New SD-WAN edge enables more secure architectures

And, of course, it provides an elegant way of mixing and matching different security vendors’ technology by business unit or in some cases, by individual application.

Secondly, an SD-WAN can also improve an enterprise’s security posture by extending traffic segmentation across the WAN and into the branch. Micro-segmentation or zero-trust networking is fast becoming best practice in the data centre. Rather than letting any virtual machine (VM) talk to any other VM, data centre micro-segmentation relies on policy to establish which VMs can talk to one another.

As a result, if any VM is compromised, the damage and exposure is contained. In the same way, we expect that enterprises will use advanced SD-WAN solutions to separate traffic into segments at the branch (e.g. PCI credit card data, IoT traffic, internal web applications, external applications).

This segmentation can be extended across the WAN and controlled via central orchestration. By adopting a segmented SD-WAN architecture, enterprises are able to isolate the impact of any security breach, effectively augmenting their existing security stack with new network-level countermeasures.

A third way an SD-WAN solution can fortify security is by enforcing consistency across all remote locations.

In traditional networks, administrators have CLI access to individual routers and firewalls, and often find themselves forced to make manual configuration changes to individual devices. Over time, the sum of all quick fixes made to individual devices conspire and lead to configuration drift – a situation where devices have configurations that appear the same superficially, but in fact have many small, easily overlooked differences that lead to pernicious issues and security holes that sap IT resources and require per-site debugging.

In contrast, with an advanced SD-WAN solution there is no need to touch individual devices. Policy and intent are established at the network level and automatically enforced by a central orchestrator. This eliminates error-prone device-by-device manual configuration and ensures that the network remains in compliance with policy.

In conclusion, if you are asked ‘How secure is your SD-WAN?’, it’s not about the number of UTM features or the number of exploits blocked by the SD-WAN device itself. Rather it’s about:

1) How well the solution enables an enterprise to orchestrate the appropriate combination of local, cloud and data centre located security services based on each application’s requirements

2) Whether the solution can support policy-based segmentation of traffic and maintain that segmentation across the network

3) How well the solution enforces consistent application of network and security policies across the WAN

At Silver Peak, we are excited about our partnerships with leading security vendors including Check Point, Fortinet, Palo Alto Networks and Zscaler, and remain committed to augmenting enterprise security with an orchestrated SD-WAN architecture that complements offerings from our partners.