Securing the Network in an Era of Digital Transformation

Featured article by Tom Kelly, CEO, AccelOps

Digital transformation comprises all the changes occurring due to the application of digital technology in all aspects of society. BYOD, IoT, advanced cyber attacks – everything’s happening at an accelerated pace, and only the science fiction writers can guess what’s next on the horizon. One thing that is certain, though, is that the current proliferation of end points requires diamond-sharp clarity about which network solutions will provide a holistic, real-time view of the network. This is difficult for numerous reasons:

– Network and security operations staff must be able to view and share data from multiple network environments to quickly identify root causes of threats.

– Organizations are challenged with a wide diversity of data sources.

– New government regulations and big-name breaches are creating security conversations at the boardroom level.

– Legacy tools cannot deliver the needed scalability and an integrated view of networks, systems, applications and virtualized environments.

New regulations and threats in particular are causing network security and operations professionals to realize that they not only need to report to the corporate CISO or CSO; they may in fact find themselves standing in front of the CEO or even explaining to the board of directors how they are protecting critical corporate resources and ensuring that compliance standards are being met.

The enterprise’s network is being bombarded with social, mobile, local and cloud applications, which has increased IT operational challenges, to say the least. Other trends such as the Internet of Things (IoT) and managing suppliers, remote users and highly diversified platforms are adding new dimensions to IT security challenges. So, how does an organization bring disparate network operations center (NOC) and security operations center (SOC) data and analytics together before security vulnerabilities have IT staff pointing fingers at each other – and only after a breach has occurred?

Presenting a Unified Front

The repercussions of digital transformation make it clear that combining network and security operations into a single view is critical. However, in many organizations, there are at least two separate teams of networking professionals overseeing different parts of the network, reporting to different department heads and working with different tool sets that don’t integrate the data being collected. While this siloed model worked in the network environments of yesterday (those networks that were never touched or couldn’t be touched by outside influences), today’s fast-paced, data-driven, mobile-first network environments demand tools that provide more agility and deeper visibility into network activity.

This all adds up to greater complexity and slower discovery of security vulnerabilities. These vulnerabilities are frequently exposed and managed only after a breach has occurred and damage to the organization has already been done. Investigations of the network weak points require gathering “all IT hands on deck,” with the security operations teams bringing in their sources of data and IT operations bringing in theirs, requiring both teams to manually correlate historical events to discover the source(s) of the breach. With shrinking budgets stretching IT assets and a growing sense of exposure and accountability, it has become vital to identify and implement solutions that will satisfy the needs of both entities and their chains of command with tools that can more rapidly identify threats through the cross-correlation of data and analytics from both departments.

Must-Haves to Bridge the NOC/SOC Gap

To help IT professionals out with real-time analysis of security alerts that are generated by network hardware and applications, vendors created Security Information and Event Management (SIEM) solutions. Since their creation, though, the emergence of the Cloud, the Internet of Things (IoT) and Big Data have tasked NOC and SOC professionals with monitoring and reporting a growing number of activities.

So, what should organizations be looking for in a solution? What are the pitfalls they should be aware of? How can they be sure they have selected a solution that will provide them with the holy grail of unifying analytics, accelerating time to discovery of threats and the ability to quickly respond? And all that while automating and integrating their regulatory compliance reporting data?

It’s a tremendous waste of time and resources to implement a solution and train staff,

only to find that the solution is difficult to use or doesn’t easily scale as the needs of the organization change. To avoid this scenario, below are five “must have” elements organizations should look for when implementing a SIEM solution that bridges both network and security operations needs and requirements:

– Discover devices automatically – Explore offerings that use aConfiguration Management Database (CMDB) to map the current network topology, including servers, devices, storage, networks, mobile, security, applications and users, and their interdependencies. The CMDB tool should also provide the ability to self-learn, in real time, any changes that occur to that CMDB environment. In doing so, teams will gain the ability to discover, identify and establish alerts from changes that may be posing threats to the organization’s compliance or performance needs.

– Gain a holistic view – Unified network analytics platforms should integrate and cross-correlate data that has historically been managed in separate departments—NOC and SOC—to bring together a comprehensive, holistic organizational or “single-pane-of-glass” view of the network. Ideally, the solution should provide pre-defined reports for common monitoring and compliance needs, along with easily customizable reports for unique needs.

– Avoid threats, gain compliance – Enterprise network environments today can span multiple national and international locations. In addition to an organization’s need to have a macro view of their overall network infrastructure, they also need the ability to partition and define unique physical and logical network elements into micro-view reporting domains (“tenants”) for greater granularity in their management of the unique requirements in those domains. Managed Service Providers (MSPs) must also manage their own internal infrastructure, as well as be able to carve out unique domains for their respective end-user customers. In either case, it is critical to implement a solution that enables users to view multiple tenant or client networks with real-time analytics in order to stay ahead of emerging threats and meet compliance needs.

– Threat data cross-correlation – A real-time view of the organization’s network infrastructure and cross-correlating data from device and event details empowers IT teams with the insights they need to quickly react to cybersecurity and network performance threats.

– Real-time threat intelligence – Look for solutions that can enable IT teams to aggregate, validate and share anonymous threat data, in real time, for rapid awareness to an ever-growing threat landscape.

Presenting a Unified Front

Big-name data breaches continue unabated, bringing with them damage to organizational revenues, brand reputation and customer experience—not to mention the potential for organizational leaders facing actual jail time. C-levels can no longer rely on the age-old idea that their network is optimally managed and protected by NOC and SOC teams working independently – the old siloed approach is dead.

MSPs have already discovered how critical it is to correlate analytics from both the SOC and NOC in meeting today’s challenges, and many of them have built business models offering services that do just that. Today’s uncertain environment is not just an IT, CIO or CISO problem; it is being felt across the entire organization, from employees all the way up to the board of directors.

Destroying the siloes that divide NOC and SOC that currently prevent organizations from quickly identifying and remediating threats must take the highest priority. If not, all other strategic initiatives will be put at risk. Security today means more than just protecting data; it means safeguarding reputation and customer trust as well. Forward-thinking organizations will position themselves for success by implementing a strategy to cross-correlate NOC and SOC analytics in real time.

About the author:

Tom Kelly is a technology industry veteran, having led companies through founding, growth, IPO and strategic acquisition. He has served as a CEO, COO or CFO at Cadence Design Systems, Frame Technology, Cirrus Logic, Epicor Software and Blaze Software. Tom led successful turnarounds at Bluestar Solutions, MonteVista Software and Moxie Software, having served as CEO in repositioning and rebranding the companies in advance of their new growth.   He serves on the Boards of Directors of FEI, Fabrinet, and ReadyPulse. Tom is a graduate of Santa Clara University where he is member of the University’s Board of Regents.