WHITE PAPER. Realizing ROI from Your Network Visibility Investment

Transcription

1 WHITE PAPER Realizing ROI from Your Network Visibility Investment Rev. A, March 2014

2 2

3 Table of Contents Executive Summary... 4 Introduction... 4 Network Visibility ROI... 5 Potential Cost Reduction Examples... 5 Potential Cost Avoidance Examples... 6 Potential Revenue Generation Examples... 7 Quantifying The Value From Network Visibility... 8 Equipment costs... 8 IT Personnel and Troubleshooting costs... 8 Company data... 9 ROI Tool Output... 9 The Cost of Doing Nothing The Final Analysis

4 Executive Summary In this budget-constrained environment, all IT directors and executives are trying to maximize the value of their network investments. When looking at some of the potential networking investments for the next several years, there are a number of options that appear to be significant sources of return on investment (ROI) for IT departments. These include: network visibility and optimization, data center/central office automation, application management improvements, conversion of data to actionable insight, and business intelligence investment. This paper will focus on the many ways in which a proper network visibility solution can reduce the network infrastructure s total cost of ownership (TCO) and drive ROI. In this budgetconstrained environment, all IT directors and executives are trying to maximize the value of their network investments. ROI is the supreme yardstick of investment success, and the right network access and monitoring strategy is key to realizing that potential value. Naturally, decision-makers need a way to objectively view and measure the return on their visibility investments. What do we mean by this, and how do you measure network visibility ROI? We ll explore this and a way to successfully quantify the ROI of network monitoring switches, also called network packet brokers (NPBs). 4

5 Introduction Rapid evolution of the data center creates both urgent challenges and outstanding revenue opportunities; of course, these vary according to the organization and its unique goals and concerns. However, all IT teams have to deal with the proliferation of devices from multiple vendors, threats in every form, and scalability needs. The ongoing 1G/10G/40G/100G network transition, along with environmental and compliance concerns and many more issues, also have a significant impact. Over the course of the next several years, there will be many places and opportunities to optimize savings for IT. A solution for increased network visibility offers IT professionals the best and most sought-after opportunities to: Reduce complexity Decrease costs Improve business agility Specifically, many companies are using network visibility solutions to: lower mean time to repair (MTTR), reduce CAPEX/OPEX, centralize provisioning and orchestration, and data center automation. A visibility strategy founded on an advanced monitoring switch gives the IT team substantial access to critical parts of the network and control over the information sent to monitoring performance and security analysis tools. This helps maximize tool performance and network security responsiveness. A starting point for calculating the return on a network investment is to evaluate the pain points that plague the IT team with their consequent monetary losses. These have to be weighed against the costs of new investments to resolve these issues. Keeping the network available 24/7 is vital, but major rip and replace upgrades can become so expensive that many benefits are canceled out. Network Visibility ROI When calculating a return on investment, there are typically three sources for investment value: Rapid evolution of the data center creates both urgent challenges and outstanding revenue opportunities; of course, these vary according to the organization and its unique goals and concerns. Cost reduction Cost avoidance Revenue generation The three categories form the basis of the upside. The downside is obviously the short- and long-term costs associated with the equipment or service purchase. In the case of network visibility investments, there can be value in all three categories, depending upon how your business deploys visibility solution components. This value is summarized below. Potential Cost Reduction Examples The following list provides a quick summary of common cost reduction examples: Eliminate change board approval delays Reduce debugging time and MTTR 5

6 Eliminate costs of adding additional monitoring tools Reduce or eliminate CAPEX costs for tap ports Minimize OPEX costs for monitoring tools and scenarios Remove data clutter and the resulting unnecessary costs In regard to eliminating change board approval delays, the time to resolution is reduced by not having to wait for a maintenance window anymore. Debugging activities can be implemented immediately. It is common for organizations to have more monitoring tools than available tap or SPAN ports. Since new equipment needs to be inserted into the production network to gather performance and debugging data, this must often happen during the maintenance window to prevent business productivity impacts. In addition, the IT staff productivity losses (that were accumulated during the process of gathering management approvals to interrupt the production network, even during a maintenance window) are now eliminated. Once an NPB is inserted into the network, no further disruption occurs, assuming the NPB supports hitless changes. Monitoring tools can be connected to the NPB at will. By its nature, an NPB can help eliminate the costs of adding additional monitoring tools to your network. An NPB will often help reduce the debugging time required per incident. A faster response time and MTTR is realized by distributing multiple copies of the same information to multiple debugging tools and processes. For instance, relevant packet captures can be created at the time of incident and forwarded on to Tier 2 and Tier 3 personnel for faster resolution by the Tier 2 or 3 technicians/engineers. In addition, automated packet captures can be triggered for anomalous incidents that help in the reduction of data (packet) loss that is critical for problem resolution processes. In at least one customer environment, what used to take one week to accomplish was accomplished in less than one hour with this feature. A typical savings factor of 60 percent in MTTR can normally be attributed to an NPB. By its nature, an NPB can help eliminate the costs of adding additional monitoring tools to your network. This can be accomplished by using features like aggregation and load balancing, that allow you to optimize the flow of data to your existing monitoring tools and maximize the efficiency of those tools. Aggregation enables you to maximize the utility of existing, under-utilized monitoring tools so you monitor more links with fewer tools. This helps reduce CAPEX costs for additional monitoring tools. CAPEX can be reduced or eliminated for additional taps, as the NPB can serve as the network access device for expanding monitoring and security tools. It is also possible that other monitoring equipment may not be needed. Operational expenditures (OPEX) costs for staff and maintenance activities can be minimized with an NPB by reducing the time to: set up monitoring tools, configure the filtering mechanisms for the monitoring tools, administer management and reporting configurations from the tools, and reduce the effort needed to insert the new monitoring tools into their appropriate network locations. In addition, the filtering capabilities of an NPB help segment the data from anomalies and problems to generate a faster mitigation response time, which directly lowers operational expenses. Removing clutter is accomplished using the de-duplication feature of an NPB. Deduplication reduces unnecessary packets to save on storage costs and increases monitoring tool processing capability. Without the NPB de-duplication feature, the monitoring tools will either spend effort processing multiple copies of the same data or have to use microprocessor effort within the tool to perform the de-duplication activity. In either scenario, the efficiency of the monitoring tools is suboptimal and creates waste. 6

7 One note: de-duplication can also result from mismatched network equipment speeds (i.e. mixing 1 GE with 10 and 40 GE equipment). An NPB can be used to help diagnose this problem, as certain duplicates can cause equipment resets. Potential Cost Avoidance Examples Cost avoidance doesn t mean that you won t have to spend money for additional network equipment or upgrades; rather, it means that you can delay those costs. This delay can be beneficial if your current fiscal budget is already depleted, or near depletion. The cost of purchasing an NPB is often less than the cost of one or two new monitoring tools. Examples of cost avoidance include: Continued investment realization from your current tools, especially after a network upgrade Reduction or elimination of SLA penalties Removal of unnecessary or sensitive data that can cause regulatory issues/fines Use of automation to improve integration to other network equipment and save or avoid costs An NPB can help you avoid additional network equipment purchases, especially when it comes to monitoring tools. This is especially true in the case where you have just upgraded your network to 10, 40 or 100 GE. If you didn t budget for purchasing new monitoring tools (or if you needed that budget for unforeseen problems in the core network upgrade process), you can use the load balancing feature within an NPB to segment packets to specific monitoring tools (that might have lower data rates than the line rate). Essentially, you take the line rate and step it down by splitting that data over multiple tools, then send the data to specialized tools and/or monitoring apps while controlling how much data goes to any specific tool. This is one way network engineers can continue to use 1 GE tools instead of purchasing 10/40/100 GE tools. You ll probably still need to purchase the higher rate tools down the road, but this gives you a way to delay those costs, should you need to. User satisfaction and service level agreements (SLAs) are major priorities for IT. User satisfaction and service level agreements (SLAs) are major priorities for IT. NPBs can be used to gather the data necessary to validate or expose SLAs in use. Once data is gathered from the filters set up in an NPB, that data can either be analyzed by specific monitoring tools or potentially by the NPB directly (if it can collect and record the required statistical information). The results can then be used to improve the network, reduce or eliminate SLA penalties as applicable, and lower any associated costs. Packet slicing is another NPB feature that allows only relevant data to be sent to monitoring tools. This has two major benefits: For one, it speeds up packet processing time for the specific monitoring tools; for another, it can help eliminate compliance issues. For instance, the PCI standard specifies exactly how credit card information is secured and who has access to that information. Transmitting that information to improper destinations (such as network monitoring tools) can result in security leaks or potential fines from payment card industry auditors. An NPB can strip the information from data packets before it is transmitted to monitoring tools. This is a very important security element, as it keeps unauthorized personnel away from important data! Another way to avoid and/or reduce costs is to implement automation capabilities that improve integration to other network equipment. Automation capability is critical, in that part of the value proposition of a visibility network is to improve network and configuration management. The last thing you want is for the NPB and other equipment to add network 7

8 management overhead. Intelligent traffic routing/filtering that can be programmed easily is imperative to ensure that the visibility architecture equipment is utilized within the network. One approach is to use an NPB with a web-based interface that allows for integration to security information and event management (SIEM) tools for faster analysis and diversion/ elimination of security threats. This preserves intellectual property and reputation value for the business. A second example is for a web-based interface to allow integration of the NPB to a network management system (NMS). This allows monitoring tool connections to be spun up automatically to investigate network anomalies with packet captures. This approach can be a substantial source of productivity savings, lowering IT s mean time to issue recognition and MTTR. Potential Revenue Generation Examples A typical visibility solution will have the following components: access points (tap and SPAN ports), network monitoring switch (e.g. NPB), and monitoring tools. While adding an NPB to your network will not directly create revenue, using the NPB to more quickly resolve network problems can decrease the amount of time that a network is down or running slowly. This means that a good visibility architecture will directly contribute to the following business initiatives: Maximize e-commerce uptime Maximize website performance The amount of financial contribution that the NPB delivers is dependent upon your problem resolution strategies and processes. What is clear is that every minute a network is down or underperforming can affect business revenue, particularly in the case where your business conducts e-commerce activities and sales through the website. The website is your public image and MUST be kept up and running! As mentioned earlier, creation of proper diagnostic filters, load balancing, automated capabilities, and other NPB features allow IT the ability to diagnose problems faster than manual methods. This creates a much faster MTTR. Many businesses have experienced this level of time savings that decreases network MTTR by hours and even days. Multiply that MTTR by average cost per minute for an outage: how much is that cost/potential revenue saved? Any website down time affects the corporate image! Who wants to work with a technology company that cannot keep its own network up? The NPB can also be used to help maximize application performance. Customers for webservices and other service offerings will abandon your web site if delays are too long due to inefficiencies and network performance issues. NPBs coupled with specific monitoring tools can also be used to proactively scan your network for issues before they result in outages, further limiting any potential revenue impacts. Quantifying The Value From Network Visibility Let s look at an example of the business case for a visibility solution. A typical visibility solution will have the following components: access points (tap and SPAN ports), network monitoring switch (e.g. NPB), and monitoring tools. Most enterprise networks already have some access points and monitoring tools deployed. So the financial question is, should they deploy an NPB as well? And, will this NPB generate an ROI to justify the deployment? 8

9 For the purposes of this analysis, we ll use the following input as part of an ROI analysis. Note, these figures are conservative and the average costs and benefits could be much higher for a Fortune 5000 or larger enterprise. This is especially pertinent to security breach costs, monitoring tool acquisition and maintenance costs, and the number of network incidents per year. Equipment costs Monitoring switch equipment costs: $92,500 (typical ranges are $17K to $200K, depending upon port count) Monitoring switch maintenance costs: 10% per year New monitoring tools: $0 (as it is assumed that these are already in use in your network) New tap (or SPAN port): $0 (as it is assumed that these are already in use in your network) Acquisition cost of current tap or probe: $5,000 IT Personnel and Troubleshooting costs IT employees: 50 IT network managers: 5 Number of network incidents that need remediation during a year: 12 Average number of hours of business slowdown, delay or rework that results per incident: 2 hours Number of security breaches per year: 0.8 IT staff hours required to remediate a breach: 60 IT Admin cost per hour: $31 IT Network engineer cost per hour: $43 Company data Total number of business employees: 1,000 Average employee cost per hour: $48 Cost per minute of system outage: $96.15 Number of minutes per network outage: 4 ROI Tool Output From the inputs mentioned previously, an ROI calculator can be used to generate the Return on Investment, Payback Period, Total Costs, Total Benefits and Net Present Value of the Investment. From the inputs mentioned previously, an ROI calculator can be used to generate the Return on Investment, Payback Period, Total Costs, Total Benefits and Net Present Value of the Investment. Once this data is entered into an ROI calculator, results are returned that combine various cost reductions and avoidance as described earlier. Specifically, the ROI reduction comes from: avoided new equipment purchases, reduced network downtime, productivity improvements, and faster troubleshooting efforts. 9

10 Here are some sample output graphs from a reliable ROI calculator: Financial Summary (Risk-Adjusted Estimates) ROI 112% Payback Period (months) Payback Period (PV) Total cost (PV) Not present value 8.0 $716,989 ($338,207) $375,782 Figure 1 Basic Return on Investment Summary $600,000 Financial Summary (Risk-Adjusted Estimates) $500,000 $400,000 $300,000 $200,000 $100,000 $0 ($100,000) Initial Year 1 Year 2 Year 3 ($200,000) Figure 2 - Graph of Cash Flow Figure 2 Graph of Cash Flow Cash Flow Analysis (Risk-Adjusted Estimates) Summary Initial Year 1 Year 2 Year 3 Total Present Value Total Costs ($137,571) ($80,679) ($80,679) ($80,679) ($379,607) ($338,207) Total Benefits $0 $288,312 $288,312 $288,312 $864,964 $716,989 Total ($137,571) $207,633 $207,633 $207,633 $485,329 $378,782 ROI 112% Running Total ($137,571) $70,062 $277,696 $485,329 Payback Period (months) Figure 3 Cash Flow Analysis 10

11 Cost by Category (risk-adjusted) Initial and ongoing licence costs Professional services costs Internal implementation cost IT training costs Ongoing administration costs Ongoing impact costs Figure 4 Benefit Analysis Breakdown Benefits by Category (risk-adjusted) IT Productivity Gain Associated with Real-Time Networking Monitoring and Maintenance Improved security and Prevention of data loss Cost Avoidance of Network Taps and Span Ports Business Productivity Gain from Improved Network Monitoring Tools and Probes Figure 5 Cost Analysis Breakdown As you can see by Figure 1, the ROI on this particular investment was 112% with a payback period of less than a year 8 months to be exact. Other ROI analyses range from 100% up to 300 and 400% it simply depends upon the network design and how much the network packet broker is used. 11

12 The Cost of Doing Nothing There is always an alternative to making an investment. It s called Do Nothing. While some people think this course of action automatically saves them money, the reality is that this decision usually has a financial cost in itself. That cost may be large or small, but it almost always exists. ROI analysis for network visibility can be clearly quantified with the proper methodology and tool set. With respect to postponing (or not implementing at all) network visibility improvements, enterprises commonly experience the following costs: Reduced productivity Higher problem resolution costs Higher problem recognition time and thus higher resolution time Increased complexity Lack of agility Lack of monitoring coverage. (Most businesses don t have enough money to buy tools for every network segment, so at least some parts of the network will not have coverage) Potential compliance issues Higher network security risk Higher OPEX due to increased management and network change overhead As the costs of the current processes mount, they can affect the company bottom line, as well as the IT manager s career path. The Final Analysis ROI analysis for network visibility can be clearly quantified with the proper methodology and tool set. This value can be created from both hard savings (actual costs) and soft savings (such as productivity savings). In most instances, a visibility architecture provides for hard savings examples that can be summarized as follows: Reduced CAPEX equipment costs for taps and/or SPAN ports Eliminated/delayed CAPEX equipment costs and maintenance costs for expensive monitoring tools Improved diagnostic capabilities to reduce network and problem MTTR Assistance with minimizing network downtime of e-commerce sites, which helps generate maximum uptime equating to maximum revenue In addition to the hard savings, increased productivity yields significant soft savings, including: Less time spent capturing data for debugging problems Ability of current staff to handle more incidents Less time wasted on Change Board approvals 12

13 Besides the hard and soft dollar savings that you receive from a real visibility architecture, there are also tangential sources of value. These benefits are extremely hard to monetize due to dependencies upon how IT organizations are structured and the metrics used within any particular business. The following are examples of additional benefits that can realized: IT service penalty hits for delays in addressing problems due to change board approval processes can be reduced or eliminated Data center automation reduces initial service and user programming costs because everything is implemented through automation at the start of the process. Depending upon the enterprise structure, this could result in real productivity and monetary savings. Regulatory compliance and auditing (CALEA, PCI, etc.) can be improved/achieved, which saves aggravation and increased costs or fines. Extensive filtering techniques within an NPB can be created that allow the regulatory data to be collected, consolidated and then distributed to the proper destination. One more point to consider is that just because an NPB and visibility architecture are added to a network doesn t mean that you will realize the maximum return on your investment. To actually realize the benefits, it must be installed and set up correctly and then made a central part of your processes and procedures. This is the step that often gets missed because of constantly changing priorities and complexity of some solutions. It s also why it is critical to choose an NPB that is easy to install, configure and maintain while still offering a broad array of useful features. Therefore, two more items to pay attention to are: Implementation and programming details: Use a monitoring switch that is easy to program but also powerful and flexible enough to support all of the filtering criteria you want. Otherwise, the time you spend will eat away at your ROI savings for initial programming costs and ongoing OPEX costs. An intuitive GUI: The NPB must have this interface or productivity savings can be lost due to CLI filter programming, which is time-consuming and complicated (especially with overlapping filters). As a resource, the network is one of the most critical aspects of an organization. Investing in its availability and security is essential. In terms of lowering or delaying hardware investment, maintaining SLAs, reducing maintenance costs, and controlling OPEX, a monitoring switch more than earns its keep helping the IT team to identify and resolve threats in a shorter period of time, gain total visibility across all types of traffic, meet virtualization goals, avoid oversubscription and optimize legacy investments. All of these advantages boost overall IT productivity and efficiency and give the network the ability to handle new users smoothly and securely in the course of building a scalable solution. In terms of lowering or delaying hardware investment, maintaining SLAs, reducing maintenance costs, and controlling OPEX, a monitoring switch more than earns its keep... 13

14 WHITE PAPER Ixia Worldwide Headquarters Agoura Rd. Calabasas, CA (Toll Free North America) (Outside North America) (Fax) Ixia European Headquarters Ixia Technologies Europe Ltd Clarion House, Norreys Drive Maidenhead SL6 4FL United Kingdom Sales (Fax) Ixia Asia Pacific Headquarters 21 Serangoon North Avenue 5 #04-01 Singapore Sales Fax Rev. A, March 2014