* Reader thoughts on the use of multi-function security devices
Many readers responded to the recent newsletter on multi-function security boxes that support VPNs, and raised new issues.
Redundancy was brought up over and over. If a single device performs many functions and it fails, then you lose all that protection.
One reader said that multi-function boxes will be inherently less secure than single function boxes because they are more complex, using a familiar security argument that the more complex the system, the more likely administrators will introduce errors in setting policies that leave vulnerabilities. Alternatively, the system itself by being more complex invites more places from which it can be attacked.
But, the reader argues, using many single function boxes to provide the same functions as one multi-function device is even more complex and therefore less secure. “The probability of human error is geometrically higher with a bunch of single-function boxes,” he claims. “It would certainly take longer to diagnose and repair a cluster of single-function boxes.”
Fair enough. Another reader who had a telecom background detailed how the old phone companies’ famed five-nines reliability came about via redundancy of equipment and constant testing of back-up systems. Individual systems were redundant and these systems were backed up by similar systems.
His feeling was that IP vendors make claims to perform key functions well and inexpensively, but ignore the cost of true reliability. “It ain’t easy and it ain’t cheap to get the high levels of reliability we’re accustomed to,” he says. “Well, a lot of their cost savings comes from lack of redundancy. When we institute the level of redundancy we’re accustomed to [in phone networks] IP gets a lot more expensive.”
Other readers wrote to say they worry that placing many functions on a single device will overtax its processing power, bringing performance of the network down as the device becomes a bottleneck. However, in their product literature, many vendors say they thought of this problem and dealt with it with sufficient processors . But it’s still a worry to potential customers, according to the responses to the newsletter.
“Usually multi-function devices will make you pay a performance penalty somewhere, while single function devices have been optimized for that specific function,” says one reader. “You would need to make sure that the multi-function device does respond to your performance needs when configured and plugged into network infrastructure and when configured with all the features needed.”
Another reader wrote: “When you have a single device tasked with one “job”in life you tend to get best possible performance as opposed to tasking a single device with multiple functions, none of which it can do as effectively for lack of CPU cycles.”
More thoughts? Please mail me at mailto:tgreene@nww.com
