Simplifying branch office security

Transcription

1 Simplifying branch office security By Udo Kerst, Director Product Management Network Security Securing your business network is more important than ever. Malware, botnets and other malicious programs threaten your network at your central offices and your branch offices alike. Yet enforcing consistent network security throughout your enterprise can be challenging especially for those of you with branch offices with few users and no IT expertise. This paper introduces a new standard an innovative, unified, cost-effective solution for managing branch office security, with centralized reporting and a clear process for determining return on investment (ROI).

2 Branch office security what are the real problems? Today s increased mobility and 24/7 always on capabilities may offer your business a competitive edge. But the transmission of sensitive data across business networks and the Internet must be secure. Threats from hackers and malware can target any vulnerability in your business. Your branch office needs firewall protection, secure VPN connections to corporate resources, an intrusion prevention system, web and security just like at headquarters. Three crucial points when managing branch office security 1. Deploying security devices As a matter of fact in small offices you may not have IT expertise available onsite. But many businesses simply can t afford to send their IT teams on the road to set up new offices in different locations. Some businesses pre-configure each device at the central office but often need to make final adjustments onsite. A dedicated central management solution that s easy to set up and configure offers the most efficient approach. But it can be as costly as sending IT out on the road. 2. Providing support When your branch office or remote worker has a technical problem, business and productivity can come to a halt. Describing issues over the phone is far too complex, timeconsuming, expensive and frustrating for both your IT staff and your offsite employees. Shipping the device back and forth is a non-starter. No one can afford the downtime. Your workers need virtual onsite support that helps them get back to vital business. 3. Implementing security policies You need to determine how to set up rules and policies for your workers on the network at the individual branch offices. These rules may be the same set of rules you use at the central office. Or they may be different. Some branch workers and remote employees may have unlimited access to company assets and others may be highly restricted. You may want to implement policies that restrict access to Internet software or social media. How can you manage this cost-effectively and efficiently? Sometimes corporate policies can be extrapolated into the branch office environment. If not, managing separate rules on different security devices is time consuming and inefficient. A Sophos Whitepaper December

3 Traditional security measures for very small offices Investigating the right solution for branch office security is a challenge especially when remote workers have little IT expertise. Many smaller offices start with consumer broadband routers which may be inexpensive and simpler for your remote workers, but they only provide little reporting, visibility and only the most basic security. Others deploy entry-level business firewalls to inspect traffic and enforce policies, which offer greater security, visibility, control and total cost of ownership. Here are a few of the traditional solutions you may have reviewed: Low-end unified threat management (UTM) appliances may offer you the required security protection for your industry. However they are time-consuming to set up. And you may find that the hidden total cost of ownership (TCO) ongoing maintenance, subscription fees and management are too high. Especially if you need to secure large numbers of small offices. Consumer grade routers may seem like an inexpensive alternative to UTM appliances as they are easier to set up and manage. While they offer you basic security functionality (e.g., firewall or VPN), they often lack important commercial security safeguards like intrusion prevention, web and filtering. Managed VPN or MPLS services offer the most comprehensive solution that is centrally managed. However VPN or MPLS services are not available for all locations, may lock you into long-term service contracts or might not comply with your corporate policies. The bottom line is these traditional solutions don t meet your needs. Managing multiple point solutions increases complexity in your network. It even multiplies when adding numerous point solutions at branch offices. But a new approach is now available. It offers a superior total cost of ownership (TCO) for even the tiniest office of one, and offers the benefits of fully automated central management. A Sophos Whitepaper December

4 A new approach for branch office security: central management made easy An innovative approach opts for a truly unified threat management solution integrating security measures at the branch offices into the corporate structure. This solution sets up a virtual Ethernet cable for connecting your central and branch offices. Instead of running firewall, VPN, intrusion prevention, web and security functions on an expensive branch office device, they are centrally provisioned by a powerful security gateway. It can be located at your central office or in the cloud (e.g. at a service provider). A small remote Ethernet device (RED) forwards encrypted traffic from the remote office to a central device that scans and filters the data before it is sent to the Internet. It connects your central office to your branch office with secure VPN technology. Astaro s RED box is the single most innovative product I saw. It leverages the investment in security at one location by extending it to many. It is simple and inexpensive. Security industry expert Richard Stiennon Fig. 1: Complete UTM security through virtual Ethernet cable Astaro RED appliances and award-winning Astaro Security Gateway products provide cost-effective centrally managed unified threat management (UTM): ÌÌ Set up of a new RED appliance takes only a few minutes. Ì Ì Recurring maintenance tasks or subscription costs for the branch are eliminated. Ì Ì Reporting tools are included. A Sophos Whitepaper December

5 Two-minute deployment This innovative approach offers plug and play deployment. Here s how it works: RED devices are shipped to the branch offices. The remote worker reads the serial number on the shipping box to central office IT. They activate the device within the central Astaro Security Gateway. The local employee plugs the device into the Internet router, connects the router to the computer and plugs it into the wall. The RED device automatically retrieves its setup information, configures itself and establishes an encrypted tunnel to the central office. You can deploy up to 100 appliances per day with this automated, flexible solution. Our IT security costs have dropped dramatically. With Astaro RED, we can now easily protect our smallest remote sites. Four easy steps to ensure branch office security: Alu Petrussen IT Manager, Nukissiorfiit ship RED device to branch office communicate back the serial number to central IT connect RED to the Internet RED automatically connects to the central office Central support RED delivers greater network control and visibility. Your IT staff now has an integrated solution at hand that supports clear centralized reporting tools offering 360-degree visibility into each branch office. RED eliminates onsite travel, and enables your IT team at the central office to virtually support your branch office staff with just a few clicks of the mouse. Simple policy management With RED, you can create and maintain one global policy that protects and tracks all remote sites in your central security gateway. You can set different user rights for individual branches or employees just like you can do at the headquarters. Therefore the branch office obtains the same level of security as the central office. A Sophos Whitepaper December

6 Saving up to 80% on your TCO Compare the total cost of ownership (TCO) for maintaining your branch office network particularly one with tens or even hundreds of sites with traditional UTM solutions. Initial cost is dwarfed by ongoing expenses, from remote administration to security subscriptions. This largely stems from treating each branch as a standalone that must be configured, secured, and monitored. This traditional UTM approach results in uniform security but is extremely complex and far more costly than Astaro RED. The chart below shows the dramatic savings of Astaro RED versus other unified threat management solutions. TCO Comparison (30 remote offices - 5 Years) Central office appliance (1x) Appliance Hardware maintenance 24/7 (5 years) Security subscriptions (5 years) Remote office appliances (30x) Appliances Hardware maintenance 24/7 (5 years) Security subscriptions (5 years) Central management tools Appliance Software (5 years) Central reporting tools Appliance Software (5 years) Administration costs Initial central site setup Initial remote site setup Ongoing remote site maintenance Travel costs Total Savings Market 2,995 3,745 5,015 8,850 11,100 8,400 6,746 11,245 4,496 7, (2 days) 3,068 (3h/site) 16,364 17, Astaro ASG 220 1,275 1,180 10,155 Astaro RED 8,850 4,500 included included 34 (1 hour) 256 (15min/site) 26,250 76% A Sophos Whitepaper December

7 Summary Astaro RED is a better way to manage branch office security. Learn how you can benefit from RED, the new standard for innovative, cost-effective branch office security management. For more information please visit our website at sophos.com/network. Find out more visit sophos.com/network. United Kingdom Sales: Tel: +44 (0) sales@sophos.com North American Sales: Toll Free: nasales@sophos.com Boston, USA Oxford, UK Copyright Sophos Ltd. All rights reserved. All trademarks are the property of their respective owners. A Sophos Whitepaper 12.11v1.dNA