Posts

A Zero Trust Secure Access Service Edge for a Distributed Data World

You might call it ‘living on the edge.’ A growing number of organizations are moving computing out of the data center, out to the edge of the network. The various reasons for this include increasing numbers of mobile devices and remote users requiring access, expanding digital opportunities, cloud adoption, reduction of network latency and backhaul costs, and more. Making this edge computing possible are technologies such as SDN, SD-WAN and cloud access service broker (CASB) capabilities, all of which provide points of presence (POPs) where distributed workforces need them.

Traditionally, however, easy provision of good security has NOT been one of the drivers for this pivot to the network edge. Hence, many companies that have transformed their network architectures haven’t yet modernized their security architectures. They continue to indirectly route traffic to security engines (tromboning, hairpinning, backhauling), defeating the whole latency advantage and racking up in-house equipment costs. Or worse, they’re not adequately inspecting the edge traffic and payload, leaving their users, network endpoints, cloud data and internal network data exposed to increasingly sophisticated cyberattacks.

That’s all changing with the convergence of computer networking and security at the edge, something IT analyst firm Gartner dubbed the secure access service edge (SASE), pronounced  “Sassy.”

The secure access service edge is an emerging solution category combining wide-area network (WAN) functions with security capabilities such as secure web gateway (SWG), cloud access security broker (CASB), firewall-as-a-service (FWaaS), and zero trust architecture (ZTA) to support a wide range of digital transformational requirements.

SASE merges edge computing’s distributed approach – bringing computation and data storage closer to the location where it is needed – along with the advanced security near or at these points of access.

Cloud Security-as-a-Service for Your Edge Computing

However, SASE isn’t a security scenario that data center-based hardware appliances are going to feasibly address. When modernizing your network, your traditional security equipment can get bypassed in your traffic’s shift to a software-defined perimeter. Alternatively, equipment deployments and reconfigurations (in your data center and remote sites) may struggle to keep up with today’s pace of secure connectivity requirements.

Your distributed workforce is accessing cloud providers for things like SaaS applications, while your branch offices and mobile workers take advantage of direct Internet access. Meanwhile, the resultant data is no longer being centrally stored on, or accessed from, the premises. More users, devices, applications, services and data are located outside of an enterprise than inside, according to Gartner. With organizations still responsible for data privacy and security of individual employees and customers, that’s a lot of scattered data to protect.

The edge requires agile management, and this is where security software and software-defined perimeters step in.

From a cybersecurity perspective, protection can now come closer to where access is needed. A software-centric SASE approach can deliver zero trust security best practices over Web gateways, cloud access points, tunnels, and the devices themselves, while eliminating inefficient hairpinning of traffic inspection to your data center or nearest branch-office hardware.

The OPAQ SASE Cloud provides more ubiquitous and local points of presence, with the zero trust architecture capabilities you need to ensure secure access, control and segmentation.

The OPAQ Zero Trust Secure Access Service Edge (SASE)

Whether it’s a branch office, remote workstation, router, or VM, all of these endpoint identities need network access. Before they connect into your private network and data, they must be identified, authenticated, and properly segmented.

OPAQ delivers a Zero Trust Secure Access Service Edge that bases decisions on the identity of the entity at the source of the connection (user, device, branch office, edge computing location, time of day, risk assessment of the user device, and the sensitivity of the data or app being accessed).

Primary components of this Zero Trust SASE architecture include:

  • User Authentication: IP spoofing, phishing, social engineering, identify theft, and bot break-ins demand a zero trust view of access. Is the device, person, or service attempting to enter into the network authentic? If access is allowed, what might happen next from a security impact perspective? OPAQ checks for a number of factors including user credentials, MFA, access privileges, device certificates, and more.
  • Access Control: Access has moved out to the edge, largely outside of the reach of a perceived private enterprise network. The OPAQ Cloud keeps inspections away from your private data containers, and secures traffic and performance at the edge closer to where access and QoE is sought. Tunneling to the nearest POP, OPAQ SASE provides end-to-end encryption of each session, including over public Wi-Fi networks (cafes, airports, malls, etc.).
  • Segmentation: Ransomware and other malware seek to spread and capture data and control as they go about their damaging business. Endpoint connections are underdefended by basic on-device antivirus updates, opening the door for the latest sophisticated attacks. OPAQ continuously extends layered next-generation security across the dissolving network perimeter, reinforcing workstations, VMs and other endpoints, and then making sure that distributed endpoints don’t expose vulnerable in-roads into your core network and data.
  • Device State: What are your wandering workstations connecting to? Are these devices adequately protected with antivirus, anti-malware, intrusion detection, and more? How are the devices behaving, and are they putting your network and data at risk? OPAQ device state analysis and control secures multidirectional access for your wandering workforce and stationary endpoints and what they can safely connect to.

Transformational edge computing requires a rotating shield of SASE protection.

Learn more.

Network Modernization and SD-WAN: How to Deepen Security as Your Network Goes Wider

So you want to modernize your organization to capitalize on all the leading-edge advantages of the digital era, big data, cloud efficiencies, AI, leading business apps, and partner and customer relationship opportunities? Achieving this business IT transformation requires a strong dose of change management including a willingness to transition on-premises servers to the cloud and switching from Web browser-only services to mobile-friendly apps and sites that facilitate new and more distributed connections. However, these promising modern system architectures won’t pay off without high-performance, highly scalable yet affordable networks to support them. Hence, a move to modernize networks and utilize the cloud is under way.

Why is the cloud so important in network modernization and wide area network (WAN) optimization? The biggest advantage is it enables organizations to leverage what’s already out there (namely, flexible networks, high-value application infrastructures, multitenant shared services, and outsourcing opportunities) so you don’t have to build or invest in the WAN infrastructure yourself.

But the underlying technologies in today’s network infrastructure consist of a hodgepodge of components such as traditional IP routers, multiprotocol label switching (MPLS), and software-defined networking, all of which offer differing ways of transporting data, creating a massive amount of complexity for organizations and managed service providers alike.

MPLS is a network technique that directs data from one node to the next based on the quickest path instead of relying on referencing IP routing tables. But when it comes to security and traffic orchestration in the cloud, MPLS is not fast, flexible or straightforward, requiring branch office-to-Internet service requests to pass through a core network before being delivered. This creates additional traffic over expensive MPLS lines, a utilization that doesn’t take advantage of the whole agile and ubiquitous nature of today’s cloud-centric business model.

A different networking approach drawing attention is software defined wide-area network (SD-WAN). SD-WAN is a transport-agnostic overlay that can route any type of traffic (LTE, 3G and broadband, as well as traffic over private MPLS circuits). The SD-WAN approach provides a network management and control layer to orchestrate ‘backhaul offload’ and WAN optimization. It should figure in enterprise considerations when trying to achieve faster deployment timetables for branch enablement and realizing cloud benefits such as availability and cost. But, as SD-WAN starts to complement today’s private MPLS networks and traditional IP routing, organizations should also consider a number of security questions.


Don’t Forget to Modernize Security as You Modernize Your Network Strategy

Just as there are compelling reasons to modernize your system architecture, business computing methods and networks, there are also compelling reasons for modernizing network security.

As you shift from backhauling all or most of your traffic through the core network in favor of more direct branch to cloud pathways, you are potentially losing some elements of centralized network and security policy.

SD-WAN – as a central enterprise WAN-traffic controller from which to easily apply policies across all devices – is not a security technology, per se. It allows you to avoid the cost of backhauling traffic through the core network, but with that comes the challenge of implementing enterprise-grade security policy across a distributed network.

So what do you do? Do you trade off some security at the branches by plugging in an SD-WAN device that offers only basic protection? Or do you pay for truck rolls (i.e., technicians to install and configure edge devices at every office) and then bear with lengthy deployment cycles? Do you team up with a managed security provider?

This is where the notion of security as a service (SECaaS) and network service insertion from the cloud can come in handy. With a single network and security cloud, you or your managed service provider can simply throw the switch to deploy smart centralized network policy and security at the branch level, extended VPNs, and mobile outliers. This cloud-based security approach, while reducing vulnerabilities at the branches and among mobile/remote users, can also reduce deployment times by up to 91 percent.


Five Key Security Considerations for SD-WAN and Hybrid Cloud Networks

A new white paper from OPAQ discusses five security imperatives companies should keep in mind as they modernize their network infrastructure. A few of these important considerations are to:

  • Modernize security as you modernize your network. SD-WAN is a modern transport system, but isn’t necessarily an advanced security system. Protect your digital assets and your information with security solutions such as next-generation firewalls and leading-edge endpoint protection.
  • Secure your branches as you enable them. As you fortify distributed users with direct access to Internet information and apps, the implementation of advanced security doesn’t have to create long delays and siphon from productivity.
  • Ensure that backhaul offload doesn’t open Pandora’s Box. Mitigate the risks of infection, costly viral lateralization attacks, and the compromising of sensitive data by passing any direct branch office-to-cloud traffic through an agile and virtual firewall and fully encrypted network. Easily segment your network to limit the spread of a cyberattack.

As you modernize your networks, make sure you protect your data, users and business reputation with a fully integrated solution that incorporates an encrypted software-defined network, next-generation firewall and endpoint protection capabilities that can be applied in a matter of minutes, long before that next truck roll.

Watch the Webinar.

Read the white paper.