Controlling the corporate net gate
As remote access to business networks increases and as threats against these networks grow, IT executives need to support technology that is flexible and that can combat evolving attacks effectively.
That means surrounding their remote access VPNs with support technology that reduces the likelihood that unauthorized users will be able to use the VPN as an entry to the company network to impede performance or steal data, experts say.
To ensure this security, businesses should look for features such as strong authentication and strict policy-enforcement tools to prevent VPNs from becoming vulnerable to intrusion.
While older remote access methods such as dial-up are still in use, the vast majority of businesses have embraced IP and are now building their own VPNs or buying managed VPN services, says Lisa Pierce, a vice president with Forrester Research.
“The most common form of VPN right now is IPSec, but we believe SSL is catching on because it is lighter-weight and more flexible,” Pierce says. Based on browser technology, SSL finds support from customers looking to deploy remote access without having to deploy dedicated VPN clients such as those required with IPSec.
According to Forrester, 62% of businesses in North America use IPSec for remote access and another 20% say they are evaluating or deploying it. SSL, on the other hand, is deployed by 28% of businesses, with another 23% evaluating or deploying it, Pierce says. Some use both technologies. In a separate study, Infonetics ranks use of SSL at 39% among small to midsize businesses.
Features attract
Although the attraction of simplified administration draws many customers to SSL, other features convince them to expand its use. For example, Loews, a conglomerate in New York, started using SSL remote access VPN gear from Whale Communications more than three years ago to supplement Cisco IPSec VPNs, says Al Alexander, manager of Loews’ IT center. “We still use both, but we do more with SSL than before because it requires less administration,” Alexander says.
Key to SSL implementation is use of endpoint-checking software that makes sure remote machines comply with corporate security policies, he says. “It inventories the computer when it connects to the SSL VPN,” he says, rejecting the computer if it doesn’t comply. This is important as use of a VPN expands to more users, because all users’ computers cannot be monitored all the time. The IPSec VPN will stay in use for the IT staff, which is capable of maintaining its own VPN client and needs actual network connections to the Loews network, Alexander says.
A significant trend among remote access VPN vendors is adding security functions to their existing gear – particularly firewall and VPN appliances – or producing new hardware to support these expanded functions, according to a recent study by Current Analysis. “There is an overwhelming trend toward unified threat management [UTM] and multi-layer inspection,” the study says. These devices inspect packets and can perform, for instance, virus, spyware and spam filtering at the same time they admit remote traffic to the VPN. This backs up software that checks whether remote machines also have software to protect against these types of attacks.
IDC projects these devices will become more popular. It compared sales of UTM devices with sales of firewall and VPN boxes and predicts that this year the combined sales of SSL and IPSec firewall and VPN gear will peak and start a slow decline. Sales of UTM devices, on the other hand, will increase steadily through 2008, IDC says. That year, it predicts, sales of UTM devices will reach $1.98 billion worldwide, which is $180 million more than the study projects for peak sales of firewall and VPN appliances.
Vendors in this area include Crossbeam, Fortinet, ServGate and SonicWall, as well as network equipment makers 3Com, Cisco and Juniper. The attraction of UTM devices is that they reduce the equipment needed to perform a battery of security screening, uncluttering equipment closets and streamlining device management.
The expected jump in popularity can be credited to better performance as these products mature, says Zeus Kerravala, an analyst with The Yankee Group. Initially the hardware slowed down under the burden of additional security applications, but that problem is being solved. “Now they have a lot of processing power to handle all functions,” he says.
While the devices that stand between the Internet and corporate VPNs have enhanced security features, more types of machines are trying to access those VPNs. According to a recent IDC study, most businesses surveyed allow remote access from laptops and desktops. Nearly half allow wireless e-mail devices to connect, and more than one in five allow PDAs and even cell phones to access internal network resources, the study says.
To support such access securely, IPSec VPN software can be installed on handheld devices and connect to standard VPN gateways. For instance, Certicom sells tool kits for embedding VPN clients in cell phones and other handheld devices. Motorola, Sierra Wireless and other phone vendors use the technology. Wireless phones with Web browsers can gain access to SSL VPNs without additional software.
Services, too
Although they’re not as popular as remote access VPNs that customers build themselves, managed remote-access VPN services offer an alternative that can keep costs predictable, Forrester’s Pierce says. According to an Infonetics study, only 14% of those polled said they use managed VPN services, and there is no clear leader among the service providers.
Companies may be drawn to VPN services because they can be less expensive than the alternative of setting up a privately run VPN, and managing, maintaining and updating it.
Services will gain in popularity also because of the proliferation of mobile technologies such as EV-DO, Enhanced Data GSM Environment and WiMAX, Pierce says. Because of the convenience of wireless access and the broadband capacity of these technologies, businesses will continue to adopt them, she says.
To push this along, laptop vendors are embedding support for these wireless transport services in their gear. For instance, HP says it is developing a laptop with pre-installed chips for EV-DO, the cellular Code Division Multiple Access technology used by Verizon and Sprint Nextel to support data rates of as much as 700Kbps. HP says it also has plans in the works to support high-speed downlink packet access services.
This will be an increasingly popular option, according to Infonetics, which projects that in 2009 businesses worldwide will spend $29.8 billion on VPN services, about 10 times what they will spend on buying their own VPN gear.
The next major new remote access service to look for is SSL access to an entire corporate VPN, Pierce says. If all the sites of a business are linked by an MPLS VPN service, a remote user could access its entire VPN via SSL. “You want SSL access to the MPLS cloud,” Pierce says.
|
