En Garde!

Survey Says… IT Managers Concerned About LAN Sprawl

By Rod Kay

Knowing what’s happening on the LAN, much less controlling it,  is becoming quite complex.  We hear concerns about managing access rights and other control issues all the time from our customers, across every industry, and the message is always the same. With the rapid increase in the number and types of users, applications and devices on LANs today, IT managers are losing visibility and control at an alarming rate.  To better understand this situation, and to get from anecdote to real data, we commissioned Loudhouse, an independent research consultancy, to interview IT decision makers in both the US and UK on these issues.

Loudhouse asked respondents to consider how their LAN had grown over the last two years and about anticipated growth over the next two years.  A key finding is that LANs have grown at fairly consistent rates across a wide range of axes and are expected to maintain this multi-dimensional growth over the next two years. Loudhouse calls this multi-dimensional growth “LAN Sprawl” – the combined effect of more and different types of users, applications, and devices and their inter-dependencies. Cross-functional users, third-parties, more diverse applications, and corporate, personal, and non-user IP devices are all in the mix, contributing to LAN Sprawl.

For IT organizations being asked to do more with less, this sprawl has become quite a problem. The video below provides survey results on the LAN Sprawl issue and some of the concerns IT has in dealing with this situation. If you’re having trouble viewing this video or text, click here for a larger slideshow with the full results.

We’d love to hear from you on this topic – are you feeling the effects of LAN sprawl? What steps are taking to regain control?

The survey, conducted in June 2009, is based on 200 interviews with IT decision makers from mid-size (250+ employees) to large enterprises (1000+ employees) across the US (100) and UK (100) regions.

Key Findings: LAN Sprawl Growth

1. 30% average growth in LAN size from 2007-2011 (average across all areas of growth)
2. The largest areas of growth in the network overall over the last two years are:
         *Number of applications (16.8%)
         *Smart/mobile devices (16.6%)
         *Remote working employees (16.6%)
3. The greatest area of risk for UK respondents: ability to control access in remote locations (50%)
4. The greatest risk for US respondents: inability to enforce appropriate usage policies (40%)

Key Findings: Resources and Growth

Key Findings: Resources and Growth
1. The greatest areas of growth are increases in:
         *Approved business applications
         *Number of applications supported by the network
         *Smart/mobile devices
         *Remote working employees
2. Over next two years, 55% of US companies expecting greater growth, and 44% of UK
         *The largest growers are also more likely to increase the pace of LAN growth
3. However only 42% of businesses have sufficient investment for IT to support their business goals 
         *37% say that staffing levels have increased to support LAN growth

 

The Rise of the Virtual Organization

By Michelle McLean

Yankee Group recently published a report entitled “The Era of the Virtualized Organization Demands Context-aware LANs.” ConSentry commissioned the report after extensive discussions with customers about how their businesses have been changing and the ways in which today’s static LANs have made it difficult for them to keep up with those changes.

What does Yankee mean by the virtualized organization? The term refers to the constant coming and going of different “workers” – including employees, guests, contractors, partners, even competitors – as well as those workers’ devices and applications. It also encompasses the idea of ad hoc groups, where people from different parts of the business, both inside and outside, come together to work on a given project (M&A activity, for example, or a CRM customization).

The Yankee report contends that given the rise of the virtualized organization, IT needs a more dynamic and knowledgeable infrastructure to accurately assign user access rights on the LAN. The report argues that to regain control, IT needs context in the LAN – deep knowledge of the user, role, device, application at Layer 7, destination, and environmental factors such as location and time of day. Based on this richer set of information, the LAN becomes an orchestrator – delivering the right services to the right people at the right time. And IT has the info needed to better manage the interactions amongst users, applications, and devices.

Essentially, with context-driven switching, policy becomes the new forwarding table.

You can read the full report on the ConSentry site, and hear Yankee Analyst Zeus Kerravala discuss what organizations require to solve this problem.

Clearly the LAN edge isn’t the only place to need context – the data center and the LAN/WAN boundary are two other places that would benefit greatly from a richer understanding of the users, applications, and devices traversing them.

Where else do you think context matters? And what other attributes will it encompass? I look forward to reading your comments.

Tales of Woe: IT Challenges on the LAN

By Joe Golden

While at the Interop show in Las Vegas last May, I was able to catch up with a number of IT managers walking the show floor in search of solutions for some of the issues they face on a daily basis. Although the faces were different, the stories were the same – tales of woe about remote users coming into the corporate network from unsecured home computers, new applications being introduced (often without IT’s knowledge), and the need to keep up with the constant influx of new devices on the network.

While these IT managers hail from organizations varying in scope and size, they share a common set of problems. Moreover, they share a common need for more visibility and control over the users, applications and devices on their LANs.  

To find out firsthand what IT managers are saying about challenges they face on the LAN, take a look at this video, “Growth Challenges on the LAN: Insights from IT Managers at Interop 2009.”

Part 2: If you could only see what was REALLY happening on your network!

By Derek Granath

My last post focused on how seemingly harmless user activity can threaten the security of the corporate LAN.  What follows here are some of the more malicious activities we’ve seen take place when users are able to take advantage of corporate resources. If you don’t have the right level of visibility on your LAN, you cannot adequately enforce policy or control users.  Are things like this happening on your network? Do you really know?

1. Nobody will notice if I use this port: IT staff for this customer had an IP address that they thought was a service port on one of their switches, so they white-listed it into a role for network devices. When they then locked down the role to only the management functions, they began to see a stream of policy incidents: this switch service port was talking to a buddy on AIM, surfing the web, copying files to the file server, and using Outlook – clearly it wasn’t a switch port! By watching the traffic in more detail via the ConSentry InSight Command Center, the IT staff determined the address belonged to a user, not a switch, and were able to hone in and identify the user by name. In the process, they also learned how severely out-of-date the manually maintained IP address spreadsheet was, and they found several servers out on the edge network, a deployment model that violated company policy. They even discovered several duplicate IP addresses shared by both the network devices that are statically assigned and the DHCP pool used to assign user IP addresses. The customer was lucky that the duplicate IP addresses hadn’t interrupted network service; however, service disruption might have been the inevitable outcome had ConSentry not uncovered the problem.
2. It’s my time, not my money, I’m wasting: Another customer recently reported that after deploying our gear and reviewing the top applications at the call center, the IT staff uncovered extensive use of web-based Pogo and Yahoo games. In some cases, calls had been left on hold while call center employees were gaming, inflating charge times for their unsuspecting customers. By tying this inappropriate application use to individual users, the IT staff was able to eliminate this illicit usage and thus more accurately bill its customers.

The bottom line for both inadvertent and blatant misuse is the same:  you need Layer 7 visibility, tying together users, applications, and devices, to enforce policy and control over your LAN.

What to Look for when Purchasing Network Equipment

By Rod Kay
In these tough economic times, justifying a new equipment purchase is harder than ever. One key element beyond needing the basic functionality of the device is investigating its impact on operational costs.

Data has consistently shown that opex constitutes 70% to 80% of IT’s overall costs, so buying equipment that can save IT time is critical. For example, being able to tie username to a traffic flow, with application information, can dramatically lower IT’s troubleshooting time. In addition, having this kind of user and application control built into the network infrastructure means IT can avoid the capex associated with buying overlay products and the opex needed to run all those disparate systems.

To get a feel for the value a given product can provide, IT buyers should explore the manufacturer’s vision for how business demands are changing and how the network must evolve to meet those changing requirements. Does the vendor’s vision for the business issues align with the challenges your organization is having? Does the current product meet your requirements today but also have a path for evolving with your business? Is there programmability and flexibility built into the system to enable the vendor to deliver on its vision over the long term?

In network switching, just getting a better switch will never be the right justification. Needing Power over Ethernet, for example, to drive a voice over IP or wireless LAN deployment is one common driver. But once you've decided you need a new switch, then you need to ensure you're getting the best value for dollar - today and in the future.

As IT Director John White of Technicolor explains, getting a programmable device that keeps up with business needs were top reasons he chose ConSentry to secure his network - you can hear his perspective in this two-minute Technicolor Case Study on YouTube.

The operational impact is key. Small and medium-size companies don’t have the luxury of extra staff, so they need devices that are simple to deploy and run and, more importantly, make key ongoing IT tasks easier.

Innovation is the Currency of a Down Economy

By Joe Golden

We’ve all heard the adage “Necessity is the mother of invention.”  Facing leaner IT budgets, many of our prospects and customers are being forced to consider closely what they need from their infrastructure to support the demands of their core businesses.  The savvier ones are using this opportunity to rethink the status quo and consider new approaches that might just simplify their lives as well as stretch their network investment dollar.

Networks tend to grow in incremental phases. As a company’s requirements and business drivers evolve, IT departments add on new appliances and applications to fill functionality gaps in their infrastructure.  Each individual phase of LAN growth must be separately provisioned, managed, and secured. They also need to interwork –contributing to IT pain.  Over time, networks that grow this way can remain cost effective only as long as the behavior of the users remains fairly static—that is, there are not too many moves, adds, and changes and no new surprises. 

But in most successful companies today, user behavior is more fluid—because that’s what is required for the core business to remain innovative.  Today’s IT departments need the ability to create ad hoc groups to work on projects as required.  Some of these groups will include third-party users for temporary amounts of time.  Increasingly IT also must support more users working remotely and needing access to corporate resources from home offices and mobile devices.  They need clear visibility into application use and audit trails of all different types of users—employees and third parties alike—to demonstrate “who” is doing “what” “when”.  The operational burden of provisioning, controlling, and managing access in this type of virtualized organization can threaten the ability of IT to keep up with business demands.

Business innovations are driving companies to extend their corporate networks, and technical innovations are now available to address the challenges this phenomenon creates for IT groups.  When IT decides to upgrade its LAN infrastructure, decision-makers are looking at context-driven LAN Switches to address these issues. By using high-powered L7 processing, organizations can gain visibility into traffic forwarding decisions and have the ability to enforce policy for users, applications and devices on the LAN.  With visibility and control delivered directly from the LAN infrastructure, IT can now become a contributor to the innovations of the core business and not a victim of them.

Part 1: If you could only see what was REALLY happening on your network!

By Derek Granath

One of the better parts of my job is making contact with ConSentry customers and understanding their day-to-day IT concerns. A common theme often emerges in these conversations: after deploying the ConSentry product, IT was able to uncover seemingly harmless user activity that was, in fact, threatening the security of the corporate LAN, as well as other more nefarious activities that were intentionally malicious. What’s interesting about these revelations, and also a bit scary, is that often this type of activity has been going on for quite some time, but IT has never had enough visibility into user activity on the network to identify it and shut it down.

In this post, I’ll share a few examples of employees that inadvertently put the network at risk through rather benign actions. In my next post, I’ll outline the more malicious activities employees engaged in thinking they’d get away with it.

1. We’re just doing what we do at home: The majority of enterprise customers who deploy ConSentry switches eventually discover unknown peer-to-peer servers – for uploading songs, videos, and other media files – somewhere on their network.  Employees use these and other applications at home, and they want their work environment to be the same—even if they “forget” to go through the proper authorizations.  The offense ranges from annoying (it consumes bandwidth) to illegal (the RIAA holds companies responsible for sharing of copyright material). With ConSentry context-driven switching, these organizations can identify users running these applications such as BitTorrent or Kazaa, and educate users on everything from the severity of an RIAA lawsuit to the business cost of consuming server space with gigabytes of music files. We’ve seen example of users exploiting network resources at places you’d expect, like colleges; but also, we’ve seen this practice at places you wouldn’t expect, like financial firms.
2. We’ve always done it this way: In one case, the IT staff at a financial institution believed employees were using the encrypted protocol SSH to talk to the mainframe banking system and that they had been doing so for years. During policy planning sessions after a ConSentry device had been installed and was collecting data, they discovered that the employees were actually using Telnet, not SSH.  Since Telnet is an unencrypted protocol, sensitive customer and financial information was running over the network in the clear – a massive violation of the PCI spec. But the IT department needed visibility of user-application interactions to spot the problem and correct it.

Can bad things happen when users violate corporate policy, even unwittingly?  These real life anecdotes demonstrate that the answer is clearly “yes.”  

 

Should you be concerned about your employee’s “Plan B” in the case of a staff reduction?

By Michelle McLean

Many businesses today are being forced to lay off experienced employees as a result of the current economic climate. Many of ConSentry’s customers have become acutely aware of the precautions they must take to ensure corporate assets remain protected in the event of a reduction in force.

An oft-cited report from the Ponemon Institute cited the statistic that 59% of people laid off or fired or who quit their jobs within the last 12 months admitted to stealing company information they thought could help them in a new job.

It’s clear that IT managers need to know when employees are accessing sensitive files. Decades of research can disappear if companies don’t have technology at the network edge that can quickly identify users on the LAN – by full user name and not just IP address – especially when today’s economy has many employees proactively thinking about “plan B” in advance of a staff reduction.

Many of our customers have expressed concern over the vulnerability of Intellectual Property (IP) during layoff situations. These customers view their patents and other assets as a competitive differentiator, and much of their revenue derives from this critical data. Thus, the ability to see what users are accessing does more than provide interesting info or simplify troubleshooting; it literally protects the bottom line. 

One example of a ConSentry customer that put role-based control to use during a recent layoff is Pioneer Electronics.  SC Magazine interviewed Max Reissmueller, senior manager of IT operations and infrastructure at Pioneer Electronics. The interview ended up being the magazine’s cover story that month, with the headline "Security During Layoffs: Inside Out." The article is full of great advice about the need for context — Layer 7 visibility of policy over users, applications, and devices—to control your network and users. While layoffs are always very difficult, enforcing role-based access control can at least ease the concerns around protecting corporate assets.

The Problem with Commodity Switches

Richard Stiennon brought up a great issue in a comment on my "Security Goodness - Baked Right In" post. I was writing my reply into a comment back to him but decided to post as another entry to encourage more discussion with the broader audience.

Richard summed up the perspective of his panelists at RSA as "security must stay separate from the network because the switching market is driven by cost-per-port and security is too expensive." Richard wants to know our response.

It's a great question in several ways. First off, I totally agree that switching has hit commodity status and security, particularly LAN security, is far from it. There are exceptions on both sides, of course, but it's generally true. So what's the implication for a secure switch? Essentially, a secure switch is a security device first and a switch second. So it's anything but a commodity product. If a customer's switch purchasing decision is driven solely by price, a secure switch will not even be on his or her radar. Someone buying a secure switch needs something more - some form of network access control. This buyer is motivated by the security feature set, not by simple packet forwarding, and that changes the equation immediately.

Richard's question indirectly raises two other interesting issues.

One - the separation of security and control planes. A minority of shops will want to keep the security plane separate from the control plane in perpetuity. Those shops are rare, but we do see them, so the market for a controller-type approach, where the enforcement device stays separate from the LAN switching infrastructure, will continue. It'll be much smaller than the secure switch market, but it will persist.

Two - the innovation cycle for security vs. switching. This topic is even more interesting, because every shop has this problem. Basically, people want their infrastructure to last five to seven years but they know security changes at a much faster rate. So how can you have a switch that can "keep up" with those security changes?

To be fast, switches have been built on ASICs. But a secure switch has to be updated to stay relevant. So the commodity merchant silicon chips that everyone - including ConSentry - uses to build their switches aren't enough. To build a secure switch, you also need programmability, but to keep up with LAN speeds, you need really fast programmability. For ConSentry, the answer is our custom CPU (see the Multithreading post from Dan a couple weeks ago).

And now we've come full circle - that combination of high speeds and programmability is why a secure switch isn't a commodity. Richard's panelists are right - you can't get the security you need in today's "cost per port" designed switches. But that's doesn't mean security and switching can't come together effectively - they just can't come together in those switches. You need a new architecture. You need a secure switch.

--Michelle McLean

mmclean-at-consentry-dot-com

Controlling your "corporate ghosts"

To better understand how IT is thinking about LAN security, ConSentry recently commissioned some independent research to survey IT leaders at enterprises. Just yesterday the full report hit. Part of the survey asked IT staff to quantify the risks and challenges they face:

• so-called "corporate ghosts" represent the biggest threat for data loss
  
  • temporary workers (62% of respondents cite them as the most risky group)
  • guest users (54%)
  • contractors (51%)
• 82% of respondents have such workers on their LANs
• 65% believe network access is getting more diverse and harder to manage

Other parts of the survey discussed techniques IT is seeking to meet these challenges. The most startling finding was this one:

• 94% of companies see an increased need for identity-based control

I found that statistic surprisingly high, given that identity has only recently come into the Network Access Control and LAN security discussion. As the guys on the Digital ID World blog frequently lament,  people have been slow to make this connection.

We're happy to see this evidence that enterprises are beginning to understand how critical it is for identity to be the foundation for applying access controls.

So take a look at the research - and definitely let us know what stands out as you look over the data.

--Michelle McLean
mmclean-at-consentry-dot-com