INDUSTRY EVOLUTION BY SECURELINK FROM HISTORY TO FUTURE

Transcription

1 INDUSTRY EVOLUTION BY SECURELINK FROM HISTORY TO FUTURE In this white paper we will briefly describe how SecureLink, as well as our industry has changed over the last 12 years. It is crystal clear that our industry has evolved: 12 years ago, the adop on of the cloud and of concepts like so ware defined or advanced security threats was zero to none. Today, mobility and flexibility are key elements. Everything should be possible from any device and at any me; of course security and privacy are of utmost importance! If we look back to the beginning of SecureLink, it was important to have basic protec on on your internet gateway and to have a redundant LAN/WLAN network

2

3 TABLE OF C NTENTS History Long term evolu on 7 About the author 10

4 2 History We have dis nguished four major meframes during which we ve seen changes in our industry. Note that these periods of transforma on are becoming increasingly shorter SecureLink was founded in February 2003, ini ally we were mainly focusing on NetScreen firewalls and Nortel Networks LAN switching projects. This has evolved over me to more complete security-gateway and LAN/WLAN projects The first addi onal vendor that we signed up was Neoteris, an SSL VPN solu on, which was later later on acquired (in October 2003) by NetScreen. We also signed up the following vendors: Ironport, BlueCoat, Trapeze Networks, TrendMicro, F5 Networks, RSA and Vasco. They were all vendors that provided solu ons for the internet gateway, remote access or LAN/WLAN. During the meframe, companies started to expand their DMZ. Mail relays and reverse proxies where devices that were typically installed first. Companies started with remote access and access to specific web applica ons. The servers were typically located within the enterprise. They implemented remote access using strong authen ca on. On the la er subject, we have seen an evolu on from hardware to so ware tokens. NAC or 802.1x is very popular in wireless environments. Solu ons for LAN Networks exist as well, but they are typically being used as an automa on tool for placing devices in their assigned VLANs. Unknown devices or guests can be put in a guest VLAN. Security is s ll ensured by employing network segmenta on and internal firewalling. Over the years we have also seen a consolida on in our industry. Neoteris was acquired by NetScreen, which was in turn acquired by Juniper Networks in February Nortel Networks was acquired by Avaya in December 2009 and IronPort was acquired by Cisco in January Neoteris Netscreen Nortel Networks IronPort In April 2008 we launched SecureLink Netherlands; their concept is essen ally based on the same value proposi on. Over me, we designed and implemented even more complex networks where redundancy was o en a key factor. The goal was and s ll is, to avoid any single point of failure, also for internet connec ons and VPNs. For instance, a considerable amount of hospitals became a SecureLink customer based on their requirement for managing an environment where network availability is key Business value: Rendering a network always available so that employees and/or partners always have access.

5 In 2010 we started seeing some changes. We saw that Managed Services became more important. As such, we decided to start inves ng in this area. We started the development of our own monitoring appliance, which was completely integrated with our internal cke ng system. This management appliance is an important part of our Managed Services, even today. It has been further developed over the years and now provides a host of addi onal func onali es next to monitoring. Another thing that we have seen was that, within the por olio of Juniper Networks, the dis nc on between high-end enterprise solu ons and low-end service provider solu ons disappeared. SecureLink had already invested in knowledge of the JunOS opera ng system. This ensured an easy move towards the more high-end Juniper solu ons, which enabled us to target the service provider market, resul ng in several successful Juniper M-series routers and MX projects As from 2010 we have also seen the adop on of the so-called next-genera on firewall. In 2009 Gartner released a document tled The next genera on firewall. That document defines that next genera on firewalls should contain applica on awareness, full stack visibility, extra-firewall intelligence, and upgrade paths in addi on to the full capabili es of both tradi onal firewalls and intrusion preven on systems. Palo Alto Networks was the first company to build this type of firewall. This evolu on lead to the forma on of a partnership with SecureLink. The adop on of what is known as the next-genera on firewall started 1 year later. Security became more important as the media provided a boost with more hacks being made public. The number of a acks and their complexity also increased. DNS is a protocol that has existed for decades. DNSSEC provides an important addi on to the security of the DNS protocol. Market adop on, however, has been slow. Most Belgian DNS providers do not have an easy-to-use interface for the configura on of DNSSEC. We did see some private ini a ves using Infoblox or F5 Networks on-the-fly DNS-signing capabili es. To cope with the new types of a acks, we took two important steps. We acquired the company ISSX (beginning of 2013) and rebranded it to SecureLabs in order to provide high-end security consul ng. On top of that, we also invested in SIEM (Security Informa on and Event Management) technology in order to have a more accurate view of what is going on in a network. For this, we have signed up with Q1Labs, a company that was acquired by IBM in October MANAGED SERVICES Q1 Labs Business value: Provide a high-end, highly-secured infrastructure to ensure that the company stays out of the media, tagged as having been hacked. Managed Services can overcome the problem of hiring and keeping security specialists in-house IPv6 has also been around for years. We have all been warned numerous mes that new IPv4 addresses are no longer available and that we have to move to IPv6. The market shows us that most service providers have implemented IPv6 on a wide scale. However, enterprises are weary of adop on because they have no immediate requirement. There is no killer applica on yet that makes IPv6 an absolute requirement.

6 In 2013 and 2014 we have seen some simultaneous trends: Adop on of the cloud Adop on of VDI Advanced Persistent Threats Concept of So ware defined 2013 Over the last few years we have seen an apparent adop on of the cloud in general. Whether that be through the use of SaaS, private clouds, public clouds or hybrid clouds, we have seen a clear shi in our industry. The trend is that increasingly less companies are building an in-house infrastructure; for the most part they are shi ing to the cloud. This shi ranges from ren ng rackspace in a datacenter to the use of cloud applica ons such as SalesForce and Office365. The use of public clouds such as Amazon and Microso Azure is also on the rise. Virtualiza on is well adopted on all layers. We have seen that most of our vendors are also delivering virtual appliances for their solu ons. Most of those Virtual Appliances are supported on the VMWare pla orm but the adop on of Microso s Hyper-V pla orm is increasing as well. In some cases, we also find Amazon versions available. Another trend we ve no ced is the opportunity in the market to build private clouds. As flexibility and mobility are key nowadays, we no ce a shi from an on-site computer room towards a loca on in a datacenter. Dimensioning, power and cooling requirements are examples of important elements which can typically be be er met in a datacenter. In March 2013 we have started an addi onal business unit within SecureLink ton address this new trend. It is clear that a lot of infrastructure elements are converging: security, networking and servers and storage. NEW BUSINESS UNIT SERVER STORAGE VIRTUALIZATION We have also seen an increased interest in highly converged infrastructures such as the solu ons from Nutanix. Server, storage and virtualiza on so ware are completely integrated and as such are easy to install and to maintain. As this solu on also has a low footprint it is the ideal component to be installed in a datacenter. Combined with both physical and virtual appliances, we can build a complete datacenter in a limited number of HU and with minimal power consump on. Business value: By moving to the cloud there is an opportunity to op mize your cost. This kind of migra on warrants a specific case study, every me. Another major step which we took, is taking a par cipa on in Raido in April Raido is a company that specializes in virtualiza on solu ons, with an emphasis on VDI. We have seen mul ple reasons for this huge market opportunity for this kind of solu on. There is a clear trend towards more mobility and flexibility, but more importantly, the security-argument o en comes up in these projects. Control is achieved much more easily when all sensi ve data remains at one loca on instead of on a lot of remote PC s. VDI or published applica ons have to be seen as a secure delivery of applica ons. Evolu ons in VDI technology have made its general adop on more widespread. DDoS a acks are becoming more prevalent. We need to dis nguish 3 a ack types and each of these types require a vastly different set of techniques to cope with them. - Volumetric a acks - Network based a acks - Applica on based a acks F5 Networks offers a good solu on to protect your environment against all three types.

7 5 Business value: Moving to a VDI solu on can improve the user experience and its security all while reducing opera ng costs. We have seen that security is s ll extremely important as there have been increasingly more advanced a acks and malware. Security companies have come up with a new technology that is commonly known as sandboxing. Palo Alto Networks has integrated this technology into their firewalls through the Wildfire op on and TrendMicro has a dedicated dicate on-premise solu on dubbed Deep Security. The biggest problem for our customers has, more than once, been dealing with the addi onal d informa on generated by these new technologies. These technologies o en require highly specialized skills to interpret their findings. SecureLink responded to this by evolving from regular Managed Services to the more specialized Managed Security Services. Typically a SIEM solu on is used to help correlate the events from different products to provide adequate repor ng. Business value: SecureLink Managed Security Services can help customers in augmen ng their security while removing the requirement to invest in more people to manage this addi onal complexity. In the more high-end networks, especially with service providers, we have seen NFV and/ or SDN gain a lot more trac on. Whether it is the virtualiza on of network func ons or the use of a solu on where most of the network is so ware defined, it all comes down to making be er use of hardware and enabling the automa on of certain func ons. In most enterprises have seen mainly VMWare NSX as the most popular technology. Many companies stand on the side line and we see very few actual projects appear. SecureLink strives to invest in knowledge that allows us to be er assist our customers as they make their first steps in So ware Defined Networking. Business value: Customers are inves ga ng SDN because it allows them to lower the total cost. They re looking at automa on and at a more efficient use of their resources MANAGED SECURITY SERVICES Within the industry, we re seeing a lot of vagueness surrounding everything so ware defined. Every vendor now claims that they have solu ons for SDN. In my opinion, we can alleviate the vagueness by dis nguishing a number of things. The first big dis nc on that we need to make is between enterprises and service providers. For service providers, the most important thing is to automate as many func ons as possible to provide end-users with the necessary control. For enterprises, the focus lies on flexibility, agility and the most economic use of hardware. A trend we ve no ced is that service providers are increasingly looking into open source solu ons, while enterprises are more interested in the VMWare NSX solu on. At this moment we re seeing a lot of interest from companies and in some cases some even a Proof-of-Concept, but we don t see any actual implementa ons as of yet. We expect 2016 to bring some change in that.

8 IAM Iden ty and Access Management will become increasingly more important. Many organiza ons are already using cloud applica ons such as Office365 and SalesForce. In many cases though, the user directories remain completely separated, promp ng the requirement for them to be maintained separately. This usually means that when a person leaves the company, the accounts need to be manually deleted in all the applica ons Another issue we o en encounter with our customers is the fact that these applica ons rarely employ strong authen ca on. In many cases we find that the use of strong authen ca on to access corporate resources is mandatory, but when resources are moved to the cloud we see that this requirement o en disappears in favor of a less complex and more easily maintained setup. Several solu ons based on SAML exist today and are ac vely being used by our customers. However, these are some mes complex in setup and the requirement for a separate setup for each SaaS applica on is all too common. We see that a new type of company is rising up: companies that deliver IAM as a service, essen ally taking away the complexity while providing connec vity to most of the cloud applica ons. Even setups that enable the use of strong authen ca on for single-sign-on are readily available. CASB Gartner defines CASBs as follows: Cloud access security brokers (CASBs) are on-premise or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed. CASBs consolidate mul ple types of security policy enforcement. Example security policies include authen ca on, single sign-on, authoriza on, creden al mapping, device profiling, encryp on, tokeniza on, logging, aler ng, malware detec on/preven on and so on. As we adopt more cloud services, the need for an extra layer of security becomes quite clear. Mul ple companies have recently become ac ve in this market space. They typically also func on as discovery-points for the use of so-called shadow IT. These are applica ons in the cloud that are not known to the internal IT department. SecureProtect, SecureLinks improved Managed Security Services model, many Security-as-a- Service formulas are possible, but basically SecureProtect can be split in two parts: Network Opera ons Center services (NOC) Security Opera ons Center services (SOC) Monitoring, Incident Response and Malware Analysis are key components of SecureProtect and an indispensable service for your IT department. NOC The challenge lots of organiza ons are facing, is to manage and control the complexity of the infrastructure. SecureLink provides you hands-on knowledge and exper se. Leave the management of your infrastructure to specialists; enabling you to focus on your core business. Your infrastructure should be like electricity: always available, extremely efficient and highly reliable.

9 7 SOC Security is not only about having the necessary security devices in place, nor about the installa on of devices. Security includes the con nuous processing of the informa on from these devices. The locally hosted SecureLink Security Opera ng Center provides the security services glue between all your infrastructure components. Security analysts and specialists monitor your infrastructure 24x7 with the goal to intervene immediately once your security is at risk. In addi on, con nuous repor ng on what is happening in your environment is provided to offer you be er visibility. The NOC and SOC services will guarantee your good night s rest. Another major step which SecureLink took, is the recent par cipa on in the Leuven-based applica on security company ZIONSECURITY. ZIONSECURITY will remain an independent en ty within SecureLink, but both teams will work closely together in their market approach. The exper se of the ZIONSECURITY team in the field of applica on security will help SecureLink in the further expansion of it s customer offering. As from now, companies will be able to check security as from the development of new applica ons, including mobile applica ons. This par cipa on fits perfectly in our growth strategy and responds to the ever increasing security challenges customers face. We con nue to invest in new technologies and qualified exper se which allows us to guide our customers in the development, implementa on and complete management of complex security solu ons....

10 8 Long term evolu on Applica ons need to be available from any device and from anywhere. Whether it is via an app or a web browser, from a mobile device or from a computer, they must be available. BYOD is slowly becoming the de facto standard. As a result of this, we will see applica on delivery focused on web based delivery, delivery through VDI or through published applica ons or a mobile app. All these technologies rely on a very strong and secure central infrastructure and do not rely on security on the endpoint device. From where I m standing, I m seeing endpoint security become a vital part of the OS. Looking at the banking sector, they publish guidelines on how to protect your device, but in the end they cannot make you personally responsible if something goes wrong with your transac ons. Doing so would strike a fatal blow to much of the clientele for their applica ons. Iden ty and privacy will become important issues over the next few years. Strong authen ca on solu ons have existed for years, yet adop on seems slow. Eventually we will see strong authen ca on for almost all applica ons, including Facebook. The cloud based IAM providers have the tough responsibility of streamlining everything. Direct authen ca on between personal apps, websites or business related applica ons is likely to disappear. This previously described trend prompts the ques on of what the value is of an internal, trusted network. In many cases, securing that internal network will seem to make li le sense because you can do everything from anywhere without any apparent internal point of security. Of course, there will always be cases where local security remains a very important concept. A typical example of this is within a hospital where, for example, MRI-scanner generated data needs to be secured. The corporate firewall will evolve into a produc vity control device, thereby extending its use beyond that of a pure security device. If all applica ons have moved to the cloud or to an external datacenter, imposing very strict security makes li le sense. The aforemen oned evolu on implies that we, as SecureLink, also need to evolve into developing more datacenter oriented solu ons next to our overall security solu ons. Managed Security Services will become an even more important part of our business. LAN and WLAN technology will remain a necessity within the office environment.

11 SecureLink NV Belgium Uilenbaan Wommelgem T F Info@SecureLink.be

12 About the author Frank Staut is co-founder & Managing Partner of SecureLink and has been involved in building the the companys vision. Por olio management is an important part of his role. Frank is ac vely involved in customer side technology discussions and regularly speaks at public events. Frank holds a degree in electronics as well as a numerous industry cer fica ons. SecureLink NV Belgium Uilenbaan Wommelgem T F Info@SecureLink.be