The Perfect Storm: How Digital Transformation is Reshaping Security and Networking

Think back to the end of 2019. Enterprises were evolving IT infrastructure at a moderate pace to reduce costs, be more competitive, and improve their ability to adapt to an increasingly digitized world. Whether migrating workloads to the cloud, virtualizing network functions, diversifying mobility, or moving applications and services closer to the edge, digital transformation was steadily evolving the business landscape.

Then came COVID-19, and in less than 12 months, digital transformation went from that steady evolution to an absolute imperative, accelerated by a suddenly remote workforce and realization that the network (especially user access to data, services, and applications) and its security are the lifeblood of business. Conversations in the C-Suite quickly changed in tone, focusing on one crucial question: How quickly can we pivot and securely update or even rebuild our network to provide for future business continuity and remain competitive?

Even as businesses continue to traverse the challenges of the pandemic and remote working, they are building on digital transformation strategies and investments so they can rebound to recovery. According to IDC, investment in digital transformation has been accelerated by the events of the last year, and it will continue to grow at a compound annual growth rate (CAGR) of 15.5% from 2020 to 2023, approaching $6.8 trillion.

We’ve seen a significant uptick in and acceleration of enterprises embarking on digital transformation. Typically, these initiatives involve wireless access network (WAN) virtualization (a push to SD-WAN) and cloud migration paired with cybersecurity evolution. And they are being set in motion by both the network and security teams, depending on the organization’s priorities. Regardless of who is leading these initiatives, it’s the leadership of the organization that is pushing for change as they come to terms with the challenges of managing and protecting today’s highly complex networks and the connections that support them.

With data, users, applications, and devices spread across hybrid environments, connecting to the network from hugely diverse locations, managing and controlling access — authentication and authorization — has taken on unprecedented priority and urgency. In the new reality of remote working, for example, employees must be able to access the applications and data needed to perform their jobs. Without that, the business is at a clear disadvantage. However, security teams are struggling not only to control who and what devices have access but also to consider when, why, and for which purpose. This has brought the conversation about security to the forefront. Gone are the days of security as an afterthought. Today, a security-first mindset is driving the conversation.

Because of this, security approaches like Zero Trust have become mainstream. To this point, a global survey of 1,000 enterprises conducted by AT&T in September 2020 revealed that 95% of enterprises are researching, implementing, or have completed implementation of a Zero Trust initiative in their network.

In addition, as the mobility of the workforce continues to expand, IoT data consumption explodes with edge computing, and the attack surface continues to become more complex. Security leaders will be looking for ways to consolidate security tools and decrease the number of vendors they’re working with. However, they also need complete visibility of their complex environment (still yet-to-be-realized for many), to automate processes and in some cases preemptively orchestrate them using advanced analytics, and to improve response times for known threats and the unforeseen ones that will come with emerging technologies such as 5G and the edge applications it will actualize.

To add an extra layer of complexity, functions across security technologies are starting to overlap. For example, secure web gateways (SWG), cloud access security brokers (CASB), next-generation firewalls, and data loss prevention (DLP) solutions have overlapping functions, which is creating even more friction between security and IT teams. As an example, according to a 2020 survey by Enterprise Strategy Group (ESG), data loss prevention controls that are available across SWG, CASB, and DLP could result in multiple teams managing the same function in silos, which in turn potentially increases the chance of inconsistent policies or misconfigurations. Half of the respondents in the survey cited increased organizational complexity, inefficiency in managing multiple form factors of the same tool, and complexity of investigating alerts as the top negative impacts on the business resulting from the use of disparate tools.

The problem and cost of managing too many tools has always been one of the main drivers to security virtualization, as security and IT teams seek simplification and centralized management. However, today they are asking for even more. They want unified edge-to-edge security and so are seeking WAN capabilities (in particular, SD-WAN) to be combined with appropriate network security functions like CASB, SWG, and firewall-as-a-service, all delivered as a cloud solution that can support their decentralized, digital business. Gartner, among others, has reported on this trend, calling it secure access service edge (SASE). It’s worth stating that depending on the entity, the definition of services included in a SASE-like solution is still being hotly debated. Regardless, the industry is moving in this direction.  Key components of the trend to edge-to-edge security with network capabilities include:

In response to the call for these combined services, security and network vendors have begun aggressively building out solutions in the last year — natively or through acquisitions. No single vendor has fully realized the promise of SASE, despite marketing claims, but many are leading the pack. Managed service providers (MSPs) and managed security service providers (MSSPs) alike are also increasingly teaming with SD-WAN vendors that offer native security functionality built into their platforms.

No matter the purpose, business criticality, scale, complexity, or design of the transformation, enterprises consistently ask for an evolution in security to be a core part of the initiative. In addition to seeking cost reduction and simplification, they want network security that is more resilient and able to adapt as the business embraces innovation, the networks evolve, and the threat landscape changes. The promise of SASE is that it will significantly move the dial on this. It’s not a panacea, but it will certainly give businesses a leg up as they navigate through the challenges of protecting a business today.

Rupesh Chokshi is Vice President, AT&T Cybersecurity.