Overview
• Deliver centralized applications with LAN-like speed to remote users, while preserving visibility and branch security.
• Consolidate costly branch office servers, storage and backup infrastructure into data centers, while optimizing WAN bandwidth usage.
• Maximize regulatory compliance and data protection through consolidation of branch storage, as well as acceleration of branch backup applications.
Increasing Number of Incidents of Branch-Office Data Leakage
• In March 2006, a file server was stolen from AIG New York containing the personal information of 930,000 customers, including names, Social Security numbers, and tens of thousands of medical records.1
• On February 25, 2005, Bank of America disclosed that in late December 2004, it lost unencrypted computer backup tapes containing information from 1.2 million federally issued credit cards.2
• In 6 June 2005, unencrypted tapes containing information about 3.9 million CitiFinancial branch network customers were lost by United Parcel Service while they were en route to a credit bureau.3
On June 29, 2006, the Nebraska State Treasurer's Office announced that a hacker broke into a child-support computer system and may have obtained information including the names and Social Security numbers of 300,000 individuals and 9000 employers.4
• In a survey of 768 IT managers, 81 percent companies reported the loss of one or more laptops containing sensitive information during the past 12 months. Handheld devices and laptops ranked highest among storage devices that posed the greatest risk for sensitive corporate data, followed by universal serial bus (USB) memory sticks, desktop systems, and shared file servers.5
• In 2006, research by the Ponemon Institute revealed that the average cost of a data breach per record compromised grew 30 percent, averaging a total of $4.8 million per breach.6
• Forrester Research determined that the cost per breached record ranges from $90 for a low-profile breach in a nonregulated industry to $355 for a high-profile breach in a highly regulated industry.7
Tougher Data Privacy Regulations
Table 1. Data Privacy Compliance Regulations
* Security Breach Laws in More than 34 States.
Organizations Are Responding
• Integrated security: According to Infonetics, the top emerging technology trend, regardless of site type or timeframe, is the integration of security features such as firewalls, VPNs, and intrusion detection systems (IDSs) into routers. This trend is validated by the recent rapid adoption of integrated security embedded in Cisco Integrated Services Routers. Organizations have been implementing integrated firewall and IDS and IPS security at the branch office, in addition to link-level security such as Multiprotocol Label Switching (MPLS) links. Organizations are using these integrated security features to protect against split VPN use and prevent viruses from propagating in the branch network (Figure 1).
Figure 1. Mainstream Adoption of Integrated Security
• Secure optimization: According to the Taneja Group survey, 250 IT directors require optimization to preserve their integrated security investment. Their top priority for a remote-office and back-office (ROBO) solution is security, with network optimization next, as shown in Figure 2.
Figure 2. ROBO Capabilities Most Wanted in a Single Solution
• Management, optimization, and protection: According to the same Taneja Group survey, 250 IT directors sum up their top three challenges for ROBO environments as management, WAN optimization, and data protection for locally stored data (Figure 3).
Figure 3. Top Challenges in Remote-Office Deployments
• Encryption: The Taneja Group survey also indicated that IT directors consider data encryption to be essential (Figure 4).
Figure 4. Security Element Deployment at ROBO Sites
• Protection of data at rest: In the Ponemon Institute and Vontu survey, 81 percent of the 500 IT directors indicated that protecting sensitive data at rest is a priority this year, and 89 percent predicted that it will be a priority next year. Spending priorities will increasingly focus on e-mail, file servers, mobile devices, and backup (Figure 5).
Figure 5. Protecting Data at Rest
Cisco Secure WAN Optimization Solution and Benefits
Figure 6. Data Protection Capabilities of Cisco WAAS Solution
• Disk encryption: Encryption of all optimization data on the remote Cisco Wide Area Application Engine (WAE) Appliance or network module prevents unauthorized data access or theft. Federal Information Processing Standard (FIPS) 197 approved technologies and Advanced Encryption Standard (AES) 256-bit encryption are used to encrypt data on the Cisco WAE disk drives. The automated centralized key management service, integrated within the Cisco WAAS Central Manager, simplifies management of encryption keys, provides centralized failover capability for high availability, and supports backup and restoration of keys to offline vaults for disaster recovery purposes.
• Regulatory compliance: Cisco WAAS is designed and rigorously tested for compliance with major industry security standards. Cisco WAAS is the only WAN optimization solution to be listed in the Common Criteria Evaluation and Validation Scheme (CCEVS), also known as ISO 15408. The CCEVS is the leading program of the National Information Assurance Partnership (NIAP), a U.S. government initiative of the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) designed to increase the level of consumer trust in information systems and networks. Furthermore, Cisco WAAS maintains compliance with stateful firewall operation, which is required in compliance standards such as the PCI standard.
• Stateful firewall protection: Cisco is the only vendor that supports stateful inspection of WAN-optimized traffic through certified interoperability between Cisco firewalls and Cisco WAAS. For the first time, organizations can receive equal protection for optimized traffic and regular traffic without compromise.
– Full compliance with firewall policies and access control lists (ACLs) through packet header transparency
– Full compliance with stateful firewall protection for individual, end-to-end traffic that is optimized
– With Cisco WAAS, no need for additional ports to be opened on the firewall except for those for management and CIFS acceleration
• IPS interoperability: Cisco IPS provides virus scanning in the network and prevents the propagation of other malicious data while maintaining full interoperability with Cisco WAAS. This feature allows customers to perform WAN optimization while protecting their networks against viruses.
• Role-based access control (RBAC): The Cisco WAAS Central Manager offers authentication, authorization, and accounting (AAA) integration with external authentication providers such as Microsoft Active Directory, RADIUS, and TACACS+. Cisco WAAS is the only leading WAN optimization product that provides flexible RBAC for deployment. Customers can create profiles based on role, department, responsibility, and other parameters to help ensure secure access to only the portions of the system that are required. Role-based access is a requirement in many compliance regulations.
Conclusion
For More Information
Table 2. Cisco WAAS Security Capabilities
Note: * For firewalls other than Cisco IOS Firewall, static ports need to be open only for CIFS and management.