Why Software-Defined Security Can Strengthen Branch Office Weak Links

As branch offices show themselves as the weakest security link in an organization, software-defined security could be deployed to help shore up their defenses.

It’s difficult to manage multiple proprietary security appliances for different layers of security at locations where no IT/security expertise is available locally. What’s more, a different expert is often required for each vendor in the stack.

Beyond managing individual security layers, it’s difficult to integrate those layers into a cohesive stack without compromising overall network protection.

Smaller organizations and even some midmarket firms are not able to purchase or lease security appliances for some or all of their branch offices. As security threats targeting the branch become more advanced, and the range of required security functions grows, customer-premises equipment costs can soar. For example, a unified threat management or next-generation app-level firewall appliance is significantly costlier than a basic stateful firewall.

Companies now have apps running both in the cloud and the corporate data center. Additionally, branch offices often have different connectivity requirements. Some use high-speed internet, others use MPLS, and some use both technologies. Each connectivity type requires a different security approach, which adds significant complexity when deploying traditional security appliances to create a standard branch security model.

Companies taking the traditional security appliance approach can experience long deployment times. It can take weeks or sometimes months before the hardware ships, and then consultants or integrators must be scheduled to install, integrate and test the equipment. This process occurs at both initial deployment and when capacity upgrades are required.

Unlike proprietary security appliances that have a finite amount of capacity, software-defined security capacity can easily and dynamically be scaled up or down without having to waste time with replacing proprietary appliances.

With the advent of network functions virtualization (NFV), service providers and large enterprises have the capability and flexibility to decide where to run each security layer—either on-premises in the branch office or centrally in the data center or provider point of presence (POP).

Software-defined security also provides a way to deliver services from a single point of control, avoiding the challenging requirement for skilled personnel to be available to go onsite whenever needed. Instead, services can be deployed, increased in capacity and enhanced with additional functions, all without requiring any onsite presence, hardware refreshes or manual provisioning.