Security Strategies

Broad Threats Require Network-Based Security

Enter virtualization
Virtualization offers an opportunity to distribute security to more places within the network, including at its edges, so that attacks can be detected more rapidly and in different ways from the traditional signature-based approaches. Virtual firewalls are one prime aspect of the virtual CPE trend that is one of the early uses cases for network functions virtualization.

At the same time, virtualization makes centralized approaches to things such as traffic scrubbing more difficult, notes Bipin Mistry, VP of product management for Corero Network Security Inc. , which provides a range of DDoS protection solutions. Because services are more localized, it becomes highly inefficient to pull traffic back to a central location and that is helping push forward the distributed architecture approach.

Once they move in that direction, he notes, network operators are also beginning to see things such as DDoS protections as a means of monetizing their services and in doing so, are actually providing a baseline level of protection for everyone, then selling premium protections on top of that.

What they are doing is different from traditional "clean pipe" services, Mistry says, in that it recognizes that providing DDoS protection means protecting everyone that is downstream from the attack, and not just companies paying for that protection.

"They flip the whole thing on its head and will offer a level of protection for everyone," Mistry says. There are then different business models for offering protection when a DDoS attack occurs, whether it's giving the affected customer the option to upgrade and pay more for a scrubbing service or delivering DDoS protection as a service, in essentially a cloud-based approach.

Carrier Activity
AT&T is using a network-based approach that builds on virtualization to deliver security that dovetails with enterprise demands for comprehensive security, notes Jason Porter, VP of Security Solutions for AT&T. (See AT&T Virtualizes Multi-Layer Security and listen to Cyber Security: What CEOs Need to Know Now.)

"That's where we started, with our customers expecting us, as their network provider, to be able to secure their mobility, their IoT, the distribution of data to the cloud and the apps they'd never had before," Porter says. "It is too hard to manage security in all these different locations unless I can leverage the network."

So analyzing the 100 petabytes of traffic that AT&T sees every day, to detect misbehavior and new trends, becomes a fundamental part of what the carrier provides -- and that's something many big network operators are doing.

Level 3 Communications Inc. (NYSE: LVLT) is leveraging network intelligence both to identify bad actors and to help enterprise customers audit their own networking to see, for instance, where their assets are being accessed improperly without their knowledge, says Chris Richter, senior vice president of Global Security Services. (See Level 3: Security Is Company-Specific.)

Leveraging its work in the cloud in developing its NetBond platform to automate connections to multiple cloud environments through applications programming interfaces, AT&T also can connect to multiple security environment, including its security vendors such as Fortinet Inc. and Palo Alto Networks Inc. , Porter says.

Amoroso actually compared the perfect security architecture to that of a botnet, in that it is distributed, diverse and resilient -- but he also foresees security being spun up as needed, when an application, workload or virtual function is created. That kind of specific flavor of distributed security matches resources to specific needs.

In general, those engaged in security operations are embracing virtualization's possibilities, notes analyst Donegan, but also recognizing that virtualization creates new vulnerabilities that must be addressed. His May 2015 research shows security experts are more aware of the security challenges of virtualization, but also more confident in their ability to use virtualized security functions to address those challenges.

"Security experts are much more bullish [on virtualization's possibilities] because they are much more on top of the issues, they are ahead of the game and they are much more confident in their ability to use virtual security functions than non-security experts" within the telecom operators, Donegan says.

In AT&T's case, the next phase is virtualizing its security to be context-aware, and transaction or application-based, says Jon Summers, senior VP-growth platforms, because what is appropriate security for one type of transaction may not fit another. "Security also needs to be like the cloud -- elastic, on-demand, usage-driven and context aware," he says. (See Advance Warning: Security Threats to Watch in 2016.)

One of the advantages to doing that, say Summers and Porter, is the ability to move much faster, once threats have been identified, to automatically distribute policy updates to enterprise customers.

— Carol Wilson, Editor-at-Large, Light Reading

Previous Page
2 of 2
COMMENTS Add Comment
Lisa Ray 12/26/2017 | 1:44:47 AM
I agree with DHagar Absolutely right!!! I appreciate your statement that the future architectures will be smarter and clever from today. 

Regards: cheap modafinil
DHagar 12/23/2015 | 1:51:37 PM
Re: Broad Threats Require Network-Based Security Carol, excellent perspective and this truly makes sense.  Both the technical capabilities and the economies of scale are best served under a network base.

It appears increasingly, that the "glue" that makes things work and truly effective (i.e., virtualization, IoT, etc.) are new architectures that support networks and provide a platform to effectively deliver the value of the technology,  It appears to require new thinking.  I believe the future architectures will be very different from the current.
Sign In