same individuals want to continue doing their jobs with work-from-anywhere (WFA) flexibility.
Often organizations are happy and willing to accommodate their hybrid work team members, but they face a mounting security challenge. The problem is that many IT departments are hard-pressed to offer employees WFA flexibility because they cannot support them with consistent, high-quality security.
At a network operations center (NOC), getting a flood of helpdesk requests full of complaints from users at every corner of a large distributed network is a sure way to ruin everybody's day. For IT staff, the goal isn’t just to keep the network up and running, it’s to keep it running well. Slowdowns, wireless problems, DHCP issues, DNS issues, VLAN configurations, and security and password issues all keep users from getting their work done. And then nobody is happy.
If you’ve ever been to Scotland, you know that there’s a whole tourist industry that centers around the Loch Ness monster. People swear up and down that they’ve seen Nessie, and the tales continue, even though there’s no real documented proof that the monster actually exists. Stories like these can take on a life of their own because it benefits someone to perpetuate the myths.
In technology, trying to explain complex technology in understandable ways isn’t easy, and sometimes efforts to make a topic more accessible leave out important details and misinformation ensues. For example, with the notable exception of cloud computing, few topics have fostered more confusion than zero-trust network security principles. Even though the subject has been written about for more than a decade, the myths roll on. Here are the top three myths I’ve seen lately.
IT organizations worldwide are struggling to meet their business objectives for application performance. The growth of the hybrid workforce and the movement of applications to the cloud have put both employee productivity and high-quality customer experiences at risk.
One key contributor to this increased risk is that most companies rely on legacy monitoring tools such as application performance monitoring (APM), infrastructure performance monitoring (ITIM), and network performance monitoring (NPM) solutions. These old solutions lack the holistic visibility necessary to evaluate, troubleshoot, and optimize today’s user-to-application experience.
“The Wi-Fi is down.”
These words are perhaps some of the most dreaded among IT professionals everywhere. Whenever users experience issues accessing the corporate network, they often assume the Wi-Fi is malfunctioning. Yet IT teams know that the problem is usually more complicated. A helpdesk ticket about a compromised user experience often sends IT analysts down the proverbial rabbit hole of their networks in search of the culprit, inspecting everything from Network Access Control (NAC) technology to wired switches and wireless access points to authentication solutions.
Currently, many IT departments are being challenged to make fundamental changes to their cybersecurity strategies. The changes required are necessary to meet their organization’s demands of digital transformation and the rapid growth of their work-from-anywhere (WFA) workforce. Because users from anywhere need to access resources distributed across their networks, organizations are faced with security gaps and vulnerabilities as their legacy, siloed point products are incapable of providing consistent end-to-end protection.
One of the biggest challenges facing organizations today is a direct result of their efforts to chase their biggest opportunity. The end goals of a digital-first model include ensuring every user and device has rapid access to critical resources (including workers on-premises, at home, and on the move), enabling the rapid scalability and agile development of those resources, ensuring an optimal user experience for all users, including employees, contractors, and customers, and gathering and processing data from distributed sources to enable better business decisions.
To do this, organizations have transitioned to a hybrid network strategy that encompasses traditional data centers and campuses, branch offices, private clouds, multiple public clouds, home offices, and mobile workers. Newer strategies, such as Edge Computing, will expand the edges of the network even further by moving computation and storage closer to sources of data to improve response times and conserve bandwidth.
To stay competitive and meet user demands, organizations are adopting new technologies and architectures—such as software-defined WAN (SD-WAN), software-defined branch (SD-branch), Internet-of-Things (IoT), multi-cloud, and zero-trust access (ZTA)—which has led to network infrastructures becoming increasingly complex and fragmented.
According to a recent Dell’Oro Group report, the SD-WAN market expanded by 35% in 2021, exceeding industry predictions. And that trend is expected to continue as SD-WAN continues to prove itself a vital technology for enabling reliable and consistent on-demand connectivity. Its ability to provide rapid cloud on-ramp, accelerate access to applications, monitor and resolve connectivity issues, and maintain optimal user experience enables organizations to compete effectively in today’s digital marketplace. And as SD-WAN usage matures, more and more organizations are using SD-WAN to interconnect clouds and data centers so applications and services can move more efficiently across today’s distributed hybrid networks.
IoT devices are a double-edged sword for IT and security teams everywhere. These devices are undoubtedly a catalyst for digital transformation efforts and pave the way for new operational efficiencies. But they also introduce new risks by expanding an organization's attack surface. This is especially true in industries like manufacturing that rely on operational technology (OT)—especially as businesses start to converge their IT and OT networks to take greater advantage of connected tools like sensors and security cameras.
Like many of the most valuable advances, SD-WAN was the right solution at the right time. It enabled organizations to accelerate their digital transformation efforts by providing flexible, optimized access to critical applications and resources to workers in remote offices. Its advanced cloud on-ramp, application steering, and self-healing connections eliminated the need to backhaul application traffic through the core network due to rigid MPLS connections. It was the perfect complement to cloud adoption, supporting both corporate-based and SaaS applications.
The broad adoption of SD-WAN has been vital to digital acceleration. While SD-WAN began by providing branch offices with flexible access to remote applications, it does so much more today. Secure SD-WAN blends security and connectivity to add adaptable inspection and superior user-experience for applications. This integrated strategy also enables organizations to seamlessly extend enterprise-grade security into the LAN/WLAN and 5G as SD-Branch. New SD-WAN solutions enable flexible, on-demand access between cloud environments and between data centers and the cloud. And SD-WAN is now a critical component of SASE, extending the same controlled access to essential resources that branch offices enjoy to today’s hybrid workforce.
At the start of the pandemic, nearly every organization was forced to expand their security to include an entirely remote workforce. All those home offices significantly increased the organization’s attack surface and exposed it to more risks because home networks often aren’t well secured. These remote office vulnerabilities have led to increased attacks as employees, vendors, partners, and guests move to different locations using an array of devices.
The digital acceleration that is sweeping across organizations has resulted in millions of new IP-based devices getting connected to the network. And the benefits to productivity, efficiency, and flexibility driven by cloud-based analysis has opened up a whole new landscape that is ripe for attack. Wired and wireless networks need to adapt to this reality by having native features to address security. In the same way that zero trust principles are being applied to how users access applications, organizations need to be able to provide the same zero trust principles to the non-user associated devices.
The zero-trust security model is based on the principle that every device or user is potentially compromised, so every access request must be authorized. When the zero-trust approach is applied to corporate campus networks (Ethernet and Wi-Fi) it often works in concert with network access control (NAC) solutions, which ensure that only devices that should attach to the network do. However, this can lead to complexity. What’s needed in this time of digital acceleration is the integration of NAC functionality into the very fabric of the wired and wireless networking equipmentto restrict what networked devices can access.
After the pandemic sent many people home to work, interest in hybrid work and the work-from-anywhere (WFA) model has skyrocketed. A forecast analysis from Gartner® reveals that “by the end of 2024, the change in the nature of work will increase the total available remote worker market to 60% of all employees, up from 52% in 2020.” Also, according to Gartner, “Organizations are facing a hybrid future, with 75% of hybrid or remote knowledge workers saying their expectations for working flexibly have increased.”
Many organizations still use a traditional hub and spoke architecture to connect offices to the data center for application access. However, with users working remotely and applications distributed across multiple clouds and the need for cloud application access, older network architectures can reduce productivity.
Network edges are no longer a branch or a campus. The edge may be at home, in a car, a motel room, or a coffee shop. No matter where users are, they need fast, secure, reliable connections. To meet the needs of users, networking and security must converge. The pandemic caused more users to work from home, acting as "a branch of one," and led to more focus on security at the network edge. But for people to work productively, security has to work seamlessly with connectivity to ensure fast, secure access to applications across rapidly changing connections.
Today’s networks are hybrid collections of interconnected systems composed of campuses, physical and virtual data centers, multi-cloud environments, and branch offices. And they also include a work-from-anywhere workforce that needs consistent access to applications and resources whether working on-premises, at home, or while traveling.
But digital acceleration isn’t just transforming our networks and how we do business. In terms of network security, the days of placing a firewall at the edge of the network perimeter and calling it a day are also long behind us. To provide consistent protection for every user and device, regardless of location, security must be agile, adaptive, scalable, and integrated. This has left organizations with an alphabet soup of new security solutions and strategies designed to protect these expanding and shifting environments. Tools like SD-WAN, SASE, ZTE, and ZTNA have entered the cybersecurity lexicon, and many leaders are still unsure where or when to implement them.