WHITE PAPER
How To Achieve Secured
Wired and Wireless Networks
Top Challenges and How To Solve Them
WHITE PAPER | How To Achieve Secured Wired and Wireless Networks
Executive Summary
The access layer is the broadest attack surface in an enterprise’s network. It supports all network connectivity (via both wired Ethernet switches and wireless access points) for employees, contractors, and guests—as well as Internet-of-
Things (IoT) devices. With about 21.5 billion interconnected devices connecting to networks each day, 1 ensuring access-layer security is a critical need. And with work-from-anywhere quickly becoming the new normal, proper security to mitigate access layer attacks has never been more crucial.
Problems With Existing Access Infrastructure
The local-area network (LAN) edge presents a broad and potentially vulnerable target for cyber criminals—especially at a time when businesses in every sector depend on network connectivity to survive. And attacks are increasing.
Some of the specific challenges that IT organizations face when managing their access layers include:
Upgrading the campus LAN not only refreshes a neglected part of the network—it can also set the stage toward full, end-to-end management and visibility.
2 n n
Keeping different configurations in sync n n
Gaining visibility across the network n n
Managing differing levels of access n n
High total cost of ownership (TCO)
To better manage a secure network, enterprises are looking at integrated mesh platform approaches. A solution that combines wired, wireless, and security functions management is becoming more common as IT groups streamline operational overhead.
But not all networking solutions offer the simplicity, features, and performance required.
Complexity Creates Challenges for LANs
Traditional LAN networks gain complexity as they physically expand due to business growth and the addition of users and devices. As a result, IT administrators need to keep track of all of the different comings and goings. With the deployment of branch and satellite offices and the increasing numbers of employees working from home, the LAN situation gets steadily more complicated and costly at an operations level.
Managing configuration n n
In large campus instances, one small change can disrupt major pieces of the network. Institutions must ensure that any adds, changes, or updates can be tracked and managed to keep all network parts in sync and operational.
n n
Network deployment at remote sites also presents potential configuration problems. Installing and overseeing a common standard across remote locations and disparate branch topologies can rapidly drain IT resources.
Network visibility n n
Campus networks are in constant flux, with devices from employees, contractors, and guests coming and going at all times.
Typical LAN-edge visibility can provide details about the device connection. Still, it can be missing upper-layer device contexts such as user authentication and associated resource access limits.
n n
IoT devices pose a particular challenge in terms of visibility. As these devices appear on the network, IT is under pressure to enable the applications they represent without putting the network’s overall security at risk. In locations without on-site IT staff, this can be even more difficult as the only information on a particular device is what’s provided in the access-layer interface.
2
WHITE PAPER | How To Achieve Secured Wired and Wireless Networks
High total cost of ownership (TCO) n n
Modern LAN network manufacturers have tried to solve their complexity issues by adding additional licenses or subscriptions to address the various needs of the IT group. In adding all these features, however, the overall cost of the solution increases by twofold or even threefold over the cost of the networking gear alone.
n n
In addition, as more systems and overlay tools are brought online to manage and secure the LAN edge, IT groups become stretched thin learning and managing all of these different, disconnected solution interfaces.
Security n n
As LAN networks get increasingly complex, security across all network ingress points for every variety of authorized network user can also become overly complicated. Many organizations add individual point security products on to close gaps one at a time. This complex, disaggregated approach to security can put the entire organization at risk. A single misconfiguration of a LAN security solution can lead to the broader network being breached.
LANs have been neglected from a security perspective— missing key features like encryption, access control, and granular visibility. Bad actors are quickly discovering that the
LAN is now the weak point.
3
Things To Consider When Evaluating a Solution
When updating a wired and wireless LAN network, there are several considerations that any organization should factor into the decision-making process:
9 n
Topology structure .
When looking at how to deploy a secure LAN, one key aspect is the nature of the sites where the network will be deployed. Is this a collection of large campuses or several small branches? Will there be remote workers requiring connectivity? Very often, the solution will be a hybrid of two or more operational requirements. As each topology comes with its own challenges and limitations, the solution chosen should be extensible and scalable to add value and offer functionality that is appropriate in each scenario.
9 n
Connected devices .
What types of devices will be connecting to the network? And who are the different users? The
LAN must be kept secure if guests and contractors with external devices will also need access. A good LAN-edge solution should offer capabilities to deal with all types of devices and users as they connect—without needing constant involvement from IT staff. Technologies for link aggregation make it relatively easy for network architects to keep up with the growing bandwidth demands of end devices.
9 n
Low TCO .
While a solution may offer all the above features, the cumulative costs for licensing, enabling, and subscribing to a la carte capabilities can add up. Network decision-makers must keep careful track of how many systems and solutions need to be purchased for the overall desired functionality to work across the entire organization, how many licenses may be required, and if any key features require recurring subscriptions.
Also, cost of ownership goes beyond capital investment and subscriptions. The amount of staff time that a given solution demands for operations deployment and maintenance can also vary quite a bit. Decision-makers should be prepared to ask how complicated the solution is to manage. Does it work out of the box? Or are there multiple “glue” products needed for it to function correctly?
9 n
Integrated security .
Many LAN solutions lack built-in security. This requires a bolt-on approach to securing the network after the fact, which adds both cost and complexity. Or sometimes, security options are available, but they are not integrated with the LAN edge. This can create “seams” in the network—opportunities for configurations to drift and for bad actors to take advantage, slipping through the cracks. Networks should be built and maintained within a security context to ensure the best possible protection and minimal impact to managing the LAN infrastructure as a whole.
3
WHITE PAPER | How To Achieve Secured Wired and Wireless Networks
Secure Access Requires a Seamless Solution
Wired and wireless LAN networks may form the backbone of every enterprise, but they also represent a significant monetary and time investment for any IT group. Picking the right solution helps IT and security teams fully enable and drive company initiatives.
There are many network equipment vendors in the market today, and VPs of IT should carefully review all of their options to find a solution that offers deployment flexibility at the access layer with integrated security to ensure continuous operations.
1 Internet of Things (IoT) and non-IoT active device connections worldwide from 2010 to 2025 , Statista, 2022.
2 Andrew Froehlich, “ A Network’s Weakest Link May be Different Than you Think ,” Network Computing, November 26, 2019.
3 Ibid.
www.fortinet.com
Copyright © 2021 Fortinet, Inc. All rights reserved. Fortinet ® , FortiGate ® , FortiCare ® and FortiGuard ® , and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
January 20, 2022 4:54 PM
762006-B-0-EN
