Cloud and SDN Convergence Demand Shift in Network Security

Life in the SOC has grown a lot more complicated in the last few years as the major forces of cloud and software-defined networking (SDN) adoption have started to converge on enterprise IT in a very big way.

Many security organizations are already struggling to keep up with the tectonic shifts imposed on security by massive cloud adoption over the last five years. Now that network virtualization is moving to the next level with SDN, security teams will have to do better than just tread water.

Consensus is that as SDN adoption moves from proof-of-concept to widespread deployment, network security professionals will be forced to adjust some fundamental tactics to keep up with architectural changes. According to several high-profile surveys that have surfaced in the last few weeks, security professionals are just barely figuring out how to keep end-to-end visibility and control over hybrid cloud environments. Most are not prepared for the added difficulties posed by the impending rapid adoption of SDN in the enterprise, along with the associated shift to the software-defined data center (SDDC).

Where We're At With Cloud Today

Let's start with a level set on the state of cloud security provided by a pair of surveys conducted by Enterprise Strategy Group (ESG). One of them showed about seven in ten enterprises in North America are running private clouds in IT production, and the exact same proportion are still learning how to apply security policies to public/private cloud infrastructure. Meanwhile, close to half of professionals at these organizations believe their team doesn't have the cloud computing skills to provide ample security controls and oversight for cloud security. Another survey by ESG that spanned across the enterprise and the midmarket reported that at least one in three organizations struggle with the following: 

• provisioning security controls for new workloads in the cloud in the face of DevOps adoption of infrastructure as code;
• assessing the overall security status of cloud infrastructure;
• monitoring workloads across clouds--within hybrid clouds or across heterogenous private or public cloud infrastructure; and
• maintaining regulatory compliance while using cloud infrastructure.

As Jon Oltsik, principal analyst for ESG, puts it, the relative immaturity of cloud makes these kinds of challenges inevitable:

"The problem here, however, is that organizations aren't waiting around for CISOs to address these challenges. Rather many are moving full-speed ahead with cloud computing and increasing IT risk as they do so. So, in essence, enterprises are embracing clouds for business benefit, but these benefits come with the cost of degraded security protection."

SDN's Added Complications

Not only is that full-steam-ahead attitude not slowing anytime soon with regard to cloud, but SDN is soon to experience a similar surge in IT as organizations clamor for the operational flexibility offered by virtualized networks. ESG reports that close to half of enterprises have already implemented SDN and are committed to it as a part of their long-term IT strategy. And another 29 percent say they're committed to SDN and are engaged in a proof of concept project.

This tracks well with a recent survey released by Intel and HyTrust that shows 62 percent of senior business executives expect a higher adoption of SDDC in 2016, for which SDN plays a big part. However, as that occurs, more than half of these leaders said they could see more data breaches and other security problems as a result.

According to Oltsik and ESG, this trend is further complicating network security. Approximately 63 percent of organizations queried by the analysis firm said network security operations have become more difficult over the past two years.

"Security personnel must learn new technologies, understand their security capabilities, monitor threats and vulnerabilities, and modify existing security policies and controls to accommodate a variety of virtual technologies," he writes. "This can be a daunting set of tasks."

One big problem at the moment is that implementing and modifying network security controls requires many manual processes, a complaint of over three-quarters of organizations. In some ways, SDN is both the cause of and solution to these problems.

As some experts have explained, the centralized control of SDN can be a single-point of failure for SDN if not properly secured, but it can also offer security practitioners a new plane from which to orchestrate their own efforts.

Warren Wu of Fortinet, explained in a recent Dark Reading Radio interview:

"By bringing those same SDN paradigms to the network security layer itself (to achieve) automation and orchestration of security policies we have the chance to move much more quickly to move ahead of the line of business, eliminating security gaps. One of the exciting things about these new SDN approaches is the ability to get more visibility."

Clearly, paradigms will shift with SDN as surely as they have with widespread cloud adoption. It is up to security to not only secure the SDN architecture, but also get the most out of it when employing new network security strategies in the future.