Creating Secure Branch Connectivity With SD-WAN

 Every enterprise that makes use of computing resources, which is every enterprise in today’s world, relies on several forms of network-based communication, such as LAN and WAN.


Devices within a facility use a Local Area Network (LAN) to talk to each other e.g., a desktop uses a LAN to connect to a printer. A LAN is relatively easy to manage as it is entirely within the control of the organisation and is located within a distinct physical entity such as a bank office, hospital, academic institution, or data centre. These facilities may be a part of a larger organisation that has multiple branches of banks, hospitals, or educational institutions and each of these branches will need to be able to communicate with each other and a head office, which is accomplished through a Wide Area Network (WAN), which connects the LAN in one facility to a LAN in another facility.

Private WAN Constraints

Interbranch connectivity is very convenient and helps improve the organisation’s productivity and agility, but creating a private WAN for an enterprise can be very expensive, complex, and unreliable. Modern businesses use technology solutions like internet telephony, videoconferencing, virtualised applications, and cloud-based services from multiple vendors; these solutions require high bandwidth and low latency connectivity across branches that may be situated in different parts of the country (or even the world) with varying bandwidth availability and connectivity options at each site. Private WAN is not designed to manage such workloads.

SD-WAN Overcomes The Deficiencies Of Private WAN

Software Defined WAN (SD-WAN) avoids the problems faced when deploying private WAN solutions by utilising conventional internet connectivity, rather than dedicated carrier channels, to enable connectivity between branches. As SD-WAN uses conventional internet, the solution can utilise multiple internet connectivity options available at each branch location to balance the load across internet lines or switch between them to improve the reliability of communication and maintain necessary uptime.

SD-WAN Provides Better Connectivity Management Than VPN

Businesses with fewer branches that are located within a smaller geographical area may consider using VPN networks to connect branches to the head office to gain secure interfacility connectivity while avoiding deployment of both private and SD-WAN. A VPN provides point-to-point connectivity and will utilise a single line for all communication, which will turn into a network bottleneck when the number of users, and simultaneous connections between users, increase. The VPN will also be unreliable as it uses a single communication link, creating a single point of failure. An SD-WAN solution avoids such problems by utilising multiple data transport services and intelligently directing data traffic through the optimum route, maintaining reliable communication as the business expands. SD-WAN solutions can also integrate VPN solutions to provide inter-branch VPN connectivity where required, while maintaining the reliability and uptime of SD-WAN.

K7 SD-WAN

The K7 SD-WAN solution creates virtual WAN infrastructure that has been designed to support modern enterprise workloads that combine access to SaaS services and applications hosted in on-premises data centres and public or private clouds. Businesses gain a cost-effective solution to complex networking needs with centralised control but without the need for all data to be transmitted to a central hub for analysis, improving performance, uptime, and productivity while minimising expenditure on bandwidth.

Components of K7 SD-WAN

How K7 SD-WAN connects head office to branch offices
 

At the Head Office

K7 Unified Threat Management (K7 UTM) or K7 VPN Concentrator (K7 VPNC) devices can be installed in the head office to manage the inter-branch SD-WAN.

K7 Unified Threat Management Series

K7 UTM-E-Series devices
 

The K7 UTM devices provide gateway-level security; Authentication, Authorisation, and Accounting (AAA) user management framework; and VPN connectivity, among many other features, and are available in a range of appliances to suit organisations with varying scales of operations and number of users.

K7 VPN Concentrator Series

K7 VPN Concentrator
 

The K7 VPNC devices enable cost-effective high-performance VPN for businesses with multiple branches and a large number of users but who do not require the extensive feature-set of K7 UTM.

At Branch Offices

A K7 UTM or K7 Connect 500 device, that will integrate with either the K7 UTM or K7 VPN Concentrator at the head office, is required at each branch office to establish the SD-WAN.

K7 Connect 500 Series

The K7 Connect 500 devices enable cost-effective secure connectivity for small branch offices. These devices include in-built 4G support (USB dongle or SIM) in addition to other connectivity options, allowing branch offices to enjoy the benefits of SD-WAN irrespective of the type of connectivity available at their location.

K7 Unified Threat Management Series

K7 UTM A-Series Device
Larger branch offices that require the feature-set of a UTM device but do not require the capacity to manage as many users as the head office can deploy a K7 UTM device that supports a smaller number of users at the branch office, gaining scale-appropriate SD-WAN without spending on unnecessary solution capacity.

Feature Highlights of K7 SD-WAN

The K7 SD-WAN solution has been designed to provide the features required by multi-facility businesses that are implementing digital transformation initiatives, enabling them to gain the scalable, secure connectivity they need to create reliable digital infrastructure that integrates geographically distributed operations. Feature highlights include:

  • Firewall – Secure, multi-zone, Stateful Packet Inspection (SPI) firewall for access control, authentication, and network-level attack prevention with integrated Intrusion Detection System/Intrusion Prevention System (IDS/IPS)
    • To improve security against a growing attack surface, devices deployed in SD-WAN mode add role- and identity-based IDS/IPS capabilities on top of existing security features
  • Enterprise-class Networking – Quality-based link failover, inbound and outbound load balancing, and QoS bandwidth management
  • Next Generation Networking – Support for IPv6, multi-LAN/WAN connections, SSL/IPSec VPN with 3DES, AES, and Blowfish cipher
  • VPN SSL/IPSec – Static IP and Dynamic IP configurations are supported. Multi-WAN support includes VPN failover to maximise uptime
  • Dynamic Routing – WAN traffic can be automatically routed over the best available uplink based on characteristics such as WAN throughput, latency, and packet loss
  • Anti-Malware Scanning Engine – Blocks inbound spyware, adware, and related malware in addition to blocking already existing spyware and preventing adware infected systems from ‘phoning-home’ or transferring sensitive private data
  • Web Security – Identifies malicious websites using heuristic URL analysis and cloud-based website reputation services
  • Content Filtering – Helps businesses define the types of websites and content their users can access
  • Email Security – Incoming and outgoing email is checked against whitelists and blacklists. URLs and attachments contained within emails are scanned
  • Application Filter – Packets’ (traffic) content are examined for inconsistencies, invalid or malicious commands, and executable programs
  • AAA User Management – Authentication, Authorisation, and Accounting (AAA) framework intelligently controls access to computing resources, enforcing policies and auditing usage

Benefits of K7 SD-WAN

  • Easy Deployment & Management – K7 SD-WAN is designed to be deployed quickly across the enterprise and facilitates remote monitoring and easy management of connectivity across branches, reducing IT effort and enabling the business to function with a smaller IT team
  • Zero-touch Deployment (ZTD) – K7 SD-WAN is designed for onboarding and deployment of new branch devices without requiring in-person manual configuration by a technician. The device can be shipped to the end-user who only needs to turn on the device and enter their credentials. Everything on the device is automatically set up and configured for them based on your organisation’s policies, including all the apps they need
  • Scalability – The K7 SD-WAN components are engineered to support a diverse range of users and achieve scalability without sacrificing stability
  • 100% Uptime between HQ and Branch – By supporting multiple connectivity options including mobile internet through SIMs and dongles, K7 SD-WAN ensures that 100% uptime is maintained for reliable connectivity between facilities
  • Logs & Reporting – 20 different kinds of logs are provided to help pinpoint faults and support compliance reporting
Please Contact Us to learn more about the K7 SD-WAN solution’s features and benefits and how K7 can help provide secure inter-branch connectivity for your organisation.

Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

Ransomed by Warlock Dark Army “OFFICIALS”

  Recently we came across a tweet shared by petikvx . The tweet was on a ransomware family that had the group name similar to the WARLOCK DARK ARMY. The similarities with Chaos ransomware seem to end with the attacker group’s name. Upon analyzing the ransomware from the tweet we suspect both to be very different groups just based on their malware’s attributes. The sample under consideration was compiled using C/C++, in case of Chaos ransomware it is usually .Net. Statically looking at the file we noticed a resource entry under Bitmap with an identifier “14”, while analyzing the file code we noticed that this resource was read and loaded on to the memory. Hence we decided to dump that resource entry. Figure 1: Encrypted blob in resource section Figure 2 : Loading blob into the memory During our code analysis we found this blob was XOR encrypted. The first 16 bytes of this blob acts as the key for XOR decryption and the rest is the data which plays a key role in this ransomware’s in...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more