Story image

Interview: Big Switch talks network security, data centres and DDoS attacks

18 Sep 2017

What makes up a secure network across a data centre? We talked to Big Switch Networks VP of product management Prashant Gandhi and APAC managing director Mario Vecchio about network security, demilitarised zones, packet flow and how that all ties together in the company’s approach to security architecture in data centres.

“We are getting traction across the APAC region from China, Japan, India and Australia, with some of the largest companies in each of these countries commercially deploying and using our products at scale. Our technology has been deployed across industries from banking and finance, network carriers and service providers, through to large federal governments and enterprises,” comments Vecchio.

According to Gandhi, common wisdom for organisations might be the ‘security through obscurity’ approach which says that attackers can’t see the attacks, therefore it must be harder for them to attack. But it’s not that simple anymore.

“Unfortunately, cyber attacks have become far more sophisticated – cyber criminals are able to subtly probe a victim’s infrastructure for vulnerabilities and then compromise those vulnerable assets. They often compromise low-value assets and then look for opportunities to take over high-value assets. This is prompting organisations to employ tools that provide pervasive visibility (visibility across their entire infrastructure) to detect attacks,” he says.

The demilitarised zone (DMZ), also known as the perimeter network, is populated with security vendors and products.

Gandhi says that organisations analyse their network for particular functionalities for securing their DMZ

“Key functionalities of interest to most organisations are: firewall, IPS, ATP, SSL visibility/proxy, DDoS mitigation, and cloud application security broker. Where there used to be two or three security functions in the DMZ, there are now more than half a dozen, which demands a more streamlined way to operate and carry out change management – adding and removing functions, scaling, software upgrades et cetera,” he says.

But with many different functions in the DMZ, a lack of visibility can be a severe issue, particularly for network weak spots.

Because networks are the lifeline of any business and its assets, weak spots allow attackers to discover those assets.

“It is no longer acceptable to have weak spots for low-value assets, as an attack will spread from low-value to high-value assets as it progresses,” Gandhi says.

When attacks are pervasive and widespread, how does that tie together in Big Switch’s approach towards security?

Gandhi says the company takes principles of a software-defined security approach to protect an organisation’s assets. This happens through a scale-out deployment model and API-driven automation across the network and security products, as demonstrated in its BigSecure architecture.

Gandhi says these principles go beyond the DMZ and into data centres, campus networks and enterprise branches.

To detect potentially troublesome traffic, Gandhi says that BigSecure Architecture operates transparently and hence the rest of the infrastructure, including business websites and the resources they depend on, see no change in their traffic patterns. Once BigSecure is activated, the rest of the infrastructure receives clean traffic and hence can deliver services free of DDoS attacks.

Big Switch has put particular focus on DDoS attacks, which can cripple a network for long periods of time.

Gandhi says that DDoS attack not just websites, but business-critical assets such as the DNS service that underpins a company’s website.

“DDoS attacks not only impact websites but also other assets that are critical to the functioning of business websites (such as DNS service). It is paramount to protect all data centre assets from DDoS attacks to ensure an uninterrupted service, continued monetisation and protect brand image,” he says.

BigSecure is able to fuse software-defined networking and software-defined security to build dynamic attack mitigation with the ability to withstand high-bandwidth, long-duration attacks.

Vecchio says that the term software defined networking (SDN) doesn’t mean much to most customers. Instead, they want to know how their data centres and networks can be protected in valuable and efficient ways.

“Big Switch Networks has recognised a number of common networking needs that can be addressed with SDN. Firstly, customers are desperate for visibility into their data centres, as the process of virtualisation has rendered legacy networks ineffective,” Vecchio says.

As a result, the company has invested in automation, scalability and an architecture that allows separation of hardware and software, as well as the financial and lifecycles for both.

“It is also an ideal solution for transit providers and managed security providers that operate high-bandwidth scrubbing centres. Lastly, BigSecure is well aligned for protecting emerging provider services such as 4G/5G mobile and network functions virtualisation (NFV),” Gandhi concludes.

Australians unsure of who is responsible for the safety of their information
According to a recent survey conducted by SOTI, Australians are increasingly concerned about the security of their health records.
Europol makes 61 arrests & nets €6.2 million in dark web crackdown
60 experts from 19 countries, Europol, and Eurojust were involved in hunting for activities including the illegal sale and signs of counterfeit goods and money, drugs, cybercrime, document fraud, non-cash payment fraud, trafficking in human beings and trafficking in firearms and explosives. 
The silver lining in Australia’s Government cloud strategy
Cloud has been a huge part of the ‘digital transformation’ conversation within Australian government during recent years.
Milestone: How video and IoT are finding their place in enterprise
Milestone Systems South Pacific country manager Jordan Cullis talks about three trends that will revolutionise the way video is viewed in 2019 and beyond.
Largest DDoS-for-hire websites responsible for 11% of attacks worldwide – Nexusguard
The FBI’s shutdown of the world’s 15 largest DDoS-for-hire “booter” websites in December resulted in 85% decrease in average attack sizes, year-over year.
Five things MSPs need to keep in mind in 2019
A Datto APAC channel exec outlines the most important factors for MSP to being paying attention to in the coming year.
Survey: IT pros nostalgic over on-prem data centre visibility
There are significant security and monitoring challenges faced by IT staff responsible for managing public and private cloud deployments.
61% of CIOs believe employees leak data maliciously
Egress conducted a survey to examine the root causes of employee-driven data breaches, their frequency, and impact.