When it comes to network security, there should be no disconnect between the corporate and the distributed locations

Background:

I have a number of customers in the retail industry.  Usually, they have a large number of remote locations (restaurants, brick and mortar stores, and kiosks). Before the cheap/high-speed Internet connections being used for enterprise connectivity (IPsec tunnels over these connections) and before the SD-WAN revolution, all of these remote locations’ traffic traversed private connections such as MPLS or frame relay connections to one or two centralized data centers to reach corporate resources or the Internet. Securing these types of set up were rather less complicated because you had one or two centralized points to secure (mostly at the edge where Internet was accessed).

We are now faced with every remote location acting as an “Internet PoP” (point-of-presence).  These locations will use an IPsec tunnel over the Internet connection to reach corporate resources.  The Internet traffic is locally routed using their existing high speed connection but with centrally configured and managed firewall/Unified Threat Management (UTM) policies.

My Take:

What I have seen rather often is a disconnect between the corporate and the store security operation groups.  Budgets, differences in operational processes and requirements, workload and headcounts as well as internal politics makes it harder for these two teams to strategize, plan and execute holistically.

This usually results in higher cost of implementation and operation. Multiple skill sets are required to support different vendors/appliances which basically do the same function.  More importantly, the security gap created by this lack of cohesion and integration could have devastating impacts on the enterprise or brand as a whole.

A good example is implementation of Intrusion Prevention System (IPS) in this type of enterprise.  If the corporate security group is aware of the remote location network upgrade efforts (refresh), they could (usually with no need for extra licenses or hardware), ask the IPS feature of the UTM appliance to be turned on and with granular administration profile configuration, only manage that portion of the appliance.

Another example would be the implementation of sandboxing technology throughout this environment.  The newly upgraded remote location firewalls or security appliances could act as sensors against zero-day attacks.

I recognize the delicate inner workings of corporate environments and various departments within an organization specially in Information Technology (IT). However, the more unified, holistic, dynamic, automated and integrated the corporate IT/Network security solutions are, the business as a whole benefits. 

That’s the bottom line.