What would it be worth to your business to be able to deploy application changes on the network in minutes instead of days, more securely and accurately than before?

Despite spending millions of dollars on firewalls and other security measures, organizations still struggle with very large networks that are too complex to achieve the operational efficiencies that are the stepping stones to digital transformation. Network change processes are still too manual and create a bottleneck to achieving business agility and meeting security goals.

One of the reasons for this is that enterprise networks are becoming increasingly hybrid and fragmented, spanning across many on-premise, private and public cloud environments.  Environments today include hundreds of firewalls from different vendors, thousands of routers and switches, private cloud using segmentation technologies like VMWare NSX and Cisco ACI, public cloud with native security controls, and containers running in Kubernetes or Docker, often in multi-cloud environments. .

In addition, digital transformation initiatives and DevOps practices are driving a significant increase in software releases requiring frequent connectivity changes. Not only is this difficult for your teams to keep up with, but each new network connection creates a new potential entry point for cyber-attackers.

As organizations – like yours – struggle to keep pace, they are finding it difficult to efficiently and securely control information flows across their network.

The implications of a complex network

Balancing security and business agility have always been a challenge, but with the advent of digital transformation, the pace of business is increasing, and the stakes are higher than ever. Challenges that add to the problem include:

1. Manual processes are slow and result in mistakes and misconfigurations

• Existing manual approaches to security and network operations are too slow and error-prone to be effective in today’s environment. When an engineer on your team is deciding which connections to allow, and on which firewalls and routers, they need to manually perform significant analysis. In addition, they may need to go through multiple levels of manual sign-offs, making the process even longer.

2. Increasing the pace of application deployment adds more work than network and security teams can handle.

• To remain competitive in a fast-changing market, enterprises today are releasing new software applications at a rapid pace, and DevOps initiatives are increasing the pace of software releases even further.  Security teams who need to approve these changes and network teams who execute the changes can’t keep up. Your teams are understaffed, and the manual change processes described above lead to an increasing number of network change requests that are piling up every week in most organizations.

3. Enterprises are still assuming too much risk

• Even as organizations have adopted more security tools than ever (some say the average enterprise has deployed about 80 security solutions), there is a lack of confidence that security tools are working together to provide the necessary protection.  As the threat landscape continues to increase, security and network engineers struggle to keep up. When there is a backlog of changes and those changes are manual, organizations are assuming far too much risk.

4. Security policy is not formally defined or maintained

• Often security policy is a set of abstract concepts in a legacy Word doc or pdf, or even held simply within the heads of network security engineers. This makes the job of interpreting whether a connection should be permitted more difficult and even subjective in some cases. In cases where there is a more formal security policy, there is no way to ensure it is followed across the hybrid network.

The result of these very real problems is that the network is not only complex, it’s a mess. Organizations don’t have visibility into their change processes to know if they are violating any rules or opening new vulnerabilities by granting access. Connectivity is left in commission because of the fear of what might break, meaning that old firewall rules for servers that were replaced are kept because no one knows what the impact will be if they are removed.  The rulebase is in chaos.  Without the ability to run impact analysis on a change to know if a rule already exists or if it grants too much access, you end up with overly permissive rules, shadowed rules, and redundant rules which slow down the network and increase the attack surface.

7 Reasons to Adopt a Policy-Centric Approach to Security and IT Operations

A unified, comprehensive security policy provides the foundational control for the hybrid network to bring automation and analytics to security and network operations that is severely lacking today. Organizations are adopting this approach as a strategic initiative to create a more informed, secure and efficient way to orchestrate security-related changes across enterprise networks.

Using security policy to provide the management layer for security and network tools significantly reduces the complexity of managing hybrid and fragmented networks. How can security policy play a larger role at your organization?

1. Understand your network topology to gain visibility across the heterogenous, hybrid cloud network

• It’s critical for any organization to have visibility into the network to make changes that will adhere to security policy. Using a topology model that maps the network devices, routers and cloud policy settings, network and security teams gain a better understanding of the pathways that need to be traversed to provide access between services and applications. When done correctly, this provides otherwise unattainable visibility into possible network and application connections and becomes the basis to troubleshoot connectivity and perform risk analysis that will generate alerts on anything that does not comply with the defined security policy.

2. Institute more effective change management to improve operational efficiency

• To have effective change management and protect hybrid networks, every organization needs the foundational controls that are inherent in security policy.  All too often the change requests that come into the network operations group today either need to be redone (we have seen organizations discover that 75% of the initial requests were either based on bad data or just not necessary), or they are requesting access that already exists.  By placing a laser focus on security policy, network engineers are now able to check if the change request violates any current policy before implementation.  This not only helps execute the changes faster but removes the bad requests from the outset, freeing up more time to clear the backlog.

3. Segment the network to understand policy and meet compliance and security standards

• Network segmentation is critical to isolate sensitive areas of the network and prevent access of unwanted traffic.  Security policy provides a way to set up conceptual zones of logical or business units containing any collection of networks or subnets that have a unique security context – and define how each zone should be allowed to connect to any other zone.  This provides an organization a way to enforce a unified security policy across the networks and have consistent segmentation across the entire environment.  Zones can be set up according to compliance standards like PCI DSS, follow frameworks like NIST or comply with your own internal standards.

4.  Tighten security posture

• A policy-centric approach to centrally manage security configurations across vendors and platforms enables identifying and mitigating risky and redundant access. Automated processes for decommissioning and recertification help establish a healthy routine of policy optimization that helps reduce risks and improve security.

5. Automate policy-based risk analysis and application changes

• There is a significant opportunity to use a software-defined security policy platform to automate processes. When you can automate network changes which are policy-compliant, while rejecting and escalating requested changes which do not meet the defined policy, you create significant value in terms of saving time and resource.  But you also improve your organization’s business agility by automating any future changes and maintaining network compliance with the policy on a go-forward basis.We know that the business cares less about IP addresses and more about applications. Abstracting network security policy to the application layer is also an efficient methodology for managing and automating application connectivity. It allows developers to define and manage network connectivity needs for their applications, while complying with the network security policy, without needing to learn all underlying network details. Application-based policy automation helps reduce the friction between application teams and network security teams over policy compliance and improves business continuity.

6. Orchestrate native cloud applications and container environments

• Much in the same way that security policy provides a foundation for the hybrid network, as organizations adopt containers and microservices you need those same controls to ensure that applications do not violate rules and create vulnerabilities. When security policy is integrated into CI/CD tools, such as Github and Jenkins, you allow DevOps teams to check changes for security policy compliance as they rebuild their applications, perhaps in Kubernetes, without interrupting workflows or slowing down the process. This will alleviate the friction between the security and DevOps teams and eliminate bottlenecks while providing security teams the control they need over these environments.

7. Provide a hub for security product integrations

• As we described at the beginning of the article, there is a plethora of security products in every enterprise organization.  Security policy provides that common baseline across all products to ensure security is adhered to. For example, if you use IT service management (ITSM) and ticketing systems, such as ServiceNow and Remedy, you can allow ticketed network change requests to be analyzed against security policy and automatically implemented in minutes if compliant.

We live in a complex hybrid world that needs to be managed as such. Systems and data will continue to shift to the cloud, while some highly sensitive environments remain on-premise, and network teams need to find a way to manage complexity that reduces risk and meets the business agility goals of the enterprise.  The network is not going to become more simplified, but the way we manage it all can. Security policy provides the foundational management layer between enterprise applications and the underlying infrastructure – firewalls, network devices, public, private or hybrid clouds, and containers. Unifying security policy allows you to automate network changes while maintaining security and policy control.