En Garde!

Survey Says… IT Managers Concerned About LAN Sprawl

By Rod Kay

Knowing what’s happening on the LAN, much less controlling it,  is becoming quite complex.  We hear concerns about managing access rights and other control issues all the time from our customers, across every industry, and the message is always the same. With the rapid increase in the number and types of users, applications and devices on LANs today, IT managers are losing visibility and control at an alarming rate.  To better understand this situation, and to get from anecdote to real data, we commissioned Loudhouse, an independent research consultancy, to interview IT decision makers in both the US and UK on these issues.

Loudhouse asked respondents to consider how their LAN had grown over the last two years and about anticipated growth over the next two years.  A key finding is that LANs have grown at fairly consistent rates across a wide range of axes and are expected to maintain this multi-dimensional growth over the next two years. Loudhouse calls this multi-dimensional growth “LAN Sprawl” – the combined effect of more and different types of users, applications, and devices and their inter-dependencies. Cross-functional users, third-parties, more diverse applications, and corporate, personal, and non-user IP devices are all in the mix, contributing to LAN Sprawl.

For IT organizations being asked to do more with less, this sprawl has become quite a problem. The video below provides survey results on the LAN Sprawl issue and some of the concerns IT has in dealing with this situation. If you’re having trouble viewing this video or text, click here for a larger slideshow with the full results.

We’d love to hear from you on this topic – are you feeling the effects of LAN sprawl? What steps are taking to regain control?

The survey, conducted in June 2009, is based on 200 interviews with IT decision makers from mid-size (250+ employees) to large enterprises (1000+ employees) across the US (100) and UK (100) regions.

Key Findings: LAN Sprawl Growth

1. 30% average growth in LAN size from 2007-2011 (average across all areas of growth)
2. The largest areas of growth in the network overall over the last two years are:
         *Number of applications (16.8%)
         *Smart/mobile devices (16.6%)
         *Remote working employees (16.6%)
3. The greatest area of risk for UK respondents: ability to control access in remote locations (50%)
4. The greatest risk for US respondents: inability to enforce appropriate usage policies (40%)

Key Findings: Resources and Growth

Key Findings: Resources and Growth
1. The greatest areas of growth are increases in:
         *Approved business applications
         *Number of applications supported by the network
         *Smart/mobile devices
         *Remote working employees
2. Over next two years, 55% of US companies expecting greater growth, and 44% of UK
         *The largest growers are also more likely to increase the pace of LAN growth
3. However only 42% of businesses have sufficient investment for IT to support their business goals 
         *37% say that staffing levels have increased to support LAN growth

 

The Rise of the Virtual Organization

By Michelle McLean

Yankee Group recently published a report entitled “The Era of the Virtualized Organization Demands Context-aware LANs.” ConSentry commissioned the report after extensive discussions with customers about how their businesses have been changing and the ways in which today’s static LANs have made it difficult for them to keep up with those changes.

What does Yankee mean by the virtualized organization? The term refers to the constant coming and going of different “workers” – including employees, guests, contractors, partners, even competitors – as well as those workers’ devices and applications. It also encompasses the idea of ad hoc groups, where people from different parts of the business, both inside and outside, come together to work on a given project (M&A activity, for example, or a CRM customization).

The Yankee report contends that given the rise of the virtualized organization, IT needs a more dynamic and knowledgeable infrastructure to accurately assign user access rights on the LAN. The report argues that to regain control, IT needs context in the LAN – deep knowledge of the user, role, device, application at Layer 7, destination, and environmental factors such as location and time of day. Based on this richer set of information, the LAN becomes an orchestrator – delivering the right services to the right people at the right time. And IT has the info needed to better manage the interactions amongst users, applications, and devices.

Essentially, with context-driven switching, policy becomes the new forwarding table.

You can read the full report on the ConSentry site, and hear Yankee Analyst Zeus Kerravala discuss what organizations require to solve this problem.

Clearly the LAN edge isn’t the only place to need context – the data center and the LAN/WAN boundary are two other places that would benefit greatly from a richer understanding of the users, applications, and devices traversing them.

Where else do you think context matters? And what other attributes will it encompass? I look forward to reading your comments.

Tales of Woe: IT Challenges on the LAN

By Joe Golden

While at the Interop show in Las Vegas last May, I was able to catch up with a number of IT managers walking the show floor in search of solutions for some of the issues they face on a daily basis. Although the faces were different, the stories were the same – tales of woe about remote users coming into the corporate network from unsecured home computers, new applications being introduced (often without IT’s knowledge), and the need to keep up with the constant influx of new devices on the network.

While these IT managers hail from organizations varying in scope and size, they share a common set of problems. Moreover, they share a common need for more visibility and control over the users, applications and devices on their LANs.  

To find out firsthand what IT managers are saying about challenges they face on the LAN, take a look at this video, “Growth Challenges on the LAN: Insights from IT Managers at Interop 2009.”

An Educated Guess

By Jeff Prince

Over the last decade, networking devices have been slowly moving up the protocol stack to deliver transformational business benefits.  For example, load balancers moved up the stack from L4 to L7 as they became application front ends that actually understood applications well enough to improve services for them.  As a result, companies were able to take advantage of distributed resources much more effectively. This is what happens when companies invest in sophisticated products - things work better – it’s not rocket science. 

More recently, WAN acceleration companies realized that load balancers were on to something, and they developed and deployed L7 knowledge to transform WAN application use and business practices. While the idea of adding L7 intelligence to your product is obviously one of the best ways to get ahead of the competition, developing the technology isn’t easy (in fact, that part might be considered rocket science).

Now L7 application understanding – tied to individual users – is offered in LAN switches. It’s not in every LAN switch, of course – the majority of switch vendors are still selling 15-year old technology based on L3/L4 information. These switches, based on the legacy architecture, are actually becoming business-limiting in their lack of support for today’s needs for visibility and application and access control.  If you ask IT managers, “Would you like to simplify the process of controlling network resources and have the ability to direct LAN policy to users according to their different roles in the organization?” my guess is they would probably say “yes.” It’s just an educated guess though.

Part 2: If you could only see what was REALLY happening on your network!

By Derek Granath

My last post focused on how seemingly harmless user activity can threaten the security of the corporate LAN.  What follows here are some of the more malicious activities we’ve seen take place when users are able to take advantage of corporate resources. If you don’t have the right level of visibility on your LAN, you cannot adequately enforce policy or control users.  Are things like this happening on your network? Do you really know?

1. Nobody will notice if I use this port: IT staff for this customer had an IP address that they thought was a service port on one of their switches, so they white-listed it into a role for network devices. When they then locked down the role to only the management functions, they began to see a stream of policy incidents: this switch service port was talking to a buddy on AIM, surfing the web, copying files to the file server, and using Outlook – clearly it wasn’t a switch port! By watching the traffic in more detail via the ConSentry InSight Command Center, the IT staff determined the address belonged to a user, not a switch, and were able to hone in and identify the user by name. In the process, they also learned how severely out-of-date the manually maintained IP address spreadsheet was, and they found several servers out on the edge network, a deployment model that violated company policy. They even discovered several duplicate IP addresses shared by both the network devices that are statically assigned and the DHCP pool used to assign user IP addresses. The customer was lucky that the duplicate IP addresses hadn’t interrupted network service; however, service disruption might have been the inevitable outcome had ConSentry not uncovered the problem.
2. It’s my time, not my money, I’m wasting: Another customer recently reported that after deploying our gear and reviewing the top applications at the call center, the IT staff uncovered extensive use of web-based Pogo and Yahoo games. In some cases, calls had been left on hold while call center employees were gaming, inflating charge times for their unsuspecting customers. By tying this inappropriate application use to individual users, the IT staff was able to eliminate this illicit usage and thus more accurately bill its customers.

The bottom line for both inadvertent and blatant misuse is the same:  you need Layer 7 visibility, tying together users, applications, and devices, to enforce policy and control over your LAN.

What to Look for when Purchasing Network Equipment

By Rod Kay
In these tough economic times, justifying a new equipment purchase is harder than ever. One key element beyond needing the basic functionality of the device is investigating its impact on operational costs.

Data has consistently shown that opex constitutes 70% to 80% of IT’s overall costs, so buying equipment that can save IT time is critical. For example, being able to tie username to a traffic flow, with application information, can dramatically lower IT’s troubleshooting time. In addition, having this kind of user and application control built into the network infrastructure means IT can avoid the capex associated with buying overlay products and the opex needed to run all those disparate systems.

To get a feel for the value a given product can provide, IT buyers should explore the manufacturer’s vision for how business demands are changing and how the network must evolve to meet those changing requirements. Does the vendor’s vision for the business issues align with the challenges your organization is having? Does the current product meet your requirements today but also have a path for evolving with your business? Is there programmability and flexibility built into the system to enable the vendor to deliver on its vision over the long term?

In network switching, just getting a better switch will never be the right justification. Needing Power over Ethernet, for example, to drive a voice over IP or wireless LAN deployment is one common driver. But once you've decided you need a new switch, then you need to ensure you're getting the best value for dollar - today and in the future.

As IT Director John White of Technicolor explains, getting a programmable device that keeps up with business needs were top reasons he chose ConSentry to secure his network - you can hear his perspective in this two-minute Technicolor Case Study on YouTube.

The operational impact is key. Small and medium-size companies don’t have the luxury of extra staff, so they need devices that are simple to deploy and run and, more importantly, make key ongoing IT tasks easier.

Innovation is the Currency of a Down Economy

By Joe Golden

We’ve all heard the adage “Necessity is the mother of invention.”  Facing leaner IT budgets, many of our prospects and customers are being forced to consider closely what they need from their infrastructure to support the demands of their core businesses.  The savvier ones are using this opportunity to rethink the status quo and consider new approaches that might just simplify their lives as well as stretch their network investment dollar.

Networks tend to grow in incremental phases. As a company’s requirements and business drivers evolve, IT departments add on new appliances and applications to fill functionality gaps in their infrastructure.  Each individual phase of LAN growth must be separately provisioned, managed, and secured. They also need to interwork –contributing to IT pain.  Over time, networks that grow this way can remain cost effective only as long as the behavior of the users remains fairly static—that is, there are not too many moves, adds, and changes and no new surprises. 

But in most successful companies today, user behavior is more fluid—because that’s what is required for the core business to remain innovative.  Today’s IT departments need the ability to create ad hoc groups to work on projects as required.  Some of these groups will include third-party users for temporary amounts of time.  Increasingly IT also must support more users working remotely and needing access to corporate resources from home offices and mobile devices.  They need clear visibility into application use and audit trails of all different types of users—employees and third parties alike—to demonstrate “who” is doing “what” “when”.  The operational burden of provisioning, controlling, and managing access in this type of virtualized organization can threaten the ability of IT to keep up with business demands.

Business innovations are driving companies to extend their corporate networks, and technical innovations are now available to address the challenges this phenomenon creates for IT groups.  When IT decides to upgrade its LAN infrastructure, decision-makers are looking at context-driven LAN Switches to address these issues. By using high-powered L7 processing, organizations can gain visibility into traffic forwarding decisions and have the ability to enforce policy for users, applications and devices on the LAN.  With visibility and control delivered directly from the LAN infrastructure, IT can now become a contributor to the innovations of the core business and not a victim of them.

Should you be concerned about your employee’s “Plan B” in the case of a staff reduction?

By Michelle McLean

Many businesses today are being forced to lay off experienced employees as a result of the current economic climate. Many of ConSentry’s customers have become acutely aware of the precautions they must take to ensure corporate assets remain protected in the event of a reduction in force.

An oft-cited report from the Ponemon Institute cited the statistic that 59% of people laid off or fired or who quit their jobs within the last 12 months admitted to stealing company information they thought could help them in a new job.

It’s clear that IT managers need to know when employees are accessing sensitive files. Decades of research can disappear if companies don’t have technology at the network edge that can quickly identify users on the LAN – by full user name and not just IP address – especially when today’s economy has many employees proactively thinking about “plan B” in advance of a staff reduction.

Many of our customers have expressed concern over the vulnerability of Intellectual Property (IP) during layoff situations. These customers view their patents and other assets as a competitive differentiator, and much of their revenue derives from this critical data. Thus, the ability to see what users are accessing does more than provide interesting info or simplify troubleshooting; it literally protects the bottom line. 

One example of a ConSentry customer that put role-based control to use during a recent layoff is Pioneer Electronics.  SC Magazine interviewed Max Reissmueller, senior manager of IT operations and infrastructure at Pioneer Electronics. The interview ended up being the magazine’s cover story that month, with the headline "Security During Layoffs: Inside Out." The article is full of great advice about the need for context — Layer 7 visibility of policy over users, applications, and devices—to control your network and users. While layoffs are always very difficult, enforcing role-based access control can at least ease the concerns around protecting corporate assets.

What a Week in LAN Switching!

I’ve been watching the LAN market a long time – as a journalist and analyst for nine years and as a vendor for another eight since then – and this has been one of the more interesting weeks in LAN infrastructure in years.

After not changing much since the advent of switches in the early 90s and routing switches in the mid-90s, the LAN market saw some pretty interesting events this week. Cisco’s targeting of the data center switch market with its Nexus announcement on Monday is one example of the move toward greater intelligence and application awareness in the network. Add in Cisco’s philosophy in TrustSec of the need for role-based networking and the intelligence they’re talking about in the PISA blade for the 6500, and that’s a lot of places in the LAN getting a lot smarter about users and applications.

Then you have Juniper, in what has to be one of the industry’s worst-kept secrets in years, coming out yesterday with its entrance into the LAN switch market. While the initial switches appear to offer just the basic L2/L3 switching capabilities, the company has a history of distinguishing itself in application smarts and other value-add capabilities, and one would hope Juniper will eventually apply this vision to their LAN switches as well.

Here at ConSentry, we took advantage of the timing to add to the industry discussion about LANs getting smarter. On Monday, we took the wraps off our vision for Intelligent Switching, with user and application control built into the switch. We were founded – and funded – to build the next-gen switch, with built-in security and control features. We took the pragmatic step of building an appliance first, to make customer adoption easier, but with this announcement we were able to fully detail our original vision and show how it fits within these broader industry changes. We highlighted the differences between the legacy and intelligent switch architectures – the latter having knowledge of user identity, device, role, application, and destination native in the switch. This intelligence gives IT business context like never before, which simplifies tasks like limiting access to resources or troubleshooting user or application problems.

A lot of publications picked up on this trend toward greater intelligence, including the San Jose Mercury News and Network World. And we may not be done with the news for the week. Rumors continue to swirl about, as one analyst put it, one more “monumental” announcement, after which the switch landscape is supposed to look very different. Regardless of whether more news comes, though, this week’s already seen a sea change in what’s state of the state, and for the first time in a long time, IT has more than the commodity switch feature set to think about when investigating switches for their next LAN upgrade.

As the saying goes, may you live in interesting times. At least in LAN switching, it would appear we are. Sure makes this all a lot more fun.

--Michelle McLean

mmclean-at-consentry-dot-com

Cisco oneNAC – and Four Types of Cisco Customer

Another day, another flavor of NAC from Cisco.

Network World’s Tim Greene was among those reporting on this latest variant of Cisco NAC – this time oneNAC that aims to combine aspects of the Cisco NAC Appliance and the Cisco NAC Framework. And it'll be ready in just 12 or 18 short months from now.

I love these announcements. They highlight everything that Cisco wants to be while making it painfully clear all the places they’re falling short. It also helps invite customers, media, and analysts to ask how we compare to Cisco. We love to do that – especially in the form of competitive bake-offs – because anyone who looks at the issues quickly grasps the disparity between what Cisco wants to do and what they can do. And between what Cisco and ConSentry can do.

My favorite version of the comparison question is “How can you sell security infrastructure, especially switches, given Cisco’s dominance in the switch market?”

Through my many years of competing with Cisco – in service provider core routing, wireless, WAN optimization, and now LAN security – I’ve seen a wide range of Cisco customers. Here at ConSentry, it’s really crystallized for me that Cisco customers fall into four camps.

Type 1
The true-blue believer. These customers build their networks according to Cisco blueprints and don’t diverge from that path. Luckily, ConSentry inside sales reps can quickly qualify out these prospects so we don’t end up spending time with them.

Type 2
Wedded to Cisco for switching infrastructure but will consider other vendors for appliances or other services when Cisco falls short. At Peribit, selling WAN optimization and application acceleration, I saw plenty of these, and we sell plenty of ConSentry Controllers – our appliance form factor – to these guys now.

Type 3
Wedded to Cisco for switching infrastructure at headquarters but open to other infrastructure vendors for regional or branch offices. These customers sometimes surprise you – we’ve had more than one customer tell us they’d never consider our LANShield Switch, and they happily deploy our LANShield Controller in headquarters. Then some months or even a year later, as they’re approaching a switch upgrade project in their regional locations or branch offices, they come back asking “Now what does that switch look like again? And it’s cheaper than the dumb switch I was going to buy from Cisco?” These guys represent a fantastic opportunity for both our LANShield Switch and LANShield Controller.

Type 4
Won’t waver from Cisco chassis switches in the core but consider the LAN edge to be commoditized. These customers are the most fun because they think the biggest right out of the gate – they immediately see the value of the ConSentry secure switch in lieu of something like a 3750. They love the ability to deploy identity-based control, and they see the need for it right at the LAN edge. We’ve had several customers who sought us out originally for our appliance end up accelerating their switch upgrade projects by as much as nine months to get all the security built in for free and spend less than the budgetary planning amount set aside to upgrade with Cisco

For companies like ConSentry, all the fits and starts coming out of Cisco around NAC and the self-defending LAN serve us incredibly well. The announcements serve to validate all the functionality needed but dramatically call attention to the current shortcomings of the Cisco solution. So let me say once again – thanks Cisco for making our jobs easier!

--Michelle McLean
mmclean-at-consentry-dot-com