Reduce or Eliminate Network Security Infrastructure at the Corporate Datacenter
The iboss Cloud Platform can eliminate network security and proxy appliances hosted at the corporate datacenter
Most organizations have been tasked to reduce or eliminate the corporate datacenter. This migration is occurring in an effort to become cloud-first in order to reduce costs and operational overhead. The migration from hosting applications on infrastructure to consuming those same applications in the cloud not only is more efficient, it enables organizations to work faster and be more productive by getting the benefits of SaaS, without worrying about the infrastructure overhead.
With these data center reduction efforts, server and network infrastructure must be eliminated or migrated to cloud services. Some of those services will move to cloud infrastructure providers while others will be transformed to SaaS applications. Within the datacenter, there are likely a lot of network security appliances, including proxies, to protect end users and servers. These network security appliances were designed to protect fixed servers which are disappearing and end users which are leaving the office. However, the need to protect end user connections has never been greater or more difficult, given the users are working on untrusted networks, consuming a lot of bandwidth and working from home.
The iboss cloud platform is the SaaS equivalent of the network security infrastructure and appliances, such as proxies, with the same features and capabilities delivered without appliances and completely in the cloud. This allows end users to connect quickly to cloud applications and resources while providing network and security administrators the ability to protect those connections from phishing, malware and data loss. Since the iboss cloud platform runs in the cloud, it scales infinitely as bandwidth and cloud application consumption increases, without increasing costs.
The Problem
As a network or security administrator, you’ve been tasked to reduce or eliminate the datacenter. You know, however, this will be challenging as there are many network and security policies in place that need to be applied for compliance and security. In addition, due to increases in bandwidth and cloud application consumption, the volume of bandwidth has increased 
exponentially driving the number of proxy appliances and network security firewalls up, including costs and management. The users that are protected by these appliances have also left the office, and may no longer return with new corporate work from home policies. The same level of network security must be applied to those users to prevent phishing, malware and data loss in addition to gaining visibility into cloud use.
The migration may also take some time. And some servers and on-prem IoT infrastructure may remain during and even after the migration. Heavily changing the network topology for some aspects of the network may not be feasible and must be taken into account during this migration.
The iboss cloud provides the same capabilities found in advanced proxies and next-gen firewalls as a SaaS service, delivered in the cloud. It is designed for both the network and security teams and meets the requirements of both fast connectivity while providing security to connections while users are in the office or working from home. It scales infinitely as it runs in the cloud, giving it the capacity to inspect and protect an infinite amount of bandwidth, including decryption, without increasing costs. And, it eliminates the network security appliances from the data center helping to achieve cloud first initiatives.
Typical Challenges
- Must eliminate or reduce infrastructure in the datacenter, including network security appliances such as proxies and next-gen firewalls
- Must ensure network security policies remain in place after the data center reduction
- Must ensure that mobile and work from home users are protected from phishing, malware and data loss as they connect to the cloud
- Must have visibility into network activity while users work out of the office
- Must support decryption of HTTPS traffic to protect from malware and data loss without increasing costs
- Must be able to deal with increases in bandwidth without increasing infrastructure footprint and infrastructure costs
- Must ensure that migration will not cause network interruptions and reduces risks related to connectivity outages
- Must ensure that IP Address space that is used for application IP access restrictions is available in the new solution and that the solution provides dedicated IP Address space for Access Control Lists
- Must support IoT and other network devices that may not be proxy aware or cannot authenticate to proxies
- May need native hybrid approach for situations where private cloud gateway appliances make sense.
- Ideally, the private cloud appliances are managed by the service and are drop-in replacements for the legacy traditional proxy appliance infrastructure
- Ideal if the policies that are in place with the legacy proxy infrastructure can easily be migrated so that interruptions to security and audit teams are not interrupted.
- Would like to ensure that branch offices can run through the cloud solution to minimize the number of remote firewall and proxy appliances hosted at the branch offices
- Must ensure that private HTTPS keys used for decryption remain isolated and controlled
- Must ensure data sovereignty requirements are being met as appliances are decommissioned, especially if the solution runs in the cloud as a SaaS offering
How the Solution Works
The iboss cloud platform runs in the cloud, as a SaaS offering, with all of the capabilities found in advanced proxies and the security features found in next-gen firewalls. The iboss platform is built on a containerized architecture which guarantees that any feature that can be delivered with network security appliances, can be delivered with infinite horizontal scaling in the cloud. It can be used to completely decommission on-prem proxy appliances and turn off next-gen security features in the firewall as those same features can be delivered instantly, and at scale, in the cloud.
To leverage the iboss cloud platform, first route network data through the iboss cloud service. This can be achieved using a variety of methods with the most flexibility on the market. For example, GRE or IPSec tunnels can be created from the offices to the service to automatically route network data headed to the cloud through the iboss cloud platform first. Private cloud containerized gateway appliances can be dropped in the place of legacy proxy appliances without changing network topology, authentication, or existing data redirection techniques. Unlike legacy proxy appliances, the private cloud containerized gateway appliances are completely managed by the cloud service and treated as another data center linking to the global iboss cloud SASE footprint. Network data is processed within the containerized private cloud gateways and sent directly to the cloud, eliminating any extra hops. This is ideal for large sites or locations where changing network topology is highly restrictive. In addition, since the private cloud containerized gateway appliances are linked to the global SASE footprint, a consistent global policy can be applied across the organizations, from infrastructure to remote users.
For truly Zero-Trust models, iboss provides agents, called cloud connectors, for virtually every operating system that will automatically connect users and devices to the cloud service in seconds. The cloud connectors can be pushed in mass using Active Directory Group Policy (GPO), Mobile Device Management (MDM), SCCM or any other bulk deployment strategy. In addition to connecting users and devices to the cloud service, the cloud connectors also install the root MITM decryption certificate, extract the logged in username, device name and end-user groups for dynamic ZTNA policy assignment. With cloud connectors, having users work from the office or from home is no different. In addition, the iboss cloud connectors can route all traffic through the cloud service, not just web browsing traffic, to provide protection across all network traffic. Users are always connected through the iboss cloud service before accessing anything in the cloud protecting the organization from phishing, malware and data loss as well as providing CASB visibility regardless of the user location. In essence, the device becomes the new network perimeter.
Network Architecture Scenarios
If users are using VPNs, traffic from the VPN is offloaded using split tunneling. Only traffic that will end up in the office should be sent through the VPN while all other traffic, the vast majority of it, is sent through the iboss cloud. The split tunneling works by setting iboss as the default VPN route. The specific office destinations are configured as explicit routes. The iboss agents are completely compatible with all VPN clients, run silently, can be pushed out via bulk deployment methods instantly and have the ability to send ALL cloud traffic through the iboss cloud service for inspection and protection.
1
Bad
Sending all traffic through a VPN to a datacenter hosting proxy appliances is the worst case scenario and will lead to slow and unusable connections for users, especially remote workers.
2
Better
Leverage iboss as your Secure Access Service Edge (SASE) platform for internet bound traffic. Offloading Internet bound traffic to iboss while only sending traffic that terminates at the office through the VPN will greatly improve the end user experience by increasing connection speeds dramatically. The iboss cloud connector takes the default route on the end user device and automatically redirects all non-private traffic through iboss cloud for security. This improves user productivity and streamlines connections to Office 365, Zoom, Teams, and other cloud applications. It also reduces the proxy and network security appliance footprint and the data center as all heavy traffic processing is performed within iboss cloud which has infinite scale.
3
Best
Leverage iboss as your Secure Access Service Edge (SASE) platform for ALL network traffic, both public and private, so that users are connected directly to any cloud resource quickly and securely. Sending all traffic through iboss cloud, both private and public, connects users to all cloud resources quickly and securely based on user identity and role. It eliminates costs by eliminating proxy and network security appliances hosted at the data center or office by performing security functions in the cloud and eliminating VPN infrastructure. Users connect to iboss cloud and all traffic to Office 365, cloud applications and video conference apps such as Zoom and Microsoft Teams is sent directly from the user to the cloud application with no extra hops to on-prem infrastructure. Since iboss is connected to all resources, public and private, it can connect users directly to those resources based on user role with speed and security while greatly reducing infrastructure costs, management costs and improving user productivity as they work with the network speed necessary to use cloud applications efficiently. The iboss platform is the premier SASE and Zero Trust platform that is the center piece of your cloud transformation.
The iboss Platform is the Premier Global SASE Platform which is Natively Designed to Protect Azure Resources
The iboss platform is natively integrated with Microsoft Office 365. As a zero-trust SASE platform, the iboss cloud platform can grant or deny access to cloud resources based on user context by connecting user security groups and OUs from Azure ADFS automatically. The built-in iboss cloud CASB visibility can be tied to Microsoft Cloud App Security, so that policies configured in MCAS automatically sync to the inline data path protected by iboss. Logs generated from a remote work force can be connected with Sentinel to provide more visibility and context to security admins. Any infrastructure running the Azure cloud can have their connections automatically secured by the iboss platform with a few clicks without ever deploying a virtual firewall providing true, complete SaaS network security. The following shows how iboss provides the “centerpiece” for any Microsoft Office 365 strategy, by providing the fastest and most secure connection to the cloud and to the Microsoft Office 365 suite.
Instant Benefits and Savings
The iboss cloud platform provides instant benefits and savings as the friction to purchase and implement appliances is eliminated. As bandwidth and encrypted traffic increases, the iboss cloud platform scales automatically while maintaining costs. It’s delivered globally so that data center footprints can be reduced while remote workforces are protected with ease. Because branch offices, users and corporate offices are connected through iboss directly to the cloud without unnecessary backhauling or network hair-pinning, network speeds increase, costs go down and productivity goes up.
