Broad Threats Require Network-Based Security
Virtualization offers an opportunity to distribute security to more places within the network, including at its edges, so that attacks can be detected more rapidly and in different ways from the traditional signature-based approaches. Virtual firewalls are one prime aspect of the virtual CPE trend that is one of the early uses cases for network functions virtualization.
At the same time, virtualization makes centralized approaches to things such as traffic scrubbing more difficult, notes Bipin Mistry, VP of product management for Corero Network Security Inc. , which provides a range of DDoS protection solutions. Because services are more localized, it becomes highly inefficient to pull traffic back to a central location and that is helping push forward the distributed architecture approach.
Once they move in that direction, he notes, network operators are also beginning to see things such as DDoS protections as a means of monetizing their services and in doing so, are actually providing a baseline level of protection for everyone, then selling premium protections on top of that.
What they are doing is different from traditional "clean pipe" services, Mistry says, in that it recognizes that providing DDoS protection means protecting everyone that is downstream from the attack, and not just companies paying for that protection.
"They flip the whole thing on its head and will offer a level of protection for everyone," Mistry says. There are then different business models for offering protection when a DDoS attack occurs, whether it's giving the affected customer the option to upgrade and pay more for a scrubbing service or delivering DDoS protection as a service, in essentially a cloud-based approach.
AT&T is using a network-based approach that builds on virtualization to deliver security that dovetails with enterprise demands for comprehensive security, notes Jason Porter, VP of Security Solutions for AT&T. (See AT&T Virtualizes Multi-Layer Security and listen to Cyber Security: What CEOs Need to Know Now.)
"That's where we started, with our customers expecting us, as their network provider, to be able to secure their mobility, their IoT, the distribution of data to the cloud and the apps they'd never had before," Porter says. "It is too hard to manage security in all these different locations unless I can leverage the network."
So analyzing the 100 petabytes of traffic that AT&T sees every day, to detect misbehavior and new trends, becomes a fundamental part of what the carrier provides -- and that's something many big network operators are doing.
Level 3 Communications Inc. (NYSE: LVLT) is leveraging network intelligence both to identify bad actors and to help enterprise customers audit their own networking to see, for instance, where their assets are being accessed improperly without their knowledge, says Chris Richter, senior vice president of Global Security Services. (See Level 3: Security Is Company-Specific.)
Leveraging its work in the cloud in developing its NetBond platform to automate connections to multiple cloud environments through applications programming interfaces, AT&T also can connect to multiple security environment, including its security vendors such as Fortinet Inc. and Palo Alto Networks Inc. , Porter says.
Amoroso actually compared the perfect security architecture to that of a botnet, in that it is distributed, diverse and resilient -- but he also foresees security being spun up as needed, when an application, workload or virtual function is created. That kind of specific flavor of distributed security matches resources to specific needs.
In general, those engaged in security operations are embracing virtualization's possibilities, notes analyst Donegan, but also recognizing that virtualization creates new vulnerabilities that must be addressed. His May 2015 research shows security experts are more aware of the security challenges of virtualization, but also more confident in their ability to use virtualized security functions to address those challenges.
"Security experts are much more bullish [on virtualization's possibilities] because they are much more on top of the issues, they are ahead of the game and they are much more confident in their ability to use virtual security functions than non-security experts" within the telecom operators, Donegan says.
In AT&T's case, the next phase is virtualizing its security to be context-aware, and transaction or application-based, says Jon Summers, senior VP-growth platforms, because what is appropriate security for one type of transaction may not fit another. "Security also needs to be like the cloud -- elastic, on-demand, usage-driven and context aware," he says. (See Advance Warning: Security Threats to Watch in 2016.)
One of the advantages to doing that, say Summers and Porter, is the ability to move much faster, once threats have been identified, to automatically distribute policy updates to enterprise customers.
— Carol Wilson, Editor-at-Large, Light Reading