Is API Regulation the Future of Information Security?

Recently, I listened in on an IEEE-SA sponsored roundtable at the RSA Conference in San Francisco on April 22, 2015. Karen McCabe, IEEE-SA senior director, Technology Policy and International Affairs, lead a discussion on whether Application Programming Interface (API) regulation is necessary for the future of information security. Participants were Bret Hartman, VP and CTO, Security Business Group, Cisco Systems, Inc.; Cooper Quintin, staff technologist, Electronic Frontier Foundation; Monique Morrow, CTO, evangelist, New Frontiers Development and Engineering, Cisco Systems, Inc.; Hadi Narhari, chief security architect, NVIDIA; Rob Zazueta, Director Platform Strategy, Mashery (Intel); Matt McLarty, VP, The API Academy, CA Technologies; and moderator Kimball Brown, Independent Technology Consultant.

What is an Application Programmable Interface (API)? In its native form, APIs are building blocks for developers to construct programs. APIs often come in the form of a library that includes specifications for routines, data structures, object classes and variables. In other cases an API is simply a specification of remote calls exposed to the API consumers (for example, JSON and REST). These APIs are used primarily for many of the virtualized functions/service programs we are seeing on the market today. Think of a remote controlled robot on a manufacturing floor, a virtual network function in a switch or your favorite application on your cell phone that accesses the sensor on your wrist that monitors your heart or on a macroscopic scale, the billions of devices that are forecasted to exist via the Internet Of Things (IoT) and the programs to control them. All of these programs will rely on APIs in their development. Imagine if a rogue hacker tried to manipulate these programs via accessible APIs to cause harm? There lies the issue. How can this be avoided? What is the state of protection now? And where does this responsibility lie?

The panel agreed that there needs to be more education given to developers on building security into their initial designs, possibly implementing an attack tree or use case security framework from which to build. This framework should be transparent to the consumer because this structure should not impede on the go-to-market strategies that affect the bottom line. Although the panel agreed that this would be a good idea, because there are so many types of APIs, there is no standard way to implement this. As for IoT, the development environment is not like a static information technology environment where the attack points are relatively predictable. IoT environments, in many cases, will be mobile, personal and limited in memory space for which traditional security measures cannot be used. The threat model will have to be redefined, which has yet to happen. Once one is established this model should be communicated to developers as well as consumers.

Panel member also discussed a universal consortium establishing standards and if this would help the problem? The answer was a little but it would not fully address the problem, because the market pace and demand will be too fast for standardization groups to react. One thought was to develop an emerging new API platform with proper hooks and external partners buying into the model. This thought spurred an interesting conversation dealing with the integrity of the partners in the joint venture. How credible are they? This led quickly into the examples of Target, Snapchat and J.P Morgan/Chase where the weak link was the integrity of the partner and not necessarily the flaw of an API, underscoring that business partners having a stake in the level of security that is needed. This led to an interesting discussion concerning Person Area Networks (PAN) where the person becomes the API. Would a developer, consumer or human PAN bill of rights help? Again a “one-size-fits-all” constitution would be tough because every person has his or her own view of what personal security means? It would be hard for a government or business to enforce such a constitution. Businesses do not want regulation to hinder innovation or sales.

The discussion concluded with the final question of how APIs will look in 10 years? All panelists agreed that presently APIs are in a single-user mode and need to move toward a distributed model. Higher levels of SDKs need to be implemented. APIs should have a different paradigm for deployment such that devices, services and systems govern themselves. For example, applications should automatically inform the API what it can and cannot do during processes. For IoT, this method will allow better integration between devices, reduce human regulation policies and thus optimize security.

Click for more information about Dennis Ward.

 

     Dennis Ward

     dward@acgcc.com

     acgcc.com

 

Demand for Security Solutions Driving Consistent Market Growth

The total available market for Worldwide security solutions is projected to increase from $16.3 billion to more than $25 billion by 2018 (CAGR 9.1 percent). Market growth is being driven across multiple segments by increasing complexity and sophisticated nature of security threats. Additionally, mobility, cloud and the evolution of the Internet of everything are changing the IT security landscape, creating opportunity for those vendors that present a multifaceted approach to protection.

ACG Research anticipates a further melding of the vendor and product landscape as security continues to cross over from discrete point solutions to all encompassing product portfolios. New and innovative solutions have and will continue to instigate a shift in how firms think about their security. This is particularly true when it comes to mobile device management. Increased mobile device penetration, bring your own device and consumerization of IT are driving the demand for sophisticated infrastructure to accommodate a mobile environment where employees have secure access to corporate data. ACG Research forecasts double-digit growth of more than 17% across this segment.

For more information about ACG's security services, contact sales@acgresearch.net.

Ray Mota

rmota@acgresearch.net

www.acgresearch.net

Hard Data on the State of the Internet

In his FierceTelecom article, Michael Kennedy discusses the state of the Internet and cites Akamai's "State of the Internet" report, security issues, IPv4 exhaustion and performance statistics to give a view of Internet's actual behavior.  Click here to read the article.

For more information about Michael Kennedy, click here.

For more information about ACG Research's Business Case Analysis service, click here or contact sales@acgresearch.net.

Michael Kennedy
mkennedy@acgresearch.net
www.acgresearch

Advancing the SDN Security Conversation

Recently, the Open Networking Summit brought together people from academia, the private sector (both vendors and potential customers), and the standards world to discuss the current state of software defined networking (SDN). Sarah Sorensen, security analyst, sat down with Matt Palmer from Wiretap Ventures, who spoke at the event, to get his thoughts on what’s happening in the space from a security perspective.

First of all, what would you say was the main take-away from the event? 

I think we saw that software defined networking has hit a tipping point. It’s real and people are starting to see a path where they could actually deploy it. It was fascinating to hear Urs Hölzle, SVP of technical infrastructure from Google, talk about how they are running all the traffic for their internal data center WAN network on a SDN built using OpenFlow. That was a real eye-opener for a lot of people. You really can use this stuff to run a network. Google talked about how they are able to optimize flows and achieve better QoS visibility and predictability, which starts to deliver on some of the promise of SDNs, and they are hopeful they will be able to use it for some customer-facing applications soon. 

So, where is security in all of this? It seems to me it’s been missing from a lot of the SDN discussions. 

It’s true, security hasn’t been a large part of the discussion. However, we are starting to see a lot of people raise the questions and concerns you have been talking about (http://www.acgresearch.net/knowledge-insights/articles/preparing-for-the-ipv6-evolution-and-the-security-implications.aspx) around “how to secure this environment, “how to secure the controller,” “how to secure the connections between the controllers and the switches/routers,” “how to ensure I don’t have malicious things injected in the mix,” etc. 

I think the reason we haven’t seen more of these discussions up to now is that we haven’t been close enough to deployments, so the security guys haven’t been brought in to validate the architecture or poke holes in the technologies.  

Isn't that one of the major stumbling blocks to wide-scale adoption? Security can’t really be an afterthought; it needs to be considered from the start. 

True, but right now the trials are in the lab, and the people working on them are focused on solving the next generation networking problems. A lot of it is theoretical, making it hard to understand the real implications and security issues. There are a limited number shipping products out there to test, but as products start to ship, people will want to know what the risks are. 

If they haven’t thought about those risks, it will probably be a nonstarter. CIOs I have spoken with are looking for those companies that are thinking about and know how to solve for security before they will consider putting anything in a production environment. They can’t afford to disrupt their networks or increase their risks. There’s just too much at stake. 

Agree, I think we are just now learning what security issues they may encounter and the security questions we need to be asking. I think you will see security and SDNs ramp up over the next phase of this evolution. We also see a number of early use-cases being in either single tenant, back-office deployments (ala Google), which means that SDN is deployed behind an already secure network. The second common early use-case we see are deployments in test and development environments where security is less of a concern because it is not outward facing and is in the experimental areas of the network.

What do you think SDNs can mean for security? 

SDNs have the potential in certain situations to streamline security processes or even change how security is deployed, say from physical appliances to virtual appliances, or even virtual security services embedded within the infrastructure. While these are exciting and important developments, we do need to temper the excitement until customers and vendors have experimented and learned how to execute SDN to enhance network security. 

One thing is for certain, it’s an interesting time and an interesting space to be in!

Sarah Sorensen

ssorensen@acgresearch.net

www.acgresearch.net

Top Three IPv6 Transition Assumptions that Can Impact Security

In 2011, we saw the first IPv6 attacks on production networks. As more traffic is transported by IPv6 we can expect more attacks. There are risks right now you should be considering, regardless of whether you have started the transition to IPv6.

You should know most providers have enabled IPv6 in some capacity (often as a default option), so even if you have not started your transition, you likely have it in your network in some fashion. Be mindful your IPv4 only routers and switches in your network are often "blind" to IPv6 attacks hidden in IPv4 traffic.

To get a better understanding of the IPv6 activity going on in your network, you should identify and try to take a closer look at any encapsulated packets in your network. You can also deploy IPv6 enabled devices and see what kind of traffic they get, such as broadcasts from other IPv6 devices and multi-cast sweeps with IPv6 data in it.

The key is to start planning for the transition (if you have not already) to understand the impacts on your network, applications and services and proactively reduce any risks. To smooth the evolution to IPv6 and protect your network the following three common transition traps should be avoided:

1. Assuming Your Security Posture Will Remain the Same Over IPv6 As Over IPv4.

The same attack can present itself differently when running over IPv4 versus IPv6. As when delivered over IPv6, leaving your network and information assets vulnerable.

2. Assuming Your Applications Will Immediately Behave the Same Over IPv6 as Over IPv4.

The change to a new underlying network protocol has far reaching implications; many applications have IP addresses embedded within them, and there are no existing standards for how they should handle this. As a result, applications often widely vary in terms of function, security, and scalability when they go from one transport protocol to the other.

3. Assuming Your Regular Development Processes Will Be Enough.

If you are developing new products, applications and services, you need to be mindful of how IPv6 will impact your functionality and security. When trying to determine what will happen at the system level, as you perform QA testing, it's critical to include security (sending abnormal and unexpected inputs) and scale tests to identify how the device will handle them.

For more information read Sarah’s article Preparing for the IPv6 Evolution and Security Implications.

Sarah Sorensen

ssorensen@acgresearch.net

www.acgresearch.net

Dell’s SonicWall Play

Companies are consolidating as players attempt to add or extend their security expertise and technology to address customers’ demands.

Dell announced it has signed a definitive agreement to acquire SonicWall for an undisclosed price, but which financial analysts estimate has a likely price tag north of $1 billion. Citing cyber security as a top customer pain point, this acquisition makes a lot of sense as a way for Dell to quickly deliver more advanced security technologies to its enterprise customer base.

This acquisition will help the company extend the range of security solutions it can offer, leveraging SonicWall’s unified threat management portfolio: NSA Series, SuperMassive Series, and TZ Series, which includes web security, virtual private networks, anti-virus and malware, intrusion detection and protection, content filtering, application control in an appliance, and next-generation firewall technology.

Enterprises are asking for more comprehensive security to help them protect their operations and intellectual property and address regulatory and compliance demands. Some of today’s security challenges are due to the exponential growth of data, the adoption of cloud-based solutions, and the increased presence of mobile consumer devices in the enterprise (BYOD).

Behind the acquisition

Dell hopes enterprises will turn to Dell to solve their security issues. At first glance, there appears to be good alignment between Dell and SonicWall to address the mid-market. Both have had success there; Dell has six million small business customers and SonicWall has been adding 200,000 new small businesses a year.

With only a little overlap within the channel partners, (15,000, SonicWall; 100,000, Dell), there is the potential for significant growth, if Dell can effectively leverage its brand and global distribution to attain greater penetration for the security technologies. (Note that two-thirds of SonicWall’s $260 million revenue is based in the US.) The challenge may be in getting the channel up to speed selling security; we have seen this take other organizations longer than they anticipated, for example, when Juniper acquired NetScreen or IBM acquired ISS.

Breaking into the big league?

Will Dell be able to effectively move up and into the large enterprise and provider markets? This has traditionally been a struggle for SonicWall, which is hoping its SuperMassive Series will enable the company to finally break through. Dell has a foothold in the data center and has had some recent success with providers, such as US Cellular and Telefonica, but we will have to see if, together, they can expand their footprint.

Competitors are Cisco, Juniper, with whom Dell has a relationship, Check Point and Fortinet. This acquisition is consistent with Dell’s strategy of trying to own more of its intellectual property, so it is fair to say the Juniper relationship is probably in jeopardy.

Dell expects the transaction to close in the second quarter of its 2013 fiscal year. Dave Johnson, SVP, Corporate Strategy for Dell said SonicWall represented a good strategic, cultural and operational fit. Time will tell. One thing we can say for certain is that we will see more consolidation in this market, as players attempt to add or extend their security expertise and technology to address customers’ demands.

Sarah Sorensen

ssorensen@acgresearch.net

www.acgresearch.net

From the Trenches of RSA: Cloud, Mobility and Management

The RSA Conference is a forum for an industry trying to keep hacktivism, espionage, and money-driven crime syndicates at bay. Walk the floor and you will see how many facets there are to keeping the network secure, so that more than a third of the world’s seven billion people can use their phones, laptops, tablets, smartphones, etc., to connect to the people and information they need to run their lives, businesses and governments. So what were the main themes at the conference? Cloud, mobility, and management.

Cloud: There is no doubt organizations are migrating to the cloud, whether it’s a public, private or hybrid model, to take advantage of its scale and economies. However, securing that cloud deployment can be tricky as you navigate various migration paths, relationships and control issues. While it seems everyone has a cloud story (which evidently necessitates blue collateral and puffy clouds somewhere in the booth), the reality is most still tend to be more of a repackaging of existing technologies rather than new, innovative solutions. For example, VMware talked about its collaboration with partners to deliver security in the cloud, and Fortinet released a new form factor optimized for data centers for its firewall technology in the FortiGate 5140B/5001B.

Mobility: Anything mobile is a hot security issue especially as the bring your own device (BYOD) trend heats up; the devices, are becoming an increasingly attractive target. We have already seen data traffic rise exponentially on smartphones and tablets. Video is now the leading driver of total data traffic, averaging 50 percent across geographies. Then, there are the apps that contain particularly sensitive information, for example, retail sales through mobile devices is on the rise. According to Internet Retailer, the 300 largest U.S. mobile merchants generated $5.37 billion in sales through mobile devices. Mobile banking app usage is also increasing with nearly 14 percent of U.S. mobile subscribers accessing banking services on their devices.

Depending to whom you talk, the percentage of phones infected with malware is estimated between one and five percent. There are solutions being hyped from Juniper (Pulse) and CheckPoint that focus on encrypting mobile traffic and controlling and optimizing access to applications for the enterprise. Other companies attempt to tackle attack identification and remediation on the device, such as Alcatel-Lucent Kindsight, for end users (as a service for providers).

Management: Visibility into the traffic is one of the hardest things to get; most service providers and enterprises cite visibility and subsequent security identification and event management (SIEM) as one of their hardest problems to solve, which is why almost every booth had some sort of SIEM story to tell. But that is really the problem: different “panes of glass” for different functions, regardless of how helpful that pane is, it doesn’t take the pain away from the time and effort it takes to manage the network and the security of that network. Ultimately, all the logs and information that each of the devices in your network generate turn it into a big data issue. The National Science Foundation puts the “Big Data” market at a $100 billion industry. It’s why we have seen companies such as Oracle, IBM, Microsoft and SAP spend a combined $15 billion+ acquiring technology that can help them with data management and analytics. Of course there are security-specific solutions too, such as NetForensics, HP’s ArcSight and many others.

For questions or more specifics, please contact Sarah at ssorensen@acgresearch.net.

Sarah Sorensen

ssorensen@acgresearch.net

www.acgresearch.net

The Top Five Security Considerations for Software Defined Networks

While there is a lot of interest in the potential of Software Defined Networks, there are only a handful of actual production networks out there right now. Why? One reason is because of the security risks associated with deploying the existing technology. The following are the top five areas that need to be addressed to improve the security of this new architecture:

Secure the Controller: By separating the control and management plane from the data plane, the “brains” of the network are centralized, which theoretically enables you to make changes to improve the speed, efficiency and potentially security of your network, with just a few clicks. Because the controllers that manage the network can be used to do anything, it also means securing them is of paramount concern.

Depending to whom you talk to, “putting all your eggs in one basket” so to speak, with all the brains of the network in the Controller can be seen as bad, representing a big target and vulnerability, or good, enabling the concentration of protection efforts on one thing. (Note, it may not be that dissimilar to DNS servers today, which are hugely disruptive if taken down or compromised; however, most network administrators feel fairly comfortable in their ability to protect the DNS servers in their network.)

Protect the Controller: Protecting the availability of the controller is also critical. Commercial solutions must easily enable redundancy to reduce the impact a compromise on one controller can have on the entire network.

Establish Trust Between the Controller and the Applications and Devices: Ensuring the integrity of anything that communicates with the controller is a critical first step in making sure the network is running as it should. There must be strong, mutual authentication for the applications that run on it, as well as the switches, routers and servers it controls. Also the communications channel needs to be secure to prevent attacks, such as man-in-the-middle.

Create Robust Policy Framework: Checks and balances are needed to ensure the network is operating as it should. When changes to the controller are made, there needs to be a framework in place to ensure they are in line with corporate policies and don’t open up security risks or knock the organization out of compliance.

Forensics and Remediation: Just as in any network, understanding what is going on or what happened is vital to being able to make changes that strengthen your overall security posture and better protect you from future threats.

Most likely these risks will be addressed as the technology matures and more commercial offerings are made available to the market, but it’s important to keep in mind what needs to happen before wide-scale, production deployments can be considered.

Sarah will be speaking at “What Every Business Executive and Investor Needs to Know about SDN and OpenFlow”

Sarah Sorensen

ssorensen@acgresearch.net

www.acgresearch

Steps to Building a Secure Cloud

Customers may be willing to negotiate and compromise with a cloud provider on cloud pricing or performance guarantees, but evidence of a secure cloud will always be non-negotiable. In the first part of SearchCloudProvider's two-part series, security expert Neils Johnson outlines how and why cloud providers must address customers' cloud security concerns and addresses cloud computing security risks.

Building a secure cloud: What customers want from providers

Cheat sheet: Talking to clients about cloud computing security risks

Click here for more information on cloud computing.


Neils Johnson
Security@acgresearch.net
www.acgresearch.net

Targets, Towers and Terrorists

I was recently in NY during the week is the 10th anniversary of 9/11. I drove by Ground Zero and realized what they are doing there is illustrative of what has to happen within IT. Where the two towers once stood, they are building a single, taller, larger, stronger tower called the Freedom tower.

Not so long ago enterprises’ data center and security teams didn’t even know each other and were independent silos of responsibility, analytical information and processes. The modis operandi was “never the twain shall meet”! It wasn’t an overnight event, but as businesses became more information centric and less system centric, best practices required the dissolution of those two silos.

Information has to have two attributes, availability and security. Information that is secure but not available is worthless. Information that is available but not secure is suspect. IT had to deliver both. The need for the data center/security merger was probably best demonstrated in 2005 when Symantec (then a pure play security vendor) merged with Veritas, which was all about the data center. Initially the industries on both sides of that aisle scoffed. Since then, EMC has bought RSA, Intel has bought McAfee and IBM has been buying security technologies by the handful.

Six years later, it is simply a given that risk definition and risk tolerance have to include consideration for both. The differences between today and 2005, however, are significant. Today, the craftsmanship of the malware writers is much better; therefore, security in one form or another must be a part of every IT decision. We are dealing with an economy that has pressed IT to squeeze as much efficiency out of the existing infrastructure as possible. With limited IT staff and funding, efficiency in the forms of automation, outsourcing and the redefinition of risk tolerance are now parts of the equation.

Note, at no time have I used the words cloud computing, virtualization or mobility. Those three business functions are the best contemporary indicators of why the lines on an IT’s organizations chart must be dotted, erased or blurred to a faint vestige of what they once were. In their place there needs to be a single, stronger, efficient, effective and secure organization that can resist and repel the attacks your company may be facing.

Neils Johnson
Security@acgresearch.net
www.acgresearch.net

IP Networking: Building Value through Network Subscriber and Application Awareness

Network subscriber and application awareness are two ways that IP networking is being extended beyond Layer 2 switching and Layer 3 routing. This expanded networking functionality is being driven on the demand-side by service providers' need to differentiate their services from both competitors and among internal lines of business where service cannibalization is a serious problem; and on the supply-side where more flexible hardware architectures make it possible to combine transport, switching, routing, and DPI capabilities in the same system chassis.bine transport, switching, routing, and DPI capabilities in the same system chassis.

To read the complete article, click here. To read more from Michael Kennedy, click here.

Michael Kennedy
mkennedy@acgresearch.net
www.acgresearch.net

Security and Compliance: Anticipating Tomorrow

One of the most significant numbers in 2010 is 6253, which is the number of potentially exploitable vulnerabilities (PEVs) discovered last year. A PEV represents an exploitable hole in an operating system (OS), a piece of software or hardware or 6253 new opportunities for the bad guys to move into and disrupt the digital world. That’s 17 a day. And if you are a customer of Microsoft, Adobe, Cisco or using any ubiquitous piece of software, hardware or OS your odds of being exposed to one daily is actually very high.

That number has consequences for both security and compliance. For security it represents potentially exploitable weaknesses that can be leveraged to disrupt operations or processes. Those are written by the malware writers that are “notoriety driven,” and the anti-virus industry has pretty well reined those guys in. But more problematically, malware is now used to drop malicious code into environments to capture and remove data for future profit. Typically, the propagation techniques are much better architected and traditional security technologies have difficulty dealing with this type of threat. Hence, they are more successful and costly.

In 2009 the average lag time from the initial exposure of a PEV to the release of Beta code to exploit that PEV was 3.5 days. There are development teams designed to write and release that code quickly so the hole can be exploited before the targets are prepared to deal with it or are even aware that the issue even exists. The average lag time from PEV exposure to the release of the appropriate patch to resolve the issue was 45 days. This obviously represents a huge issue. That’s 41.5 days of exposure.

There is also the impact that 6253 PEVs bring to the compliance requirement table. Fact: None of the compliance documents (US or international) say (I will paraphrase) “thou shall fix the hole!” There is simply no requirement to patch or resolve a PEV. However, all of them say, and again I paraphrase, “You better know that the PEV is in your environment, document exactly how many instances of it you have and where they are located and have some 3rd party documentation of the probability of that PEV being exploited. If it’s low enough, you can use that as a rational for not fixing the hole.”

Those 41.5 days of exposure drive me back “the elephant” I talked about in the previous blog. It’s all about the knowledge component. Security technologies are only as good as the real-time pre-emptive knowledge that sits behind them and alignment or misalignment of the external risk landscape with the internal working environment. Today, it’s not how fast you can respond; it’s what do you already know about tomorrow.


Neils Johnson
Security@acgresearch.net
www.acgresearch.net

Why Virtualized Data Center Security? The $36 Million Dollar Answer

In my previous column Data Center Security: Only as Strong or Safe as the Weakest Link I discussed the seriousness of security in relation to data centers. Yesterday’s news emphasizes that security is serious business: A 26 year-old computer hacker pleaded guilty on Thursday to stealing hundreds of thousands of credit card numbers, causing losses of more than $36 million. Rogelio Hackett, of Lithonia, Georgia, stole 675,000 credit card numbers by hacking into business computer networks, downloading credit card databases or purchasing them on the Internet. He also admitted that he sold credit card information and counterfeit cards to acquire gift cards and merchandise.

This breach is not unusual; although the amount of data lost to cyber attacks dropped significantly in 2010, even as the number of breaches jumped, confirmed cases of compromised data in 2010 rose to 761 from 141 in 2009.[1] And with the proliferation of new data and end-user packaged services such as managed security, compliance and cloud, SPs are under increased pressure to ensure that their data centers have network architecture, systems and robust policies in place to guard against hacking and malware. With network services delivered by multiple data centers and application servers (or more frequently by third parties with applications hosted in remote data centers across the Internet), each layer within the data center must have security protocols that guard against potential breaches.

One safeguard that SPs can employ is system virtualization, which can effectively address and improve data center security. In a virtualized data center LANs, storage area networks, and servers are virtualized so that a single physical network or system element can run multiple logical elements. In a layered security model, security boundaries are controlled so that trusted network components are separated from unreliable components. IT personnel may designate multiple boundaries and multiple layers of protection assigned to systems. By managing network elements and systems within and outside of the boundaries differently managers provide an added level of security. The importance of the system or component and how vulnerable it is determines where it falls within or outside of a boundary and how deeply it will be embedded. Additionally, the layered security architecture is correlated to the virtualization architecture that is implemented in the data center. This is done by mapping virtual networks at layer 2 and layer 3 to virtual storage networks and virtual servers. This model not only improves scalability and reduces OpEx related to energy, but it also improves data center security by isolating components of the network and system infrastructure and mapping the virtualization and security defenses in the network to the virtualization models deployed across the entire data center.

Securing data centers is not simple and requires stringent security design at every layer, which must complement the logical design and systems requirements in the data center. SPs must be able to quickly identify and respond to evolving threats, protect their critical assets, and enforce their business policies. Not having these requirements in place could end up costing a service provider millions, $36 million to be exact.

---

[1] Data Breach Investigations Report

Ray Mota
rmota@acgresearch.net
www.acgresearch.net

Data Center Security: Only as Strong or Safe as the Weakest Link

Although a government shutdown was averted, had it happened, cyber security and providing impregnable networks for the CIA, FBI and other U.S. government agencies with limited staffing and resources could have been severely compromised and had huge consequences and repercussions for these and other departments — not unlike security issues faced by enterprises. Data centers, whether government or enterprise owned, are key targets for criminals trying to hijack, steal or destroy critical and confidential information.

Enterprises and service providers must be able to quickly identify and respond to evolving threats, protect critical assets, and enforce their business policies. They need to understand that when they consider security they cannot only look at it as a point solution but as an end-to-end solution. Why? Because your security system is only as strong or safe as the weakest link in a network or infrastructure and having the appropriate security tools and controls ensures that firewalls and servers are not breached and systems are not at risk.

The security requirements vary somewhat when you consider the differences between enterprises and service providers. Enterprises are very critical about their networks and the importance of their infrastructure in relation to their business initiative. Essentially, they either manage their own network or have a partnership and coordinate their infrastructure/network security with a group of trusted managed service providers.

Service providers, on the other hand, must understand that just as with enterprises, applications are driving their networks. However, the key difference is that service providers are dealing with either hundreds or thousands of unrelated networks that require traffic flow isolation and each necessitate impenetrable security — both potentially costly requirements.

What must enterprises and service providers do to address the goals of (1) maintaining and upgrading the integrity of their network security while simultaneously (2) offering more services and expanding their market and (3) reigning in their OpEx?

To address their market share and retain their competitiveness, service providers must increase their content and applications, which demand more complex infrastructure requirements. Since all service providers are moving to IP because of the flexibility and potential cost saving (driven by convergence), security must be impregnable because IP increases security risk. Additionally, service providers need to maximize the value of each service they deliver either through multiplay or some manage service offering, both of which also have security requirements.

When it comes to service and security, the bottom line is that SPs need to, at a minimum, implement scalable, high-performance, reliable, and inviolable networks; manage multiple remote connections; and monitor and address potential security issues from many sources without degrading the customers’ experience. The challenge becomes one of juggling and balancing security and performance without compromising either.

Ray Mota

rmota@acgresearch.net

www.acgresearch.net