THANK YOU FOR SUBSCRIBING
Network Infrastructure Mag Weekly Brief
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large infrastructures exclusively from Network Infrastructure Mag
Arnaldo Zimmermann, CEO and Livio Ceci, VP of EngineeringThat being said, it is a tedious task to manage one or more appliances such as servers, switches, access points, and more at each branch, as every single appliance has its own unique operating systems and management tools. These require manual updates and configuration changes, adding complexity as teams try to manage devices from different vendors. In short, companies spend too much time performing manual, inefficient, and repetitive processes to support their network hardware and software. Also, the lack of visibility of the total deployment with no centralized management, clustering, or absence of search capabilities to track changes in the network adds to the company’s woes.
Although the enterprise network solutions market is replete with companies that purport to solve the problem—one company, ZPE Systems, provides the vantage point. ZPE offers secure hardware- and software-based remote access and control to bridge the gap between existing legacy systems and emerging technologies by supporting data center, SD-Branch, and edge networks with an integrated infrastructure platform—a single pane of glass interface. The company was the first solution provider to offer an “Open Infrastructure Management Solution” for in-band and out-of-band access and control of the network, compute, storage, and power devices in both physical and virtual IT Infrastructures. “Using a single pane of glass (ZPE's integrated infrastructure platform) that supports automation and provisioning, you can keep your network secure, up to date, and, most of all—running smoothly through otherwise costly outages,” states Arnaldo Zimmermann, CEO of ZPE.
Why you need better Remote Network Infrastructure Management!
ZPE streamlines deployment and management of the SD-Branch to decrease downtime and costs of maintenance. With a strong data center background, the team at ZPE brings their Out-of- Band (OOB) expertise and extends it out to the Remote Office/ Branch Office (ROBO) by providing users the ability to establish a 24×7 remote virtual presence throughout their network.
ZPE's Nodegrid provides end-users with the ability to provision and deploy devices in remote locations without putting specialized staff on-site. The Nodegrid platform empowers SD-Branch, SASE, Firewall, and IoT partners to collaborate on a symbiotic network and OOB environment, complete with cellular failover, network clustering, and cloud management. With an automation feature built into the solution, it helps eliminate manual errors and standardize procedures and the deployment of repeatable tasks. Besides, the Nodegrid platform removes the need for multiple boxes and complex configurations. The company’s platform is a vendor-neutral solution and also virtualizes guest-OS applications and offers SASE- and SD-Branch-integrated services. This helps ZPE deliver simple, centralized remote management via one console. “Since our solution provides a remote virtual presence and decreases the number of devices on-site, it not only simplifies managing and upgrading those systems, but also reduces operating costs as on-site IT support and maintenance are redundant,” explains Zimmermann. Furthermore, companies can extend their networking options via Guest OS and SVN, compute power options by deploying uCPE on Nodegrid Compute cards, and IoT options by using Docker and Kubernetes applications on Nodegrid.
Since our solution provides a remote virtual presence and decreases the number of devices on-site, it not only simplifies managing, and upgrading those systems, but also reduces operating costs as on-site IT support and maintenance are redundant
Eliminating the Need for Shipping Pre-configured Devices
“Another key functionality ZPE provides companies is the ability to remotely configure devices, securely and do away with the need for shipping pre-configured devices to their branch,” says Zimmermann. The company provides a cloud-based management platform called “ZPE Cloud” that simplifies initial deployment, configuration, and ongoing management of branch devices, and provides users with a 360-degree view of their entire implementation along with in-depth analytics for enhanced decision-making.
“The beauty of our solution is that we access via the cloud securely, to act as if you are on-site and get your environment running securely without sending a team or pre-configured device to the site,” elucidates Zimmermann. The ZPE cloud is a multi-tenant, highly secure cloud platform that enables users to manage, monitor, and deploy consistent automated provisioning of their systems on a global basis. ZPE Cloud brings together all Nodegrid products on a single platform. Users can reconnect their branch to a NOC automatically and securely via VPN or IPSec, even if Nodegrid was the first device deployed at the office. “Overall, it’s a cost-effective and smarter way to deploy devices in remote environments,” adds Zimmermann.
“Innovation is our biggest differentiator. We routinely collaborate with our customers’ network architects and engineers on future requirements and solutions. Therefore, we are building new use cases before anyone else in the market,” states Zimmermann.
ZPE is continuously working with companies from various industries to test and implement new technologies. The effectiveness of ZPE solutions was on full display when it assisted a large firm to provision and remotely manage devices across hundreds of locations in diverse environments and deploy SD-WAN as a virtual guest-OS. By implementing the company’s Nodegrid solution, the customer was not only able to use zero-touch provisioning and remotely manage their boxes, but they were also able to consolidate high-level, multi-tiered SASE solutions (128T routing and Palo Alto level 4 firewall) into a high-availability configuration. ZPE has helped automate provisioning and implement a seamless setup, thus supporting the customer’s many complex VM architectures. Furthermore, since the customer decreased their reliance on field engineers to go to each of these remote locations (decreased costs and downtime), it helped in closing back-door security risks by eliminating the practice of shipping pre-configured devices.
”Another critical functionality ZPE Systems provides companies, is the ability to remotely configure devices securely and do away with the need for shipping pre-configured devices to their branch”
Thanks to the company’s customer-centric approach to formulating solutions, ZPE has expanded and brought their expertise across international waters to Europe by establishing its European headquarters in Dublin, Ireland, with engineering development centers in the US, Brazil, and India. “Our competitive edge is driven by customer interaction. We can listen to the customer and make engineering changes quickly and swiftly, to meet their needs,” says Livio Ceci, VP of Engineering.
In the current scenario, enterprises are undergoing digital transformations more than ever before by adding new applications to boost productivity, reduce costs, and meet the growing demand of their customers. There is tremendous pressure on CIOs and IT leaders to orchestrate a new network strategy to protect and control all business-critical applications in real-time, regardless of the size of their network, sites, or users. As the enterprise networking space continues to evolve and drive companies to keep pace, ZPE's solutions and services, coupled with their thirst for innovation, have hit the sweet spot to meet the ever-changing requirements of clients. “We will continue innovating and pushing additional appliances for new functionality in OS and Cloud. We want to extend our partnerships with major market-leading cyber-security companies” concludes Ceci.
| Share this Article: Tweet
|
Company
ZPE Systems
Management
Arnaldo Zimmermann, CEO and Livio Ceci, VP of Engineering
Description
ZPE Systems’ Nodegrid®, an integrated Hardware & Software Infrastructure platform, provides SD-Branch and OOB management, flexible network interfaces, automated provisioning, cellular failover, Secure Access Service Edge (SASE), co-hosted virtualized applications like SD-WAN, Firewall, IoT and Cybersecurity to reduce footprint and maximize functionality. With the reduction of downtime, decreased complexity of legacy infrastructure, and elimination of manual and repetitive tasks, IT is transformed from a cost center to a business value creator. ZPE Solutions’ cloud or on premises access and control of network, storage, server, and power devices becomes simplified and automated providing for a more nimble IT environment. ZPE Systems is headquartered in Fremont, California, with offices throughout the US and global offices in Ireland, India and Brazil
In the current business landscape, the significance of a robust cybersecurity framework cannot be overstated. Recent predictions indicate that cybercrime-related losses could surge to an annual total of $10.5 trillion by 2025. The escalating frequency and severity of attacks can be attributed in part to the challenges of establishing a reliable security perimeter around modern enterprise networks. With the proliferation of Internet of Things (IoT) devices and the expansion of networks to encompass remote branch offices and edge data centers, defining network boundaries has become intricate, let alone effectively safeguarding those boundaries. An example of this challenge involves tools like Citrix, which are employed to ensure secure remote access to enterprise assets; however, recent revelations exposed high-risk vulnerabilities in various Citrix gateway products. Ironically, the very tools aimed at fortifying network perimeters might expose us to heightened vulnerability against attacks.
The concept of zero trust security was developed to counter the limitations of traditional perimeter-centric defense strategies. This piece delves into the definition of a zero trust security architecture, identifies common gaps within such architectures, and provides recommendations to avoid these pitfalls.
Understanding the Zero Trust Security Architecture At its core, a zero trust security architecture revolves around the principle of "never trust, always verify." Traditional security models operate on the assumption that any user or device within the organization's network perimeter is inherently trustworthy. This assumption leaves room for compromised accounts and malicious insiders to move laterally across the network, potentially extracting data or initiating ransomware attacks.
Conversely, a zero trust security architecture operates under the assumption that every account and device is potentially compromised until trust is continuously established. The inception of the zero trust methodology can be attributed to Forrester analyst John Kindervag in 2009. That same year, Google's BeyondCorp project was launched, with the primary objective of conceptualizing and developing a zero trust security architecture.
Zero trust security employs network micro-segmentation, advanced authentication, Layer 7 (application-level) threat monitoring, and finely-tuned security policies to validate trust and curb lateral movement. Each network resource's risk level is assessed, leading to the establishment of micro-perimeters with tailored security controls. Users and devices must establish trust at every micro-perimeter, irrespective of their account privileges or network entry point. This approach enhances the ability to detect and neutralize compromised accounts swiftly. By adopting a zero trust architecture, the potential impact and duration of cyberattacks are limited, ultimately mitigating associated costs.
Guidelines for Seamless Zero Trust Implementation Zero trust security is not a singular solution that can be acquired and deployed; rather, it is an amalgamation of tools, policies, and processes contributing to network resilience. Given its complexity, the implementation of a zero trust architecture is susceptible to gaps. For instance, the manual configuration and management of numerous components elevate the risk of human errors. Moreover, while zero trust reduces the likelihood of attacks, many organizations lack comprehensive recovery plans. Additionally, achieving a true zero trust environment mandates the isolation of all administrative interfaces for infrastructure.
During the planning phase of zero trust security implementation, consider the following key questions:
How will the management of diverse policies and solutions be streamlined? Do you possess the requisite tools to facilitate recovery from successful attacks? How will you safeguard the control plane against malicious actors on your network?
Addressing these challenges using the subsequent best practices can facilitate the creation of a successful zero trust security architecture.
Mitigating Human Errors through Centralized Orchestration A zero trust security architecture encompasses numerous individual security policies and solutions. The configuration and management of such an architecture is an intricate task prone to human error, potentially leading to vulnerabilities. Microsoft attributes 80% of ransomware attacks to configuration errors, underscoring the threat of human mistakes to network resilience. To minimize complexity and avert errors, it is crucial to have a centralized security orchestration platform that provides oversight, automation, and management of all zero trust solutions from a single interface.
An optimal approach is to employ a vendor-neutral platform that integrates seamlessly with third-party zero trust vendors, encompassing identity and access management (IAM), next-generation firewalls (NGFWs), and more. Such a platform empowers organizations to construct tailored micro-perimeters utilizing preferred solutions, irrespective of the vendor, while managing the entire architecture from a unified dashboard. This holistic view facilitates a more accurate assessment of the overall security posture, enabling the detection of systemic issues or subtle breach indicators.
Prioritizing Incident Response and Recovery Planning Recent statistics from Check Point Research reveal that the global frequency of cyberattacks averaged 1168 per week per organization during Q4 of 2022. This underscores that it's not a matter of "if" a breach occurs, but "when." Incorporating incident response and recovery considerations into the zero trust security architecture is essential for minimizing attack-related costs.
Research by Sophos indicates that over 70% of organizations targeted by ransomware required more than two weeks to recover, implying inadequate recovery architecture. Extended downtime translates to higher expenses, necessitating enhanced recovery capabilities. For instance, safeguarding data backups through zero trust authentication and policies is critical to prevent compromise or corruption. Additionally, security scans should validate backup data, systems, and infrastructure before restoration to prevent malware re-entry. Swift restoration of business operations substantially reduces the costs associated with cyberattacks, making a recovery toolkit a pivotal component of the zero trust architecture.
Securing the Control Plane via Dedicated OOB Network Management interfaces used by administrators to control network infrastructure are often omitted from cybersecurity strategies, as end users typically don't access them. These interfaces are entrusted to administrators who have usernames and passwords, leading to a mistaken assumption of their safety. Neglecting to apply zero trust policies to the control plane can result in compromised administrator accounts wreaking havoc on infrastructure and gaining unrestricted access to sensitive data and backups. The potential impact of such an attack is extensive and severely hampers recovery efforts.
A recent directive from CISA provides guidance on mitigating the risk of open management ports. The recommended best practice within a zero trust security architecture is to segregate the control plane onto a distinct out-of-band (OOB) network. This dedicated infrastructure remains isolated from the production LAN, impeding lateral movement by attackers. This separation also allows administrators to perform recovery operations even if ransomware or hardware issues affect the production network. Furthermore, zero trust policies and controls must be extended to the OOB control plane to curtail excessive access resulting from a compromised administrator account.
The zero trust methodology necessitates continual validation of trustworthiness for devices and accounts, assuming network breaches and requiring consistent verification before accessing enterprise assets. An effective zero trust architecture is underpinned by a vendor-neutral orchestration platform, emphasizes business resilience and recovery, and secures management interfaces with the same stringent policies and controls applied to the production network.
Constructing Your Zero Trust Security Architecture with Nodegrid The realization of such an architecture is streamlined through the utilization of the Nodegrid solution from ZPE Systems. Nodegrid serves as a vendor-neutral security orchestration platform, delivering unified control over the entire array of zero trust policies and controls. This mitigates complexity and diminishes the risk of human errors. Nodegrid's branch gateway routers and serial console servers facilitate secure out-of-band (OOB) management, enabling the establishment of an isolated control plane without necessitating the deployment of a secondary network. Nodegrid can also be employed to create an isolated recovery environment (IRE), streamlining ransomware recovery and minimizing the business impact of attacks.