ESG Research. Executive Summary. By Jon Oltsik, Senior Principal Analyst, and Colm Keegan, Senior Analyst

Transcription

1 ESG Research Executive Summary The Expanding Role and Importance of Application Delivery Controllers (ADCs) By Jon Oltsik, Senior Principal Analyst, and Colm Keegan, Senior Analyst February 2015 This ESG Research Executive Summary was commissioned by Radware and is distributed under license from ESG.

2 Executive Summary: The Expanding Role and Importance of ADCs 2 Contents Introduction... 3 ADCs Are More Pervasive Than Ever... 3 ADCs Move Beyond Load Balancing... 4 ADCs Have Become a Critical Security Control... 5 The Bigger Truth... 7 All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at

3 Introduction Executive Summary: The Expanding Role and Importance of ADCs 3 The Enterprise Strategy Group and Radware recently conducted a collaborative research project that focused on the current utilization and future strategies of application delivery controllers (ADCs). The data presented in this ESG white paper is based upon a survey of 243 IT professionals working at enterprise organizations (i.e., those with more than 1,000 employees) based in North America. The ESG research reveals that the role of ADCs has expanded well beyond the historical perception of hardware- based load balancers. Organizations are deploying ADCs as virtual appliances at an increasing rate and taking advantage of ADC functionality from the network through the application layer. What s most interesting, however, is that ADCs are becoming a critical component of a defense- in- depth security strategy as enterprises fine- tune security policy and enforcement to align with their sensitive business applications. ADCs Are More Pervasive Than Ever Mention ADCs to IT professionals and many will think of massive hardware appliances deployed in data centers at large organizations. This perception may be historically accurate, but recent ESG research indicates that ADCs have become far more ubiquitous. For example: More than half (51%) of enterprise organizations surveyed have at least 21 ADCs in use today. Eighty- two percent (82%) of organizations believe that the total number of ADCs will increase substantially or increase somewhat at their organizations. Clearly, this data demonstrates that ADCs are used extensively in large and small enterprises, supporting hundreds of web applications for business analytics, CRM, e- mail, and HR. Organizations also report that ADCs can deliver numerous other benefits as well 49% say that ADCs deliver higher levels of availability, 47% believe that ADCs provide improved response time, 44% state that ADCs offer better access to applications, and 36% associate ADCs with an enhanced security posture. ESG research also contradicts the image of ADCs as chassis- based hardware devices. While physical ADCs are most common, two- thirds of organizations have deployed a combination of physical and virtual ADCs. Furthermore, virtual ADCs popularity will only increase over the next few years. Why are virtual ADCs becoming so prevalent? IT professionals are implementing virtual ADCs because they let them align ADC processing power with application performance requirements. Virtual ADCs can be customized for specific requirements in multi- tenant environments, and for alignment with provisioning virtual workloads (see Figure 1).

4 Executive Summary: The Expanding Role and Importance of ADCs 4 Figure 1. Factors Driving the Deployment of Virtual ADCs Which of the following factors drove your organizabon to deploy virtual ADC appliances? (Percent of respondents, N=201, mulbple responses accepted) Virtual ADCs let us align ADC processing power with the applicafon performance requirements of individual applicafons Virtual ADCs can be customized for specific requirements in mulf- tenant environments 49% 53% Virtual ADCs can be provisioned easily and in the same fashion as virtual workloads 48% Virtual ADCs can be mapped to a single applicafon for ease of deployment and operafons 48% Virtual ADCs let us align security requirements with individual applicafons 46% Virtual ADCs are cheaper to purchase 38% 0% 10% 20% 40% 50% 60% Source: Enterprise Strategy Group, ADCs Move Beyond Load Balancing Another common misperception is the view that ADCs are no more than network load balancers in spite of years of innovation and a track record of additional features/functionality. The ESG research indicates that enterprises are using many ADC features today far beyond load balancing alone (see Figure 2). For example: Forty- five percent (45%) use ADCs for network- level security tasks like firewalling and network segmentation. This indicates that ADCs have a role within network engineering and operations. Forty- three percent (43%) use the programmable interfaces on their ADCs. This functionality is often used by DevOps to align application requirements with ADC capabilities for performance tuning, application monitoring, and security. Thirty- nine percent (39%) use ADCs for web application firewalls to protect critical applications from attacks like SQL injections, cross- site scripting, and buffer overflow attacks.

5 Executive Summary: The Expanding Role and Importance of ADCs 5 Figure 2. Common ADC Features/Capabilities Utilized by Enterprise Organizations Which of the following addibonal ADC features/capabilibes does your organizabon currently ublize? (Percent of respondents, N=243, mulbple responses accepted) Network level security Programmable interfaces Web Applicafon Firewall (WAF) Caching Web content opfmizafon Applicafon performance monitoring Compression Mulf- tenancy Applicafon specific accelerafon Single sign- on TCP connecfon mulfplexing Content transformafon/rewrite SSL offload We only use simple load balancing capabilifes 1% 24% 23% 45% 43% 39% 37% 37% 35% 33% 29% ADCs Have Become a Critical Security Control 0% 5% 10% 15% 20% 25% 35% 40% 45% 50% Source: Enterprise Strategy Group, When asked to identify their most common challenges in meeting application service- level agreements (SLAs), the most common challenge selected was security problems (chosen by 39% of IT professionals). It should come as no surprise then that ESG research reveals that ADCs are assuming a growing role as critical security controls. For example: Nearly half (49%) of organizations leverage the security capabilities/functionality on all ADCs while 44% leverage the security capabilities/functionality on ADC- supported applications containing sensitive data. ADC security has become a robust layer of a defense- in- depth network security architecture (see Figure 3). For example, many organizations use ADCs for firewalling, IDS/IPSs, and network segmentation that sits behind similar security controls residing at the network perimeter. Why make ADCs another layer of network security defense? To block attacks that circumvent perimeter security controls. This is not an uncommon scenario for enterprise organizations 58% of organizations believe it is extremely likely or somewhat likely that a malicious attack could penetrate the network perimeter leaving the ADC as a last line of defense. Clearly, ADC- based security can help lower risk in this situation.

6 Executive Summary: The Expanding Role and Importance of ADCs 6 Figure 3. ADCs Have Become a Layer of Defense Behind Network Perimeters What is the primary method your organizabon employs to deliver network security services as it relates to protecbng its data center- resident business applicabons? (Percent of respondents, N=243) At the network perimeter on a purpose- built network security device On a physical ADC On a virtual ADC On a general purpose, data center- resident server Don t know Network firewall 33% 23% 14% IPS/IDS (intrusion prevenfon/detecfon system) 28% 32% 23% 16% 2% Secure network segmentafon 28% 12% 1% DDoS defenses 27% 31% 26% 12% 3% Web authenfcafon gateway 27% 27% 16% 1% WAF (web applicafon firewall) 26% 33% 26% 13% 2% Integrafon with other security tools (e.g., SIM, log management, etc.) 24% 37% 24% 13% 1% SSL accelerafon 24% 35% 27% 12% 2% 0% 10% 20% 40% 50% 60% 70% 80% 90% 100% Source: Enterprise Strategy Group, Finally, ADC- based security appears to be gaining momentum for enterprise organizations, as 76% of organizations say that their use of ADC security capabilities/functionality will increase significantly or increase somewhat in the future.

7 The Bigger Truth Executive Summary: The Expanding Role and Importance of ADCs 7 When it comes to ADCs, perception is not reality. For example, many IT professionals still think of ADCs as hardware- based load balancers but the ESG research presented in this brief indicates a different situation. ADCs are being deployed as virtual appliances and this will only increase as organizations embrace private and hybrid cloud architectures. Furthermore, most organizations use ADC functionality well beyond load balancing alone as they utilize them for API integration, caching, web content optimization, etc. While the role of ADCs is certainly expanding, ESG research reveals that this is especially true with regard to information security. In fact, CISOs are using ADCs in an assortment of security use cases such as network firewalls (OSI layers 3 and 4) all the way up to web application firewalls (OSI layer 7). Furthermore, ADCs have become an additional layer of defense beyond perimeter security devices. The IT professionals surveyed for this project understand and are taking advantage of the fundamental strength offered by ADCs. Unlike general- purpose network appliances, ADCs marry network and security functionality with specific web application requirements. As such, they can be fine- tuned at the IT infrastructure, security policy, and even business level, providing a degree of flexibility that is difficult or impossible to implement in other IT technologies. There is a lesson to be learned here: The ESG data suggests that enterprise organizations can be creative with their ADC deployments for performance tuning, application- specific services, and critical system protection. CIOs, CISOs, application owners, and network engineers can benefit by applying ADCs in this fashion.

8 20 Asylum Street Milford, MA Tel: Fax: global.com