provide蒲公英sd-wan

1SD-WANIsn'tJustforRetailAnImportantTechnologyforCriticalIndustriesInanyorganization,beingresponsibleforcybersecurityisacomplexjobentailinginteractionswiththeteamsmanagingsoftwaredevelopment,servers,databases,storage,andnetworking.
ItbecomesevenmorechallengingwherethereisalsoaneedtoprotectindustrialinstallationsandtheOperationalTechnology(OT)thatrunsthemincriticalindustriessuchasmanufacturing,energy,andextraction.
AlthoughitisnotalwaysontheOTsecurityteam'sradar,intheITnetworkingworldSoftwareDefinedWideAreaNetwork,orSD-WAN,isthehottopicrightnowanditisjustasapplicabletotheworldofOT.
However,SD-WANhasmajorsecurityimplicationswhichmighthaveevengreaterimpactinanOTenvironmentthantheywouldinatypicalSD-WANdeploymentTheconceptbehindSD-WANistoreducethecostofconnectingbranchofficesandremotelocationsbyusingrelativelyinexpensivebroadbandinternetaccessaseitherapartialorcompletereplacementforexpensiveprivateWANtechnologiessuchasMPLS.
Thisisanexcellentsolutionforreducingoverallnetworkingcostsandmanagingtrafficflows.
However,itraisessecurityissuesbecausenowtens,hundreds,orthousandsofsitesaredirectlyconnectedtotheinternet.
Althoughthisallowsorganizationstoaddmorebandwidthinexpensivelyandusersatthosesitestohavedirectandhigh-qualityaccesstointernet-basedresources,italsoexposesthemdirectlytoincomingattacksfromtheinternet.
Inmanufacturing,remotesitesarenotsimplyoffices.
Theyrangefromhugeplantswithhundredsofmachinesandthousandsofworkerstosmallremotelocationssuchasautomatedoilorgaswells.
Oranythinginbetween.
Theyarecrucialtothebusinessbecausetheyproducewhatthebusinesssells.
Theydon'tsupportthebusiness,theyarethebusiness.
Noproduct,nobusiness.
AFORTINETPOINTOFVIEWKeyPointsnSD-WANisanimportantnetworkingtechnologythatcanprovidesubstantialcostbenefitsnItconnectsremotesites,includingindustrialandmanufacturinglocations,tocorporateapplicationsandtotheinternetnSiteswithinternetconnectionsareexposedtocybercriminalsattackingITassetsandOperationalTechnologysuchasIndustrialControlSystemsnThesolutionisSecureSD-WAN,withadvancedcybersecurityprotectionthatisbuilt-innotaddedonnFortinetSD-WANandFortiGuardIndustrialSecurityServicecombinetoprovidethemostadvancedconnectivityandprotectionavailableformanufacturingandcriticalindustriesApril3,202011:36AMfortinet:Shared:CREATIVESERVICES:EMEACreativeServer:03_DOCUMENTS:02_SOLUTION_BRIEFS:SB-SD-WAN_TOFU_Asset:sb_SD-WAN_TOFU_AssetCostSavings,ButAtWhatPriceReplacing(orreducing)expensiveprivateconnectionswithinternetaccessatallofthosesitessavesmoney.
Itcanalsoimproveproductivitybecauseusersonsitewhoconnecttoacloudservice(MicrosoftOffice365,OracleCloud,orapplicationsinAWS,forexample)canhaveaccessdirectlyfromthelocationratherthantraversingthecorporatebackbonenetwork.
Thisprovideslowerlatencyandafarbetteruserexperience.
Buttheseadvantagesarenotwithoutdownsides.
Securitytoolsinthedatacentersuchasfirewalls,IDS/IPS,URLfiltering,orevenantivirusareuselessatremotefactoriesdirectlyconnectedtotheinternet.
Inaddition,asITandOTnetworksconverge,theOTenvironmentisnolongerprotectedbytheairgapofthepast,leavingtheseIndustrialControlSystemsvulnerabletomaliciousactorstryingtoaccessthemfromtheITsideofthehouse.
Preventingattacksnotonlyensuresthatproductioncontinuesasusual,italsoprotectsthesafetyandreliabilityoftheplantanditsworkers.
MostSD-WANofferingsareadequateatprovidingmechanismstodeterminethebestpath,routethetraffic,andprioritizehigher-valuetrafficoverlesserflows.
However,becausetheseproductsareusuallybasedonroutingtechnology,securityisanafterthought,ifitisthoughtofatall.
TheSolution:SecureSD-WANWhichiswhy,fromthepointofviewofcybersecurity,SD-WANdoesnotgofarenough.
WhatisrequiredisSecureSD-WAN,wherethetrafficcontrolisintegratedwithsecurityfeatureslikenextgenerationfirewall(NGFW)advancedthreatprotection,applicationinspection,IPS,URLfilteringandbotnetprotection.
InindustriesthatrelyonOT,thecapabilitiesandprotectionsthatSecureSD-WANprovidestotheITenvironmentcanbeextendedintotheOTspaceandcanprovideanextralevelofsecuritybeyondwhatmayalreadyexistinanIT/OTgateway.
ImplementationoftechnologiessuchasSD-WAN,muchlessSecureSD-WAN,atremotelocationscanbechallengingbecausethesesitesoftenhavelimitedornotechnicalpersonnel.
Thisproblemcanbesolvedwithzero-touchprovisioningtools,whichareavailablewithmany(althoughnotall)SD-WANsolutions.
Butthatisn'tenoughfromasecuritypointofview:inadditiontorouteselection,coherentsecuritypoliciesareamustinordertoprotectthesitefromtheveryfirstmomentsthesystemisupandrunning.
Inaddition,thecentralizedSecurityOperationsCenterneedsvisibilitytoeachandeverysitetomonitorthreatlevels,managethegatewaysbetweentheITandOTnetworks,andquarantinesystemsfoundtobeinfectedinordertolimitmalwarepropagation.
OneexampleofasecureSD-WANsolutionisprovidedbyFortinet'sFortiGateNext-GenerationFirewall,whichcombinesAdvancedThreatProtection,IPS,Anti-virus,ApplicationControl,URLFiltering,VPNandnativeSD-WANfunctionalitywithadvancedOTprotocolinspectionandsecurity.
Tocompletethisrobustsecurityposture,Fortinet'sSecureSD-WANsolutionissupportedbythreatintelligencefromFortiGuard,Fortinet'sthreatintelligencearm.
FortiGuardensuresthatthedifferentsecuritycapabilitiesarekeepuptodate,continuouslyandautomatically.
ThreatIntelligenceSpecificallyForOTOT/ICSsystemsarenomoreimmunetoattacksthanITsystems,andolderimplementationsaresubstantiallymorevulnerablethannewerones.
Fortinet'sFortiGuardIndustrialSecurityServiceisspecificallydesignedtosupportICSenvironments.
ThisservicecontinuouslyupdatessignaturestoidentifyandpolicemostofthecommonICS/SCADAprotocols,providingsecuritystaffwithgranularvisibilityandcontrol.
ThisservicecanprovidevulnerabilityprotectionforapplicationsanddevicesfromthemajorICSproviders.
ThiscombinationresultsinhighlysophisticatedapplicationcontrolofthetrafficbetweenzonesandenablestheFortiGateNGFWtodetectattemptedexploitsofknownvulnerabilities.
WhatthisallmeansisthatthecybersecurityteammustactivelytakepartinanySD-WANdecision.
Thisistrueinanyindustry,butespeciallyinmanufacturing,whereOTsystemvulnerabilitiescanleadtocostlyproductiondowntimeorworse.
AtrulysecureSD-WANsolutionwillnotonlyprovideWANsavings,itwillfurnishasinglecybersecurityapproachthatreducescomplexityandextendsneededvisibilityandcontroldeepintoboththeITandtheOTnetwork.