Serro Solutions Enables Managed Security Service Providers to Optimize Networking Performance and Cost

Transcription

1 Serro Solutions Enables Managed Security Service Providers to Optimize Networking Performance and Cost Serro s SDN Controller automates Internet connections on a global scale to migrate traffic to lower cost and better performing paths Background Many enterprises today are hiring managed security service providers (MSSPs) to manage specific initiatives such as DDoS mitigation, cloud access security, or continuous security monitoring. In fact, according to a new report from Allied Market Research, cloud-based managed security services are expected to overtake on-premise deployments by 206. This provides a bright opportunity for the companies that are well positioned to deliver these services but it also means the competition in this space will be stiff. MSSPs will need every advantage they can muster to create and sustain a competitive advantage. These types of services often require customers to pass all of their Internet traffic through the service provider s cloud-based engine for scanning and scrubbing before passing it along to the destination. The networking architecture to deliver such a service at scale is usually quite complex. The MSSP might need to provide thousands or tens of thousands of Internet connections to receive and retransmit customers traffic. These lines represent quite a large operational expense, especially when the amount of customer traffic causes overages of the contracted line capacity. MSSPs that are looking for that competitive advantage want to streamline the complexity of their networks and reduce the operational costs. This can only be done through automation using software-defined networking (SDN). Serro Solutions has developed a cloud-based SDN controller that can communicate with and configure in real-time a wide variety of networking devices. The controller helps service providers adjust network structures and configure virtual machines (VMs) to address constantly changing data center requirements. This greatly improves the use of resources, and through trend and predictive analysis, also reduces networking operational costs. This white paper describes the SDN solution Serro has created to control complex global networking infrastructure. We describe how one MSSP is poised to benefit from the automated process of continually measuring performance metrics and using policies to determine how to steer customer traffic to optimize bandwidth utilization and vastly reduce line costs. Allied Market Research, World Managed Security Services Market - Opportunities and Forecasts, , April 205

2 A Managed Security Service Provider Success Story Serro s client provides managed security services to organizations around the world. At this writing the company has approximately 3,500 customers in almost 70 countries, and the customer base keeps growing. A primary service this company offers is 24x7x365 monitoring of all of a customer s inbound and outbound traffic to provide real-time threat protection against sophisticated cyber attacks. This MSSP s service offering is architected such that customers traffic that would ordinarily flow to and from targets on the Internet is diverted to pass through the service provider s cloud service for thorough screening by a proprietary processing application. Once the traffic is analyzed for indicators of compromise and deemed safe, it is forwarded on to its intended destination. Operating on a global scale, the MSSP has hundreds of processing engines hosted in data centers around the world, and each engine can support hundreds of customers. Each processing engine is essentially a Point of Presence (PoP) location, and each PoP is connected to at least three Internet Service Providers (ISPs) for redundancy and high availability. Customer traffic can come into a processing engine through any one of the three Internet peers at any given time. Traffic from hundreds of customers is traversing these Internet connections 24x7x365. The Business Challenge The challenge for the MSSP is that it doesn t know how much bandwidth each customer is going to use, and this can cause occasional overage of the capacity the MSSP has contracted for with each of the ISPs. Even a 0% overage of unplanned bandwidth use can result in a hefty overage fee from the ISP. The MSSP could increase its reserved amount of bandwidth from the ISPs, but this can result in significant unused capacity for a majority of the time. The ideal situation would be to steer customers traffic to a particular route at any given time in order to load-balance the traffic and avoid overage fees. But there is more at stake here than just keeping costs down. As with any network connection, the Internet lines are subject to performance issues such as latency and jitter. If the MSSP knows that one of the three lines is temporarily having issues, it wouldn t want to move traffic there just to save money, and it probably would want to move traffic off that line without overloading the others. It s all a delicate balancing act in order to provide the best possible service at the lowest possible cost. Then there is the scale issue. For every one of the MSSP s PoPs, there are three ISPs. Across 00 PoPs, there are 300 Internet peering relationships to manage. The numbers go up from there because there already are several hundred PoPs and triple the number of peering relationships. The scale of this massive global operation is beyond the realm of manual traffic steering and cost optimization; it can only be done through automation. The Business Solution It s impossible for a human to perform the calculations required to manually shift this traffic around. If ever there was an ideal use case for software-defined networking (SDN), this is it. A sophisticated SDN controller application is able to do path computation to determine a route based on service needs, network topology, resource status, cost and other parameters.

3 This MSSP approached Serro Solutions to develop this type of application. The objective was to develop an SDN solution that fully automates the process of measuring line bandwidth usage and performance metrics every 30 minutes in order to route traffic in a policy-driven manner. Serro s SDN controller is a complement to the MSSP s global network infrastructure. Serro s SDN solution performs a number of tasks without human intervention: The Serro solution collects data and analyzes the user experience from the Customer Premise Equipment (CPE) to the MSSP s PoP following the currently designated route. Serro is measuring latency, jitter and other performance metrics so we know what the end customer s experience to a particular PoP is. These measurements comprise just one aspect of the routing consideration managed by networking policies. Serro is also measuring the bandwidth consumption of all of the ISPs paths in a particular cloud. The goal is to not exceed the contracted capacity of any of the lines in order to avoid overage charges. If measurements, which are taken every 30 minutes, determine that a line has poor performance, or use of a specific line is causing or going to cause capacity overage, the SDN application considers moving a designated customer s traffic to a different route. The considerations are myriad and written into policies that are managed by a policy manager component of the SDN application. If a customer s traffic is to be moved to a different path, the directives for this action are translated into machine language and sent to the solution s configuration manager, which makes the routing changes in the network s equipment. This solution also predicts the bandwidth costs that the MSSP will incur over a 30 day period if traffic being carried by a specific ISP is not altered to avoid overages. The application can tell the MSSP which end customers are using the most bandwidth and, if desired, where they can be migrated to in order to reduce cost. This latter point is a key feature of the SDN application. A graphic image illustrating the predictive analysis of the cost is shown in Figure. Estimated days until overage: 0.6 days Estimated billing cycle charge: $75.03 Burst Budget Consumption (cumulative consumption to date) Burst Budget (minutes) Estimated days until overage: -- days Estimated billing cycle charge: $0.50 Burst Budget Consumption (cumulative consumption to date) Burst Budget (minutes) Estimated days until overage: 6.0 days Estimated billing cycle charge: $0.50 Burst Budget Consumption (cumulative consumption to date) Burst Budget (minutes) October Time (days) October Time (days) October Time (days) Optimal Cumulative Burst Budget Consumption Cumulative Consumed Burst Budget Optimal Cumulative Burst Budget Consumption Cumulative Consumed Burst Budget Optimal Cumulative Burst Budget Consumption Cumulative Consumed Burst Budget Highcharts.com Highcharts.com Highcharts.com Figure Predictive analysis of bandwidth overage

4 The workflow of all of these tasks is totally automated. The actions are taken through machine-to-machine communications; no humans need to intervene. As a result, decisions can be made and actions taken throughout the global network to optimize the costs of the service while also providing a good user experience for the customers. The Service Provider s Business Benefits This solution is in its early stages for the managed security service provider, but the company expects to attain the following benefits: The overage charges for excessive use of bandwidth will be vastly reduced. The company is now able to see, in real time, the predicted cost of staying the course with particular network paths, and then change the traffic patterns to reduce overages. Moreover, bandwidth utilization is expected to be fully optimized. The company now knows which end customers use the most bandwidth, as well as when they use it. Decisions can be made about whether or how to migrate those customers to other networking paths. Policies can be fine tuned for each customer to determine how their traffic will be treated. More important customers can be given preferential treatment in terms of routing their traffic. The service provider is able to optimize its contracts with ISPs by having a better understanding of traffic patterns through each link. The service provider is better able to meet customer SLAs by migrating traffic to lines with fewer performance issues. What s more, SLAs can be better defined based on the ability to have more information on how traffic is flowing. Reducing costs while providing better service performance gives the MSSP a competitive advantage and provides a higher ROI on the networking infrastructure. The Serro SDN Solution The key technology that makes this solution possible is software-defined networking. SDN decouples the system that makes decisions about where network traffic is sent (i.e., the control plane) from the underlying systems that forward traffic to the selected destination (i.e., the data plane). This simplifies networking because the routing and switching decisions are no longer in firmware, but in software, which gives Serro s application developers the flexibility to manipulate the routing resources through programming. SDN allows Serro s solution to control the operation of all sorts of network resources routers, switches, optical gear, servers, firewalls, and even medium earth orbit satellites. As long as the resources in question can be exposed through Representation State Transfer (REST) application program interfaces (APIs), Serro can control the devices to optimally route traffic based on parameters specified by policies. Using open source tools like Open Daylight, Floodlight and OpenStack, Serro can control the actions of the resources through software programming.

5 Serro s SDN solution is comprised of five tightly integrated components, shown in Figure 2. FireEye-SDN FireEye-SDN Policy Management component Controls data-flow inbound and outbound from PoP using administrative Policy Management FireEye-SDN Analytics component reduces data and control plane statistics to trends and projects for use in policy decisions Analytics FireEye-SDN Collector component collects network data and control plane statistics for analysis and policy enforcement Configuration Management Resource Management Monitoring FireEye-SDN Configuration Management component configures network equipment, manages configuration changes based on directives from the policy management component FireEye-SDN Resource Management component tracks and manages utilization of network resources such as IPs, VRs, VLANS, Interfaces and ports Figure 2 The Serro SDN controller Policy Manager This component is a set of rules which defines how traffic can flow in and out of the network. The policy manager takes an English language description of a rule and converts it to code. When a service request is made (for example, to migrate traffic from one line to another), the policy manager interfaces with the resource manager to determine if the request can be made, and if so, what resources should be used to fulfill the request. If the service request is cleared for fulfillment, the policy manager sends its directives to the configuration manager. Configuration Manager This module makes the actual configuration changes on the various resources in the network. The configuration manager takes its marching orders from the policy manager. Resource Manager The resource manager is a database that keeps track of all of the devices on the network and their capacity utilization. Serro keeps track of various parameters of each resource and factors this information into a resource request.

6 Collector This module is continually collecting network data, control plane statistics and even external data, as appropriate, to help the application do analysis and policy enforcement. The types of information collected include latency, jitter, packet loss, round-trip delays, bandwidth usage, etc. In some cases, external data can be included. For example, a Serro SDN application can be used to control MEO satellites for networking communications. In this case, weather data from the National Oceanic and Atmospheric Administration (NOAA) is correlated to the position of the satellite resources, as weather can dramatically impact performance. All of the data that is collected is fed to the analytics engine to help make dynamic routing decisions. So, for instance, if the primary path of communication experiences problems such as latency, Serro s application can switch the traffic to an alternate path that offers better performance. Analytics Engine - This component ingests a vast amount of data from the collector and performs analysis on the planned routes of communication. This helps the application select the best possible path to fulfill the customer s requirements. Results from the analytics engine go to the policy manager to determine if a planned route is compliant with current policies. In addition, this module identifies trends and makes projections for use in policy decisions. For example, in the use case detailed above, the analytics engine analyzes bandwidth usage and ISP costs to determine when an overage might occur, and how much the overage fees will be, if the traffic patterns maintain the status quo. All of these application components are tightly integrated so that decisions can be made and resources configured in near real-time and without human intervention. Why Serro for Your Software-Defined Networking Needs Serro Solutions was founded by Nitin Serro in 2008 as an independent consulting firm focused mainly on service providers. Nitin Serro gained his expertise from being one of the original engineers that built out Google s global network. He has shared his in-depth networking expertise to train his highly capable team. Since then, Serro Solutions has taken service provider-grade technologies and brought them to enterprise networks to provide highly robust and scalable systems. The Serro solution architects align network goals to meet your business goals. Serro Solutions specializes in deploying flexible solutions that exceed current service needs and seamlessly scale to meet future needs. The company s developers have extensive expertise with complex networking solutions. Using software-defined networking, the focus is on the automation of resource orchestration and taking humans out of the repeatable processes to save time and reduce errors. The company has successfully deployed numerous solutions in industries such as healthcare, transportation, education, information services and aerospace.

7 Serro can develop a turn-key solution for you, and then bring your team up to speed on how to operate and maintain the solution long-term. Serro believes in doing knowledge transfer to make you self-sufficient. The company also creates a run book that provides details on almost every scenario your application is intended to handle. Would you like to talk about your company s needs? Contact Serro Solutions at or by using the form at Serro s solution architects want to talk to you about automating and orchestrating your infrastructure to enable your company to deliver global networking communications services in near real-time. Copyright Serro Solutions 205. All trademarks, service marks and trade names referenced in this material are the property of their respective owners.