Timothy Liu is the CTO and cofounder of Hillstone Networks.
I love it when a product’s best use case emerges as an unintended consequence of past efforts, or from a “happy accident.” In the case of software-defined wide area network (SD-WAN) emerging as a cybersecurity solution from its networking roots, I am reminded of the decades-old story of 3M and how Post-it notes came to dominate the walls and desks of offices worldwide.
As the story goes, a 3M scientist tasked with developing a strong new adhesive inadvertently developed a formula for an adhesive that could be applied and reapplied without losing its stickiness. When one of his colleagues needed a bookmark that wouldn’t fall out of a book, the two hooked up and the rest is history.
Sure, SD-WAN’s emergence as a cybersecurity solution is perhaps a bit more predictable than that of a now-ubiquitous and beloved office accessory, but the theme of a strong fundamental conviction runs through both stories.
The Growth Of SD-WAN
The concept of SD-WAN came into focus a decade ago. After falling in love with and relying on multiprotocol label switching (MPLS) in the early 2000s, corporate networking leaders were ready for something new as the century’s first decade rolled over.
For as much as people loved MPLS, they couldn’t ignore its shortcomings as the world became more connected. For example, businesses using MPLS to connect multiple branch locations were forced to backhaul traffic through their corporate headquarters, giving up many of the efficiency gains that the technology once promised. Moreover, specific networks needed to be built and switched on, taking most small organizations out of the game.
SD-WAN was first conceptualized in 2013 and requirements development was taken up in earnest and first published in 2015. Interest in the technology grew quickly, and today the SD-WAN market is worth about $3.4 billion and is projected to reach $13.7 billion by 2026. Even with this robust demand, some common misconceptions about SD-WAN still exist:
• It’s just software. You would be forgiven for thinking that SD-WAN is purely a software solution. Despite the confusion in its name, SD-WAN is actually a combination of networking software and edge devices that are typically deployed on-premises at remote locations such as branch offices or multi-building campuses.
• It’s only for the enterprise. When MPLS was first introduced, it was indeed mainly an enterprise-level technology as it remains today. Carrier vendors were few, deployments were costly and most of its benefits were only recouped at a scale that was both expensive and difficult to reach. While it’s true that deploying hardware such as that used in SD-WAN is often considered to be less scalable than using software solutions alone, having this type of hardware on-premises can bring value to small and distributed organizations.
• It’s only about connectivity. One of the main benefits of SD-WAN is its ability to transmit data over multiple protocols and technologies whether that’s MPLS, T1 or even 5G. Yes, this is a giant leap forward from legacy connectivity solutions, but again, it’s that powerful combination of software and hardware that makes SD-WAN more than just a connectivity or even a performance-enhancing solution.
SD-WAN has proven itself to be more than what it initially set out to be. Leveraging its abstracted architecture, SD-WAN splits functions into two planes: the control plane and the data plane. This architecture enables fine-grained control and monitoring of not only where network traffic goes and how it gets there, but also what it contains.
This functionality was leveraged by security professionals inside organizations whose use cases quickly stole the spotlight from their networking peers. For example, if an endpoint in a branch office is detected connecting to an internet host that responds with malware, the control software can create a rule and push policy updates to the local hardware which will prohibit future connections to that host from all devices on the network. This combination of performance and security has appealed to both IT and cybersecurity leaders.
Finally, there’s a value proposition in the consolidation that SD-WAN offers in the context of cybersecurity. As networks and connected devices have grown exponentially over the last decade, vulnerabilities and security risks have also emerged in relative proportion. Ever the opportunists, the cybersecurity industry has over the years developed thousands of so-called “point solutions” to address these risks. SD-WAN has consolidated many of these solutions into one platform.
SD-WAN’s Place In Cybersecurity
That said, SD-WAN is still not a panacea. The global threat landscape is far too dynamic to rely on a single cybersecurity solution no matter how comprehensive it is. When we talk about “defense in depth” as a best practice, what we really mean is “layers of security.” SD-WAN provides a very solid core, but more security is still needed.
For example, credentialed devices such as laptops and mobile phones can be still be targeted with off-network attacks, endpoint detection and response (EDR) can help to manage that issue. Applications and software packages are still vulnerable to sophisticated attacks that leverage unseen flaws in their design.
While SD-WAN is a very capable Swiss Army knife of cybersecurity, if your goal is to build a fortress, you’ll still need axes and scalpels, too.
Interestingly, we are currently witnessing the evolution of SD-WAN into solutions such as secure access service edge (SASE) and security service edge (SSE), but to what end? As mentioned above, the SD-WAN market is projected to triple in size in the next three years. Organizations still need secure, reliable networking with fine-grained controls across disparate locations. And that’s really the story here: how one solution borne out of a different mold can evolve to be highly effective at solving multiple challenges on its own.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Read the full article here
