How SDN builds next-gen security
Connecting state and local government leaders
A shift towards software-defined security can deliver improvements in automation, virtualization and a holistic security architecture.
As software-defined technology continues to gain traction in the federal space, agencies can expect to see a significant, positive impact on their own security posture. Those who embrace software-defined and other next-generation technologies will benefit from three key improvements that only a shift towards software can provide: automation, virtualization and a holistic security architecture.
Automation
Setting up a new application is an involved process. Servers, storage, applications and networking equipment must be set up and configured -- all with security integrated throughout.
This is often a time-consuming, manual process of determining what equipment is needed, writing commands, typing them into the computer and testing. And it's inevitable, with humans doing these very complex tasks, that at least one mistake will be made. Such errors can create dangerous holes in an agency's security posture.
Misconfiguration, in fact, is one of the biggest cybersecurity threats. For example, engineers might install a firewall but forget to configure it to stop malicious traffic by leaving an ALLOW ANY rule. Or, they might set up an admin or development account to conduct testing and then forget to delete the account. Using automation to reduce misconfiguration will take cybersecurity to the next level.
Software-defined networking can create scripts that set up resources, conduct testing automatically and then report the test results. Because humans configure these scripts, there may still be an error or two at first, but, after running the same script a few times, it will be error free. That's the key to the cybersecurity’s future.
Virtualization
Although virtualization has been around for about 20 years, the virtualization of security appliances is relatively new. Only recently have we been able buy security products as software for virtual machines that deliver the same level of performance.
For many years, security experts were focused on the ingress and egress from the Internet, so there wasn't a huge push for virtualized security within the data center.
Similarly, many data center professionals were reluctant to install security appliances in data centers where they are trying to run applications.
IT administrators now realize that we have to protect the inside as well as the outside of the data center. And we now have the opportunity to build security into the virtualization layer. When creating a network, the system now asks what kind of firewall and security measures this data flow requires. The ability to drive that virtualized security layer in the data center will pay huge dividends in terms of improved cybersecurity.
Holistic security architecture
To date, most security professionals have been satisfied with thinking that, so long as we prevent most bad guys from getting into our networks and catch the ones that do, that's good enough. One of the biggest security benefits of SDN is the ability to make security part of the lifecycle, instead of bolting it on at the end.
SDN and other next-gen technologies will help us reimagine a robust security architecture for federal agencies. With SDN and virtualization coming together and the ability to build automated networks, appliances and support systems, we can sit down and think about cybersecurity’s future and to change the way we do things to improve it.
Security professionals will have the opportunity to get away from being the "No” police, which has been their traditional role. Now they can be a stakeholder, working more closely with federal employees to understand their goals and to helping them achieve them securely. When security no longer gets in the way of business getting done, federal employees will quit looking for the work-arounds that expose their agencies to unnecessary risk.
With the benefits of a more holistic approach, improved virtualization and increased automation, SDN and other technologies emerging today will exponentially improve cybersecurity.