Fortinet Continues to Redefine Security

The entire world has been undergoing one of the most massive network reconfigurations in the history of computing. Networks have been literally turned inside out as millions of internal users, almost overnight, became part of the new network edge. One outcome of this sudden stress test of our BCDR (business continuity and disaster recovery plans) is that that too many organizations suddenly learned that their traditional firewalls could not scale to support this explosion of edges. This has forced many organizations to upgrade devices or even install completely separate appliances to meet the demands of a new remote workforce.

Solving the Wrong Problem

The problem is that most security vendors have failed to fund the innovation necessary to meet the high performance and high scalability requirements of today’s networks – which means that (for years) they have been unable to deliver the solutions their customers need at a price point they can afford. As a result, organizations have been forced to buy “good enough” solutions that struggled to support standard digital innovation. And unfortunately, those ‘good enough’ security solutions were suddenly not good enough as organizations scrambled to rapidly scale remote workers and inspect encrypted traffic.

This should not have been a surprise, as we have been headed toward this situation for a while. Digital innovation puts increasing pressure on the security infrastructure, and security manufacturers keep putting off addressing the problem. It’s as if those vendors have been driving down a completely different road from the one that their customers are traveling. Security innovation needs to solve the big problem everyone is facing – the need to protect today’s expansive, dynamic, and high-performance networks. 

Today’s companies use complex, hybrid networks, and multi-cloud environments to process unprecedented volumes of data. They need security tools capable of enabling hyperscalability and hyperconnectivity and delivering an optimal user experience to their workers and customers. But most legacy security has failed to keep up. So to meet new business demands – where the bar is continuously being raised in terms of performance, scalability, and time to market – more and more of these organizations have had to turn off or dial down their corporate security.

Innovation is Essential for Customers and Partners

In stark contrast, Fortinet’s commitment to innovation – with more security patents than our next several competitors combined – has enabled us to continue delivering a level of security performance, functionality, and interoperability unmatched in the industry – even as the current situation has completely transformed most networks and users. 

It starts with the Fortinet Security Fabric platform, designed to deliver the following critical security differentiators in a single, integrated package.

Security-Driven Networking (SDN): 

The core idea behind Security-Driven Networking is that security and networking must be two sides of the same coin. That way, whenever the networking infrastructure evolves or expands, security not only automatically adapts as an integrated part of that environment, but can also leverage Fortinet’s SPUs to ensure accelerated performance across all network edges. 

Internal segmentation is a perfect example of the necessity for Security-Driven Networking. It combines internal network infrastructures with the Security Fabric platform to dynamically protect networks inside the perimeter from active threats through dynamic and intelligent segmentation. This not only enables organizations to see and separate all of the devices on their network but also dynamically create horizontal segmentation to support and secure applications and automated workflows that need to travel across the extended network.

Fortinet pioneered Secure SD-WAN, which is an excellent example of Security-Driven Networking. In SD-WAN environments, security is woven together with connectivity functions such as application steering, bandwidth management, and dynamic failover to ensure that when connections adjust to maintain quality of experience, security is an integrated part of that process. This integrated approach can then be extended to the SD-Branch by securing access points, switches, and even 5G connectivity.

The Performance Advantage of Fortinet’s Security Processing Unit (SPU) Innovation

Advanced security designed to protect the internal network, as well as the perimeter, requires a level of performance that other security vendors can’t provide. The truth is, software-based security offerings running on off-the-shelf CPUs will never be able to meet today’s advanced network performance requirements. It would be like trying to run a processor-intensive video game on a system without a GPU. Even a gaming system built using the fastest CPUs won’t be able to keep up.

We have spent years developing custom Security Processing Units (SPUs), such as our latest NP7 Network Processor, to enable organizations to deploy true, enterprise-class security in even their most demanding environments. The NP7 can inspect encrypted traffic about twenty times faster than devices that rely on off-the-shelf CPUs – and it delivers comparable performance acceleration across all critical security functions, including firewall, threat protection, connections per second, concurrent connections, and IPSec VPN. And our advanced Content Processors are designed to support the processor-intensive convergence of security and networking required by Security-Driven Networking – which is fundamental to protecting the next generation of highly dynamic networks. 

These SPUs not only provide customers with the fastest security and SD-WAN platforms in the industry and enable unprecedented levels of integration between security and networking environments, but they also lay the foundation for the successful securing of the next generation of advanced networks. This includes collaborative smart environments and ultra-fast, hyperconnected edge networks powered by 5G and beyond.

Zero-Trust Network Access: 

Rather than operating an open network where data access is driven by inherent trust, organizations need to start with the assumption that any device can, and may already have been compromised. As a result, every device and user that connects to the network, whether through edge access points or physical connections to the internal network, needs to be authenticated, inventoried, assessed, and then allocated the minimum amount of access privilege possible to still do its job. And more, security needs to be in place inside the network to monitor and enforce those policies by responding to policy violations and abnormal behavior at internal network speeds.

In today’s hyper-mobile world, users can work and connect from anywhere and anytime. Equally important, then, is deep visibility of users and devices, both on- and off-network. And to then leverage that visibility to make informed policy-driven decisions to minimize risks to the organization such as limiting access based on posture, or placing certain devices in a specific (VLAN) segment of the network.

Dynamic Cloud Security:

As organizations leverage multiple cloud environments, such as private cloud, public cloud, and SaaS, to build and deploy business applications, the importance of consistently securing this heterogeneous environment increases. Furthermore, by leveraging public IaaS and SaaS infrastructures, the attack surface has increased beyond the usual network and application attacks to other types of malicious behavior targeting the misuse and misconfiguration of the cloud infrastructure. 

Compounding the challenges associated with the use of a heterogeneous technology stack, and the complexity of implementing best-practice security across the network, applications, and cloud platform vectors, organizations are also challenged by the lack of skilled professionals.

Fortinet’s dynamic cloud security addresses the intersection of these challenges by enabling organizations to confidently deploy any application on any cloud while implementing the same security tools in every cloud environment for consistent policy enforcement and unified threat response. With the broadest set of security solutions natively integrated into the most cloud environments, with all offering streamlined management and automation capabilities across these environments, organizations can unleash digital innovation initiatives for each cloud, or across multiple clouds, without compromising security.

AI-driven Security Operations:

Even as the network paradigm has undergone a metamorphosis, the threat landscape has continued to accelerate – quickly taking advantage of an exponentially expanded (and in many cases, hastily implemented) digital attack surface. Most security vendors are just as far behind on platform integration – let alone developing and integrating AI technologies across that platform – as they are with the development of accelerated and hyperscale security. Coupled with the chronic shortfall of cybersecurity professionals, this lack of innovation can be devastating. 

Fortinet’s advances in AI-powered security – for advanced threat prevention, detection, and response – are ideally suited to meet the challenges of today’s security operations, whether deployed in our cutting-edge threat research labs or throughout our customers’ security operations. It underpins our ability to automatically analyze more than 100 billion security events from all around the world every day, which is then used to quickly generate global threat intelligence pushed out across our threat prevention portfolio. At the same time, it is also now being built directly into the solutions deployed by our customers to prevent and detect attacks specific to their organizations. And it is even utilized in many of our SOC platforms that automatically enrich, alert, and orchestrate a coordinated response across incidents anywhere across the digital attack surface.

Open Fabric Ecosystem:

None of this can happen in isolation, which is another of the dangerous gaps created by today’s security vendors. All of Fortinet’s security solutions – and we have the broadest portfolio of solutions in the industry – have been engineered to work together as a single, integrated system, which is something no other vendor can claim. 

In addition, Fortinet’s security platform leverages open standards and APIs to ensure deep and seamless integration with third-party solutions. Fortinet’s Fabric-Ready partner program, and affiliated vendors who leverage our open API environments, constitutes one of the most extensive security partnership programs in the industry.

And we couple this with extensive alliances with industry organizations such as the Cyber Threat Alliance (CTA). We maintain a permanent seat on the World Economic Forum’s Centre for Cybersecurity – where we are actively engaged in addressing the global cybersecurity skills gap. We deliver skills training through partnerships with over 200 academies, educational institutions, and non-profits located in over 60 countries. And we have active working partnerships with organizations such as Interpol and NATO to protect individuals, businesses, and governments.

The recent introduction of additional free cybersecurity courses further builds on Fortinet’s existing efforts to address the cyber skills gap through training and education. Fortinet established the Network Security Expert (NSE) Institute in 2015, comprised of the Fortinet Network Security Academy (FNSA) program, the Authorized Training Center program, the Fortinet Veterans (FortiVet) program and the NSE training and certification program which to date has issued more than 350,000 Network Security Expert certifications.  

Fortinet Leads the Market in Security Innovation 

The biggest challenge that the digital world faces is that the majority of the security industry is already years behind, and this is just the start. And as networking functions begin to converge even further, creating the next generation of smart environments – including cars, buildings, cities, and critical infrastructures – the lack of security tools capable of inspecting and protecting these hyperfast, hyperconnected, and hyperscalable environments stands to severely impact our digital economy – and our way of life.

Organizations can’t wait for security vendors to catch up so they can protect and defend the “networks of tomorrow.” Networks are being left exposed right now because the traditional security solutions they have in place are just not up to the task. Fortinet is the first security manufacturer to step up to the plate to meet the demands of these networks, and we urge other security vendors to join us in delivering the next generation of security performance and scalability necessary for securing the global digital economy.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Waste Management, Inc. Adopts Fortinet’s Secure SD-WAN All-in-One Solution

We recently spoke with Tim Stuart, Enterprise Voice and Network Director of Waste Management, to discuss how Waste Management was able to address their evolving business requirements by implementing Fortinet Secure SD-WAN. Stuart also shared best practices and lessons learned for deploying on such a large scale. 

Waste Management, Inc., the largest waste management and environmental services company in the US, provides services that range from collection and disposal to recycling and renewable energy generation. As their organization continued to expand, and they began to integrate digital innovation into their business processes, it was imperative to Waste Management that they could expand and contract network communications as needed. This was even more important as they needed to rapidly transition their workforce to remote work as a result of COVID-19.

By converting their router-based WAN infrastructure to Fortinet’s Secure SD-WAN solution, Waste Management was able to leverage the Fortinet Security Fabric to tie their security and networking elements together. They were also able to easily support their employee’s transition to telework with their existing Secure SD-WAN deployment.

Waste Management’s Objectives

Today’s branch offices have complex requirements that legacy routers, and even most SD-WAN solutions have simply not been designed to address. The goal of Waste Management was to reduce costs and centralize security management across their distributed organization, and they were looking for a high-performance security solution that would meet both their business and employee needs. They began by looking for a cybersecurity solution that could:

  • Reduce overall costs and operating expenses by migrating from static MPLS to multi-broadband.
  • Improve user experience and the performance of applications by prioritizing business-critical applications and enabling branches to directly communicate with the internet.
  • Increase visibility to reduce the time needed to remediate user-impacting issues.
  • Eliminate expensive 3rd-party services through a single interface, and unify the management of SD-WAN, including optimization and security.

Replacing Complexity with Improved Operations

In an attempt to gain full visibility, control, and decision-making capabilities through enhanced data correlation and integration between its various security elements, Waste Management had employed a WAN infrastructure that relied on routers and expensive MPLS circuits to connect their remote locations. This solution also included a variety of point products to provide both connectivity and security. 

However, not only did they not function as an integrated system, they had also introduced application performance and limited visibility challenges. And they still needed to rationalize their security product inventory and centralize security management to more efficiently and securely interconnect their recycling facilities, landfills, and transfer stations. 

“We were looking for something that we could go to improve that service so we started looking at the different industries and SD-WAN caught our attention and we started looking at what solutions were out there. We needed to get into modern speeds to be able to handle modern applications and a solution that would provide us the speed, security and ease of deployment and that’s what really drove us towards the Fortinet solution and got us to where we’re at today.” 

– Tim Stuart, Enterprise Voice and Network Director of Waste Management

After an internal analysis of different solutions, they found that the Fortinet Secure SD-WAN solution enabled them to meet all of their objectives. Its Security-Driven Networking approach, powered by the Fortinet Security Fabric, enabled them to combine their security and networking solutions into a single, integrated system. This enabled them to successfully manage all 1200 locations while reducing WAN costs, improving business application SLA, and simplifying overall management with best-of-breed security and performance. 

The addition of the Fortinet SD-Branch solution then enabled them to seamlessly extend that security functionality deep into each local branch network by combining Secure SD-WAN with LAN switching, wireless access, and LTE (3G/4G) extensions.

The Advantages of Secure SD-WAN and SD-Branch

Fortinet Secure SD-WAN delivers vastly improved application performance by routing traffic over the most efficient WAN connection. Since resource allocation and dynamic connectivity are automated, once basic connection, security, and minimum bandwidth policies are set, the process of maintaining and managing an adaptable software-defined network is now simple and easier than ever. This is a significant benefit for organizations, since they often have multiple locations and thousands of employees with limited security resources and must accomplish all network administration from a centralized location. 

As a result of implementing Fortinet’s Secure SD-WAN and SD-Branch solutions, Tim and his team had access to the powerful security tools included in the FortiGate NGFW security appliance – including firewall, IPS, antivirus, web filtering, and sandboxing – combined with a full suite of essential connectivity, bandwidth management, and application recognition tools. 

Because these tools and services are integrated into a single, holistic solution, Waste Management was able to ensure the reliable delivery of even their most latency-sensitive business applications. And in addition to immediately seeing a significant difference in their application performance, they also saw enhanced security, increased visibility, and simplified management ­– all while reducing their WAN overhead.

“We took the Fortinet solution because it has a centralized operation in zero-touch deployment that worked perfect and it was a very easy platform to troubleshoot on and it also had great visibility force, along with security in the price for the performance. I mean, that’s really why we drove it down. We were looking for price stability and speed of deployment because the telco vendor that we were dealing with did not meet our needs. If we needed to make a change within our network, Fortinet made it possible.”

– Tim Stuart, Enterprise Voice and Network Director of Waste Management

Business Impact

By selecting and deploying the Fortinet Secure SD-WAN and SD-Branch solutions, Waste Management immediately received the following benefits:

  • Reduced WAN costs by converting from expensive MPLS circuits to broadband connectivity and Direct Internet Access over the public network.
  • Improved application user experience through granular application identification and steering to ensure that business critical applications maintain optimal performance.
  • Enhanced protections by deploying Secure SD-WAN’s full stack of integrated security solutions at every location. 
  • Scalable and simplified management through integrated SD-WAN optimization, branch access, and switching functionality, all seamlessly integrated with comprehensive security capabilities.
  • Increased visibility due to Secure SD-WAN’s ability to integrate connectivity, traffic management, access control, and security into a single, centralized administration platform.

“It was important to find a device that fit all of our needs, not only our network but also security and that’s what drove us to Fortinet, not to mention the 20 million dollars a year that we saved in doing.”

– Tim Stuart, Enterprise Voice and Network Director of Waste Management

Hear the full discussion and learn how Waste Management transformed their network to reduce cost by 65% and improve the application experience.

Take a security-driven approach to networking to improve user experience and simplify operations at the WAN edge with Fortinet’s Secure SD-WAN solution.

Read these customer case studies to see how De Heus and Burger King Brazil implemented Fortinet’s Secure SD-WAN to alleviate network complexity, increase bandwidth, and reduce security costs.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Accelerate Security Operations with SOAR Across the Security Fabric

In 2019 alone, over $124 billion was spent on cybersecurity. In spite of this, however, many security teams are still struggling to keep up. Their challenges include having too many consoles to monitor, alert overload, a reliance on manual processes, and a shortage of cybersecurity personnel.

Fortunately, there are a number of technologies designed specifically to address these issues. The question is, which SOC tools are right for your organization? The SOC Automation framework is designed to help security teams simply identify their current maturity level based upon their existing investment in people, processes, and products. From there, an organization can identify the tools appropriate for their organization, as well as define the steps required to advance to the next level.

Fortinet solutions, such as FortiAnalyzer (Security Fabric analytics and automation), FortiSIEM (security incident and event management), and FortiSOAR (security orchestration, automation and response), provide solutions for organizations along with every phase of the SOC Automation framework. Each solution leverages security automation to address the key challenges faced by security architects at their level of SOC Automation. And the Security Fabric links all of these solutions together, enabling lean security teams to maximize their ability to protect their enterprise.

Leveraging the Power of FortiSOAR

SOAR represents a new level of integrated incident response management designed for today’s larger, distributed, and highly dynamic and scalable networks. FortiSOAR is an ideal solution for enterprises and service providers seeking to simplify their operations while maximizing the efficiency of their security operations centers (SOCs). 

It does this by consolidating and triaging alerts from a wide range of security products, automating threat analysis and repetitive tasks to save valuable resources. This includes interoperating with a wide array of solutions and technologies, and then leveraging well-defined playbooks to automate a real-time response to security events without human intervention to streamline SOC operations. 

With over 300 connectors, FortiSOAR easily integrates with all major security vendors and technologies for a single, centralized point of visibility and control, and granular, role-based access control to secure user-related data. And its more than 200 out-of-the-box, easy-to-configure playbooks, including the most advanced case management modules in the industry enhanced with incident timelines and asset correlation views, enable the automation of incident response action sequences as well as routine tasks. 

FortiSOAR is able to address all three of the most important SOAR capabilities identified by Gartner:

Security incident response that spans the entire response process, from planning and management to the tracking and coordinating of responses to a security incident.

Threat and vulnerability management to enable the remediation of vulnerabilities through formalized workflow, reporting, and collaboration capabilities.

Security operations automation to enable the orchestration of workflows, processes, policy execution, and reporting.

Digital Innovation Requires Automated Security Solutions

Moving aggressively into today’s digital marketplace is essential for organizations looking to compete in the new digital economy. But new business models and digital resources expand the attack surface and can quickly overwhelm security teams struggling to see and manage the expanded network through the lenses of multiple security consoles. 

Digital innovation should not come at the expense of security. Simplifying security deployment requires a Security Fabric – supported by the use of SIEM technologies to aggregate security threat intelligence, and the deployment of a SOAR solution to provide deep analysis, broad visibility, and automated response to threats. And the addition of advanced AI analysis across the distributed Security Fabric further ensures visibility, detection, orchestration, and automated response to cyber events that occur anywhere across the expanding enterprise.

Find out how FortiSOAR enables SOC teams to accelerate incident response, unify operations,  and eliminate alert fatigue.

Discover how this managed care provider and this consumer financial pioneer leveraged FortiSOAR to streamline SOC operations.

Engage in the Fortinet Security Orchestration, Automation and Response (SOAR) user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Automate Network Management to Accelerate Digital Transformation

Over the last 12-18 months, I have talked to hundreds of customers across segments and industries. The two most common themes coming out of these conversations are, first that networks are getting more complex with time, and second, that automation is a strategic topic of interest regardless of the digital transformation project they have in place.

One of the most critical challenges of these increasingly complex and naturally fragmented infrastructures is how to implement an effective security strategy. Distributed and dynamically evolving networks can be a prime breeding ground for cyber risks, leading to frequent network outages. Contributing to this challenge is the fact that network operations teams rarely have clear and consistent insight into what controls and configurations have been setup across the infrastructure, and more importantly, a lack of comprehensive visibility across the network to identify anomalies. This limited visibility and control is the result of having deployed too many independent point products across the various segments of the network. 

The Need for Network Infrastructure Automation

The events of the past several weeks, driven by the need to adapt to the COVID-19 pandemic, have accelerated digital transformation for many organizations even faster and further. The need to support remote workers by inverting the traditional networking model, where the majority of workers have now been moved outside of the network, has accelerated the need for network operations teams to adopt agile network strategies supported by infrastructure automation.

In fact, a recent Gartner report on “Cool Vendors in Enterprise Networking” had some good data points around agile network infrastructures:

  1. Digital business requires agile networks, but 70% of enterprise networking activities are performed manually. This creates “human middleware” that limits networking scalability and agility, and increases the likelihood for errors. 
  2. The percentage of network activities that will be automated will rise from 30% in early 2020 to 50% by 2023. 
  3. The percentage of enterprises that do pre-verification of configurations will increase to 10% by 2023, which is an increase from fewer than 1% in early 2020. 

These data points help explain why 75% of network outages and performance issues are the result of misconfiguration errors.

In this regard, a network security strategy that prioritizes network automation can help reduce one of the leading causes of cyber risk and downtime—human error and misconfigurations. An integrated network security architecture enhanced with network automation capabilities can easily eliminate the complexity challenge for network operators. 

The Fortinet Fabric Management Center 

Fortinet’s Fabric Management Center combines FortiManager and FortiAnalyzer for effective network operations, making agile network management a reality for Fortinet customers across NGFW, SD-WAN, and IPS, as well as other projects for the organization. This combined solution enables three key use cases:

  • Centralized Management
  • Network Automation  
  • Security Fabric Analytics

1. Centralized Management  

When it comes to network security, disparate products typically cannot share threat intelligence or coordinate responses across an organizational infrastructure. This critical cybersecurity shortcoming is often compounded by a lack of skilled security personnel who are able to manage a wide assortment of disconnected point products. But even large organizations with dedicated IT security staff still have difficulty monitoring the network to keep track of which devices are connected, who has access to the network, and which resources are needed by applications and workflows. 

Elevating the Total Value of Network Automation Across the Enterprise

Fortinet’s Fabric Management Center enables enterprise-class automation capabilities while helping network leaders actualize industry-leading benefits, including:

Improved Efficiency. With its single-pane view, FortiManager helps enterprises simplify the oversight of their security infrastructure and automate responses to potential problems.

Reduced Risk. Fortinet’s tracking and reporting features help organizations ensure compliance with privacy laws, security standards, and industry regulations, all while reducing risks associated with fines and legal costs in the event of a breach. FortiAnalyzer tracks real-time threat activity, facilitates risk assessment, detects potential issues, and helps mitigate problems. 

Decreased TCO. As part of Fortinet’s Security Fabric architecture, the Fabric Management Center helps lower TCO by consolidating disparate security management functions. Its FortiAnalyzer component delivers the advantages of advanced analytics and automation capabilities without having to add-on expensive, third-party point solutions. 

Combined, Fortinet’s Fabric Management Center leverages orchestration and automation to increase visibility across complex, hybrid network environments, identify and alert on anomalous behavior, and ensures granular control to reduce network disruption and downtime, whether they are due to human error or malicious behavior. 

Learn more about how Fortinet’s Fabric Management Center enables enterprise-class automation capabilities while helping network leaders realize industry-leading benefits like improved efficiency, reduced risk, and decreased TCO. 

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

What is the Average Cost of a Data Breach? Highlights from Fortinet’s Executive Cyber Exchange Series

The global six-year average cost of a data breach is $3.78 million. To address this liability head-on, organizations must incorporate industry and security best practices into their cybersecurity posture to reduce the cost of what most cybersecurity professionals recognize as an inevitable data breach. 

FortiGuard Labs’ Chief of Security Insights & Global Threat Alliances, Derek Manky, recently teamed up with Dr. Larry Ponemon of the Ponemon Institute for Fortinet’s Executive Cyber Exchange: The Perspective Series. This presentation, titled “The Economics of Data Breaches & Cybersecurity Exploits” centered on the economic impact of data breaches and cyberattacks, while also noting the investments that organizations should make to minimize the financial burden of such an event. 

Below are some of the key takeaways from Ponemon and Manky that explain why organizations should shift from a detection-based focus to one that is centered on breach prevention to save on the resources, costs, damages, time, and loss of reputation that occurs following a successful attack.

What Factors Contribute to the Cost of a Data Breach?

Benchmark research conducted by the Ponemon Institute concluded that, the global six-year average, cost of a data breach amounts to $3.78 million. However, the financial consequences of a data breach can vary based on several factors, including root causes, network size, and the type of data held by an organization. 

Overall, malicious attacks were found to be the leading root cause of data breaches, followed by human error and system glitches. Loss of business was determined to be the most significant cost contributor resulting from business disruption, system downtime, customer turnover, and reputational damage that inevitably result in revenue losses. Additionally, cost amplifiers like cloud migration, IT complexity, and third-party breaches were found to add close to $370,000 to the total cost of a breach. 

So, what can organizations do to address these security challenges? Derek Manky highlighted the importance of incident response and automated threat intelligence, explaining how his team leverages these concepts to lessen the impact of data breaches:

“At FortiGuard Labs, we are essentially an external SOC for customers in the sense that we’re creating definition updates, antivirus updates, and actionable intelligence. We’ve seen considerable cost benefits stemming from machine learning models, particularly with application vulnerabilities with actionable intelligence on malware. We have one system on the backend that analyzes malware and when it can properly identify that something is malicious, it creates actionable updates that are then pushed out to our Security Fabric and our customers. That system is effectively doing the output job of a team of several analysts. Therefore, organizations can realize a considerable cost benefit by implementing machine learning within their incident response plans.” 

On the other hand, cybercriminals are also leveraging automation and machine learning to increase the speed and efficiency of attacks. Manky notes: 

“Cyber adversaries are weaponizing AI and leveraging swarm technology as a catalyst to speed the attack cycle up even further. The use of offensive automation results in decreased latency for attackers, or a reduced time to breach (TTB), thereby increasing their rate of success. Security teams need to account for the fact that attacks are happening at a much quicker pace and adjust their defensive strategies accordingly. This requires advanced automation technology.” 

The Cybersecurity Lifecycle and the Importance of Prevention 

There are five phases of the cybersecurity lifecycle, ranging from prevention to remediation, that should be part of every organization’s security strategy. Each stage is crucial to reducing the impact of a breach through threat identification, incident response, and resolution. 

  • Prevention is the effort to stop malicious threats from infiltrating the network and to classify the types of attacks that are targeting the organization in real-time. In this phase of the lifecycle, organizations can stop attacks before any process can run on the network. 
  • Detection is the effort to recognize and identify threats within an organization’s IT security infrastructure that have managed to bypass prevention efforts. During this phase, organizations need to be able to identify malicious processes that are running on a device in the network.
  • Containment refers to the effort to stop the spread of a cyber threat once it has been detected and identified on the network.  
  • Recovery occurs following threat containment. In this phase of the cybersecurity lifecycle, security teams work to restore the IT infrastructure to its previous, stable state.
  • Remediation refers to the effort made to ensure that processes and technologies are updated to mitigate future cyber events. This includes updating training and awareness programs when individuals played a role in enabling a breach to occur.

Most organizations tend to focus the majority of their cybersecurity efforts on the detection of cyberattacks because they perceive prevention as too complicated to achieve. In fact, 76% of respondents to a Ponemon survey agree or strongly agree that prevention would be too challenging to accomplish within their cybersecurity program. When asked about their reasoning, respondents noted issues around attack identification, deploying effective technologies, their own in-house cybersecurity experience, and the challenge of false-positive cyber threats. 

Although preventing a cyberattack is challenging, Dr. Larry Ponemon explained that organizations can realize significant cost savings when an attack is thwarted during this phase of the cybersecurity lifecycle. He detailed such cost savings with the following example: 

“Fending off phishing attacks costs an average of $832,500. But 82% of that cost is spent during the detection, containment, recovery, and remediation phases, and only 18% is spent during prevention. So, if an attack is prevented, total cost savings would be $682,650.” 

Security Operations Centers and Cost Efficiency 

According to findings from the Ponemon study, most organizations believe their security operations centers (SOCs) are a crucial element of their security strategies. When asked to rank the importance of SOC activities, respondents reported that most of their SOC value comes from the minimization of false-positive detections, the enhanced reporting of threat intelligence, the monitoring and analysis of alerts, and improved intrusion detection. However, close to half of all respondents also reported dissatisfaction with their SOC’s overall ability to detect attacks. 

Additionally, after investigating the economics of security operations centers, researchers found that outsourcing SOC services does not improve cost efficiency. On average, organizations spend $2.86 million per year on their in-house SOC – but this cost increases to $4.44 million when outsourcing SOC functions to a managed security service provider (MSSP). 

However, those numbers depend on having the right SOC resources in-house. Three-quarters of organizations rated the management of a SOC environment as challenging. At the same time, only half of those organizations found they were able to hire the right talent to manage their SOC. Which may also be why only half of those organizations felt that their SOC environment was effective. The crucial takeaway is that cost is only part of the equation in establishing an effective SOC environment. Organizations need to focus on assembling the best possible SOC team.

AI Improves Incident Response and Lowers Costs 

Considering the high success rate of data breaches, Manky highlighted the critical role of incident response and automation in reducing data breach costs. He emphasized that Artificial intelligence (AI) is an essential tool that can help SOC teams overcome the challenges associated with breach mitigation and incident response. 

Most organizations report success with AI implementation, seeing increases in the speed of threat analysis, acceleration in threat containment through the automatic separation of infected endpoint devices or hosts, and improved identification of security vulnerabilities. By realizing these benefits, organizations can leverage AI to reduce the time and cost of incident response. Dr. Larry Ponemon further explained:  

“When AI is used to contain cyber exploits, the time and cost are significantly reduced. The average cost of not using AI to address cyber exploits is more than $3 million, versus $814,873 if AI is used. Thus, a company can potentially save an average of more than $2.5 million in operating costs.” 

Final Thoughts

Top CISOs and experts in the security field warn that data breaches are inevitable. With breach costs reaching close to $4 million, organizations must be fully prepared to prevent or deal with the fall out associated with a successful attack. For this reason, organizations should focus their efforts on developing a security framework that highlights prevention and incident response while also leveraging AI capabilities to decrease the economic impact of a breach.

Learn how FortiGuard Labs provides unmatched security and intelligence services using integrated AI systems.

Find out about the FortiGuard Security Services portfolio and sign up for our weekly FortiGuard Threat Brief.

Discover how the FortiGuard Security Rating Service provides security audits and best practices to guide customers in designing, implementing, and maintaining the security posture best suited for their organization.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Fortinet Addresses Customers’ Network and Application Security Needs with a Dynamic Cloud Solution

As organizations deploy workloads and critical resources in the cloud, they must ensure they’re also properly securing data, applications, and other digital resources that are getting migrated. With the threat landscape continuing to evolve, organizations need to create a security framework as part of their cloud strategy so that digital innovations don’t result in cyber threats and increased business risks.

Protecting the cloud requires going beyond the traditional security model. With secure access to cloud resources available from anywhere, organizations should now have the confidence to deploy any application on any cloud infrastructure with ease. Fortinet’s Dynamic Cloud Security offerings are helping customers reap the benefits of cloud adoption while providing the necessary visibility and control across cloud environments. In this blog, we look at three customers who have deployed the Fortinet Security Fabric’s cloud offerings to secure their cloud environments and critical business applications. 

Large Retirement Funds Manager 

Since its inception, one of Mexico’s largest retirement funds manager has aimed to provide their customers with a bright and secure future managing individual accounts and helping ensure they can retire at ease. Serving thousands of customers and with years of sensitive customer information, the company needed comprehensive security to protect its web application servers, through which it grosses 90% of the organization’s revenue. 

After a WAF architecture evaluation that included Fortinet alongside several other vendors, the company chose Fortinet’s solution to protect their web applications, including IP reputation, DDoS protection, protocol validation, application attack signatures, bot mitigation, and machine learning capabilities. Having a hybrid environment, consisting of cloud and on-premise workloads, the company took a comprehensive approach to defend its core business applications that power critical information and services and ensure constant communication with customers.

In addition to the comprehensive WAF architecture, Fortinet identified additional pain points for this large retirement funds manager that required key security components that Fortinet was able to uniquely address by providing complete cybersecurity protection, including next-generation firewall protection that also provides internal segmentation and company-wide VPN service. By implementing Fortinet solutions, and specifically leveraging FortiWeb WAF, this customer has been able to decrease its customer attrition rate, increase application performance without compromising security, and reduce complexity and TCO by enabling and implementing diverse network and security options.

Private Pharmaceutical Company

A major Italian pharmaceutical company was looking to better secure its critical business information and sensitive data. They were looking for both security and simplification, enabling a holistic security solution that would allow them to expand into other countries while managing more for less.

Not only were they looking to ensure workflows and applications could securely travel across and between different clouds, data centers, and devices to accomplish their tasks, but they also needed their security to scale. The organization was also looking to secure their entire network in order to move to the Office365 cloud solution. Additionally, they needed to optimize WAN links between HQ and their four main sites. 

With Fortinet’s Security Fabric offerings, this major pharmaceutical company was able to accomplish all this and more. Deploying Fortinet’s cloud solutions, the organization was able to implement advanced security and simplification with a lower TCO compared to other competitors. Using Fortinet’s Secure SD-WAN, this customer has been able to accelerate connectivity to Software-as-a-Service (SaaS) applications as well as applications located in major public cloud providers globally.

A Leader in Real Estate 

As a top leader in its sector, a real estate service provider in France focuses on delivering a high-quality experience across multiple sites to their customers. The organization caters to student housing, retirement facilities, and hotel residences, working with thousands of customers year-round. In order to remain competitive in the industry, they were looking to implement a solution that would modernize and protect them as they migrated workloads to the public cloud. 

By deploying Fortinet’s Security Fabric offerings, they were able to securely migrate several core web applications to Azure Cloud. Additionally, the organization wanted to have full visibility across their network as well as leverage a Secure SD-WAN solution that was scalable and independent from telco operators. Using Fortinet’s FortiWeb WAF and FortiCWP, the organization was able to reuse their data center 1200D as a hub, thereby reducing costs, and were also able to establish extensive visibility across their environments. This leading French real estate service provider also deployed Fortinet’s FortiGate NGFW for its Secure SD-WAN capabilities, which has allowed the organization to digitalize remote locations and securely connect their branches to the cloud. 

Securing Environments with Fortinet’s Dynamic Cloud Security 

It’s necessary to develop a unified technology approach across all computing environments to optimally secure business operations. With the right deployment, organizations can secure their networks, including any application on any cloud infrastructure. Similar to the three customers mentioned above, any organization can take advantage of impressive performance and cost savings, while ensuring their data is protected, through the adoption of Fortinet’s Dynamic Cloud Security offerings.

Learn how Fortinet’s dynamic cloud security solutions provide increased visibility and control across cloud infrastructures, enabling secure applications and connectivity from data center to cloud.

Read these customer case studies to see how Cuebiq and Steelcase implemented Fortinet’s dynamic cloud security solutions for secure connectivity from data center to the cloud.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Expect More from Your Network Firewall: The FortiGate 4200F

Digital Innovation Has Transformed the Way We Live

The rapid rise of both e-commerce and online gaming expresses society’s firm reliance on the power of the internet and what services they expect it to deliver. The proof, as reported by the US Department of Commerce, is that e-commerce increased from $461B in 2017 to $602B in 2020 – a 31% increase.

New trends like 5G will transform what’s possible even further by enabling a world of hyperconnectivity between users-users, users-machines, and machine-machines that require hyper speed and hyperscale.

Because of the speed at which user traffic is growing – propelled by the rate at which applications, workflows, and transactions need to take place – many organizations have had to adopt a hyperscale data center. And a growing number of these high-performance networks are built using advanced routing and switching infrastructures. 

As a result, traditional security solutions are being discarded because they cannot provide adequate protection due to inherent performance limitations that lead to workflow bottlenecks and poor user experience. In many instances, security has been deprioritized in favor of preserving user experience because security devices would meltdown when they were used to secure user consumption of online services. Instead, a growing number of organizations have had to replace their enterprise-grade security with VLANs and Layer 4 access controls lists to protect their high-performance environments.

It’s a terrible tradeoff.

From a security perspective, this can be disastrous. These alternatives do little to prevent attackers from impersonating themselves as legitimate users, establishing a beachhead, and then moving laterally across the network to gain access to credentials, applications, and data. Using a completely different attack method, nefarious actors could also send volumes of requests to overwhelm a website. This could bring down e-commerce sites or online services, resulting in the loss of revenue, bad press, and in worst cases, shut an organization’s doors – permanently.

Organizations should never have to make the impossible choice between performance and protection.

Disruptions Can Result in a Detour, but the Journey to Dgital Innovation Continues

While organizations were mulling over the tradeoff of providing high-speed online services to grow their business while reducing the uncertainties of not having high-performance security controls in place, a more certain calamity hit us – the onset of the COVID19 pandemic. Those same organizations had to pivot their resources to quickly provision a suddenly massive remote workforce with encryption-based VPN technologies. Business continuity and disaster recovery plans were initiated to keep workers productive and maintain morale during a time of uncertainty.

However, far too many organizations quickly found that their firewalls – built using off-the-shelf hardware – did not provide enough scalability and performance headroom to inspect and secure the large number of remote connections that had come online. Even after paying high VPN upgrade license fees to scale connectivity, they still had to install new firewalls to deal with escalating scale and performance needs. And as a result, two of their prevailing concerns about cost and complexity just got exacerbated. 

But a Time of Crisis Can Also Become of a Time of Opportunity 

The outgrowth of this sudden transformation of networks around the world is that users are now able to more effectively collaborate – between themselves, with customers, and with partners – in ways unfathomable before. Using rich streaming media enables organizations to deliver content and collaboration and training while preserving the user experience. This is now the new normal.

But capitalizing on this opportunity requires building ultra-high-performance networks capable of handling the needs of both external and internal users equally well. But these same networks create security challenges that require an approach that traditional, off-the-shelf hardware-based firewalls cannot address.

Build Ultra-Fast Security-Driven Networks with FortiGate 4200F

The power to provide the security that today’s networks require is only possible by using purpose-built hardware. Fortinet’s latest NP7 network processor ­- enables astronomical performance and unparalleled capacity, all delivered in the industry’s most cost-effective FortiGate 4200F security platform. 

As an integral part of the Fortinet Security Fabric, the FortiGate 4200F has been specifically engineered to deliver the scalability and performance required for the networks of today and tomorrow by enabling an innovative, security-driven network approach that seamlessly integrates networking with security. And it provides the highest Security Compute Ratings in the industry to meet the extraordinary demands of today’s data center security demands.

The hardware acceleration of FortiGate 4200F is made possible through Fortinet’s seventh-generation network processor, the NP7, that delivers Security Compute Ratings 5 to 15 times higher than any other security solution in the market. For example, it offers 15X the industry’s average with more than 8M sessions per second. 

The FortiGate 4200F also delivers the highest speed, scale, and performance for large enterprises and MSSPs, allowing mobile operators to provide security capable of protecting the hyperconnected world. It offers 400M of normal or carrier-grade NAT user connection scalability – providing the highest Security Compute Rating of 14x above the industry average. 

By delivering the industry’s highest performance, it securely enables the most demanding digital innovation as well as meets the vast capacity and performance demands of critical business operations, both now as well as a future-proof investment against future calamities. 

Essential FortiGate 4200F Use Cases

  • Financial services organizations building massively scalable remote access: In this ever-changing world, financial services organizations need to enable a remote workforce to come online expeditiously and conduct sensitive transactions that rely on microsecond responses – speed translates to productivity. The FortiGate 4200F offers the industry’s highest security compute rating of 10x for IPsec-encrypted performance, allowing organizations to maintain business continuity while sustaining ongoing operations.  
  • Large manufacturing and energy companies managing internal security risks: Addressing the growing attack surface, especially in today’s dynamic networked environments, is essential for protecting critical applications running across sensitive infrastructures. Providing trusted application access and maintaining compliance requires these organizations to segment their networks at scale. With a Security Compute Rating of 5x for SSL inspection (including TLS 1.3), FortiGate 4200F delivers the industry’s best price/performance.
  • High-velocity e-retail and e-commerce providers handling event-based connection bursts: Managing previously unseen capacity requirements and support for up to tens of millions of user connections per second is mandatory for today’s virtual business environments. With a Security Compute Rating of 14x for connections per second, the FortiGate 4200F provides high-performance security to handle escalating business needs without compromising user experience. With a further Security Compute Rating of 8x for firewall functionality, FortiGate 4200F delivers essential protection for a wide variety of online businesses.
  • Advanced pharmaceutical research, oil and gas, and government organizations that require support for elephant flows. Today’s data centers need to securely transfer massive datasets (e.g., 1 TB files) for activities such as AI/ML simulations used within cutting-edge research. The FortiGate 4200F allows the rapid transfer of large datasets by supporting multiple 100Gbps elephant flows so that organizations don’t have to choose between performance and protection. 
  • Cloud providers and large enterprises that must segment massively scalable virtual networks: Typical security products that use software-based Virtual Extension LAN (VXLAN) solutions have low performance and high latency, which increases time to service. FortiGate 4200F offers hardware-accelerated VXLAN to enable secure and super-fast communication without impacting performance.

Continue on Your Path of Digital Innovation Without Compromise with the FortiGate 4200F

With its unmatched scale, performance, acceleration, internal segmentation capabilities, speed, and agility, NP7-powered FortiGate 4200F NGFWs provide large organizations with the ability to develop and segment services, manage internal and external risks, secure large-volume transactions, and preserve user experience. Fortinet’s NP7 will also power future FortiGate appliances to enable agile, high-performance security for hyperscale data centers and other environments where hyperscale, hyperconnectivity, and hyperperformance are table stakes. 

Read more about how the FortiGate 4200F enables ultra-fast network firewalling, accelerated internal segmentation, and massively scalable teleworker solutions.

Find out how Echoenergia and New Zealand Red Cross used Fortinet’s Security Fabric for protection from the network edge to core.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Why Cybersecurity Training Is More Important Than Ever

With the global shortage of cybersecurity professionals having surpassed 4 million – according to a study conducted by (ISC)2 – the global cybersecurity workforce must now grow at a staggering rate of 145% each year just to meet the growing demand for skilled talent. As a result, 82% of employers claim to be dealing with a lack of experienced cybersecurity professionals within their organization. 

The cybersecurity skills gap has become an even more critical issue for many organizations transitioning to a remote workforce model. IT teams are stretched as they rapidly secure and scale their network to meet new demands. 

To help IT professionals looking to expand these timely security skills, Fortinet has made its entire catalog of advanced security courses available for free as part of our continued investment in closing the cybersecurity skills gap. Since the launch of this free training initiative on April 28, we have seen more than 80,000 course registrations from people in 144 countries. This is a compelling indication of the need and desire for training as the threat landscape continues to evolve. 

Free Cybersecurity Training to Narrow the Skills Gap

The recent introduction of additional free cybersecurity courses further builds on Fortinet’s existing efforts to address the cyber skills gap through training and education. Fortinet established the Network Security Expert (NSE) Institute in 2015, comprised of the Fortinet Network Security Academy (FNSA) program, the Authorized Training Center program, the Fortinet Veterans (FortiVet) program and the NSE training and certification program which to date has issued more than 350,000 Network Security Expert certifications. In addition, the Fortinet NSE training and certification program was named “Professional Certification Program of the Year” by the 2019 CyberSecurity Breakthrough Awards. Together the programs of the NSE Institute are well positioned to help build and augment skill sets, as well as help develop the next generation of security professionals, especially given the current times. 

Our latest training initiative opens up 24 self-paced advanced security courses for free to anyone interested in learning about cybersecurity.  For those interested in pursuing certification, you will be pleased to know that the majority of the free training content comes directly from the NSE training and certification program. NSE certification is a great way for companies to validate skills and a great addition to a resume for students pursuing a career in cyber security.

These 24 additional advanced courses join our three existing no-cost courses comprised of NSE 1 and NSE 2 lessons focused on overall cybersecurity awareness and the FortiGate Essentials course recently released. NSE 1 and NSE 2 lessons provide participants with a basic understanding of today’s threat landscape, including common tricks and strategies used by cybercriminals, a familiarity with essential cybersecurity concepts, and an introduction to critical security principles and technologies. The FortiGate Essentials course teaches participants about the fundamental concepts of a next generation firewall (NGFW) including configuring firewall policies, establishing user authentication, and setting up routing and SSL VPNs.

Training for Students, Veterans and Nonprofits

NSE Institute’s training and certification program is also leveraged by the FNSA and FortiVet programs in an efforts to train students, veterans, veteran spouses and nonprofit constituents looking into a cybersecurity career. Through the FNSA program, academic institutions and nonprofits receive access to Fortinet’s NSE training and certification curricula to prepare students and participants for a career in cybersecurity. Fortinet has more than 250 academic partnerships in more than 70 different countries as part of the FNSA program. 

As part of the FNSA and FortiVet programs, Fortinet collaborates with nonprofit organizations focused on helping Veterans and their spouses enter the workforce. Nonprofits joining the FNSA program are able to provide their constituents with access to Fortinet’s NSE certifications and training, while the FortiVet program helps Veterans transfer relevant experiences to a career in cybersecurity. 

Boldly Tackling the Skills Gap Challenges

With an evolving and expanding remote workforce, more people are connecting from home networks for internet access, gaming, entertainment, education and training, and more. It has become abundantly clear that we are only as secure as the most vulnerable device or user in our networks and cyber criminals are taking advantage of this by directly targeting remote users and teleworker environments. As the skills gap grows and the threat landscape becomes more complex, it is up to businesses like Fortinet to step up to the plate and help organizations address these challenges. Ultimately, Fortinet’s NSE Institute programs and overall skills gap initiatives, like our free training courses, is helping everyone better protect themselves or their organizations against threats across the globe. 

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Fortinet Enables Leading Precision Machining Company to Quickly Adapt to COVID-19

For many companies, the COVID-19 pandemic has demonstrated serious shortcomings in their business continuity plans and challenged their ability to maintain operations during a crisis. This was not the case for Master Automatic, a leader in the precision machining industry with over 75 years of experience. 

Over the last twelve years, the company has experienced explosive growth resulting in the doubling of its operations. Although the company had an existing security deployment in place, it was designed for a much smaller organization. On the advice of its partner, Folco Communications Corporation, and after a highly competitive request for proposal (RFP) process, Master Automatic decided that Fortinet’s solutions best suited its security needs.

This upgrade, completed just two months before the COVID-19 pandemic, could not have come at a better time. The company was able to seamlessly transition to remote work, and as a result, has grown more competitive.

The Need for an Integrated Security Solution

With its rapid growth, Master Automatic is now a business with 250 associates and three sites. However, the company’s entire IT infrastructure is monitored, maintained, and secured by one person. Finding and deploying a solution that could both scale to meet business growth demands while keeping management overhead to an absolute minimum was a significant challenge.

Bill Wilson, IT Project Manager at Master Automatic, needed a security platform that would enable him to single-handedly manage and secure the company’s entire infrastructure. He also wanted one vendor capable of meeting all of the organization’s security needs. “When I need support, I want a single phone number to call,” said Wilson.

For Wilson, the Fortinet Security Fabric was a major factor in his decision to choose Fortinet. With single-pane-of-glass visibility, he was able to monitor and manage his entire network from a single console. Additionally, Wilson is now able to leverage Fortinet’s integrated machine learning (ML) and security orchestration, automation, and response (SOAR) capabilities to automate processes that would require a much larger team to manage manually.

A Painless Transition to Telework

The decision to transition to Fortinet solutions could not have come at a better time for Master Automatic. “We could never imagine how well this decision would serve us during these unprecedented times,” says Wilson. Two months after the solution was fully installed and in place, the COVID-19 pandemic forced the company to rapidly transition to a remote workforce.

The company did not have a telework policy in place, and was concerned about their ability to support a large remote workforce. However, when management asked how they would handle the transition, Wilson was unfazed. “I was able to say, ‘All is well. We are ready for this,’” he recalls. “I was in such a strong position to say we are not going to miss a beat, and we did not.”

Wilson’s preparation for the switch to telework mainly consisted of a series of emails. In one email to his Fortinet support team, he asked how much it would cost to support 150-200 simultaneous virtual private network (VPN) connections for employees working from home. He was pleasantly surprised to learn that his existing FortiGate next-generation firewalls (NGFWs) were capable of managing up to 500 simultaneous connections without any additional costs. “With Fortinet and the partner [Folco], there was a whole team available. They just made it happen.” says Wilson.

Configuring the company VPN only required a few lines of code on Master Automatic’s Enterprise Management Service (EMS). This code added a VPN button to the FortiClient, and configured it with the proper IP addresses. When this was complete, Wilson sent his second email, telling homebound employees how to install FortiClient and use the new button to connect securely to the company network.

As a result, Master Automatic was able to fully support their remote workforce. And because FortiGate and FortiClient also seamlessly integrate with the company’s local directory access protocol (LDAP) server, remote users are able to use their existing credentials to access the network. Additionally, FortiClient supports all operating systems, enabling employees to work remotely from Windows, Mac, Linux, or tablet computers.

VPN connections are computationally intensive, and the addition of full traffic decryption and inspection can slow throughput on most firewalls, significantly impacting application response times. Fortinet’s hardware-based VPN acceleration minimizes that latency, which is vital when the number of inbound VPN connections and the volume of encrypted traffic surges due to a sudden increase in remote workers. According to Wilson, though the entire front-office staff now connect to the network over VPNs, the performance impact has been negligible. He adds, “One month into the shelter-in-place order, Fortinet products have kept us working in constant communication and have proven that ‘all is well; we can do this.’ We have experienced zero downtime as a result.”

An Opportunity for Company Growth

While Master Automatic did not anticipate the need to ever move to a fully remote workforce, their existing security investment made the transition quick and painless.

In fact, the lessons learned from the COVID-19 pandemic have also enabled Master Automatic to grow as a company. The unexpected shift to telework has enabled employees to grow more familiar and comfortable with online collaboration tools and with working securely from off-site locations. These new skills make the company more competitive and will open up new opportunities when business-as-usual resumes. “The company is talking about using the technologies that Fortinet provides for us to expand on our efficiency, and it will help us grow as a company to expand in the marketplace.” 

Discover how Fortinet Teleworker Solutions enable secure remote access at scale to support employees with a wide array of access requirements.

Find out how Fortinet’s Security Fabric delivers broad, integrated, and automated protection across an organization’s entire digital attack surface from IoT to the edge, network core and to multi-clouds.

Find out how Echoenergia and New Zealand Red Cross used Fortinet’s Security Fabric for protection from the network edge to core.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online

Fortinet’s Scalable and Secure Teleworker Solution in AWS

As organizations adopt a comprehensive teleworking policy, creating a reliable, scalable, and secure connectivity solution for their expanded remote workforce has become extremely important. Many organizations have already migrated some or all of their workloads and applications to Amazon Web Services (AWS) to take advantage of the elasticity, reliability and scalability of the public cloud. As a result, customers demand a solution that not only integrates with AWS native services, but also enables their remote workforce to connect to enterprise applications deployed in hybrid cloud environments in an agile and reliable manner.

Fortinet Next Generation Firewall (NGFW) Virtual Appliance is available in the AWS Marketplace. The FortiGate NGFW supports various Amazon EC2 (Elastic Compute Cloud) instance types and configurations to offer customers scalable SSL VPN and IPSec capabilities. This allows hundreds of users to concurrently and securely connect to applications deployed in their AWS accounts via an encrypted connection (like IPSec or SSL). Additionally, FortiGate-VM leverages AWS c5n instances to distribute packet processing workloads across all available vCPUs. It also leverages the redundancy and resiliency of AWS to ensure business continuity in the event of a natural disaster. In this blog, we will discuss some of the design considerations to deploy a scalable, secure solution in AWS using FortiGate-VMs.  We will also outline how the solution can be launched in AWS.

Multi-Region Deployment with AWS Transit Gateway and AWS Route 53

While there are different ways to design a resilient architecture in AWS, most designs consider deploying services in at least two AWS regions to enable disaster recovery and avoid service disruption in the event of a natural disaster, such as an earthquake. Additionally, by deploying resources in two or more availability zones within an AWS region, customers can ensure fault tolerance. Figure 1 depicts a multi-region FortiGate deployment that leverages AWS Route 53 to help connect SSL clients (FortiClient) to a region with the least latency. In this architecture, two regional cloud security services hubs (us-east-1 and us-west-1) have been deployed. Each cloud security services hub is comprised of two FortiGate instances.

Figure 1. Multi-region teleworker deployment with FortiGate-VM and AWS Route 53

As shown, Route 53 enables VPN clients to get an IP address from a FortiGate endpoint to terminate VPN connections based on latency. In addition to regional redundancy, an AWS design best practice includes deploying at least two FortiGates, each in a distinct availability zone. Multiple FortiGate design options, such as active/active and active/passive, are available. Multivalue Answer Routing in Route 53 can be used to distribute the IPSec VPN traffic across FortiGates in each region, as shown in Figure 1. 

Most customers deploy applications in multiple VPCs that need to be accessible by remote clients. AWS recommends leveraging the AWS Transit Gateway for connectivity between centralized shared services VPC and all application VPCs. As depicted in Figure 2, FortiGate-VMs in the cloud security services hub can be connected to an application VPC via an AWS Transit Gateway. In this architecture, an AWS NLB load balances SSL VPN traffic across the two FortiGates in the hub VPC using 5 tuple hash (Source IP/Destination IP, Source Port/Destination Port and Protocol). 

As shown in Figure 2, two subnets in the cloud security services hub terminate VPC attachments connected to the Transit Gateway. Once SSL VPN tunnels are terminated at one of the FortiGates, remote users can then access applications deployed in the application VPCs. For example, if a remote user needs to access a workload in the Application VPC B, a specific route (10.20.0.0/16) in the private subnet’s route table will be used and the traffic will be routed to the transit gateway via a Transit Gateway attachment as shown in Figure 2. Note that the route table in each private subnet contains routes to the application VPCs via the Transit Gateway attachment. Additionally, they contain a default gateway route that points to the FortiGates’ private ENI in each availability zone. The return traffic will be routed via transit gateway back to the hub VPC. The route table in the FortiGate entry subnet, where the VPC attachment is terminated, has the default gateway set to the private ENI of the FortiGate – this way, the return traffic can take the same path back to the remote user. Customers can create IPSec VPN connections from their on-premises to FortiGates in the Hub VPC or Transit Gateway. This will enable remote users to access the on-premises resources as well.  

Figure 2. Remote Access SSL VPN with FortiGate-VM and AWS Transit Gateway

Additional Design Considerations

The architectures discussed earlier in this document are meant to provide a reference design for a scalable teleworker solution in AWS. However, there may be additional important design considerations that need to be accounted for when deploying the solution in your AWS environment. These may include:

  • Scaling out with FortiGate Autoscaling – Customers can deploy a FortiGate ASG integrated with the AWS transit gateway. This feature is built into the FortiOS (FortiGate’s purpose-built operating system) to allow for a smooth scale in/scale out solution. This can be deployed using a CloudFormation template available at Fortinet’s official GitHub repository.
  • Inside tunnel CIDR (classless inter-domain routing) – Plan your hub VPC CIDR (where the FortiGates reside) to accommodate all remote clients. For instance, if you expect 300 employees to connect to a FortiGate, a VPC with /24 CIDR won’t have enough IP addresses for one to be allocated to each client. Although it is possible to apply source NAT at each FortiGate, it is generally not a recommended practice since many organizations require full client visibility.
  • FortiGate instance type/size – as mentioned previously, there are several different instance types/sizes of FortiGate solutions available in the AWS Marketplace. FortiGate-VM can achieve the best performance (up to 20Gbps IPSec traffic ) when turned on with the C5n.18xlarge instance due to the enhanced networking capability that the FortiGate-VM can fully achieve, as well as other optimizations such as auto CPU affinity. Note that to support a greater number of tunnels and higher throughput, a FortiGate-VM can be scaled up to a higher instance size.

Launching FortiGate-VM from AWS Marketplace

To launch a FortiGate-VM from the AWS console, log in to the AWS Management Console, select the AWS region where your resources are located, and navigate to EC2 landing page. Click on launch instance and enter FortiGate in the search field. This will bring up the associated links in the AWS Marketplace. Click on the link to choose the FortiGate-VM.  

FortiGate-VM for AWS supports both on-demand licensing and bring-your-own-license (BYOL) models. The On-Demand Model offers a free trial that will let users try FortiGate-VM in AWS without incurring software charges.  You can choose the licensing model that best suits your licensing needs. 

Once you select the right Amazon machine image (ami) for the FortiGate-VM, you can subscribe to the Fortinet FortiGate Next Generation Firewall software and click on Continue. At that point, it will let you select the instance type for your FortiGate-VM. Fortinet supports a wide variety of instance types in AWS, ranging from 1 vCPU t2.small to 72 vCPU C5n.18xlarge instances. Fortinet strongly recommends utilizing the C5n instance type to take advantage of AWS enhanced networking to achieve maximum network throughput. In the next step, choose the VPC where you want to deploy the instance and the subnets that you want the FortiGate-VM instance to be deployed in.

Figure 3. Choosing an instance size when launching FortiGate in AWS

You can leave the storage (Step 4) and tags (Step 5) as default, and navigate to the Security Groups section. Once there, click on Create New, choose a name for the security group, and add the ports that you intend to use for managing the firewall as well as the ports used for traffic. By default, the recommended FortiGate ports will have HTTP (TCP Port 80), HTTPS (TCP port 443), SSH(TCP Port 22), and other management ports. For SSL-VPN, you can use 10433 or any other custom port other than 443, since 443 is used for FortiGate’s HTTPS management. 

Choose “save” once all the required ports are added to the security group along with the right source. The source can be anywhere (0.0.0.0/0 and ::/0) for SSL-VPN, or a specific range of IP addresses for things like source IP access control. The next step is to select the key pair. For key pairs, you can select an existing key pair or choose “Create a key pair in EC2” to create a new key pair. The public key will be added to the EC2 instance, which allows you to access the instance using the corresponding private key. After making the selection, review all the settings and launch the instance.

Figure 4. Adding inbound rules to a Security Group

Once your FortiGate-VM instance is running, associate an Elastic IP address to the internet facing interface of that instance. The Elastic IP will be used to manage the FortiGate-VM (on HTTPS) and to complete the configuration of IPSec/SSL-VPN. IPSec VPN uses UDP port 500 and 4500 (if NAT is used). Allow these ports in the security groups if you choose to use IPSec VPN for remote access. SSL-VPN users would also be using the Elastic IP on the custom port that was selected for SSL-VPN in the security Group. A single FortiGate-VM in AWS for SSL-VPN solution would be a single point of failure, so to provide high availability, fault tolerance, and resiliency we recommend deploying a FortiGate HA Cluster across multiple availability zones in a single region. 

To provide disaster recovery, the same setup can be replicated in another region, with the traffic load balanced by Amazon Route53. Amazon Route53 supports multiple routing policies one of which is latency-based routing policy which serves the user’s requests from the AWS region that has the lowest latency. Within each region, additional record sets can be created with multivalue answer routing to load balance connections to the FortiGates. Multivalue answer routing policy let’s users configure Amazon Route53 to return multiple values in response to DNS queries. Detailed information about Amazon Route53’s latency based routing can be found here. To configure multivalue answer routing, refer to the documentation here. Traditionally, FortiGate’s clustering protocols work over multicast, but in AWS the configuration synchronization happens over unicast (UDP and TCP). It also leverages AWS features like AWS Lambda, API Gateway, and CloudWatch metrics for the failover process.  

In a FortiGate (Active-Active) A-A solution in AWS, FortiGates are launched in two different availability zones. This solution does not provide failover for ingress traffic, as this should be handled by external resources such as AWS ELB or Route53 services. In a FortiGate (Active-Passive) A-P solution in AWS, FortiGates are launched in two different availability zones. During failover, the Elastic IP of the Active Device is disassociated from the Active FortiGate and associated with the Passive FortiGate. In both Active-Active and Active-Passive soltuions, if one of the FortiGate-VM fails, the route tables for the private, protected subnets are also changed so that the traffic now flows to the active FortiGate-VM. 

FortiGate NGFW Active-Active Solution can be deployed using a CloudFormation template from Fortinet’s official GitHub repository. FortiGate NGFW Active-Passive Solution can also be deployed using the related CloudFormation template from Fortinet’s official GitHub repository.  

Virtual Private Network

Virtual Private Networks (VPN) let sites and users connect to private networks over the public network (internet) to gain secure access to their resources. Instead of using expensive leased lines or other infrastructure, organizations can use utilize the relatively inexpensive, high-bandwidth internet. Since the internet is universally readily available, VPNs are used extensively for remote connectivity both for site-to-site and remote access VPNs.  Two of the most used types of remote access VPNs are IPSec and SSL-VPN. 

A managed client-based VPN service provided by AWS is the AWS Client VPN. It enables you to securely access your AWS resources as well as datacenter environments. FortiClient is Fortinet’s Client VPN software, and the added value FortiClient brings is in its embedded security features, increased flexibility and configurability, and lesser restrictions on the client computers and networks.  

Remote Access to Data Center Networks via VPN Through FortiGate-VM in AWS

FortiGate-VM can act as an SSL-VPN Gateway and IPSec VPN Gateway to terminate AWS VPN connections. The FortiClient software that runs on the Client computer manages all the details of encrypting, encapsulating, and sending packets to the remote VPN gateway (a FortiGate-VM in AWS). 

Users who can connect to VPN should be defined on the firewall.  The user configuration becomes much simpler if you integrate it with existing authentication servers through LDAP or RADIUS. Integrating with existing authentication servers, such as Windows AD, lowers the chance of making mistakes in the configuration of users and user groups. 

FortiToken can be used for two-factor authentication (2FA) to ensure that the end-user is who they claim to be by requiring authentication information as well as a dynamic token code that FortiToken Generates. 

Split tunneling lets users access the corporate network through the VPN but still access the internet – which is prevented from going through the SSL VPN tunnel. Split tunneling can be enabled on FortiGate-VM for both SSL VPN and IPSec VPN. 

IPSec VPN

On the Client computer, the FortiClient application acts as the local VPN gateway. Packets destined for the AWS VPC networks are encrypted, encapsulated into IPSec packets, and sent through the VPN tunnel to the FortiGate unit. Packets for other destinations are routed to the internet as usual. IPSec packets arriving through the tunnel are decrypted to uncover the original IP packets. 

This document shows how to configure FortiGate-VM to act as a VPN Gateway. 

The following configuration enables split tunneling for the VPN connections in the phase 1 configuration:

config vpn ipsec phase1-interface

   edit “for_AWS”

        set ipv4-split-include “local_network” 

   next

end

 

Also, using chacha20 as the encryption mode in phase 2 improves the IPSec connection performance. It can be enabled in phase2 config, as shown below. 

 

config vpn ipsec phase2-interface

   edit “for_AWS_Ph2”

        set proposal chacha20poly1305
   next
end

 

With firmware release 6.2.3, we have added auto-affinity to spread the load of encrypting and decrypting IPSec packets across available vCPUs. 

With the FortiGate hardware platform, it is possible to offload IPSec processing to a specific ASIC. In a virtualized environment like the public cloud, FortiOS does not have access to hardware acceleration. To optimize IPSec encryption and decryption through a FortiGate-VM running in AWS, a user has to disable the software decryption asynchronization that is used by the FortiGate hardware platforms. 

config system global
   set ipsec-soft-dec-async disable
end

 

If the number of IPSec connections or throughput requirements increase, FortiGate-VM can be scaled up to a higher instance type to get IPSec throughput as high as 20Gbps and also support more IPSec connections. This is made possible by selecting the correct instance type and also configuring the IPSec optimizations above. FortiGate’s IPSec throughput can reach up to 20 Gbps. One instance type that can achieve that throughput in AWS is C5n.18xlarge, which uses an Intel Xeon Platinum 8124M (turbo GHz 3.5) processor. 

SSL-VPN

There are two modes of operation for SSL-VPN, which include tunnel mode and web mode. 

SSL-VPN Tunnel Mode: In this mode, once the tunnel is established between the client and the FortiGate-VM in AWS, the SSL VPN client encrypts all traffic from the remote client computer and sends it to the FortiGate-VM through the SSL VPN tunnel. This mode provides a transparent experience for the end user. There is no proxying done on the FortiGate, and it can be used for accessing a wide range of applications.  

Enabling split tunneling for tunnel mode in SSL-VPN is done at the portal level.

config vpn ssl web portal

    edit “aws-ssl-portal”

        set tunnel-mode enable

        set split-tunneling  enable

        set split-tunneling-routing-address “10.212.1.0”

        set ip-pools “SSLVPN_TUNNEL_ADDR1”

    next

end

SSL-VPN Web mode: In web mode, there is no need for an SSL-VPN client on the client computer. It is a clientless access mode that allows network access using a web browser and its built-in SSL encryption.  Remote Users can authenticate to FortiGate-VM’s SSL VPN Web Portal, which provides access to network services and resources, including HTTP/HTTPS, Telnet, FTP, SMB/CIFS, VNC, RDP, and SSH. When a user starts a connection to a server from the web portal, FortiOS proxies this communication to the requested resources.

Since Web mode proxies all its communication through the FortiGate-VM, it places an overhead on the FortiGate’s resources and supports only certain applications. For most teleworkers who remain connected through the VPN for longer periods, Tunnel mode is the better option. It is transparent to the user after a successful connection and it allows the users and networks to exchange a wide range of traffic regardless of protocols or applications.

This link has the instructions for configuring the FortiGate-VM and the FortiClient software for remote access through SSL-VPN in split tunnel mode. 

In our design depicted earlier in this document, we showed end users connecting to the FortiGate-VM in AWS through SSL-VPN and then allowing them to access the on-premises networks through Direct Connect or VPN. This document shows how to configure SSL-VPN to IPSec VPN for such a use case.

SSL VPN operates on HTTPS protocol at Layer 7. If the FortiGate-VM in AWS needs to handle a large number of SSL-VPN connections, you can scale out the FortiGate-VM in an autoscaling group and use an Application Load Balancer to load balance the SSL-VPN connections between the FortiGate-VMs, as explained in the “additional design considerations” section of this document.

Conclusion

In this blog post, we discussed how organizations can leverage FortiGate-VM in AWS to provide teleworkers with secure connectivity and best-in-class network throughout. FortiGate-VM’s integration with native AWS services such as Transit Gateway and Route 53, as well as important design considerations were explained. Finally, we outlined steps to launch FortiGate-VM in AWS, and the configurations required to take advantage of FortiGate-VM’s optimization features. The Fortinet teleworker solution enables organizations to securely connect their remote workforce to AWS workloads and applications, and ensures business continuity by leveraging the purpose-built FortiOS software as well as the scale and resiliency of AWS.

Discover how Fortinet Teleworker Solutions enable secure remote access at scale to support employees with a wide array of access requirements.

Learn how Fortinet’s dynamic cloud security solutions provide increased visibility and control across cloud infrastructures, enabling secure applications and connectivity from data center to cloud.

Read these customer case studies to see how Cuebiq and Steelcase implement Fortinet’s dynamic cloud security solutions for secure connectivity from data center to the cloud.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

As Fortinet partners, Net Universe offers all Fortinet devices and subscriptions with worldwide Delivery Services.
Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/fortinet.
You can visit our Shop Online