In July 2009, a common complaint from network managers was that every year brought more users, devices and applications onto the network but no extra people to look after them. The question was how to keep the network and its data safe without adding to the operational load on IT staff.
The advice given that year was to hand repetitive security tasks to tools, so that staff time went to strategic work.
Why the load was growing
Three pressures were growing at once in 2009. The first was the range of people on the LAN. IT teams had to support remote workers, guests, contractors, partners and suppliers, and sometimes competitors, while still protecting sensitive corporate assets. Some users held several roles at once.
The second was applications. Users often ran their own software to get a job done, and the number of applications outside IT’s official approval was rising sharply. The so-called “Port 80” problem made this harder to see, because so many applications ran through a web browser.
The third was devices. Employees were bringing their own laptops and smartphones to work. In other cases, organisations were issuing new tools for a job, such as a doctor using a laptop or tablet PC to reach electronic patient records.
IT was being asked to manage all of this with fewer resources. Staff hours were scarce, so the answer was to move routine work onto software.
Where automation helped
Password resets
Help desk work had already been automated in places. Automated password reset programs had existed for years. One enterprise bought contractor provisioning from a large professional services firm and estimated that it saved US$10 each time a contractor reset his own password instead of calling the help desk. That enterprise supported more than 35,000 contractors worldwide, so the yearly saving was substantial. It also gave a direct money value for the IT time saved.
Log compilation
To spot possible breaches, organisations needed event correlation. The more software could gather and compile output such as syslog, instead of people doing it by hand, the better the organisation’s security awareness became. This cost no extra staff time.
Guest and contractor access
Provisioning guest access, and keeping guest, contractor and staff traffic separate, were two more tasks where tools could take over a large share of the work.
Role-based network access
The largest time saving came from network infrastructure that controlled access automatically according to a person’s role. That removed the need to administer virtual LANs and access control lists by hand for each user and device.
Common mistakes
The 2009 reasoning points to a few errors that defeat the purpose:
- Treating each new user group, application or device type as a separate manual project, which adds work in proportion to growth.
- Leaving logs to be read by staff when software can correlate them.
- Keeping help desk tasks such as password resets manual when they can be self-service.
- Tying access rules to individual ports, VLANs or lists instead of to a person’s role.
The common thread was that controls should scale with the number of users, devices and applications without scaling the headcount needed to run them.