white paper software defined wan (sd-wan)software defined wide area networks (sd-wan) 4. the...

WHITE PAPER

Software Defined WAN (SD-WAN)Driving the digital transformation of the distributed enterprise

SOFTWARE DEFINED WIDE AREA NETWORKS (SD-WAN) 2.

The traditional WAN has become

an increasing impediment ... in an increasingly

digital-first, application-

centric business environment.

INTRODUCTION

For distributed enterprises, maintaining a secure, reliable and high performing wide area network (WAN) for every remote site can be an IT department’s biggest and most costly challenge. And as more businesses position themselves to support more complex application-driven networking, the traditional WAN has become an increasing impediment to achieving successful digital transformations. This problem is even more pronounced for distributed retail stores and restaurants where onsite IT support and security expertise at remote locations are limited or non-existent.

Challenges

The following are typical challenges distributed enterprises face as they try to compete in an increasingly digital-first, application-centric business environment.

• Security—Mobility, cloud and IoT services increase exposure to breaches

• Compliance—PCI compliance for every site requires significant time and resources

• Downtime—Mission-critical transactions now depend on real-time online connections

• Cost—New technologies mean increased cost for transport, devices, and maintenance

• Complexity—Complicated network configurations and policies must be replicated at every site and integrated across every device

• Expertise—Distributed enterprises have limited IT and security staff for their remote sites

• Agility—Rigid traditional WAN architectures cannot adapt quickly to new requirements


The traditional WAN has become

an increasing impediment ... in an increasingly

digital-first, application-

centric business environment.

Securing distributed

locations used to be a huge

challenge for IT departments....

Impediments to Digital Transformation

Digital transformation is essential to business agility. And despite countless new apps and technologies, for some distributed enterprises with outdated or underpowered WANs, transformation still remains beyond their reach. Why?

• Companies expect their current WANs to do more without additional investment

• New requirements and services have made their WANs too complex to manage

• Culturally, change is hard to do and therefore slow to happen

From Rigid (WAN) to Highly Adaptive (SD-WAN)

Securing distributed locations used to be a huge challenge for IT departments due to the complexity of remotely managing multiple network devices, temperamental VPNs, vulnerable Internet connections and applications with conflicting security and performance requirements.

Cost was also a huge issue considering each location required many different network devices to perform basic business operations. In addition to the price of the equipment, the cost included installation, upgrades, maintenance plans and network integration and service fees.

Software applications added more complications especially if they competed with each other for bandwidth or required dedicated connections to data centers. Adding mobile and Wi-Fi to the mix made management even more difficult and maintaining all the required connections and ensuring full business continuity if a link went down was next to impossible.


The introduction of the Cybera ONE® software defined WAN (SD-WAN) was a game changer for the distributed enterprise. It not only provided immediate practical benefits over traditional WAN technology, but strategic business advantages as well. As a fully managed SD-WAN service, much of the complexity of provisioning and maintaining WAN services at each location was significantly reduced.

For remote locations, Cybera ONE operates as a network overlay that consolidates the functions of multiple high maintenance network devices into one small plug and play appliance. This device includes many built-in functions including firewall, anti-malware, Internet gateway, routing and switching, Wi-Fi, 3G/4G wireless backup and more. Zero-touch installation eliminates the need for on-site IT staff or truck rolls since all provisioning, configuration and updates are managed remotely from the Cybera cloud.

Security is embedded within the fabric of the Cybera SD-WAN providing multiple layers of security for defense-in-depth protection. Micro-segmentation ensures each application operates on its own virtual network. In addition to preventing breaches from propagating from one app to another, it also provides custom security and performance policies tailored to the unique characteristics and needs of each application.

At at the heart of the Cybera SD-WAN platform is the network function virtualization (NFV) cloud. Providing centralized management and orchestration, the NFV cloud’s service insertion framework (SIF) enables the chaining of virtual network functions, or VNFs, to create the custom combinations of network services that are fully interoperable and optimized for performance and security.

Cybera ONE operates as a

network overlay that consolidates the functions of

multiple high maintenance

network devices into one small plug and play

appliance.

Cybera ONE


APP 1APP 1APP 1APP 1APP 1APP 1

APP 1APP 1APP 1APP 1

APP 1APP 1APP 1APP 1APP 1



APP 1APP 1APP 1APP 1

APP 1APP 1APP 1APP 1APP 1


CYBERA ONE SD-WAN VS. TRADITIONAL WAN

With traditional WANs, a remote site may need many different network and computing devices and even multiple WAN circuits to support the different applications and services needed. This creates a significant burden for IT in terms of staffing, equipment costs, physical installation, maintenance plans, contracts and security.

Another issue with traditional WANs, is that the networks are typically unaware of the applications deployed at the network edge (remote locations). The WAN cannot ensure that multiple applications traversing the network are safely isolated from each other. It also may not guarantee end-to-end application security across the network such as protecting the data that a Point of Sale (POS) system sends across the WAN to its payment processing center. This increases the burden of securing applications at every site. Cybera ONE SD-WAN addresses major shortcomings of traditional WANs.

Service Insertion Framework

A key benefit of the Cybera ONE SD-WAN is its service insertion framework (SIF) for deploying enterprise-wide security and virtual network functions without adding complexity and cost. This enables provisioning of consistent, high performance enterprise-grade network environments at every location with system-wide access to best-of-breed services and apps at a fraction of the cost of licensing and provisioning these services separately at each site.

Traditional NetworkApp Experience is the Customer’s Burden

Wide Area NetworkCustomer Site

Customer SiteData Center

Data Center

Wide Area Network with Segmentation

Cybera SD-WANApp Experience is the Provider’s Burden


Cybera’s service insertion

framework (SIF) accommodates

the growing scope of UTM (unified threat management)

without additional complexity by taking things

further...

Security via Enhanced UTM

In a constantly evolving threat landscape, how can you ensure you are not compounding WAN complexity and yet are still able to take advantage of effective security innovations and rapid threat remediation?

Unified threat management, or UTM, provides an integrated security and visibility solution that can grow in scope to increase security agility. UTM allows network administrators to monitor, manage and load balance a broad range of security-related applications and infrastructure components such as firewalls, web and app filtering, SIEM, SSL (decryption, inspection and re-encryption), intrusion detection and anti-virus, anti-malware and anti-spyware software.

Cybera’s service insertion framework (SIF) accommodates the growing scope of UTM without additional complexity by taking things further with security automation, application specific security policies, micro-segmentation for applications and continuous online monitoring. It can easily accommodate newer forms of threat remediation in the form of interoperable VNFs across the entire enterprise.

Micro-Segmentation

With Cybera ONE, each application is assigned its own virtual application network, or VAN, to protect against breach propagation. This also allows diverse applications, such as POS and guest Wi-Fi, to be optimized with their own custom security and performance policies rather than relying on one-size-fits-all settings.

PCI DSS Compliance Scope Reduction

PCI compliance for payment network Card Data Environments (CDE) is easier with the Cybera ONE advanced security features including continuous 24 x 7 wireless intrusion detection, network security and monitoring and reporting, end-to-end data encryption, and network segmentation on an application-specific basis. Third party apps and services such as wireless intrusion prevention and additional reporting tools can also be added via the Cybera ONE service insertion framework (SIF) to expand PCI compliance capabilities.

SD-WAN as a Managed Service

Cybera ONE operates as a managed service which greatly simplifies enterprise-wide SD-WAN implementation and eliminates the need for IT departments to maintain their own SD-WAN data centers. This results in very fast time to execution for initial installations and future upgrades and can be done at web scale and at the lowest possible cost.


Maximum Uptime and Business Continuity

The loss of a WAN connection can bring the operations of a remote site to a screeching halt. Cybera ONE’s built-in automatic 3G/4G LTE wireless failover ensures uninterrupted WAN connectivity should the primary broadband connection go down. The transport-independent and software defined nature of the platform also makes it versatile enough to accommodate 5G LTE when the new service becomes available.

Zero-Touch Installation

Cybera ONE is provisioned in the cloud so on-site installation is simply a matter of plugging in a single Cybera device to an existing network. The device connects itself to the Cybera ONE SD-WAN cloud for automatic provisioning and configuration updates with no truck rolls or IT support required. And because the Cybera device consolidates multiple network and security functions there is no need to install and maintain many separate devices for functions such as routing, switching, firewall, Wi-Fi, 4G wireless and more.

Traffic Shaping and Prioritization—Ensuring Priority for Mission Critical Apps

By routing and monitoring all enterprise traffic traversing its secure SD-WAN cloud, gateways and endpoints, Cybera can collect very large data sets for use in optimizing network performance. This data drives an intelligent machine learning engine that in turn drives dynamic path selection (DSP) to determine the most optimal and highly available paths for mission critical data.

SmartView Management

Console


Enhanced User Experience and Customer Loyalty

Enhanced user experiences, especially for retail and restaurant industries, can be delivered easily to all sites via guest Wi-Fi services over SD-WAN. Combining these services with wireless visitor analytics apps, geo fencing, proximity-based marketing and beacons to enhance customer loyalty programs and reduce customer churn.

24 x 7 x 365 Monitoring and Support

Cybera provides unprecedented access to its support team, being on call for customers 24 x 7 x 365. In addition, Cybera also orchestrates the operations and monitoring of all security and solutions features comprising the Cybera ONE SD-WAN to fully protect customer networks and brands. This service provides round-the-clock monitoring, alert notification, hardware and software troubleshooting, diagnostics and issue resolution.

Maximum ROI and TCO

Because they simplify deployment and management of connectivity to remote sites, SD-WANs can provide excellent ROI compared to conventional WANs. Cybera SD-WAN extends these savings even further with a lower cost of ownership (TCO) by consolidating network devices, simplifying complex security and PCI compliance functions, providing SD-WAN as a low cost managed service and providing a “future-proof” platform that can accommodate emerging applications and technologies.

SD-WANs can provide excellent

ROI compared to conventional WANs. Cybera

SD-WAN extends these savings even

further...


CYBERA ONE ARCHITECTURE

The Cybera ONE SD-WAN architecture comprises three primary layers

• Cybera Security Overlay• Cybera NFV Cloud for Managed SD-WAN Services • Cybera Service Insertion Framework

Together, these three architectural layers amplify Cybera’s application-centric approach for providing industry leading security delivered as a fully managed SD-WAN. These three layers interoperate seamlessly creating a chain of security for defining workflow states relating to applications identified and authorized to operate in the customer’s network. The progressive workflow states between where application activity begins and where it ends are application dependent, and usually defined by metadata.

For example, a point of sale (POS) payment application will subscribe to configuration rules defining a transactional workflow, whereas a video surveillance application will likely follow workflow rules defined by other rules such as scheduling video archiving on a daily, weekly, or other predefined period.

Cybera ONE“ SD-WAN Architecture


Layer 1. Provides the

primary WAN connection for

the remote site ... combines a broad range of security

and other essential networking

functions inside a single cloud

managed device.

Layer 1—Cybera Security Overlay

The Cybera Security Overlay layer is implemented at each remote site with the installation of a Cybera remote gateway appliance. This device provides the primary WAN connection for the remote site and supports new or existing network connections such as DSL, cable, fiber, Wi-Fi, 3G/4G LTE wireless or other IP-based broadband services.

The Cybera appliance connects on-premises systems to the WAN such as POS systems, surveillance equipment, LAN devices and Internet of things (IoT) enabled devices. The appliance also provides built-in serial to IP conversion for legacy devices with serial ports.

In addition, the Cyber appliance combines a broad range of security and other essential networking functions inside a single cloud managed device to eliminate the cost, complexity, and multiple points of failure related to deploying disparate solutions from multiple vendors at each location.

With the security overlay, all applications connected to the WAN are segmented into their own VANs virtual networks to prevent breach propagation and to enable individualized security and performance policies appropriate for each application.

Dynamic path selection ensures optimal connection performance and continuous application availability. If a VAN link between customer’s remote location and application server goes down, the VAN automatically switches to the next best link such as an alternate data center inside Cybera’s distributed, fully redundant private cloud. Examples of network states that trigger a DPS routing switchover include when a link goes down or when the health of the link, as determined by VAN policy, degrades.

Automatic 3G/4G LTE wireless failover ensures continuous network continuity even if the primary link goes down.


Layer 2.Provides secure,

managed SD-WAN connectivity

between applications at edge and their corresponding services in the

cloud.

Layer 2—Cybera NFV Cloud for Managed SD-WAN Services

This layer, provides secure, managed SD-WAN connectivity between applications at edge and their corresponding services in the cloud. This fully-redundant managed SD-WAN data center is designed for very high multi-tenant scalability for individual customers as well as service providers and very large, multi-brand enterprises. The architecture also supports private customer clouds and data centers.

Customers can monitor their sites via the network function virtualization (NFV) cloud using the Cybera SmartView management console which provides a network map of remote sites with weather overlays and color indications of site status. Users easily drill down to site level data and view the status of trouble tickets automatically opened in response to an incident.

Cybera’s NFV cloud supports a robust service-insertion-framework (SIF) that can apply multiple virtualized network functions (VNFs) such as advanced security and load balancing. This multi-tenant cloud is preferred by many customers due to its simplicity, time-to-market and cost-effectiveness over on premise based, DIY solutions. Cybera’s NFV cloud provides many market benefits over alternative approaches, namely:

• The multi-tenant nature of its NFV cloud makes its services more affordable for customers who want enterprise-grade services that may have previously been too costly for them to deploy on-prem.

• The flexibility of its NFV cloud allows customers greater choice over services from security to load balancing to specific connectivity services including third-party Wi-Fi vendors of choice.

• The NFV cloud does not trade-off choice vs. accountability—many customers want best-of-breed services that are part of its service-insertion-framework but also want “one throat to choke” for more transparent accountability. That balance is offered through the managed SD-WAN offering.


Layer 3.The SIF is designed

for an agile and resilient service infrastructure to provide secure,

end-to-end segmentation on an application-specific basis.

Layer 3—Service Insertion Framework

Cybera’s service insertion framework (SIF) layer delivers a highly diverse set of apps, services and virtual network functions (VNFs) for sharing across the enterprise. Because the VNFs and services are pre-integrated and tested for interoperability prior to deployment, provisioning is both simple to do and accelerated for immediate use.

The SIF is designed for an agile and resilient service infrastructure to provide secure, end-to-end segmentation on an application-specific basis. The key SD-WAN service enabling components operating within the SIF include, but are not limited to, the software defined network (SDN)-based universal policy controller (UPC), an application gateway, and virtualized network functions (VNFs) including IPsec/SSL virtual private network gateways, intrusion prevention and detection systems, and firewall protection consisting of the local, Cybera appliance-based firewall and the Cybera ONE cloud-based next generation firewall.

Centralized policy enforcement eliminates device-specific manual configuration and accelerates application deployment to remote locations by simplifying provisioning of multiple, differing applications securely on the same network, regardless of where the applications reside. For example, a customer's payment application might require data leak prevention, anti-malware, web security, and behavioral analytics functions, whereas this customer's loyalty application will likely require a different set of security functions.

Cybera ONE determines what virtualized security functions to chain together based on the application metadata that describes unique characteristics and policies associated with the application. The service insertion framework allows Cybera to easily integrate 3rd-party, best-of-breed security solutions into our cloud or to connect to a 3rd-party vendor's cloud security solution.

For the distributed enterprises, including retail and restaurant chains, Cybera has many pre-configured apps that are tailored based on years of expertise and internal best practices on priority, resiliency, advanced security and load balancing, and extended through partnerships with the world’s leading players in the payments ecosystem.


In far too many applications, security is an afterthought if it is addressed at all. Security embedded in the fabric strikes a balance between user experience, security, and affordability by ”baking into the platform” a best-practices approach that combines defense-in-depth, micro-segmentation and continuous network monitoring.

DEFENSE IN DEPTH

This incorporates security best practices and multiple layers of well-known security technologies such as VPN, IDS/IPS, firewalls, multi-factor authentication and others, by incorporating these functions into the platform to ensure the economic barrier to entry for the cybercriminal is significant.

MICRO-SEGMENTATION

As described earlier in this document, places each app in a separate virtual application network to prevent application traffic from intermingling and thus, reducing the overall attack surface by protecting against lateral breach propagation. Since no app can see the traffic from any other app, an infected app can’t hijack the traffic of other apps for nefarious purposes.

SECURITY MATTERS FOR SD-WANWhy we embed security into the fabric of the Cybera ONE SD-WAN

CONTINUOUS NETWORK MONITORING

Cybera ONE continuous monitoring optimizes performance and security for all remote sites. Like diseases, security threats are often cyclical in nature. They come in ebbs and flows, periodically resurging. And like diseases, security threats often mutate, returning in a different form. As a result, security is not a once-and-done exercise. Here, we can borrow an analogy from the medical world. Even though Salk’s vaccine eradicated polio in the U.S. to the degree that no cases have originated in the U.S. since 1979, polio keeps sneaking back in through international travel.

Continuous monitoring also serves a heuristic security function. When emerging or resurging threats are detected in one part of the network, we can use our cloud managed solution to proactively inoculate the network by propagating security updates across our entire client base.

SERVICE CHAINING

Service chaining quickly and cost-effectively incorporates innovative, state-of-the-art security services transparently into an enterprise network in response to the continually changing nature of the attack landscape. The ability to add a targeted security service via an agile service-insertion framework and replicate it across a sizeable footprint is an important consideration in the SD-WAN scale out process.

IN SUMMARY

All the elements of security embedded in the fabric work in concert with security service chaining combine to create predictive, network-wide protection at scale. A secure, cloud managed SD-WAN flips the reward/effort equation in the favor of the enterprise, which frees up significant time and money to run their business instead of managing a large-scale network that is a cost multiplier. Business, as it should be.


INSTALLATION

Adopting Cybera ONE SD-WAN simplifies network operations and app deployment and maintenance without adding to the workload and cost of customer organizations responsible for IT, Networking, and Security. There are no costly and complex multi-box solutions to install, configure, and manage for enabling the Cybera ONE secure SD-WAN. No expensive truck rolls are required for the customer installable Cybera ONE appliance.

From our customer’s perspective, enabling the Cybera ONE service really involves only two simple steps. Any employee staffing a customer’s remote location can easily follow the Do-It-Yourself, Plug-and-Play instructions for installing the single appliance, multi-function Cybera ONE platform.

• Step 1. Connect power and Internet. System will auto configure and reboot itself.

• Step 2. After the system reboots, connect LAN devices and test your apps.

Total installation time, including automatic configuration, typically takes only 15–30 minutes.

MANAGEMENT AND MAINTENANCE

As a fully-managed SD-WAN service, Cybera ONE enables enterprise-wide system updates from the cloud without onsite intervention. Micro-segmentation and policy control can be applied to both current and future applications, so there is no need for hardware upgrades or site visits to implement new services. This “future proofing” reduces the TCO considerably both in terms of hardware and implementation time.

CONCLUSION

The security, network complexity and operational challenges that have hampered WAN deployments in the past are no longer an impediment for the digital transformation of the distributed enterprise. Cybera’s SD-WAN architecture has enabled web-scale growth across a wide swath of customers who require maximum business agility and cost savings despite being very security sensitive and IT constrained. Cybera’s secure SD-WAN deployments are well proven in scale, agility and economy, spanning thousands of sites with record application bring up times.

Total installation time, including

automatic configuration, typically takes

only 15–30 minutes.


CALL1-866-4CYBERA

[email protected]

VISITwww.cybera.com

Cybera Inc.9009 Carothers Parkway

Suite C5Franklin, TN 37067

© 2017 Cybera, Inc. All rights reserved.

Cybera® is a registered trademark

of Cybera.

WP_SP-SDWAN-DE 0617-01

ABOUT CYBERA

Cybera is a leading provider of secure, software-defined WAN (SD-WAN) solutions to many of the world’s top enterprises and has been named a Gartner Cool Vendor and recognized 7 times by Inc. 5000 as one of America’s fastest growing private companies. Cybera provides a simple solution for the growing complexity distributed enterprises face at remote locations by automating application-centric security and performance in the cloud and providing greater customer choice and faster time-to-market through best-ofbreed partnerships and services. By virtualizing security functions in the fabric of the network, Cybera offers advanced enterprise-grade security for any location, no matter how remote. For more information visit www.cybera.com

white paper software defined wan (sd-wan)software defined wide area networks (sd-wan) 4. the...

Documents