2018 AFCEA TechNet Augusta Conference and Expo

Solution Review 11: "Network Automation - Rapid Response to Enterprise Threats" (Room Estes A)

22 Aug 18
10:50 AM - 11:10 AM

Tracks: Solution Reviews

Today’s technologies demand a network that constantly learns. Constantly adapts. Constantly protects. So you can work faster, more efficiently and more securely. Mission requirements are always changing which put network operators into a reactive posture that requires participation from multiple teams; Network, Security and Endpoint Management to name a few. Even with the most responsive and talented teams, timing and accuracy are still a challenge and threat detection is usually an afterthought or a bolt on solution. Network automation can address these issues by automating provisioning and configuration with pre-defined and approved rules and policies that provision the network itself and deploys the appropriate security tools without human error or the inefficiency of coordinating multiple teams.

Network Automation by itself is a powerful concept, but when it can be leveraged by the network acting as a sensor to take action based on security threats with or without operator assistance, the network can now defend itself. Analyzing traffic behavior, the network can identify threats and dynamically restrict access permissions or remove it as its threat potential worsens. Once the threat is contained, focus can then be placed on remediating the endpoint.

Unfortunately, a lot of organizations look to automation as a point solution to a specific need such as network provisioning or security and find little value compared to the conceived complexity and learning curve of automation. In order to enjoy the benefits, organizations should look for automation to solve interdependent requirements and solve broader workflow challenges. Open source tools should be evaluated with the understanding they will require a higher degree of operator expertise. Commercial tools have cost concerns and require less demand from the operators. Vendor provided Software Defined Network tools demand even less from operators but may have vendor specific hardware requirements. Larger organizations will find a mix of tools will solve more challenges.