En Garde!

Survey Says… IT Managers Concerned About LAN Sprawl

By Rod Kay

Knowing what’s happening on the LAN, much less controlling it,  is becoming quite complex.  We hear concerns about managing access rights and other control issues all the time from our customers, across every industry, and the message is always the same. With the rapid increase in the number and types of users, applications and devices on LANs today, IT managers are losing visibility and control at an alarming rate.  To better understand this situation, and to get from anecdote to real data, we commissioned Loudhouse, an independent research consultancy, to interview IT decision makers in both the US and UK on these issues.

Loudhouse asked respondents to consider how their LAN had grown over the last two years and about anticipated growth over the next two years.  A key finding is that LANs have grown at fairly consistent rates across a wide range of axes and are expected to maintain this multi-dimensional growth over the next two years. Loudhouse calls this multi-dimensional growth “LAN Sprawl” – the combined effect of more and different types of users, applications, and devices and their inter-dependencies. Cross-functional users, third-parties, more diverse applications, and corporate, personal, and non-user IP devices are all in the mix, contributing to LAN Sprawl.

For IT organizations being asked to do more with less, this sprawl has become quite a problem. The video below provides survey results on the LAN Sprawl issue and some of the concerns IT has in dealing with this situation. If you’re having trouble viewing this video or text, click here for a larger slideshow with the full results.

We’d love to hear from you on this topic – are you feeling the effects of LAN sprawl? What steps are taking to regain control?

The survey, conducted in June 2009, is based on 200 interviews with IT decision makers from mid-size (250+ employees) to large enterprises (1000+ employees) across the US (100) and UK (100) regions.

Key Findings: LAN Sprawl Growth

1. 30% average growth in LAN size from 2007-2011 (average across all areas of growth)
2. The largest areas of growth in the network overall over the last two years are:
         *Number of applications (16.8%)
         *Smart/mobile devices (16.6%)
         *Remote working employees (16.6%)
3. The greatest area of risk for UK respondents: ability to control access in remote locations (50%)
4. The greatest risk for US respondents: inability to enforce appropriate usage policies (40%)

Key Findings: Resources and Growth

Key Findings: Resources and Growth
1. The greatest areas of growth are increases in:
         *Approved business applications
         *Number of applications supported by the network
         *Smart/mobile devices
         *Remote working employees
2. Over next two years, 55% of US companies expecting greater growth, and 44% of UK
         *The largest growers are also more likely to increase the pace of LAN growth
3. However only 42% of businesses have sufficient investment for IT to support their business goals 
         *37% say that staffing levels have increased to support LAN growth

 

What a Week in LAN Switching!

I’ve been watching the LAN market a long time – as a journalist and analyst for nine years and as a vendor for another eight since then – and this has been one of the more interesting weeks in LAN infrastructure in years.

After not changing much since the advent of switches in the early 90s and routing switches in the mid-90s, the LAN market saw some pretty interesting events this week. Cisco’s targeting of the data center switch market with its Nexus announcement on Monday is one example of the move toward greater intelligence and application awareness in the network. Add in Cisco’s philosophy in TrustSec of the need for role-based networking and the intelligence they’re talking about in the PISA blade for the 6500, and that’s a lot of places in the LAN getting a lot smarter about users and applications.

Then you have Juniper, in what has to be one of the industry’s worst-kept secrets in years, coming out yesterday with its entrance into the LAN switch market. While the initial switches appear to offer just the basic L2/L3 switching capabilities, the company has a history of distinguishing itself in application smarts and other value-add capabilities, and one would hope Juniper will eventually apply this vision to their LAN switches as well.

Here at ConSentry, we took advantage of the timing to add to the industry discussion about LANs getting smarter. On Monday, we took the wraps off our vision for Intelligent Switching, with user and application control built into the switch. We were founded – and funded – to build the next-gen switch, with built-in security and control features. We took the pragmatic step of building an appliance first, to make customer adoption easier, but with this announcement we were able to fully detail our original vision and show how it fits within these broader industry changes. We highlighted the differences between the legacy and intelligent switch architectures – the latter having knowledge of user identity, device, role, application, and destination native in the switch. This intelligence gives IT business context like never before, which simplifies tasks like limiting access to resources or troubleshooting user or application problems.

A lot of publications picked up on this trend toward greater intelligence, including the San Jose Mercury News and Network World. And we may not be done with the news for the week. Rumors continue to swirl about, as one analyst put it, one more “monumental” announcement, after which the switch landscape is supposed to look very different. Regardless of whether more news comes, though, this week’s already seen a sea change in what’s state of the state, and for the first time in a long time, IT has more than the commodity switch feature set to think about when investigating switches for their next LAN upgrade.

As the saying goes, may you live in interesting times. At least in LAN switching, it would appear we are. Sure makes this all a lot more fun.

--Michelle McLean

mmclean-at-consentry-dot-com

Cisco oneNAC – and Four Types of Cisco Customer

Another day, another flavor of NAC from Cisco.

Network World’s Tim Greene was among those reporting on this latest variant of Cisco NAC – this time oneNAC that aims to combine aspects of the Cisco NAC Appliance and the Cisco NAC Framework. And it'll be ready in just 12 or 18 short months from now.

I love these announcements. They highlight everything that Cisco wants to be while making it painfully clear all the places they’re falling short. It also helps invite customers, media, and analysts to ask how we compare to Cisco. We love to do that – especially in the form of competitive bake-offs – because anyone who looks at the issues quickly grasps the disparity between what Cisco wants to do and what they can do. And between what Cisco and ConSentry can do.

My favorite version of the comparison question is “How can you sell security infrastructure, especially switches, given Cisco’s dominance in the switch market?”

Through my many years of competing with Cisco – in service provider core routing, wireless, WAN optimization, and now LAN security – I’ve seen a wide range of Cisco customers. Here at ConSentry, it’s really crystallized for me that Cisco customers fall into four camps.

Type 1
The true-blue believer. These customers build their networks according to Cisco blueprints and don’t diverge from that path. Luckily, ConSentry inside sales reps can quickly qualify out these prospects so we don’t end up spending time with them.

Type 2
Wedded to Cisco for switching infrastructure but will consider other vendors for appliances or other services when Cisco falls short. At Peribit, selling WAN optimization and application acceleration, I saw plenty of these, and we sell plenty of ConSentry Controllers – our appliance form factor – to these guys now.

Type 3
Wedded to Cisco for switching infrastructure at headquarters but open to other infrastructure vendors for regional or branch offices. These customers sometimes surprise you – we’ve had more than one customer tell us they’d never consider our LANShield Switch, and they happily deploy our LANShield Controller in headquarters. Then some months or even a year later, as they’re approaching a switch upgrade project in their regional locations or branch offices, they come back asking “Now what does that switch look like again? And it’s cheaper than the dumb switch I was going to buy from Cisco?” These guys represent a fantastic opportunity for both our LANShield Switch and LANShield Controller.

Type 4
Won’t waver from Cisco chassis switches in the core but consider the LAN edge to be commoditized. These customers are the most fun because they think the biggest right out of the gate – they immediately see the value of the ConSentry secure switch in lieu of something like a 3750. They love the ability to deploy identity-based control, and they see the need for it right at the LAN edge. We’ve had several customers who sought us out originally for our appliance end up accelerating their switch upgrade projects by as much as nine months to get all the security built in for free and spend less than the budgetary planning amount set aside to upgrade with Cisco

For companies like ConSentry, all the fits and starts coming out of Cisco around NAC and the self-defending LAN serve us incredibly well. The announcements serve to validate all the functionality needed but dramatically call attention to the current shortcomings of the Cisco solution. So let me say once again – thanks Cisco for making our jobs easier!

--Michelle McLean
mmclean-at-consentry-dot-com

In Good Company

Last week, Cisco had an announcement about an updated Supervisor 32 engine for its 6500 line of Catalyst switches. Understandably, this news fell under the radar of most security blogs and reports, but it's worth highlighting. The heart of this new Sup engine is the Programmable Intelligence Services Accelerator, promising L7 packet inspection and enforcement, and the focus is on getting this kind of intelligence in the wiring closet, as a blade in 6500s deployed at the LAN edge.

It's exciting to see Cisco drive this message around the need for security in the wiring closet, and for ConSentry, the timing couldn't be better. We rolled out our Secure Switching news today, and it's great to be in such good company as we drive that message. Of course, the Cisco module isn't out quite yet, and it'll max out at 2 Gbps, but we definitely get a boost from the Cisco messaging that this is the way IT should be building LANs. And it clearly broadens the message well beyond the well-worn Network Access Control path.

We also decided to have a little fun with our news and how we explain the impact on the wiring closet. If you get a second, check out our take on what this all means for enterprise networks.

--Michelle McLean
mmclean-at-consentry-dot-com

Thoughts on RSA

Even more than last year, I was struck by how much the RSA show floor looks like Interop's. I'm still new to the world of RSA, but I've been going to Interop since 1991 - back in the days of Moscone, engineers, and incredible lego designs from FTP Software showing IP stack interoperability (I'll skip the tempting analogies to explore between today's purveyors of agents and FTP Software - "sure, a stack will get built into the OS, but our stack's better, so people will keep paying for it separately"). From what I hear, RSA is getting softer and softer in the same way Interop has, and I'm left feeling bad for IT folks actually trying to find solutions to their real and serious problems as they wander the dizzying maze of booths. I think it can be done, but it takes a lot of focus and work to read the buzzwords and ask the potentially relevant vendors to explain, yet again, what it is they do.

From the vendor perspective, trade shows are a mixed bag - you do it somewhat for the customers, and somewhat for the industry. We had lots of vendors coming by to see our product in action, but we also had some great conversations with users. I think Rothman's point about the value of a show depending on expectations is right on. Since I think of trade shows as more about branding than leads, I was actually pleasantly surprised by the dialogues I had with end users. The bank with some apps so dated they don't support any kind of access control, the defense bogeyman who had to stay incredibly vague about what his apps did, the company with a PCI problem and only three months to get compliant.

One thing stands out - yeah, there's still confusion about what NAC is, but people are a lot smarter about it this year. The conversations this week, as well as our sales calls and the RFIs we're seeing, show people have thought about their problems, understand their needs, and now are sorting through how to go about solving them. That's a much better state of confusion than last year's!

With an 18-month old at home and very little time to see him, I scooted out of the City as early as I could most nights, but I did stay out on Wednesday to go the security bloggers event. Like others have mentioned in their postings, it was really cool to put a face to the text. I'm still a blogging newbie, but it was fun talking to folks about how blogging is helping to advance people's understandings of security issues. As a former journalist and analyst, I really appreciate having a forum to lay out some thoughts and engage in a dialogue, and given the tight focus of so many of us, compared to often fairly broad beats that journalists and analysts have to cover, we have the luxury to delve into issues much more deeply.

So thanks for organizing, Rich (we'll miss your writings), and I look forward to tipping a glass with the whole group again soon.

--Michelle McLean
mmclean-at-consentry-dot-com

Controlling your "corporate ghosts"

To better understand how IT is thinking about LAN security, ConSentry recently commissioned some independent research to survey IT leaders at enterprises. Just yesterday the full report hit. Part of the survey asked IT staff to quantify the risks and challenges they face:

• so-called "corporate ghosts" represent the biggest threat for data loss
  
  • temporary workers (62% of respondents cite them as the most risky group)
  • guest users (54%)
  • contractors (51%)
• 82% of respondents have such workers on their LANs
• 65% believe network access is getting more diverse and harder to manage

Other parts of the survey discussed techniques IT is seeking to meet these challenges. The most startling finding was this one:

• 94% of companies see an increased need for identity-based control

I found that statistic surprisingly high, given that identity has only recently come into the Network Access Control and LAN security discussion. As the guys on the Digital ID World blog frequently lament,  people have been slow to make this connection.

We're happy to see this evidence that enterprises are beginning to understand how critical it is for identity to be the foundation for applying access controls.

So take a look at the research - and definitely let us know what stands out as you look over the data.

--Michelle McLean
mmclean-at-consentry-dot-com

Welcome to En Garde! ConSentry on Information Security

Welcome to the ConSentry Networks weblog. We established this forum as a place to hold a conversation about experiences, thoughts, and opinions from the trenches in the big, complex enterprise networks we work to secure.

On these pages we'll explore the state of information security technology and networking and comment on current events - that kind of thing. We may also relay some of the inside story of our efforts to build a remarkable company in the heart of Silicon Valley.

This is a team effort. (And it's a pretty cool team, if we do say so ourselves.) The views expressed here are, of course, the opinions of the writers and not necessarily a ConSentry corporate position.  We hope you'll contribute to the conversation as well.

About the blog's name:
En Garde! We like the double entendre of a security defensive posture "on guard" and an attack position to root out the bad guys everywhere.

Enjoy!