NC Sep-Oct 2022

FEATURE: WAN PERFORMANCE
WHY CISOs MUST NOW EMBRACE SD-WAN
SIMON HILL, HEAD OF LEGAL & COMPLIANCE AT CERTES NETWORKS INSISTS THAT
IT’S TIME FOR CISOs TO TAKE A LEAD ROLE IN THE DIGITAL TRANSFORMATION
PROCESS - OR RISK BEING SIDELINED FOR GOOD
Digital transformation has become a
business imperative, yet rather than
pulling together to enable essential
change, the friction between network and
security teams is increasing. The business
needs to move away from data centres and
traditional Wide Area Networks (WAN) to
exploit the cost, flexibility and agility
provided by the cloud and Software Defined
WANs (SD-WAN). Chief Information
Security Officers (CISOs), especially those
working in regulated industries, insist the
risks associated with public infrastructure
are too high. Stalemate.
Until now. Organisations are pressing
ahead with digital transformation plans
and excluding the CISO from the
conversation. But at what cost? Who is
assessing the implications for regulatory
compliance? At what point will the Chief
Risk Officer prohibit the use of the SD-
WAN for sensitive data, leaving the
business running legacy and new
infrastructure side by side, fundamentally
undermining the entire digital
transformation project?
A new attitude is urgently required, one
based on collaboration, understanding
and a recognition that a Zero Trust security
posture can safeguard even the most
sensitive data, while unlocking all the
benefits associated with SD-WAN.
ACCEPT CHANGE
CISOs need to face up to the fact that
digital transformation is happening - with
or without them. Organisations need to
embrace the agility, flexibility and cost
benefits offered by the cloud, by Softwareas-a-Service
and, critically, the shift from
expensive WAN technology to SD-WAN.
For CISOs, while the migration to SD-
WAN extends the attack surface, adding
unacceptable data vulnerability, saying no
is not an option any more. CISOs risk
being left out of the digital transformation
loop - and that is not only adding
significant corporate risk but also
compromising the expected benefits of this
essential technology investment.
Network and IT teams are pressing
ahead, insisting the risk is acceptable.
How do they know? For any organisation,
this is a dangerous compromise: critical
risk decisions are being taken by
individuals who have no understanding of
the full implications. For those
organisations operating in regulated
industries, these decisions could result in
an exposure to $10s millions, even $100s
millions of penalties.
Failure to embed security within the initial
digital transformation strategy is also
compromising progress. What happens
when the CISO or Chief Risk Officer
discovers the business is in the process of
migrating from the old WAN to a new SD-
WAN environment? Suddenly the brakes
are on, and the call is for sensitive data to
be encrypted before it hits the network.
Adding Internet Protocol Security (IPsec)
tunnels will degrade performance - so the
business is then stuck using the legacy
WAN for data connectivity while still
paying for the SD-WAN and failing to gain
any of the agility or cost benefits. More
frustration and friction between teams that
should be working together to support
business goals.
DRIVE CHANGE
Security is a fundamental component of
digital transformation - indeed of
corporate operating strategy. Rather than
avoiding change, CISOs have a
responsibility not only to secure the
organisation but to proactively advocate
change, with security as the key enabler of
digital transformation.
20 NETWORKcomputing AUGUST/SEPTEMBER 2022 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK