Security Appliances - The Bastions of Your Enterprise
It is understood that IT plays a major role in Business today and security for the IT systems is a major concern for many a CIO. Erstwhile wars drove the scientific innovation and invention; practically all of the major tools that we use today are offshoots of certain warfare related inventions. Similarly, some of the IT security related terms and attack models are based on earlier generation’s warfare. Trojans and Spywares are the best examples.
Let us look at the advent of colonization and use of Navy might of earlier days used to conquer uncharted terrain of the globe. To contain the Navies, Leonardo da Vinci came up with the concept of underwater boats. Submarines as we know today, are one of the crucial defense mechanisms for naval warfare. Across the horizons they do not make visibility; while making themselves as bastions of defense for the shores. Of course there are other ships/boats that play other roles in the defense of shores. But the activity of submarines is completely underwater and even their attack is stealth, making the strikes fatal.
We can draw these parallels for all the B2B interactions that take place over the Internet especially outside enterprise firewalls. The greatest of threats to any Enterprise that engages in Online Business Transactions would be attacks on their Business Support Systems (BSS). Hence, they are placed far away from firewalls and any access to these systems would mean that a message needs to pass through several security mechanisms and checkpoints.
If these interactions between Application near to firewall (called Bastion Systems) to the Core BSS system are to be viewed from the ISO: OSI reference network model perspective, there are many complex interactions between the layers. This involves multiple encryptions, decryptions and authentications which causes a significant latency if performed on software.
Taking the analogy of submarines further, we can think of a seemingly non-existent bastion system, between the firewall and the core BSS. We need to look at the lowest of the levels of ISO-OSI stack, for instance at the router or gateway level; where the Application messages are not “messages”, but just streams of bits and bytes and their packets thereof.
If at that layer, the messages are filtered/sorted/routed, the said latency of assembling the packets to form Application Level messages and subsequently filtering and then dissembling them can be extremely challenging, if the non-functional requirements are demanding, for instance, in Trading systems.
With the same thought, Cisco had come up with an “Application Oriented Network” product where the logic for Security, Routing etc can be hosted on the blade servers, which can sit on the Routers and Gateways. Apart from AON, other players in the same league are IBM Datapower, Intel Sarvega, Citrix QuickTree, Radware, Xtradyne, BIG-IP ASM (F5 Systems) etc.
Fortune 2000 Enterprises have acquired these appliances as auxiliary support engines for their EAI Product suites, as some of the functions of an EAI tool can be handled independently, yet seamlessly by these appliances giving them a moniker “Steroids for EAI”.
One of the Enterprises uses IBM Datapower for filtering of XML messages (RosettaNet protocol) at the firewall itself, saving the EAI tool the routing; while another Enterprise uses Cisco AON to filter RFID messages so that their warehouse system is not burdened with zillions of RFID messages. (RFID readers send messages back to the server once in 3 seconds about all the RFIC tags in their range. Unless there is a change in the position of the tag or if it passes through a choke point, warehouse system does not need this message, hence the filter.)
We need to wait and watch out how they emerge in the market as most of these players started as independent companies and today are part of major Integration Suites, complementing the capabilities of EAI product suites.



Comments
Good article on the Security Appliances in the Enterprise.
lateral thinking like this can initate new perspective on the EAI technologies and tool selection process as well.
Posted by: Ramalingam | August 2, 2010 5:26 AM
Thank you Ramalingam!
In today's world, we need more of innovation than inventions for ensuring cost effective solutions.
Posted by: Anil Prasad Kurnool
|
August 2, 2010 6:07 AM
Good blog that lets the readers know about on going research on new possibilities in realizing EAI capabilities at network level.
Posted by: Ravi Nori | August 2, 2010 6:20 AM
Thanks for the comments, Ravi!
This blog is more from a practioners perspective than on research. However, it might interest you to have a look at our Setlabs section, which caters only towards research on IT in solving business problems.
Posted by: Anil Prasad Kurnool
|
August 2, 2010 8:16 AM
Why should all EAI tools have a B2B component?, why reinvest in Appliances?
Posted by: Anil | August 4, 2010 3:48 AM
Anil,
I assume, you wanted to ask "When all EAI tools have B2B components, why invest in Applicances?"
Answering based on this assumption:
Agreed that all the EAI Suites have a very mature B2B components. However these tools are meant to handle other things apart from "security" alone, like Partner Profile Management, Routing Rules, Transaction Management etc. Burdening them with unwanted spam messages would bring down the throughput; hence the suggested use of appliances to filter the spam messages and send across only valid messages from Partners.
Posted by: Anil Prasad Kurnool
|
August 4, 2010 6:34 AM