Balance sought for SSL WAN optimization

Businesses need to balance WAN performance with data security

With more and more WAN optimization vendors extending their capabilities to include encrypted traffic, corporate IT executives have a decision to make: Should they trust the security these devices provide?

Rather than passing through SSL sessions between clients and servers located in remote data centers, some WAN optimization gear can terminate the SSL sessions, shrink the traffic and re-encrypt it for the next leg of the trip. These chains of encrypted sessions introduce potential vulnerabilities that different vendors address in different ways.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

With more and more WAN optimization vendors extending their capabilities to include encrypted traffic, corporate IT executives have a decision to make: Should they trust the security these devices provide?

Rather than passing through SSL sessions between clients and servers located in remote data centers, some WAN optimization gear can terminate the SSL sessions, shrink the traffic and re-encrypt it for the next leg of the trip. These chains of encrypted sessions introduce potential vulnerabilities that different vendors address in different ways.

Click to see: Speeding SSL traffic

SSL traffic represents a growing percentage of total traffic on WAN links, according to Forrester Research. So SSL support in WAN optimization appliances will become more important to businesses that want to keep traffic secure while minimizing the size of their WAN links.

In a survey last month of 1,300 IT executives by WAN-optimization vendor Blue Coat Systems, one-third of respondents said that 25% of their WAN traffic is SSL. And of those surveyed, 45% plan to roll out more SSL applications this year.

About a third of all WAN traffic at Richardson Partners Financial Ltd. in Toronto is SSL, says Andrew McKinney, director of technical services for the firm. But if only the urgent business traffic is considered, the percentage is much higher. “For critical business traffic, it’s all encrypted,” he says. So he uses Blue Coat Systems gear to secure traffic and optimize it for good performance.

But first he got the devices in and grilled the vendor about the security at each point of the proxy chain until he was satisfied it would keep the firm’s data safe. “Our big concern was that we would have control of what was being cached,” he says. He didn’t want sensitive data left on the disk of the Blue Coat appliance.

“We wanted to be sure the data could be flushed as we required but also that it was securely being stored. In the end we were satisfied,” McKinney says.

So far, just three vendors - Blue Coat, Certeon and Riverbed Technology - offer SSL acceleration on their appliances, and the capability is also on the road map for Juniper Networks and Silver Peak.

Such devices sit at both ends of WAN links and perform a number of functions that serve to speed up transaction times. These include optimizing TCP sessions, enforcing QoS, byte-level pattern matching and protocol optimization.

Without SSL support, when SSL traffic hits these boxes they are limited to using TCP optimization and QoS.

SSL support relies on terminating SSL sessions, decrypting the traffic storing segments of the data for future reference and re-encrypting. Later traffic through the devices is compared with these segments. When data being sent matches a segment, the devices send an abbreviated reference rather than the longer complete segment, thereby reducing the amount of traffic that has to cross the wire.

These segments are analogous to paperwork put through a shredder, says Mark Day, chief scientist at Riverbed. “The individual pieces are still intelligible, but total documents are somewhere between difficult and impossible to reconstitute,” he says. Customers concerned that these data segments represent a threat can turn off SSL optimization and pass the traffic through, he says.