Secure SD-WAN: Why Branch Networks Need Security Built In

As more business software moves to the cloud as a service and staff work from more places than ever, the software-defined wide area network (SD-WAN) has become a core part of how organisations stay connected. This post, from Hillstone Networks, explains what the technology does well, where it falls short on security, and how the company's own product tries to close that gap.

An SD-WAN is a virtualised version of the WAN. Sitting at the edge of the enterprise network, it can send traffic over several different kinds of link at once: ordinary internet connections, Multiprotocol Label Switching (MPLS) circuits, and mobile data such as 3G, 4G or 5G LTE.

What SD-WAN does for the business

Hillstone groups the advantages into four areas.

• Performance. A software overlay makes better use of available WAN bandwidth by reserving particular paths for demanding applications. Quality-of-Service (QoS) controls let cheaper broadband carry traffic while giving priority to the applications most sensitive to delay, and the same intelligent routing can also apply security policies. The practical result is work software that runs smoothly and video calls on Zoom without lag.

• A "branch of one". Connections can be added, removed or bundled together whenever needed. With Zero-Touch Provisioning (ZTP), template configurations turn the remote setup of next-generation firewalls (NGFW) at many branch sites into something close to plug and play. WAN services can therefore be rolled out to new locations with no IT staff travelling there, which cuts deployment effort and shortens the wait for configuration.

• Agility. Better connectivity helps a business adjust to shifts in its market and respond to what clients need digitally. SD-WAN also lets new devices, links and services run alongside legacy equipment, so there is no forced upgrade, no resulting downtime and no break in operations.

• Lower costs. The service is reliable and protected, and it can run together with MPLS, so organisations can add broadband to their existing circuits. ZTP reduces the expense of configuration and takes the effort out of bringing new branches online.

Why a conventional SD-WAN leaves gaps

SD-WAN has been widely adopted as a cheaper substitute for MPLS lines, but the traditional versions of it were not built with security first. They open gateways for all kinds of connections, from mobile devices to people working at home. Each of those gateways enlarges the attack surface and hands attackers more routes in.

Because a growing share of any organisation's staff depends on those gateways, Hillstone argues that a legacy SD-WAN is no longer good enough. What it proposes is a secure SD-WAN: one where protection is the first priority and whose features are designed to keep each connection, and the network as a whole, safe from cyber threats. In that model the business side's demand for connectivity and the security team's demand for protection are met by the same system, and people can connect without worrying.

How Hillstone's secure SD-WAN is put together

The company describes its SD-WAN as aimed at a workforce that is digitalising quickly and spread across many sites. It promises the usual gains of the technology, including faster applications, a better user experience, more agility, higher productivity and reduced IT spending, with security as the base layer. Hillstone says the product was designed from scratch by people with long experience in security, and lists these capabilities:

• Centralised management. Using Hillstone Security Management together with ZTP, administrators get one global view of the network however many devices are attached. Provisioning is automated and includes a software update and licensing, which makes onboarding quick, keeps running costs down and makes faults easier to trace.

• Zero-Touch Provisioning. Templates can auto-provision system settings, install licences and upgrade firmware automatically. Hillstone can also produce a template configuration on USB, so NGFWs at branch sites can be configured in bulk from a USB flash drive and a simple reboot. Devices can be brought up quickly without skilled IT staff on site.

• Full visibility as the security base. Security teams cannot protect what they cannot see. Hillstone says its SD-WAN sees the whole network, which lets it guard every layer and every connection into it.

• Next-generation firewall. An integrated NGFW provides breach and malware detection, which the company calls industry-leading, along with threat detection and protection in real time. Hillstone's Visionary-qualified NGFWs serve as customer premises equipment (CPE) in branch offices, so security is centralised both at the SD-WAN controller and in the CPE at each branch.

• One platform. Every security function in the product is merged into a single platform, which Hillstone says makes it easier to use, simplifies protection and keeps security central to the design.

• Intelligent routing. Traffic is steered according to the application or service, the policy in force and the live condition of each transport link. Trusted traffic from a remote branch can, for example, travel over low-cost broadband straight to a public cloud data centre or a nearby colocation site, while mission-critical applications use a high-quality private line.

Remote work raises the stakes

Every organisation depends on connectivity, and remote work has changed what that means: access can now be requested from anywhere. That is convenient, but it widens the attack surface considerably, adds vulnerabilities and raises the organisation's overall risk. Hillstone's view is that neither a traditional connectivity setup nor a standard SD-WAN is enough under those conditions, and that its secure SD-WAN was built to supply the extra bandwidth and network availability a hybrid workforce now requires.