Markets, J. Girard Research Note 8 April 2003 SSL VPN 1H03 Magic Quadrant Evaluation Criteria Secure Sockets Layer virtual private networks are simple, portable and convenient alternatives to IPsec, and "good enough" for many remote-access needs. Vendors are evaluated using these execution and vision criteria. Core Topics Enterprise Networking: Network Equipment Vendors and Technologies Security and Privacy: Security Tools, Technologies and Tactics Key Issue Which remote access technologies will best meet growing end-user demands? Strategic Planning Assumption By YE04, more than half of the leading VPN vendors will offer network access through thin-client and clientless VPN technologies (0.8 probability). Although many users may believe that Secure Sockets Layer (SSL) virtual private networks (VPNs) emerged in 1Q03, Gartner has been writing about them for at least five years as a "thinner" method of establishing private remote-access sessions over the Internet (see "SSL VPN 1H03 Magic Quadrant"). SSL VPNs do not require the installation and management of full, registered software clients on users' workstations. Instead, they primarily rely on users' Web browsers to provide VPN client termination. SSL VPNs solve five recurring user complaints about Internet Protocol Security (IPsec) and Point-to-Point Tunneling Protocol (PPTP) VPNs: SSL VPNs cost less to install and maintain on end-user workstations because the basic component is the ubiquitous Web browser, which every network-knowledgeable user knows how to use. SSL VPNs are more portable than IPsec and PPTP because browsers that support SSL are preinstalled by default on every platform and operating system. Their portability enables SSL VPNs to be used for secure access from noncorporate systems, such as home PCs. SSL VPNs have grown to provide all of the features that users may expect, including fat client/server application support and access to network file servers. Because SSL VPNs typically are used as transient connections, the current encryption strength of 128 bits is more than adequate. However, if users want more strength, browsers support Transaction Layer Security (a nextgeneration SSL). Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.
SSL VPNs can survive interrupted connections, which are expected on a wireless link, because browsers were designed with interruptions in mind. Product/Service Features Common features of SSL VPN products and services include: Completely portable access initial entry from any system that has a browser Ability to act as an application gateway or portal, with a menu of choices for the inbound user SSL acceleration (integrated in the solution) File system access through an SSL Layer 3/4 redirector Value-added support for access to Windows Terminal Services alone, or with a third-party manager such as Citrix Systems Value-added support for access to non-windows remoteterminal sessions, such as XWindows, 3270, 5150 and others Ability to limit and change which TCP/UDP ports are required for access, and to use a single port Managed services, which may include a professional design and programming service help desk, remote-user utilities, central console utilities, and managed security Support for mainstream security and authentication practices and products Mobile/wireless features for small handheld devices (or at least a vision) this is more than just supporting "any browser" because it involves getting value from access on a small device Usage tracking and billing (application metering, chargeback and others) Clientless firewalls Tiers of access not only by user rights, but also by ascertaining the trustworthiness of the network and system from which the remote user is attempting a connection Range of solutions software product, hardware product/appliance and managed service Multiple solutions articulated for end-user intranet VPN, extranet and other types of access 8 April 2003 2
IP roaming/persistence accessories are helpful, but not as critical as they would be for IPsec and PPTP users. SSL VPNs will not completely replace demand for traditional VPNs. IPsec was designed and is the best choice for site-to-site VPNs. Also, IPsec clients may still be preferred where users need to open long-term, strongly encrypted remote-node connections for fat-client applications. Execution Criteria The ability to execute refers to a vendor's ability to attract and keep enterprise business by being visible in the competitive landscape as a brand name and as a solution, which can be validated from independent sources, including channel support, customer references and case studies. Vendors cultivate execution "mind share" by delivering on contracts, enhancements and commitments with effective sales and support, as well as ongoing customer satisfaction. In general, execution rankings below the midpoint are given to vendors that have acceptable and usable offerings that are not deemed aggressively competitive in the ranking process. For example, an excellent service that is poorly known to clients may be niche or visionary, but it is no more than that. The size of the vendor (for example, revenue) is only important as it relates to the vendor's ability to deliver services to midsize and large enterprises. Mind share and industry influence to capture business. Mind share in execution prompts customers to react. Mind share is based on a vendor's success in marketing and selling its services, which, in turn, should drive "word of mouth" marketing. Strong scores are possible if the vendor has a universally recognized name in its line of business, if it can sell on the basis of only its reputation, and if it is recognized as a business solution, not just a technology. Request-for-proposal flexibility and competence. A vendor must offer a proper combination of services and products to appeal to all types of buyers, and to buyers with spending constraints or preferences from capital and operating expense budgets. The vendor also must be flexible with its contract terms and conditions, and allow for multiple solutions in a single contract. Gartner client awareness and performance. A vendor must have performed well in delivering its services, as reported by Gartner clients and other references. This includes meeting service-level agreement criteria, maintaining good customer service relations and generating increased customer interest in new service offerings. We must see unsolicited evidence that clients are 8 April 2003 3
demanding information about the vendor and placing it on shortlists, as well as anticipating renewals. Business health. Today, the most-important criterion for any vendor is stability. Enterprises need to know that the vendor will still be in business one, two or five years from now. That stability, as well as a well-rounded service portfolio, will come from a healthy combination of alliances, partners and systems integrators, as well as other distribution channels, to grow the user base. Vision Criteria The completeness of vision is a vendor's ability to adopt longerterm values and cause changes in prevailing industry trends by its actions. Vendors cultivate mind share for their vision by disclosing relevant features and futures, and delivering broad services and features beyond basic connectivity. Vision rankings to the right of the midpoint indicate that a vendor is competitively delivering broad connectivity and management services based on current and near-term needs. Mind share and industry influence to set directions. Mind share in vision prompts competitors to react. Therefore, a vendor that develops new features that other vendors are forced to copy will receive high marks. Vision leaders will also gain public recognition as industry drivers. Breadth of solution. A vendor is scored higher according to the number of options it provides for client and server solutions. Server solutions may include purchasable software or hardware (appliance) and managed services. Client solutions, in addition to a basic Web client interface, may include value-added full software clients, open Java clients for emerging mobile devices, support for file system access and fat client/server applications, and others. Enterprise focus/message based on Gartner analyst assessment. The vendor should have a clear, balanced return on investment strategy and competitive analysis for business-class remote access for enterprise intranet users. Extranet and consumer-class Internet access vision is also considered. Value-added services. In addition to basic access, monitoring and security services, vendors differentiate with value-added end-user support services, remote-user training, portal menu systems, clientless firewalls and tiered access-control policies, depending on the degree to which end-user network connections and workstations are deemed trustworthy. 8 April 2003 4
Acronym Key IPsec Internet Protocol Security PPTP Point-to-Point Tunneling Protocol SSL Secure Sockets Layer VPN Virtual private network Bottom Line: The demand for Secure Sockets Layer virtual private networks solutions is strong. Early vendors in this space are meeting the requirements of a separate market, although Gartner believes that in several years, SSL VPNs will merge with traditional VPNs into one market. Gartner ranks vendors in the SSL VPN 1H03 Magic Quadrant based on which will likely influence the market's direction in 2003, are most visible among clients, generate the greatest number of requests for information and contract review, and account for most new and ongoing installations in Gartner's client base. 8 April 2003 5