WHITE PAPER. Empowering the MSSP. Part 1: Real World Customer Needs

Transcription

1 WHITE PAPER Empowering the MSSP Part 1: Real World Customer Needs

2 Introduction MSSP Foundations for Success An increasing number of companies plan to spend more of their budget with managed security service providers (MSSP) in the coming years. According to Frost & Sullivan, overall Managed Security Services (MSS) market is expected to grow from $9B in 2013 to $15B by The significant MSSP growth numbers show a clear trend, and there s a growing consensus that outsourcing security is a viable option for small, medium and large enterprises. Enterprise customers have driven much of the growth, but as the market is maturing, the SMB (Small and Medium Business) sector is now beginning to adopt in large numbers. According to Frost & Sullivan, SMB MSS spend will double to nearly 50% of the total MSS market in The challenge with SMB MSS adoption is that the typical small and medium business expects lower price points, with many of the features that enterprise-sized customers would expect. In response to this new and growing demand, MSSPs are expanding and new players are entering the managed security services market. This is good news for the different customer segments as it increases choice and makes services pricing more competitive. It also makes provider selection more challenging because of the increased number of MSSPs and service choices. There are four basic elements that are crucial to the MSSP success: Broad scope of services facilitates the MSSP service and price segmentation to meet SMB and enterprise security and commercial needs. A broad service portfolio assures MSS evolution over time as customer s requirements evolve in terms of service scope and service performance, when and where required. Flexible delivery modes such as CPE-based, Cloud-based (Security-software and hardware-as-a-service) and hybrid CPE-Cloud implementation, enables a flexible, efficient, cost-effective offering and deployment vehicle to offer SMB and enterprise segments targeted services that answer both their security needs and cost levels. Co-management shares management responsibilities between the SMB / enterprise and the MSSP. Enabling an MSSP portal as a point of access, reporting and management of the customer s MSS reduces the MSSP OPEX while allowing better customer visibility and control over its purchased MSS. Proven, licensed technology is crucial as it is the core and base upon which MSSPs provide their portfolio of services, delivery models and cost efficiency. Residential / SOHO Delivery Models Scope of Services Licensed Technology Small & Medium business (SMB) Enterprise 2 Market Value CPE-based Delivery Traditional and most common MSS delivery for MSSPs. CPE-based MSS, although growing at a steady rate,

3 Delivery Models Scope of Services Licensed Technology Small & Medium business (SMB) MSS Delivery Modes Residential / SOHO Enable Flexibility and Cost-Effectiveness Enterprise Managed Security Service Providers (MSSP) must be able to provide a combination of MSS delivery modes that are most suitable to the different needs and challenges presented by each of these market segments: Market Value CPE-based Delivery Cloud-based Delivery Traditional and most common MSS delivery for MSSPs. CPE-based MSS, although growing at a steady rate, are loosing marketshare to clound and hybrid-based MSS. Hybrid-based Delivery Cloud-based MSS market is the fastest growing within the MSSP market as technology enables rich and competitve MSS for SMB and enterprise market segments. Hybrid-based MSS become more common as customers begin to understand the benefits and flexibility of having both type of MSS deployments depending on their needs. Time CPE-based Managed Security Service (MSS) delivery is implemented via security appliances located in the customer premises and managed by the MSSP. This delivery model is most suitable for retail and smaller SMB and enterprise customers with a multi-location environments. This delivery model has been the traditional scenario for MSSPs. Although This market is growing at a stable rate and will continue to represent a major part of MSSP revenues, it is being out-paced by an increasing number of organizations shifting towards cloud-based MSS. According to Infonetics research, CPE-based MSS market share will drop from 57% in 2013 to 50% in

4 Cloud-based MSS delivery is implemented by having some or all the security infrastructure located, managed and maintained in the MSSP s cloud. The MSS are delivered as a Security-as-a-Service to the customer premises. The fact that within the customer premises there are limited or no security appliances upon which the service is delivered, provides a supporting environment for customers migrating to a cloud architecture. This delivery model is enjoying rapid adaptation as it enables MSSPs to enhance their service offerings while better monetizing their security infrastructure upon which they deliver their services. It also provide very flexible and dynamic options such as security on demand. It is estimated that overall Cloudbased MSS will grow to 69% of the overall MSS market over the next 5 years. Hybrid-based MSS delivery is based on a combination whereby the security infrastructure is installed both at the customer premises and the MSSP cloud to provide the required security services. This delivery model provides the highest flexibility in meeting specific customer requirements. It also facilitates an enterprise s cloud migration as CPE based security services can be gradually migrated to the MSSP cloud as a Security-as-a-Service. FIGURE 1: MSSP DELIVERY MODELS 4

5 Scope of MSS Meeting Real-World Security Needs The changing landscape of threats and the rapid evolution of access and core technologies puts an ever growing pressure on the range and depth of security services required by different market segments. From clean-pipe and secure services to applications delivery and Advanced Threat Protection (ATP) services, the scope of MSS must address the concerns of the different market segments. In this section we present the main security concerns that MSSPs are expected to address via appropriate services. SMB and Enterprise Customers Regardless of their size, organizations are under constant pressure to effectively deploy and manage their network and IT infrastructure. Whether a single site Small and Medium Business (SMB) or multi-site enterprise, companies may face similar, yet on a different scale, securityrelated operational, business and mandatory issues and requirements. SMB and enterprise customers are subjected to the same threat environment and therefore need to put in place similar security strategies and defenses and meet the same regulatory and compliance requirements. Both are looking to maintain real-time threat protection and security expertise while reducing related CAPEX and OPEX. By definition, SMB are smaller in size (head count, technical expertise, number of locations, turnover, etc.) and therefore limited in CAPEX and OPEX resources to put into their defense and mitigation. The lack of specific security and network architects and resources drive SMBs to look to MSSPs for guidance and delivery of MSS adapted to their security and networking needs within an appropriate range of service pricing. The reliance and use of advanced IT technologies such as virtualization and the cloud are more common to the enterprise market segment due to several factors such as in-house expertise and the importance of applications and data in revenue generation, customer loyalty, brand awareness, reputation and the overall enterprise ecosystem. A key to the MSSP s success is understanding the security challenges facing both the SMB and enterprises in order to be able to build the right security infrastructure and deliver the appropriate MSS at competitive price points: Perimeter Security Services - The MSS Foundations Securing the perimeter is the first line of defense for any SMB or enterprise customer. This security service establishes a clear logical and physical deny-by-default boundary and the limited paths into the customer s network, data and applications. Beyond keeping the bad guys out, it controls the chaos of what enters the network. It is the foundation upon which additional layers of protection are then applied, whether at ingress/egress points or deeper within the network. The perimeter security services may include firewall, Intrusion Protection (IPS), Application Control, etc. These are the fundamental services that SMBs and enterprises require and make up the majority of the MSS market. It is therefore crucial that MSSPs provide these services on a high peformance infrastructure (virtual, physical or hybrid) that is highly scalable in a multi-tenant environment and provides high availability and disaster recovery. Fixed and Wireless Secure Connectivity Services Broad adoption of IEEE has created a complex Wi-Fi landscape with proliferating mobile devices and applications. It is no longer sufficient to treat all Wi-Fi users and applications alike and companies see the need to deploy and enforce WLAN control policies. The growing trend of Bring Your Own Device (BYOD) and Bring Your Own Application (BYOA) adds additional security challenges. In order to achieve a unified security policy enforcement, 5

6 security must be fully integrated into the fabric of the network. Deployment and management of the wireless infrastructure as part of the overall security services, network security, authentication, user, device and application based identification and policies enforcement are part of the MSSP services that SMB and enterprises are looking to outsource. These services provide real competitive differentiation and additional revenue streams for MSSPs. Application Level Threats The fastest growing categories of attacks and data breaches are those that target applications, application layer services and inexperienced users. These represent most of a network s weak spots and there are countless possibilities to exploit code vulnerabilities, application modules, and trusting users who think that the they just received was a legitimate request to reset their account credentials. Application Security Threats Public facing applications are attractive targets Sensitive customer and proprietary data exposed Almost every web application has vulnerabilities Firewalls can only detect known threats 95% of all websites have experienced cross-site scripting and SQL injection attacks Web Application Attacks Since 2010, The Open Web Application Security Project (OWASP) has consistently reported that almost every webbased application has one or more vulnerabilities listed in their 2013 Top 10 list of application security risks. They have also reported that 95% of all websites have been hit by one or more instances of cross-site scripting or SQL injection attacks in the past year. Gartner stated in their recently published 2014 Web Application Firewall Magic Quadrant that they expect over 80% of all enterprises will have a WAF in place by 2018 to protect against web application attacks (up from 60% in 2014). For SMB and enterprises, webbased applications are today one of the main interfaces to their clients and partners and securing these interfaces and applications are critical. Therefore MSSP should include a Web Application Firewall MSS as part of their portfolio. Application Layer DDoS attacks Distributed Denial of Service (DDoS) attacks have evolved over the past decade to target application level services. In contrast to volumetric DDoS attacks, application-layer DDoS attacks do not rely on huge amounts of bandwidth. Instead, DDoS attacks targeting layer 7 tend to rely on low traffic rates, but a high number of concurrent connections. By targeting the underlying application logic of Web servers, credential systems and others that can only handle a certain number of simultaneous requests, attackers can bring down infrastructures in a stealthier manner. DDoS attacks are still ranked as the top threat by data center managers compared to other events like infrastructure outages and bandwidth saturation. It is important that DDoS mitigation MSS will include all possible variations of DDoS attacks, from layer 3 to the application level. Advanced DDoS Threats Remains #1 threat to data center managers DDoS Layer 7 threats fastest growing category Firewalls have limited abilities to counter layer 7 DDoS attacks Small layer 7 attacks under 50 Mbps can do as much damage large volumetric attacks Advanced Persistent Threats (APT) Enterprises are under attack by increasingly sophisticated threats. In 2013 and into 2014, there have been many big name security breaches including Target Corporation, Adobe, Tesco, Snecma, LaCie, KT Corp, Yahoo Japan, and the New York Times. Gartner recently stated all organizations should now assume that they are in a state of continuous compromise. These new threats look for opportunities to bypass traditional firewalls and other company-specific defenses, install custom malware, and then systematically and stealthily scrub every corner the organization for data. MSSPs delivering an Advanced Threat Protection (ATP) service can meet customers most advanced concerns while creating additional competitive advantage. Growth of SSL Encrypted Data Many enterprises are aggressively expanding SSL to all their web-facing applications to protect sensitive data. Sandvine s latest Global Internet Phenomena Report demonstrated that encrypted traffic is growing at an unprecedented rate. In North America, SSL encrypted traffic usage surged from 2.29 percent in 2013 to 3.8 percent through May Europe saw a quadruple rise over that same time period with an increase from 1.47 percent to 6.1 percent. Latin American SSL traffic jumped from 1.8 percent to percent. These numbers are staggering when you consider that Internet traffic continues along at a 23% annual growth rate. Combined with this explosive expansion in traffic, the complexity of moving to more advanced encryption keys as the technology expands from 1,024 keys to 2,048 and now 4,096, is doubling and even quadrupling secure packet sizes. 6

7 SMB and enterprise s servers and application load balancers are struggling to keep up with this demand and are looking for MSS to be able to allow them to cost-effectively meet this dramatic expansion. Growth of SSL Traffic Enterprises are rapidly deploying SSL to protect all applications Firewalls usually have limited application delivery functionality Expansion of complex encryption keys (2,048 and 4,096) put increased demands on data center resources - Securing The Back Door is a critical business service, but it is one of the greatest vulnerabilities when it comes to security. It has become the primary target that criminals use as they take advantage of poor security policies and unsophisticated users. Remains a Top Attack Vector Even sophisticated SMB and enterprise users are falling prey to advanced phishing schemes Data leakage of sensitive materials is a major risk to your customers Firewalls can t stop users from making mistakes threats come in two primary forms, inbound and outbound. Inbound are the traditional threats like spam and phishing attacks that attempt to lure users into providing sensitive information such as login credentials or credit card information. Outbound threats aren t really attacks, rather they are risks to organization s sensitive information. Employees, contractors and consultants have the ability to send proprietary information to anyone, anywhere - intentionally or by mistake. Protecting and securing SMB and enterprise service is one of the basic MSS within an MSSP portfolio. Residential and Small Office/ Home Office (SOHO) Due to the very limited awareness and understanding of basic security needs by the residential and SOHO markets and the availability of free desktop anti-virus, anti-malware and anti-spam clients, providing security services to residential customers is nearly always a cost/price decision. While most households will find it difficult to justify any MSS-related expenditure, SOHO customers will positively consider using a price-competitive MSS, such as a clean pipe service, as an alternative to purchasing a full suite of anti-virus software or the purchase and maintenance of a local firewall. Taking these consideration into account, it is difficult to commercially justify the CAPEX and OPEX associated in building, launching and maintaining MSS for the residential / SOHO market. Yet, many established MSSPs offer a range of security services to the residential and SOHO markets: Why? MSS may be marketed and delivered to increase the overall service stickiness, increase operator MSSP awareness and create/match competitive offering. This is normally the case in existing Communication Service Provider (CSP) delivering multiple mobile and fixed residential services alongside its managed security offering. As direct revenue generation is not the main driver for such a service, the questions of MSS ROI and profitability for this specific market are secondary. In some cases, there are country-specific laws that require MSSPs / service providers to provide basic security services such as parental control as part of their minimal service offerings. Some MSSPs will build their own MSS platform for the residential / SOHO market, utilizing open-source tools with no reporting or customer portal. This significantly reduces the MSSP s TCO for this market and enables it to aggressively market it. Whatever the reasons, this market has the following characteristics that determine the scope of MSS and delivery mode that an MSSP would consider providing: Mass market - a market with extremely high Internet access penetration represents a significant number of potential customers to which the MSSP should provide the required services. The potential size of the residential market has two direct implication for the MSSP : 1. The security infrastructure that delivers these services must be able to support very large numbers of customers and gracefully scale up as the MSSP customer base grows. 2. A cloud-based Securityas-a-Service delivery model is imposed as the CAPEX and OPEX of a CPE-based delivery is cost prohibitive. Limited scope of services - the nature of this market and its limited sophistication and budget requires a limited scope of rather basic MSS. These services may typically include: Firewall (Anti-virus and Anti-malware), Web Filtering and Application Control. 7

8 Fortinet s Ecosystem for MSSP Empowering Managed Security Service Providers Each of the areas presented in the previous section represent unique needs, service requirements and challenges. The cornerstone of these services must be a robust Next Generation Firewall (NGFW) to provide the FW and IPS foundations for an ecosystem providing specialized and high performance security services tailored for today s market requirements and needs, with built-in mechanisms to enable evolution for the delivery of future MSS. These purpose-built products, virtualized or physical, are needed as even the highest performance, ASIC driven NGFW cannot provide all the required services and maintain the appropriate level of performance and low latency required in the MSSP s multi-tenant and high availability environment. In the face of the threats presented in this document, Fortinet offers MSSPs the industry s most robust, end-to-end security ecosystem. This ecosystem is build around the foundations provided by the FortiGate NGFW, with complementary, purposebuilt solutions to enrich and supplement the MSSPs overall service offerings to SMBs and enterprises. These include: Service Delivered by Delivery mode enabled Firewall FortiGate CPE/Cloud/Hybrid AntiVirus FortiGate CPE/Cloud/Hybrid NAT FortiGate CPE/Cloud/Hybrid VPN FortiGate CPE/Cloud/Hybrid Web Filtering FortiGate CPE/Cloud/Hybrid Application Control FortiGate CPE/Cloud/Hybrid IP Reputation FortiGate/DDoS/Mail/Web CPE/Cloud/Hybrid IPS FortiGate CPE/Cloud/Hybrid Data Loss Prevention FortiGate & FortiMail CPE/Cloud/Hybrid NGFW FortiGate CPE/Cloud/Hybrid Security FortiMail CPE/Cloud/Hybrid Web Application Firewall FortiWeb CPE/Cloud/Hybrid DDoS Mitigation Forti DDoS & FortiGate CPE/Cloud/Hybrid Secured WiFi Connectivity FortiWiFi & AP CPE Brick-and-mortar retail customer behavior analysis FortiPresence Cloud Application Availability FortiADC CPE/Cloud/Hybrid SSL Offload FortiADC CPE/Cloud/Hybrid Identity Management & SSO FortiAuthenticator CPE/Cloud/Hybrid Breach Detection (ATP) FortiSandbox CPE/Cloud/Hybrid Centrelized Management FortiManager CPE/Cloud/Hybrid Reporting FortiAnalyzer CPE/Cloud/Hybrid User Portal FortiPrivateCloud Cloud 8

9 Summary As the threat landscape continues to evolve, businesses of all sizes are finding themselves locked in an increasingly costly battle to protect their assets, be it networks, users, customers, partners, applications and data, against a dynamic, rapidly evolving and sophisticated cybercriminal community. SMBs and enterprises are looking, not just to secure their network and assets, but to reduce overall IT and security related CAPEX and OPEX. On one hand, this drives an increase in MSS awareness and adoptation that fuels the growth of the MSSP market. On the other hand, it challenges existing and new MSSPs to better understand the challenges and needs of their potential customers and deliver the appropriate services and service packages in a commercially competitive environment. Fortinet, as a leading security solution provider for SMBs, enterprises, Communication Service Providers (CSP) and MSSPs, has an intimate visibility and understanding of the threat landscape that drive these organizations security challenges and needs. Fortinet s ecosystem is more than just a set of purpose-built solutions complementing a NGFW: It is an integrated and intelligent ecosystem that provides security services that are bigger than the sum of its components, such as FortiMail s and FortiGate s integration with FortiSandbox for Advanced Threat Protection. It enables the widest breath of service delivery, including the delivery and management of network switching and the business wireless infrastructure. It shares a single intelligent brain, FortiOS that keeps evolving to defend against the changing threat landscape through continuous updates from FortiGuard Lab. It provides a set of management tools enabling MSSP - customer infrastructure and MSS co-management, enforcement and reporting. By design, Fortinet s end-to-end security ecosystem enables MSSPs to build and deliver real-world managed security services to the residential, SOHO, SMB and enterprise markets. Its unique attributes empower existing and emerging MSSPs to deliver the widest range of MSS, while reducing both CAPEX and OPEX to maximize their ROI while responding to the needs posed by today s and tomorrow s threats. 9

10 WHITE PAPER GLOBAL HEADQUARTERS Fortinet Inc. 899 Kifer Road Sunnyvale, CA United States Tel: EMEA SALES OFFICE 120 rue Albert Caquot 06560, Sophia Antipolis, France Tel: APAC SALES OFFICE 300 Beach Road The Concourse Singapore Tel: LATIN AMERICA SALES OFFICE Prol. Paseo de la Reforma 115 Int. 702 Col. Lomas de Santa Fe, C.P Del. Alvaro Obregón México D.F. Tel: (55) Copyright 2014 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other resultsmay vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.