NC1801

OPINION
FORGET VPNS: THE
FUTURE IS SDP
VPN HAS BEEN MUCH RELIED
ON BUT NOT ALWAYS LIKED.
COULD THERE BE A NEW
ALTERNATIVE? ALAN ZEICHICK,
PRINCIPAL ANALYST AT
CAMDEN ASSOCIATES SHARES
HIS THOUGHTS
The VPN model of extending security
through enterprise firewalls is dead,
and the future now belongs to the
Software Defined Perimeter (SDP). Firewalls
imply that there's an inside to the enterprise,
a place where devices can communicate in
a trusted manner. This being so, there must
also be an outside where communications
aren't trusted. Residing between the two is
that firewall which decides which traffic can
egress and which can enter following deep
inspection, based on scans and policies.
What about trusted applications requiring
direct access to corporate resources from
outside the firewall? That's where Virtual
Private Networks came in, by offering a way
to push a hole in the firewall. VPNs are a
complex mechanism for using encryption
and secure tunnels to bridge multiple
networks, such as a head-office and
regional office network. They can also
temporarily allow remote users to become
part of the network.
VPNs are well established but perceived as
difficult to configure on the endpoints, hard
for IT to manage and challenging to scale
for large deployments. There are also issues
of software compatibility: not everything
works through a VPN.
Putting it bluntly, almost nobody likes VPNs
and there is now a better way to securely
connect mobile applications and Industrial
Internet of Things (IIoT) devices into the
world of data centre servers and cloudbased
applications.
AUTHENTICATE THEN CONNECT
The Software Defined Perimeter depends on
a rigorous process of identity verification of
both client and server using a secure control
channel, thereby replacing the VPN. The
negotiation for trustworthy identification is
based on cryptographic protocols like
Transport Layer Security (TLS) which
succeeds the old Secure Sockets Layer (SSL).
With identification and trust established by
both parties, a secure data channel can be
provisioned with specified bandwidth and
quality. For example, the data channel
might require very low latency and minimal
jitter for voice messaging or it might need
high bandwidth for streaming video, or
alternatively be low-bandwidth and low-cost
for data backups.
On the client side, the trust negotiation
and data channel can be tied to a specific
mobile application, perhaps an employee's
phone or tablet. The corporate customer
account management app needs trusted
access to the corporate database server,
but no other phone service should be
granted access.
SDP is based on the notion of
authenticate-before-connect, which reminds
me of reverse-charge phone calls of the
distant past. A caller would ask the
operator to place a reverse charge call to
Sally on a specified number from her
nephew, Bob. The operator placing the call
would chat with Sally over the equivalent of
the control channel. Only if the operator
believed she was talking to Sally, and
providing Sally accepted the charges,
would the operator establish the Bob-to-
Sally connection, which is the equivalent of
the SDP data channel.
A MATTER OF TRUST
As is the case with this telephony example,
there must be a trusted third party involved
in SDP. It's not a human telephone operator
but an SDP Network Controller situated on
the public Internet, generally in a secure
facility like a colocation centre. Providing
both endpoints trust the SDP controller and
the SDP controller can verify the endpoints'
identity, secure remote communications can
take place without the need for a VPN.
Gartner has predicted that SDP will
replace 60 per cent of VPNs by 2021. Two
of the earliest players in the space are
cleverDome and NetFoundry, who are
partnering to serve a specific vertical which
allows consumers to connect securely using
SDP to their financial institutions protecting
their confidential information in the cloud.
VPNs could never scale for that application,
so SDP will be the way of the future. NC
22 NETWORKcomputing JANUARY/FEBRUARY 2018 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK