devopsy.kinsta.cloud

Tag: SD-WAN

Is SASE the DevSecOps of Infrastructure Management?

DevOps gained traction when IT and Ops (operations) teams recognized that traditional silos and handoffs were leading to inefficiencies and delays in software delivery. While DevOps enabled seamless collaboration and delivered on its promise of speed and efficiency, security remained an afterthought. To overcome the security loophole, DevSecOps emerged, proposing a shift-left approach to security. It emphasizes conducting tasks like security scanning, vulnerability assessment, and compliance checks all throughout the CI/CD pipeline.

With DevSecOps, speed no longer comes at the cost of security.

The DevSecOps approach has helped organizations strike the right balance between security and agility in software development. As the infrastructure landscape continues to evolve with the rise of cloud and edge computing, resource-intensive AI and ML initiatives, and distributed workforces, organizations must establish a similar balance between security and ubiquitous connectivity. This is where secure access service edge (SASE) comes in.

SASE’s Philosophy is Similar to DevSecOps

As legacy networks — characterized by rigid hardware-based infrastructure — struggled to keep pace with the demands of modern business, SD-WAN emerged as a solution, providing flexibility, centralized management and dynamic traffic routing. However, when distributed computing and remote work virtually dissolved the corporate perimeter, perimeter-focused security tools were no longer sufficient either. Today, enterprises must extend their security capabilities to almost unlimited network access points.

SASE addresses this challenge by merging networking and security into a single cloud-native framework. It integrates the entire security stack across all edge locations, ensuring secure connectivity between users, applications and resources no matter where they are. Just as DevSecOps shifts security to the left, making it an inherent part of the entire SDLC (software development lifecycle), SASE shifts security to the network edge, making it an inherent part of network connectivity.

The strategic resemblance between the philosophy behind SASE and DevSecOps is uncanny.

1. Breaking Silos

DevSecOps breaks down the silos between DevOps and security teams, promoting collaboration and shared responsibility. In a similar vein, SASE unifies all network and security functions into a single architecture, effectively dismantling the conventional boundaries between the networking and security teams. It allows both teams to jointly manage, monitor, and secure the infrastructure and network traffic through a unified management dashboard. SASE also effectively breaks the data silos that leave security teams with no insights regarding the networking conditions. SASE’s single pane of glass visibility enables networking and security data correlation, broadening each team’s perspective and eliminating tunnel vision for accurate and robust threat detection and an enhanced security posture.

2. Embracing the Cloud

DevSecOps aligns perfectly with cloud-native technologies like infrastructure as code (IaC) and containerization technologies like Docker, making it imperative for cloud-first and cloud-ready organizations. On the other hand, SASE is inherently cloud-native. It delivers network and security services from the cloud, providing organizations with the agility and scalability needed to meet the dynamic demands of a distributed environment.

Traditional back-haul-based connectivity and perimeter-based security solutions introduce latency and coverage gaps. SASE performs network and security functions at the edge, closest to wherever resources and users are. This eliminates the need for disparate on-premises point solutions and extends corporate security perimeter to match the cloud’s global reach.

3. Agility Through Automation

DevSecOps emphasizes automation of security tasks, such as security checks, scans and compliance assessments, within its continuous integration and continuous delivery (CI/CD) pipelines. SASE also leverages automation for networking and security tasks, such as dynamic policy enforcement, AI-driven threat detection and response, and network optimization through dynamic routing and self-healing properties. Automation reduces the need for manual intervention, bolsters security, simplifies operational tasks and enables organizations to respond to evolving demands and circumstances faster, crucial for agile environments.

SASE as an Enabler for DevSecOps

Just as DevSecOps enhances security within the context of application development, SASE enhances security and efficiency within the realm of networking and infrastructure management. Both approaches share the common goals of integrating security, promoting automation and ensuring scalability. They may apply these principles to different aspects of IT and cybersecurity, but DevSecOps and SASE can work together seamlessly to support modern IT environments.

Many organizations adopting DevSecOps realize that they lack the necessary infrastructure to support this approach effectively. DevSecOps demands seamless global collaboration and the integration of security controls across the entire IT environment. This is something SASE can help with. It can simplify infrastructure management and enhance security for DevSecOps in several ways. It offers ubiquitous connectivity for seamless collaboration, provides built-in security measures for faster incident response and ensures reliable infrastructure. As such, these are all crucial aspects for achieving the ultimate DevSecOps goal of delivering secure and high-performance applications at speed. With SASE, organizations can set their DevSecOps up for success.

November 30, 2023
What SASE Means for DevOps Teams
You have probably heard the acronym secure access service edge (SASE), and it’s hard to ignore its impact on the technology industry. SASE is a cool new way to implement networking in hybrid environments, and the most important thing about it is that it bakes security into the network fabric. In plain English—when you plug in, you are secure by default.

SASE will have a special impact on two fields near and dear to the hearts of DevOps teams:
1. Cloud security—SASE has the potential to transform how we practice security in the multi-cloud, and unify it with security in the central data center.
2. DevSecOps adoption—SASE can make DevSecOps easier to adopt and might become essential infrastructure for globally distributed DevSecOps teams.
Let’s understand the anatomy of the SASE beast, and understand how it will affect DevOps in the years to come.

What Is SASE?

SASE is a cloud service that extends networking and security capabilities to support hybrid organizations’ dynamic, secure access needs.

SASE combines WAN capabilities with network and security functions, such as firewall-as-a-service (FWaaS), zero-trust network access (ZTNA), secure web gateway (SWG) and more.

A SASE platform bundles multiple security capabilities, including SD-WAN and services like SWG, CASB, ZTNA, FaaS and SaaS. This multi-region, multitenant architecture supports a distributed and remote workforce. SASE uses inspection engines located at points of presence (PoPs) near the endpoints rather than in the data center. SASE clients send traffic to the nearest PoP.

The core characteristics of a SASE architecture are:
- Global SD-WAN—A private SD-WAN backbone helps reduce latency by avoiding the public internet.
- Distributed architecture—SASE inspects traffic and enforces policies at the edge using multiple inspection engines.
- Cloud infrastructure—SASE delivers services via the cloud, so tenants don’t have to maintain hardware and other infrastructure resources. This approach is scalable and cost-effective.
- Identity-based access—Access controls use identity markers like the user’s location and device.
SASE Adoption Drivers: Why Do Organizations Want It?

Cost Reduction

Using physical and virtual appliances from multiple vendors is highly cumbersome and costly. SASE enables organizations to replace this disparate model with a single, cloud-native solution. Organizations can use SASE to deliver more technologies and services via one provider instead of several. As a result, it eliminates the cost of miscellaneous network appliances and optimizes cloud costs, by reducing the resources and bandwidth needed to operate a cloud environment.

Edge-to-Edge Security

SD-WAN is an integral component of SASE, providing features such as an active-active failover and WAN optimization that improve performance and increase network resilience. SASE solutions are based on the concept of security automation, with a fully managed network security stack that typically includes SWGs, next-generation firewalls (NGFW), next-generation network architecture and intrusion prevention systems (IPS). This model helps protect all edges, achieving better network visibility.

Data Protection

SASE provides a holistic data protection experience that automates multiple DLP processes, including data discovery and data classification of storage locations, data usage and data in transit. It employs various security measures, such as user and device authentication, to enable control over access to data and resources at all times. Additionally, SASE DLP seamlessly rolls out protection policies across the entire network.

Impact: How SASE Will Transform the Cloud Security Stack

The emergence of services like PaaS, SaaS and IaaS has encouraged organizations to allow remote work. The cloud supports distributed workforces and streamlines business processes, but it also exposes companies to network-based threats. Many organizations store sensitive data with third parties accessed online.

The cloud security stack can easily become siloed, with team members unsure of their responsibilities and overlooking critical processes. A siloed stack is more labor-intensive and harder to track because the security team uses multiple security systems. It can also create alert fatigue, making it hard to identify threats.

While employees mostly work in the cloud, security efforts often focus on the data center. SASE shifts the focus to the cloud while ensuring seamless integration between security services.

With SASE, a single provider delivers the entire security stack, ensuring it functions as a unit. For instance, an SWG uses threat intelligence data to block suspicious traffic, sending unidentified files to a sandbox for testing. The security team can manage the entire stack from one intuitive interface.

Most activities occur at the edge—SASE secures the edge using an identity-driven approach. It is also cloud-native, ensuring a seamless experience.

Impact: How SASE Will Promote DevSecOps Adoption

SASE provides the following advantages for adopting DevSecOps.

Facilitating Collaboration

SASE helps reduce the challenges involved in cross-team collaboration. Essentially, SASE combines network security with WAN optimization. Modern DevOps teams are physically separate but must work together, requiring reliable and secure connections between team members.

The DevOps approach emphasizes time-to-market, so DevOps teams look for ways to accelerate the CI/CD cycle and push releases faster. An important part of the process is reducing the DevOps team’s reliance on the network and security teams. SASE solutions help optimize performance and enhance security, so the DevOps team doesn’t have to wait for the infrastructure team to configure resources. SASE gives DevOps teams the necessary control and operational cadence without compromising security or performance.

Enhanced Networking

SASE can improve the overall network performance by providing integrated failover and load balancing capabilities. DevOps teams must have reliable connectivity and cannot tolerate disruptions when deploying new software or fixing bugs. Fast, reliable application performance is key to the DevOps workflow.

The SASE architecture improves the networking, ensuring the organization’s edge devices, cloud resources, data center and remote users remain connected. The DevOps team doesn’t have to handle the infrastructure because it is self-healing, fully optimized, and secure. The solution automatically switches to another path if a line fails or a path becomes congested.

Security By Default

SASE protects DevOps projects with built-in security features. When implemented properly, it integrates many security technologies into the network stack. The DevOps team doesn’t have to worry about attackers intercepting sensitive information. Every security service shares the same, unified context to increase visibility and fill gaps that are often present in traditional security architectures. SASE mitigates the vulnerabilities exploited by attackers using NGFW, SWG, IPS, MDR and antivirus services in a single architecture.

SASE can secure internal applications and their interactions, reducing the burden on the DevSecOps team. Applications running on a SASE-based SD-WAN benefit from the added protection of zero-trust network access (ZTNA) and software-defined perimeter (SDP). These technologies help ensure that all interactions between applications and endpoints are secure.

Proprietary apps are often too sensitive to expose to the public Internet. SASE secures these applications by obfuscating traffic, securing all entry points with NGFW, and restricting access with zero-trust network architecture. It constantly inspects all internal application traffic for cybersecurity threats.

Conclusion

In this article, I explained the basics of SASE, which packages multiple networking and security solutions into one managed service.

SASE is giving organizations a new level of flexibility and agility with regard to their core infrastructure and is introducing the concept of security-by-design. Instead of fighting hard to “secure all the things,” we are moving nearer to a world where the “grid” our organization operates on is secure by default. This won’t make DevSecOps any less important. But it will allow us to build our applications and services within a secure, controlled hybrid environment.
July 19, 2022
Survey Predicts Massive Migration to the Cloud

A global survey of 1,600 enterprise IT decision-makers found more than half are working for organizations that plan to eliminate the use of data centers over the next two years.

The survey was conducted by Aryaka, a provider of a secure access service edge (SASE) platform, and found a quarter of the respondents have closed 25% to 50% of their office sites; 75% of respondents said at least a quarter of their employees will remain remote permanently post-pandemic. Just under a third (32%) expect at least half of their workforce would be permanently remote.

Despite the apparent accelerated shift to the cloud, the report found a full three-quarters of respondents (75%) are projecting at least a 10% growth in IT spending, with a quarter expecting IT budgets to grow 25% or more. Nevertheless, more than a third (36%) report they have IT cost concerns.

David Ginsburg, vice president of product and solutions for Aryaka, said the shift to the cloud in the wake of the COVID-19 pandemic is being driven mainly by digital business transformation initiatives that require applications be quickly built and managed by IT teams that are working from home themselves. With the pandemic entering the third year, a hybrid workforce that regularly shifts between home and the office is now permanent, he noted.

Consequently, with more people working from home, nearly two-thirds of respondents (64%) said they will shift toward a SASE-based approach over the course of the coming year to provide secure access to cloud applications over a software-defined wide area network (SD-WAN). Over two-thirds of those respondents said they will opt for a managed SASE offering rather than build and maintain these platforms themselves.

SASE was originally coined by Gartner to describe a cloud-delivered service that brought together networking and security offerings. Those offerings should include a firewall-as-a-service (FWaaS), secure web gateway (SWG), cloud access security broker (CASB) and zero-trust network access (ZTNA). In effect, it’s a secure software-defined wide-area network (SD-WAN). As organizations adopt SASE-based platforms and services, just under a third of respondents (61%) are recognizing that dynamic bandwidth reallocation will be a very important requirement as workers shift between the office and home.

The transition to SASE involves setting a strategy (35%), phasing out of legacy virtual private networks (32%) and consolidating cloud security with zero-trust (29%). Top desired capabilities include SWG (47%), SD-WAN (36%) and FWaaS (28%). A full 41% reported that responsibility for networking and security decisions have now been consolidated into a single team. However, only slightly more than a third (34%) said security is a major priority.

The implications of a shift to the cloud at this rate and level of scale are likely to have a profound impact on DevOps teams. While cloud infrastructure is designed to scale on demand, accessing applications across an SD-WAN can have a significant impact on application performance. The survey, however, finds only 29% of respondents are concerned about whether applications will perform properly. Nevertheless, well over two-thirds (69%) said there will be an increased focus on observability and control, while 42% noted identifying slow performance for remote and mobile users will be a key issue and 37% expected slow performance at the branch office to also be an issue. Lackluster application performance is a time sink, according to 42% of respondents.

Naturally, many IT teams will add new tools and platforms to deploy and manage cloud applications. The Aryaka survey found that only slightly more than a quarter of respondents are concerned about the newness of the technology they might employ.

The coming year is shaping up to be incredibly disruptive to the IT landscape. The challenge is making sure balance is maintained between cost, flexibility and application performance.

January 20, 2022
Ensuring Network Connectivity With SD-WAN and AIOps
Recently, Facebook experienced an outage. If companies relied on that app to do business, their IT teams were likely swamped with end-user complaint calls.

How would teams traditionally respond? They’d dive deep into the rabbit hole, analyzing issues on a case-by-case basis, asking countless questions, including:
- Could there be a problem with the enterprise network?
- Is the service provider experiencing issues?
- Are just a few users affected or is the issue more systemic?
Traditionally, this manual process requires significant knowledge sharing and time to complete as teams break the problem into smaller pieces to triangulate an issue’s root cause.

Oftentimes, it’s an enterprise network that experiences connectivity issues—not apps like Facebook.

Some companies pay an arm and a leg to leverage highly reliable WAN links, such as MPLS, for connecting to the internet and connecting branches to their data centers. Conversely, they may save a buck or two by using commodity links, like cable or DSL, which deliver less reliability. Both choices introduce tough tradeoffs—could there be a better way to ensure enterprise-wide connectivity?

Enter SD-WAN.

Combining the same service-level agreement (SLA) as a dependable WAN link with the affordability of a commodity link, SD-WAN specializes in handling brownout situations, rerouting link traffic to maintain network connectivity — ensuring users’ access to their must-have apps.

And by incorporating artificial intelligence for IT operations (AIOps), teams can harness the power of analytics to radically reduce their response time, ensuring that if problems do happen, they get fixed fast. In fact, 90% of IT professionals acknowledge that powering network management with AIOps will improve their companies’ business outcomes.

Drowning in Data: Understanding Traditional Network Issue Investigation Headaches

To determine the root cause of a service disruption, teams spend considerable time assessing the landscape of all the different apps that people use and the links they follow to use them. These apps could be located anywhere—forcing teams to find needles across vast haystacks of data to determine what went wrong.

And this data is exploding at such an extraordinarily high rate that it’s practically impossible for anyone to keep track of it all. Only by leveraging an advanced analytics system like AIOps can teams gain the necessary insights to swiftly solve problems.

SD-WAN and AIOps: A Problem-Solving Dream Team

How do SD-WAN and AIOps work together to enable a highly reliable, always-connected network?

SD-WAN quickly addresses all potential local issues and optimizes performance and connectivity across multiple WAN links—or even just a single WAN link that may be unreliable. SD-WAN also ensures that business-critical apps are prioritized correctly and are offered the precise amount of error correction that avoids any issues or disruptions as much as possible over the WAN.

Where does AIOps come into play? It analyzes data at a far more granular level for extended periods over a global topology. What is it looking for? Everything. It’s examining emerging patterns that are impacting individual apps. It’s searching for systemic issues that affect multiple SD-WAN edge devices simultaneously, worldwide. It could also be investigating how edges or apps are being affected over a particular time period.

By surfacing all that data, AIOps analyzes much more than SD-WAN can. And by deriving insights from that data, it highlights issues affecting everything from a lone user on a single application to a systemic issue that’s impacting an app across a far broader cohort of users. In certain cases, AIOps can cue the SD-WAN to heal itself and automatically fix the problem, then verify that the issue was fixed. As a result, end-users remain connected to their network.

Inside a Wholly Adopted SD-WAN/AIOps Environment

Imagine you’re an IT admin, supporting an extremely complex enterprise network, spanning thousands of different sites that use diverse security services for connecting to apps. Even if you’re on a huge team that’s charged with monitoring the network, it would be nearly impossible to have full visibility across the network to solve problems as they occur.

By adopting SD-WAN together with AIOps, you gain a superpower. No, you won’t be able to fly or become invisible, but AIOps will make you omniscient, enabling you to:
- Harness powerful analytics firepower to find and fix network trouble spots instantly and precisely before users complain—in some cases before they even notice
- Understand which sites perform better than others to pinpoint where improvements can be made
- Propose configuration changes that help the network self-optimize and self-heal
- Detect and optimize degraded links to boost user experience
And if issues ever do arise, AIOps advises you immediately as it monitors the network 24/7, providing you with full situational awareness and insights, solving problems as they occur.

SD-WAN & AIOps: Maintaining Connectivity by Self-Healing

The Facebook event was unusual in that it globally impacted the world’s users, who couldn’t access the app through any Facebook data center. In that scenario, AIOps simply identified the app disruption and noted the root cause.

But what if the situation had been different? For example, imagine if Facebook’s U.S. west coast datacenters were deemed unavailable but its east coast datacenters were operational. By combining SD-WAN with AIOps, a similarly affected company could have performed diagnosis and ensured app connectivity.

How could that have played out?

First, AIOps would have detected the issue and its root cause. It would have reported that the application was unreachable to users on the west coast but available to users on the east coast. Finally, SD-WAN would have self-healed by rerouting end-user application traffic to the eastern data centers to maintain app connectivity.

Using the old-school method of manually monitoring and troubleshooting networks is nearly impossible for most IT teams. Instead, teams are relying on SD-WAN and AIOps. This combined capability gives teams an unbeatable superpower, enabling them to substantially improve connectivity across the enterprise and rapidly respond to issues as they occur.
November 22, 2021
The Biggest Motivators and Barriers for SD-WAN Adoption in 2021
The SD-WAN market has exploded in 2020, driven by the need to support increasingly remote workforces, the emergence of the AI-driven WAN and the requirement to deliver branch performance that matches campus networks. As enterprises look at the year ahead, support for the distributed workforce remains a top priority, and SD-WAN is a crucial technology that businesses need to invest in to thrive in the “new normal.”

As we head into 2021, these are the biggest motivators for the enterprise to adopt SD-WAN:
- Increased demand for robust video quality: The days of in-person conferences and meetings have been traded with back-to-back Zoom calls. Though lags and connectivity issues are understandable, they can be frustrating and ultimately lead to decreased productivity. Experiencing these issues has increased the demand for more robust and higher bandwidth network connectivity, which is critical for video communications. This increasing demand is expected to continue to rise—although some businesses are planning to return to the office, many are adopting a hybrid work model that will require at last part-time remote work.
- Boosting bandwidth without breaking the bank: Outside of video calls, the surge in remote work has increased pressure on overall network bandwidth. The solution for organizations is, of course, to add more bandwidth, but doing so can be expensive. SD-WAN is an attractive option for increased bandwidth pressure because it’s a solution that can meet bandwidth pressure demands while remaining cost-effective.
- Centrally operated networks needed for distributed sites: Once enterprise video quality and bandwidth needs are fulfilled, the next step is to ensure that IT teams have the resources they need to effectively operate remote networks and deliver a great user experience from client to cloud. SD-WAN is a useful IT tool for network management because it provides full visibility into what’s happening across the network. And with the recent emergence of AI-driven WAN solutions, IT teams have more tools than ever before to get insight into user experience, enabling them to proactively and remotely resolve issues.
Despite the many benefits of SD-WAN, there are still a number of barriers that are keeping enterprises from adopting this technology, including:
- Concerns about quality of service (QoS) for applications across WAN: With SD-WAN solutions shifting traffic away from dedicated private circuits towards the public internet to reduce cost, businesses are often concerned about their ability to assure QoS for their critical applications. These businesses should look for solutions that provide insights into the experience from client to cloud as well as leverage data science and AI to detect anomalies. They should also automate the root cause determination and resolution through self-driving or IT actions.
- Lack of insight into user experience: Many SD-WAN solutions lack the insight into both user and app experience from wireless to wired to WAN, whether due to the use of link-based VPN connections rather than session-based protection and/or the lack of rich streaming telemetry from the network devices to a modern cloud-based AI system. New AI-driven solutions and session-based technologies are now available that can improve this insight to simplify network operations and assure great user experiences from client to cloud.
- Securing remote sites from potential security threats: By further extending the threat surfaces with a more distributed workforce, many organizations are concerned about the potential security threats that a distributed network could introduce. To mitigate this, it is critical to look for solutions that embrace a connected security paradigm that delivers insight into threats across the network while automating mitigation and enforcing security policies at the edge.
- Limited technical skills and knowledge: A common perceived barrier to SD-WAN adoption is the concern that there is a significant learning curve for the technology and not enough existing skills to plan and manage it. This is a valid concern, though there are solutions. First, some SD-WAN providers offer managed services and can oversee deployment for customers through an outsourced or hybrid IT model. Second, organizations can invest in closing the skills gap via training. Though the latter option can be more time-consuming, investing in employees to learn the skills can help enterprises save money in the long run and move the industry forward by up-leveling important technical skills that are increasing in demand.
Though there are notable barriers to SD-WAN adoption, there are also solutions for each one. If enterprises can overcome these barriers, implementing SD-WAN has the potential to improve scale, bring agility, unify policy and boost security efficacy through a collapsed and integrated AI-driven network. Deploying SD-WAN can be a significant investment for companies, but in the long run, the technology is an important step in moving enterprises into the next generation of networking.
December 11, 2020
Juniper Networks Brings AI to SD-WANs

Juniper Networks today announced it can now apply the same artificial intelligence (AI) engine it uses to automate the management of wireless local area networks (LANs) to software-defined wide area networks (SD-WANs).

Based on an AI engine that Juniper Networks gained when it acquired Mist Systems, the Juniper Mist WAN Assurance cloud service streams telemetry data gathered from Juniper SRX devices to an AI engine that advises IT teams on how to best set WAN service levels as part of a larger transition to intent-based networking.

As part of that initiative, Juniper Networks is also providing access to a Marvis conversational interface originally developed by Mist to enable IT teams to verbally issue commands, replacing the traditional command-line interface (CLI).

Christian Gilby, director of product marketing for Juniper Networks, said as the number of remote branch offices that IT organizations need to manage increases at a time when travel is limited, the need to apply AI to SD-WANs has never been more apparent.

Rather than return to central offices in the wake of the COVID-19 pandemic, Gilby noted, many organizations are shifting staff to smaller remote offices to enable collaboration while continuing to minimize potential exposure to anyone who might be infected.

The challenge is that many IT teams tasked with managing the WANs that connect those remote offices aren’t growing during the downturn caused by the pandemic. AI provides a way to troubleshoot and optimize WAN performance without having to increase network operations headcount, Gilby said.

Platforms such as the Juniper Mist WAN Assurance cloud service provides the added benefit of never forgetting anything they learn or taking a day off.

Gilby said it’s not likely AI systems will replace the need for network operations teams anytime soon. However, Juniper Mist WAN Assurance is part of a larger wave of AIOps technologies that are augmenting existing IT staff. It may take a while for them to trust the optimizations being made by AIOps platforms, but the more data those systems collect, the more accurate they become over time.

In the case of a cloud service, the machine learning algorithms that drive the AI models are being trained continually using anonymized data collected from thousands of systems.

The launch of Juniper Mist WAN Assurance comes at a time when more organizations are looking to embrace SD-WANs as a way to more easily scale the delivery of network services when employees are working from home for the foreseeable future. In many cases, IT teams are now dropping Mist wireless routers into home offices to extend the reach of SD-WAN services in a way that can be managed and optimized using the same core AI technologies, said Gilby. In its most recent quarter, Juniper Networks reported a 170% rise in orders year-over-year for Mist wireless LANs.

It remains to be seen how much or how quickly networking operations will be transformed by AI. However, at this point, that transformation is all but inevitable.

July 29, 2020
Barracuda Networks Partners With Microsoft on SD-WAN Service

Barracuda Networks today launched a software-defined wide area network (SD-WAN) service that runs natively on the Microsoft Azure cloud.

Klaus Gheri, vice president of network security for Barracuda Networks, said Microsoft has made it possible to launch an SD-WAN service using Azure Virtual WAN Hubs, a networking service based on a hub-and-spoke architecture that unifies networking services such as security and routing under a common interface. Those services span branch connectivity, multiple types of virtual private networks, cloud interconnects, firewalls and encryption services.

Gheri said rather than having to replicate all those networking services, Barracuda Networks is layering a Barracuda CloudGen WAN service on top of the Azure Virtual WAN Hubs to provide a service that, like any other cloud service, can be consumed per billable hour.

Developed in collaboration with Microsoft, the Barracuda CloudGen WAN service provides the management framework needed to convert Azure Virtual WAN Hubs into an SD-WAN service that IT teams can employ to securely connect remote offices to cloud applications or on-premises IT environments, he said.

SD-WAN services today come in four basic forms. IT teams can deploy and manage their own SD-WAN appliances. Alternatively, telecommunications carriers make SD-WAN services available on their networks or a managed service provider (MSP) can create its own SD-WAN service by deploying the appliance on points of presence (PoP) on a global network it manages. More recently, cloud service providers have been making SD-WAN services available via the networks they built to connect all their data centers.

Gheri said Microsoft is now taking that SD-WAN capability a step further by adding a management portal created by Barracuda Networks.

A recent survey of 750 business and IT professionals conducted by Vanson Bourne on behalf of Barracuda Networks finds more than half (52%) are looking to employ SD-WAN services delivered via the cloud. In comparison, the survey finds 16% prefer to get SD-WAN from an independent vendor, 15% would opt for a telecommunications partner and 12% would rely on a value-added reseller.

With more application workloads moving into the cloud, the way networks are deployed and managed is evolving rapidly. Instead of connecting branch offices to local data centers to access cloud applications, more organizations are employing SD-WANs to provide direct access to cloud applications without having to backhaul network traffic through a local data center. That approach significantly improves overall application latency and, in many cases, reduces the need to rely on leased MPLS lines from a telecommunications carrier.

Rather than build those SD-WANs themselves, many IT organizations want to be able to access and manage them via a portal through which they can allocate bandwidth to applications as they best see fit. It’s not clear to what degree IT organizations will continue to prefer to deploy appliances versus consuming SD-WAN as a service. However, given the complexity of managing SD-WANs, there’s a high probability that SD-WAN services delivered via existing cloud networking infrastructure will soon become a widely employed alternative.

July 16, 2020
HPE Acquires Silver Peak to Gain SD-WAN

Hewlett Packard Enterprise (HPE) announced its intent to acquire Silver Peak, a software-defined wide area network (SD-WAN) platform provider, which will be incorporated into its Aruba Networks subsidiary.

Keerti Melkote, president of Intelligent Edge for HPE, told industry analysts the $925 million acquisition will eventually lead to edge computing devices all being managed via the same cloud framework regardless of physical location.

Aruba Networks has been making a case for unifying the management of wired and wireless networking in branch offices via a cloud management platform. The acquisition of Silver Peak will extend the reach of that framework to SD-WANs, which are becoming more widely employed to connect both remote offices and end users working at home to applications running both in the cloud and in the local data center.

In the wake of the COVID-19 pandemic, the number of employees working from home and needing direct access to applications has exploded. Rather than employing virtual private networks (VPNs) to connect all those home offices to a local branch office, it’s more efficient and secure to connect those working at home to applications residing in both the cloud and on-premises IT environments via SD-WANs.

HPE claims the total addressable market for networking services aimed at various edge computing use cases is north of $32 billion, which includes both SD-WANs and wireless and wired networks deployed in the branch office.

Silver Peak currently has more than 1,500 customers and in its last fiscal year generated $132 million in revenue. The challenge HPE and its Aruba Networks subsidiary will face is most SD-WANs that have been deployed thus far use appliances that were acquired by internal IT teams. Increasingly, however, SD-WANs are being consumed as a managed service. Aruba provides customers access to a cloud console to manage networks deployed in remote offices. It’s not clear how many internal IT organizations moving forward will want to manage remote networks versus relying on a managed service provider (MSP).

Of course, HPE and Aruba can opt to provide a managed service. However, they will need to build out the points of presence (PoPs) to deliver a managed SD-WAN service—something many MSPs, especially telecommunications providers, and cloud service providers have already done.

Longer-term, it’s also not clear to what degree wireless 5G services will eliminate the need for not just wired networks, but also wireless local area networks (LANs) in branch offices. Some IT organizations may conclude the cost of a 5G cellular service is less than the total cost of managing a LAN.

There is, of course, no absolute when it comes to networking. However, if more employees are working from home for the foreseeable future, the dynamics of networking at the edge will never be the same. Developers especially will need to take into account a whole different level of network latency dynamics when deploying applications. The irony is that as applications become more distributed, the management of the networks on which they depend is becoming more centralized.

July 14, 2020
Report: SD-WAN Shift to the Cloud Accelerates

The rate at which software-defined wide area networks (SD-WANs) are being consumed as a cloud service appears to be accelerating in the wake of the COVID-19 pandemic.

A global survey of 750 IT professionals conducted by the market research firm Vanson Bourne on behalf of Barracuda Networks finds over half of respondents (52%) are looking to acquire an SD-WAN solution via a cloud provider, with Microsoft Azure being cited as the most preferred option.

Only 16% said they prefer an SD-WAN from an independent vendor, while 15% would opt for a telecommunications provider. Another 12% said they would rely on a reseller.

Klaus Gheri, vice president of network security for Barracuda Networks, said the survey suggests that as application workloads move into the cloud, more IT organizations want to centralize acquisition of networking services alongside compute and storage. As such, he said, providers of SD-WAN appliances such as Barracuda Networks will need to evolve to extend the basic SD-WAN capabilities provided by cloud service providers.

At the same time, Gheri noted that way applications are being accessed is also evolving as more employees are working from home. Rather than directly accessing applications running in a local data center or office, many organizations are routing access requests to those applications through their cloud service provider. That approach reduces costs by using a public internet connection to access to cloud service, which then routes that request over a virtual private network (VPN) to a local data center.

Given the egress charges a cloud service provider requires, that approach may not reduce costs in the case of every workload. However, it may reduce costs by reducing the amount of network traffic moving across a leased MPLS line, he noted.

Gheri said the rise of the cloud as a networking conduit illustrates how varied SD-WAN implementations have become. Organizations increasingly need some capability at the client level to automatically determine which network path makes the most sense for any request based on cost and latency requirements.

In the meantime, frustrations with VPN clients continue to mount. Most VPN implementations were designed to support a small percentage of employees for occasional access. With more employees working from home more frequently, many organizations are reconsidering their SD-WAN strategies. In addition to being able to scale services more easily, Gheri noted SD-WANs also afford organizations the opportunity to implement zero-trust networking services to better isolate application environments in the event of a security breach.

Over the last few years, SD-WANs have been one of the fastest-growing categories in IT. The Barracuda survey found 23% of respondents have already deployed SD-WAN, with another 51% either in the process of deploying or expecting to deploy one within the next 12 months.

Clearly, competition between cloud service providers, telecommunication carriers and independent providers of SD-WAN services will intensify in the months ahead. The challenge facing IT teams now is determining to what degree they want to be directly involved in managing SD-WAN networks versus simply consuming SD-WAN services on an as-needed basis.

June 15, 2020
Making SD-WAN More Secure and Flexible

Cloud and managed services enable companies to focus scarce IT resources on business outcomes. According to Gartner, the “market size for cloud is growing exponentially, and cloud is projected to be a $317 billion industry by 2022.”

Managed service providers (MSPs) leverage the power of software-defined wide area networks (SD-WAN) to offer higher quality services and reduce branch network costs. SD-WAN offers compelling advantages for distributed organizations with critical branch operations, including the benefits of business agility, improved application performance and lower bandwidth costs.

MSPs invest considerable time and energy in ensuring that their servers, applications, data centers and people are always available. The same amount of attention needs to be paid to managing customer connectivity, as connectivity issues will result in customer support and retention issues, together with increases in cost and decreases in monthly recurring revenue.

While bringing connectivity to the data center is viewed as a customer-driven activity — meaning that MSPs are relying on end-users and carrier networks to deliver their customer experience — managing that connectivity is primarily, but not always, the responsibility of the MSP.

However, the quality, performance and security of carrier networks can be outside of the MSP’s control, creating vulnerability in the MSP’s service delivery and revenue process. Many MSPs are, therefore, rightly concerned about the safety of end-user data as it passes over the carrier networks. Outsourcing security measures and data assurance for end-users’ critical data can sometimes be undesirable and, thus, should be considered as part of a risk mitigation strategy.

Making SD-WAN More Secure and Flexible

A challenge that most MSPs face is ensuring that their customers’ data is encrypted safely in an SD-WAN environment and the integrity and confidentiality of that data is assured.

An on-premise, scalable encryption management solution that can integrate into an SD-WAN without disrupting an MSP’s environment provides the flexibility MSPs are seeking. In addition, the utilization of micro-segmentation using cryptography to prevent lateral movement of threats between segments can protect the confidentiality and integrity of the end-user’s data providing the security both parties need.

A viable encryption solution that makes the SD-WAN environment more secure and flexible provides the data assurance MSPs and their end-users are seeking, while mitigating risk and reducing the attack surface for everyone.

Data Assurance with Separation of Duties

Layer 4 encryption provides data assurance and eliminates risk for both the MSP and the end-user with the separation of duties, allowing the end-user to encrypt and protect their data prior to sending it over the MSP/carrier networks. Through crypto-segmentation, fine-grained policies are defined and enforced to protect the confidentiality and integrity of the end-user’s data.

In practice, this means that MSPs do not take on the risk of having to manage and protect the confidentiality and integrity of their customers’ data, nor do they have to accept risk to protect end-user data when it’s on their network — it remains the responsibility of the end-user.

Similarly, the end-user can eliminate risk to their data from both the MSP and whatever carriers they, or the MSP, may be using for the connectivity; they do not have to trust the carrier team or network to be secure.

Ensuring Fine-Grained Regulatory Policies with Crypto-Segmentation

Most MSPs will have enterprise, government and high assurance customers, all of whom are under varying data protection regulations. The end-user can now use crypto-segmentation to create separate policies and data flows, thus eliminating risk by defining fine-grained policies that are difficult to infiltrate.

Crypto-segmentation enables MSPs with customers who must adhere to different or multiple industry and/or government regulations — for example, to generate these fine-grained policies by each customer and regulation (GDPR, PCI, CJIS, NERC CIP) etc.

Scalable Implementation Into Any Network or Transport

Lastly, a scalable, network agnostic overlay which integrates easily and sits on top of SD-WAN can make the SD environment more secure for MSPs and their customers without disrupting the current network architecture and with zero impact to performance. This solution should be fully interoperable with the SD-WAN, scale to support the breadth and depth of the customer’s environment and operate without impacting the SD-WAN core functionality.

Conclusion

MSPs and their end-users need to mitigate the risks and vulnerabilities associated with multiple carrier networks. In order to achieve this, it is essential that MSPs investigate flexible and secure data assurance solutions that help both carriers and end-users to take advantage of the management services provided by MSPs and provide critical separation of duties to mitigate risk for both parties.

June 12, 2020