Network Security - A Model For Future Generations

Transcription

1 WHITE PAPER The Journey to IP Networking Sponsored by: AT&T Corporation Nav Chander May 2015 Courtney Munroe EXECUTIVE SUMMARY What Is IP Networking? IP networking has become the bedrock foundation for current business wide area networking. In general, IP is the universal network standard for the Internet and internetworking. TCP/IP was originally designed for establishing and managing connections between networks to facilitate control of routing between locations and end-to-end networks. However, this framework has evolved dramatically from the original model (see Figure 1). FIGURE 1 The 3rd Platform Changes Everything Innovative Industry Solutions The 3rd Platform is IDC's vision of the ICT industry's emerging platform for growth and innovation built on the technology pillars of mobile computing, cloud services, big data and analytics, and social networking. LAN/Internet Client/server Cloud Mobility Emerging markets Big data/analytics Social business Mainframe Terminal Source: IDC, 2015 May 2015, IDC #248259R1

2 Today's enterprise IT environment is based on several pillars, including IP, cloud, mobile, and social networks. This dynamic IT infrastructure is driven by exponential growth in mobile and rich content traffic. It supports hundreds and even thousands of corporate applications and scales to support thousands of sites as well as tens of thousands of end users. Most importantly, current IT environments are becoming national or global, spanning a multiplicity of government and vertical compliance regimes as well as multiple equipment architectures. Today's enterprise IT staff require innovative solutions that provide an agile and creative framework. As an open network, TCP/IP is intended to be transparent. The most important protocols are the ones from which it takes its name, Transmission Control Protocol and Internet Protocol. TCP and IP together facilitate networking at various levels of the OSI stack. While TCP and OSI were created independently, TCP emerged as the foundation layer for efficient management of a diverse suite of protocols at the application layer, such as FTP, HTTP, POP3, etc. TCP and UDP are the transport layer protocols that manage connections between devices. IP corresponds to Layer 3 of the OSI networking model, which handles addressing, delivery, fragmentation, and reassembly. Each device is assigned a unique address, and because TCP/IP works at the mid-to upper levels of the OSI model, the type of underlying network is irrelevant. This platform has evolved from the client/server model in which hosts provide data in response to requests from clients such as Web browsers. Most importantly, TCP/IP uses entirely open and nonproprietary standards and facilitates true convergence because it can interconnect any kind of network technology, public or private, LAN, WAN, or wireless. For example, the network 4G wireless framework LTE is based on IP and packet switching and offers seamless internetworking with wireline technologies. Another important feature of TCP/IP is its scalability. TCP/IP is very a reliable network of millions of networks serving billions of end users. The most important issue with TCP/IP is its ability to efficiently facilitate complex hierarchies, such as MPLS IP VPN, class of service, and service-level agreements (SLAs), that can allow for many variations of end-user configurations and requirements. Business Networking Priorities IDC routinely polls companies about their WAN networking priorities. Implementing a converged network road map is one of the most basic requirements for businesses seeking to leverage IP networking. Most companies begin by implementing IP voice and Web hosting, and then they branch out to unified communications and collaboration (UC&C) as well as hosted applications and security. As mobility and social networking become increasingly ubiquitous, providing a converged infrastructure for fixed and mobile networks continues to be a major priority for enterprises. In addition, the consolidation of multiple fixed networks such as traditional circuit switched voice, with packet switched networks such as frame relay and ATM, offers significant cost savings and management efficiencies. Migrating multiple layers of various networks to a common IP infrastructure has proven cost efficiencies as well as multiple benefits in the form of flexibility, productivity, and the benefits of leveraging the rich enhanced features of IP-based networking IDC #248259R1 2

3 What Are the Benefits of IP Networking? Integrated/Converged Platform The first step in implementing a truly converged infrastructure is usually the consolidation of legacy voice and data networks. Integrated access provides immediate cost savings by reducing the number of circuits as well as the management resources required for monitoring and maintaining multiple disparate circuits. Another key feature in moving to an integrated platform is the reduction of complexity in the WAN. Many companies are in the process of migrating from point-to-point private line networks to IP networking. In a similar vein, companies are also migrating from hub-and-spoke packet networks, which include frame relay and ATM networks. As in the consolidation of voice and data convergence, consolidating parallel data networks over IP provides cost savings and reduces complexity. Companies can save on the cost of managing and maintaining dedicated personnel for various packet switching technologies. Savings are also realized from the consolidation of CPE. Flexibility Flexibility is one of the major benefits of IP networking for businesses over traditional legacy network infrastructures. IP networks offer faster provisioning of hardware and services, such as the underlying network access layer. They also provide a much more efficient management structure for managing features at the application layer. Since IP can be provisioned as a mesh networking configuration, it not only can incorporate point-to-point networking for large sites but also can seamlessly integrate distributed remote offices and roaming personnel via secure gateways. As such, new users can be provisioned and authenticated within minutes rather than in days or weeks as in traditional legacy networks. Figure 2 shows AT&T's concept for implementing network convergence IDC #248259R1 3

4 FIGURE 2 Network Convergence VoIP Cloud Services Unified Communications IP Conferencing Hosting Security Fixed Mobile Application Layer AT&T POP AT&T Global MPLS - Enabled Network Internet Wireless Broadband WiFi 4G LTE Mobile Worker Fiber DSL Ethernet Nomadic Worker Remote Worker Source: AT&T, 2015 Network and Device Security The vulnerability of IT organizations to sophisticated internal and external network security threats continues to be top of mind for enterprises. Some of the most important network security issues include identifying and implementing relevant security policies. Network security remains a top-of-mind issue for enterprises and is a primary function currently being delivered via the managed services model. Growth in this market continues to be driven by many enterprises making the decision to utilize a managed security services provider rather than build a costly internal security operations team to manage and monitor their security processes. Security has become one of the fastest-growing areas of managed network services largely because of the rapid changes occurring in the security threat landscape. Requirements around compliance, identity management, and data protection will continue to drive spending growth in this area. Another key aspect of network security is implementing a security road map for mobile devices. This is a multifaceted and complex issue. The first key consideration is the implementation of policies for accessing corporate applications. The proliferation of mobile devices both corporate- and employeeliable devices to access enterprise networks will require investment in mobile security technologies to protect the devices, content, applications, and data resident on the devices IDC #248259R1 4

5 IDC expects that in 2015, 70% of all smartphones used for business will be owned by the employees rather than the enterprise. This widespread use of employee-liable devices presents its own unique security challenges since enforcing security policies can be more difficult when the enterprise does not own the mobile device. Bring-your-own-device (BYOD) growth rates increase the risk of personal devices infecting enterprise networks. Mobile devices are becoming an appealing security risk for corporations. Company data is increasingly at risk of being compromised by malware. In fact, according to a recent IDC survey on mobile security, 62% of all U.S. enterprises cite malware as a top mobile security threat. Businesses need to consider the following factors when implementing a mobile security policy: Perhaps the most important starting point for mobile security policy is figuring out who in the company will get access to mobile devices. What is the profile of your mobile worker (knowledge workers, field workers, factory workers, etc.)? What kinds of information do these people need access to and from where? What devices and networks will they access this information on? Are these devices corporate or employee liable? The type of mobile applications that will be used by the company and the information sources that the company connects to are also important. Another important factor is selecting mobile device OS platforms that evolve rapidly and then deciding which OS the company will support for both corporate-owned and employee-owned devices. The architecture of the app (Web, native, hybrid) affects the security methodology used to secure it. What back-end sources does the app need to connect to, and where do those resources reside? Mobile apps can vary greatly in terms of complexity it is not uncommon for one app to need to connect to behind-the-firewall back-end servers as well as public cloud services. Build versus buy who owns your application IP, and are they keeping up with the fast pace of the mobile market? If they are not, can you be sure your application is secure? The Evolution of IP VPN Today, more than ever before, enterprise IT departments are under pressure to deliver more services, IT resources, and applications with less budget and staff. Company executives want their organizations to take full advantage of technology to enhance operations, improve communications, and build customer service, but they also want to minimize operating costs. At the same time, the nature of enterprise IP WAN services is changing with the increasing dominance of real-time VoIP and video- and data-intensive applications like backup, storage, rich media Web sites, cloud computing, datacenter virtualization, SaaS applications, and WiFi/mobility, leading to new Enterprise 2.0 applications and services. These new services are now expected to be available to any business customer anywhere on any device, even outside the workplace (see Figure 3) IDC #248259R1 5

6 FIGURE 3 Evolution of Enterprise WAN Enterprise 1.0 WAN Trends Voice Internet access Leased line to datacenters IP VPN connecting regional sites Central policy control Enterprise 2.0 WAN Trends VoIP MPLS/hybrid VPN Ethernet-based cloud connect Any-to-any remote access for VPN Application-aware VPNs Source: IDC, 2015 Enterprises today are focused on acquiring new high-bandwidth and mission-critical applications at economical prices. These next-generation applications and services are expected to help enterprises reduce the cost of business operations and travel budgets and become more efficient, productive, competitive, and global. Some examples of these new applications are: Cloud computing Datacenter virtualization VoIP and video applications Media-rich Web sites, digital signage, and software distribution Business continuity and disaster recovery Enterprises are looking to access these new services and applications anywhere, anytime, and with identical capabilities and consistent service qualities and security policies. These services are used to connect with remote sites, partners, and customers, regardless of access differences and geographic distances IDC #248259R1 6

7 Today, enterprises require the agility to respond quickly and adapt to changing markets. The new "normal" is an enterprise's requirement for WAN services that are "always on" and available "anywhere," and that has triggered the need for highly scalable, reliable, and traffic-engineered meshbased IP architectures with remote and mobile access to IP VPN. Unscalable, rigid, and uneconomical legacy VPNs and fixed leased lines are no longer tenable. To meet their new business communication goals, enterprises must rely on service providers that are committed to upgrading their infrastructures or those that can already meet their next-generation IP service and application requirements. The enterprise therefore needs network services that can adapt quickly. Service providers must be able to respond quickly to requests for changes in site services, applications, bandwidth, and QoS. As more interactive social networking, video, and other interactive new Web-based applications are deployed, enterprises need to adapt their WAN requirements. Figure 4 shows how today's business communication requirements are driving Enterprise 2.0 demands. FIGURE 4 CSP Service Virtualization: Enabling Enterprise Service Flexibility Customer Portal Legend: NFV = Network Function Virtualization vcpe = Virtual Customer Premise Equipment vpe = Virtual Provider Edge Optimized, Agile Paths NFV vpe SP Datacenter vcpe HQ NFV NFV vpe vcpe Branch Premium XaaS Service Provider: 1. Partner peering/resell 2. VPN creation 3. NFV service chaining Source: IDC, 2015 IP/MPLS Network vpe SaaS Cloud 2015 IDC #248259R1 7

8 Enterprises are also adopting hybrid WAN network configurations, combining Ethernet access with a network-based IP VPN service. These hybrid network solutions are also a popular method for upgrading legacy private line access from T1s to higher bandwidth rates such as Mb access while leveraging new technologies like Ethernet access. In many cases, enterprises continue to use private line or Ethernet private line (EPL) for point-to-point connectivity for key facilities and then implement Layer 3 VPNs for other facilities. For example, Ethernet connectivity or dedicated private lines may be implemented at large sites or to interconnect enterprise datacenters, while MPLS IP VPNs are used for site-to-site connectivity. Enterprises are interested in extending their enterprise network MPLS/IP VPN to include on-demand access to cloud service providers and SaaS providers, allowing them to maximize the use of emerging business applications hosted in the cloud and use a secure MPLS VPN service (refer back to Figure 4). AT&T's new NetBond service is a pre-integrated, cloud-within-the-network service that extends the enterprise AT&T MPLS private network directly into IBM's, Microsoft's, HP's, CSC's, and salesforce.com's respective clouds for the enterprise-grade security, performance, availability, and control of a private cloud. In addition to connecting to these private clouds, AT&T will offer enterprise users its NetBond dynamic virtual private networking service from Equinix datacenters, which are popular colocation facilities for cloud service providers. Since all endpoint connections route directly to the cloud, cloud solutions using AT&T NetBond not only deliver applications and data directly to users to help with several issues such as minimize latency and maximize bandwidth efficiency, enhanced reliability, QoS, and optimized performance but also deliver enterprise-grade security to better enable the provisioning of cloud computing resources. VoIP and Collaboration IDC identifies unified communications (UC) as a platform that combines advanced IP telephony calling and management; unified messaging ( , fax, and voice messaging combined); Web conferencing, audioconferencing, and videoconferencing; instant messaging (IM); and pervasive presence management and awareness all accessible through common user interfaces (UIs) on desktop and mobile devices using voice and/or tactile controls. UC solutions are designed to provide a way of delivering, managing, and supporting all of the various types of IP communications that an organization or individual requires in both horizontal and vertical industry business processes and applications. UC&C is a term that emphasizes the increasingly important role that collaboration applications and services are playing in support of the UC market. Collaborative applications and services provide the user interfaces, repositories, and computer logic required for individuals and groups of users to interact, coordinate tasks, and share voice, video, and data in real-time and non-real-time models IDC #248259R1 8

9 Hosting/Cloud/Network Function Virtualization According to recent IDC survey data, enterprises are increasing their use of public and private cloud services for hosting lower-priority IP-based network applications, beginning with the applications that do not require stringent SLAs and latency restrictions. Many of these enterprises also prefer to use network capacity for these applications as a "virtualized network asset" that can be used for a short period of time, and they prefer an IP-based network that can provide access to these cloud resources dynamically, similar to virtual machines (VMs) in cloud computing. AT&T is one of the first IP networking service providers to lead a telecom industry transformation to standardize many of the current physical telecom network functions (such as firewalls, CPE) with software-defined network function virtualization (NFV) and to embrace open, programmable software platforms. This new development will eventually lower operating costs for telecom operators but, more importantly, will improve service delivery, service flexibility, and service agility to enterprises. The flexibility of newer IP networks that can support this mix of robust private IP network services with dynamic, virtualized cloud-based services and offer a consistent enterprise customer experience backed by SLAs will provide enterprises with an easier choice for future WAN networking needs (refer back to Figure 3). CONCLUSION Today's enterprise WAN networking requirements are more complex than ever before and diverse, spanning 4G LTE access, IP VPN, unified communications, datacenter services, and access to cloud services. IP networking communications platforms that can enable this diverse mix of services with configuration flexibility, inherent security, and support for a wide range of business software applications with simpler, easy-to-use Web-based portals and tools will make it easier for enterprises to focus on their core business. Partnering with an experienced CSP like AT&T to help the enterprise manage current and future diverse communication requirements includes sharing the journey to transform network communication services to leverage a state-of-the-art IP network IDC #248259R1 9

10 About IDC International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. Global Headquarters 5 Speen Street Framingham, MA USA idc-insights-community.com Copyright Notice External Publication of IDC Information and Data Any IDC information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Vice President or Country Manager. A draft of the proposed document should accompany any such request. IDC reserves the right to deny approval of external usage for any reason. Copyright 2015 IDC. Reproduction without written permission is completely forbidden.