View Profile
BYOD security is a network architecture problem
The data centre (as we knew it) is never going to be the same. Fluid changes are already in motion, brought about largely as a result of ‘paradigm’ shifts in computing including…. :
- Multi-core processing and parallelism
- Cloud computing and server virtualisation
- Bring Your Own Device
- Complex Event Processing
- Software Defined Networks
- Big Data
- Analytics and In-Memory Computing
… actually, several other major factors too, but that’s a good data-centric 7-pack to start with is it not?
This swollen spring tide of information management elements brings with it empowerment for those that can bring meaningful analytics to bear upon the new data stack and, conversely, security concerns for those who fail to grasp the new triffid-sized nettle that has the growth potential to run rampant.
So colourful analogies aside… what are we talking about here in real terms? Enterprises today are increasingly forced to deal with massive amounts of so-called Big Data as they have to contend with the risk of employees connecting to the network with Bring Your Own Device (BYOD) tablets, smartphones and more.
This has created an inflexion point for large organisations in terms of data centre transformation. We have reached a chasm where network security infrastructures will fail to scale and cope with the complexity of compute throughput caused by our seven factors as mentioned above. Put simply, the new under-managed over-clocked network is a security risk.
So how do we put our next step forward without falling?
“The reality is, if a hacker wants to get into your network, then they will, 100 percent of the time. Match that risk with the new reality of BYOD security concerns and it’s a heady concoction,” argues Peter Doggart, management executive for security platform company Crossbeam. “Once we accept these basic truisms we can move on. From this point we can start to plan for compromised user containment, mitigation and segregation/quarantine.”
But it’s not all about mitigation argues Doggart. Too much discussion circulates in the security industry focused on mitigation and cure, with comparatively scant lip service being paid to pre-infection prevention instead.
“You can’t put anti-virus controls on an iPad; so putting controls at the network layer is the only way to deal with the security risks we stand in front of today. But going deeper, companies need to think about the structural build of their data centres and networks to ensure that they architect them correctly. New security vectors demand a new approach to application and network architecture. As a basic example, servers that process credit card data should be physically and locally segregated from other basic services.”
Crossbeam’s Doggart is adamant that this problem of implementing network security within more dynamic, virtualised data centers means that network security infrastructure needs to evolve in order to help organizations achieve their vision for the next-generation data centre (NGDC). Then (and only then) can we successfully reap the benefits of cloud computing technology for both public and private environments he says.
So where do we turn next?
Contemporary technologies in this space lean towards intelligent “boxed” solutions i.e. appliances such as Intrusion Prevention Systems (IPS) and Threat Management Systems (TMS). Crossbeam’s X-Series ‘network in a box’ challenges purpose-built security device products from HP, Oracle, IBM and others suggesting that there is a defined need to “corral” switches, routers, load balancers, network layer protection mechanisms and application delivery controllers into a unified single solution. Indeed, HP appears to also embrace the ‘unification’ label directly, naming its HP 200 Unified Threat Management (UTM) Appliance Series as it does.
So do we still need end point security in the shadow of more powerful network layer security controls? Take HP’s aforementioned product, which does indeed come with anti-malware controls plus denial-of-service (DoS) attack protection, plus optional services such as anti-virus, anti-spam and URL filtering capabilities. The consensus argues that yes, we mostly still do need user end point security at whatever level we can bring it to bear; but it must work in harmony and unison with the wider strategy for this new and more intelligently designed network and data centre structure currently under construction.
So this is happening. Not everywhere and not at every level. But a network architecture security handbook should be on every CIOs Christmas list this year. Until we get there, wear a hard hat.
Crossbeam offers the following white paper on this subject: “The Rise of Next-Generation Data Center Network Security”
