Effective Business Continuity Plans Require CISOs to Rethink WAN Connectivity

As more businesses leverage remote, mobile, and temporary
workforces, the elements of business continuity planning are
evolving and requiring that IT professionals look deep into the
nuts and bolts of connectivity.

CISOs and their team members are facing new challenges each and
every day, many of which have been driven by digital
transformation, as well as the adoption of other
productivity-enhancing technologies.

A case in point is the rapidly evolving need to support remote
and mobile users as businesses change how they interact with
staffers.

For example, the recent COVID-19 crisis has forced the majority
of businesses worldwide to support employees that work from home or
other remote locations.

Many businesses are encountering numerous problems with
connection reliability, as well as the challenges presented by
rapidly scaling connectivity to meet a growing number of remote
workers.

Add to that security and privacy issues, and it becomes evident
that CISOs may very well face what may become insurmountable
challenges to keep things working and secure.

It is the potential for disruption that is bringing Business
Continuity Planning (BCP) to the forefront of many IT
conversations. What’s more, many IT professionals are quickly
coming to the conclusion that persistent WAN and Internet
connectivity prove to be the foundation of an effective business
continuity plan.

VPNs are Failing to Deliver

Virtual Private Networks (VPNs) are often the first choice for
creating secure connections into a corporate network from the
outside world.

However, VPNs have initially been designed to allow a remote
endpoint to attach to an internal local area network and grant that
system access to data and applications stored on the network.

For occasional connectivity, with a focus on ease of use.

Yet, VPNs are quickly beginning to show their limitations when
placed under the demand for supporting a rapidly deployed remote
workforce.

One of the most significant issues around VPNs comes in the
context of scalability; in other words, VPNs can be complicated to
scale quickly.

For the most part, VPNs are licensed by connection and are
supported by an appliance on the network side to encrypt and
decrypt traffic. The more VPN users that are added, the more
licenses and processing power that is needed, which ultimately adds
unforeseen costs, as well as introducing additional latency into
the network.

Eventually, VPNs can break under strain, and that creates an
issue around business continuity. Simply put, if VPNs become
overwhelmed by increased traffic, connectivity may fail, and the
ability for employees to access the network may be impacted, the
concept of business continuity suffers as a result.

VPNs are also used for site to site connections, where the
bandwidth may be shared not only from a branch office to a
headquarters office but also with remote users. A situation such as
that can completely derail an organization’s ability to do business
if those VPNs fail.

Perhaps an even bigger concern with VPNs comes in the form of
cybersecurity. VPNs that are used to give remote users access to a
network are only as reliable as the credentials that are given to
those remote users.

In some cases, users may share password and login information
with others, or carelessly expose their systems to intrusion or
theft. Ultimately, VPNs may pave the way for attacks on the
corporate network by allowing bad actors to access systems.

ZTNA Moves Beyond VPNs

With VPN technology becoming suspect in the rapid expansion of
remote workforces, CISOs and IT pros are looking for alternatives
to ensure reliable and secure connections into the network from
remote workers.

The desire to bridge security and reliability is driven by
continuity, as well as operational issues. CISOs are looking to
keep costs down, provide a level of security, without compromising
performance, and still meet projected growth.

Many enterprises thought that the answer to the VPN dilemma
could be found in SDP (Software Defined
Perimeters)^[1] or ZTNA (Zero Trust
Network Access), two acronyms that have become interchangeable in
the arena of cybersecurity.

ZTNA has been built for the cloud as a solution that shifted
security from the network to the applications. In other words, ZTNA
is application-centric, meaning that users are granted access to
applications and not the complete network.

Of course, ZTNA does much more than that. ZTNA can “hide”
applications, while still granting access to authorized users.
Unlike VPNs, ZTNA technology does not broadcast any information
outside of the network for authentication, whereas VPN
concentrators sit at the edge of the network for all to see, making
them a target for malicious attackers.

What’s more, ZTNA uses inside-out connections, which means IP
addresses are never exposed to the internet. Instead of granting
access to the network like a VPN, ZTNA technology uses a
micro-segmentation approach, where a secure segment is created
between the end-user and the named application.

ZTNA creates an access environment that provides private access
to an application for an individual user, and only grants the
lowest level of privileges to that user.

ZTNA technology decouples access to applications from access to
the network, creating a new paradigm of connectivity. ZTNA based
solutions also capture much more information than a VPN, which
helps with analytics and security planning.

While a VPN may only track a device’s IP address, port data, and
protocols, ZTNA solutions capture data around the user identity,
named application, latency, locations, and much more. It creates an
environment that allows administrators to be more proactive and
more easily consume and analyze the information.

While ZTNA may be a monumental step forward from legacy VPN
systems, ZTNA solutions are not without their own concerns. ZTNA
solutions do not address performance and scalability issues and may
lack the core components of continuity, such as failover and
automated rerouting of traffic.

In other words, ZTNA may require those additional third-party
solutions to be added to the mix to support BCP.

Resolving ZTNA and VPN issues with SASE

A newer technology, which goes by the moniker of SASE (Secure Access
Service Edge), may very well have the answer to the dilemmas of
security, continuity, and scale that both ZTNA and VPNs introduce
into the networking equation.

The Secure Access Service Edge (SASE) model was proposed by
Gartner’s leading security analysts, Neil MacDonald, Lawrence
Orans, and Joe Skorupa. Gartner presents SASE as a way to collapse
the networking and security stacks of SD-WANs into a fully
integrated offering that is both easy to deploy and manage.

Gartner sees SASE as a game-changer in the world of wide-area
networking and cloud connectivity. The research house expects 40%
of enterprises to adopt SASE by 2024. However, a significant
challenge remains, networking and cybersecurity vendors are still
building their SASE offerings, and very few are actually available
at this time.

One such vendor is Cato Networks^[3], which offers a fully
baked SASE solution and has been identified as one of the leaders
in the SASE game by Gartner.

SASE differs significantly from the VPN and ZTNA models by
leveraging a native cloud architecture that is built on the
concepts of SD-WAN^[4] (Software-Defined Wide
Area Network). According to Gartner, SASE is an identity-driven
connectivity platform that uses a native cloud architecture to
support secure connectivity at the network edge that is globally
distributed.

SASE gives organizations access to what is essentially a private
networking backbone that runs within the global internet. What’s
more, SASE incorporates automated failover, AI-driven performance
tuning, and multiple secure paths into the private backbone.

SASE is deployed at the edge of the network, where the LAN
connects to the public internet to access cloud or other services.
And as with other SD-WAN offerings, the edge has to connect to
something beyond the four walls of the private network.

In Cato’s case, the company has created a global private
backbone, which is connected via multiple network providers. Cato
has built a private cloud that can be reached over the public
internet.

SASE also offers the ability to combine the benefits of SDP with
the resiliency of an SD-WAN, without introducing any of the
shortcomings of a VPN.

Case in point is Cato’s Instant Access, a clientless
connectivity model that uses a Software-Defined Perimeter (SDP)
solution to grant secure access to cloud-delivered applications for
authorized remote users.

Instant access offers multi-factor authentication, single
sign-on, least privileged access, and is incorporated into the
combined networking and security stacks. Since it is built on SASE,
full administrator visibility is a reality, as well as simplified
deployment, instant scalability, integrated performance management,
and automated failover.

In Cato’s case, continuous threat protection keeps remote workers,
as well as the network, safe from network-based threats. Cato’s
security stack includes NGFW, SWG, IPS, advanced anti-malware, and
Managed Threat Detection and Response (MDR) service. Of course,
Cato isn’t the only player in the SASE game; other vendors pushing
into SASE territory include Cisco, Akamai, Palo Alto Networks,
Symantec, VMWare, and Netskope.

SASE Address the Problems of VPNs, ZTNA — and More

With VPNs coming up short and ZTNA lacking critical functionality,
such as ease of scale and performance management, it is quickly
becoming evident that CISOs may need to take a long hard look at
SASE.

SASE addresses the all too common problems that VPNs are
introducing into a rapidly evolving remote work paradigm, while
still offering the application-centric security that ZTNA brings to
the table.

What’s more, SASE brings with it advanced security, enhanced
visibility, and reliability that will go a long way to improving
continuity, while also potentially lowering costs.

^[2]