You learned in the introduction how more and more organizations rely on distributed architectures. Many organizations deploy their enterprise applications as distributed applications. Although the actual applications and resources belong in other domains, clients need the ability to access resources and run distributed programs. Providing the ability to connect diverse resources is the main purpose of the WAN Domain. Although making your resources and data available to more users is a good thing, you must pay close attention to security. Keeping your data secure as it leaves your network takes advance planning. Always consider how secure your data is in each of the domains of your IT infrastructure. Figure 12-1 shows the WAN Domain in the context of the seven domains in the IT infrastructure.

Remember that your responsibility to keep your data secure doesn't stop when that data leaves the controlled area of your networks. The WAN Domain represents an area that might be largely out of your control. Your responsibility to secure data means to protect it in such a way that it is secure even when traveling across an untrusted network. Ensuring data is safe even in the WAN Domain makes it possible for your organization to deploy distributed applications that can provide unprecedented functionality to remote users. Implementing the controls necessary to support your security policy in the WAN Domain makes your organization more secure and allows you to provide a higher level of visibility to your data.

Figure 12-1. The WAN Domain within the seven domains of a typical IT infrastructure.

Protecting Data Privacy

WANs provide the valuable service of connecting your networks together without having to install or maintain the interconnection network media. In other words, you use someone else's network to connect your networks together. You can connect your headquarters to several branch offices using a WAN. You connect each of your networks to the WAN and all your nodes can communicate. The only problem is that you now depend on another organization to communicate. Each time you send a message from your headquarters to a branch office, that message travels across someone else's network. You no longer have control over who sees your network traffic or who can alter it. Figure 12-2 shows how data traveling from one of your nodes to another across a WAN is out of your control.

One of the most important concerns when sending data across public networks is confidentiality. Although not all data is confidential, any data you exchange with a remote resource using a WAN is potentially available for anyone else to see. Consider all WANs to be hostile and insecure. Your organization likely controls the access to your LANs and has some measure of assurance of how private the LANs are.

Figure 12-2. Lack of control for data traveling across a WAN.

WANs are different. You don't have control over who accesses them or who can access data traveling across a WAN. You must deploy sufficient controls to protect the privacy of any data in the WAN Domain.

Figure 12-3. Protecting WAN traffic using encryption.

The WAN Domain exists to transport network messages from one node to another. In most cases, the WAN is a network that is owned and managed by some other entity. Your ability to affect the WAN's security is limited or nonexistent. You must ensure that you transmit data across the WAN in a secure fashion using secure protocols and techniques. In this section, you'll learn about the devices and components you'll commonly find in the WAN Domain that support communication, both secure and insecure. Once you've learned about the devices and components, you'll learn about controls to ensure compliance in the WAN Domain.

WAN Layer 2/Layer 3 Switches

Most discussions of network protocols include a discussion of the Open Systems Interconnection (OSI) reference model. The OSI reference model is a generic description for how computers use multiple layers of protocol rules to communicate across a network.

Figure 12-4. TCP/IP and OSI reference models.

The OSI reference model defines seven different layers of communication rules. You'll also likely encounter another popular reference model, the TCP/IP reference model, when discussing network protocols. The Transmission Control Protocol/Internet Protocol (TCP/IP) reference model defines four different layers of communication rules. Both models are useful to describe how protocols work and how to implement them in network communications. Figure 12-4 shows the TCP/IP reference model and the OSI reference model.

You might hear hardware devices or software protocols referred to as "layer 2 devices" or "layer 5 protocols." These references generally refer to the OSI reference model layer to describe where the referenced hardware or software operates. In the context of WANs, most WAN protocols operate at OSI layer 2. MPLS actually operates between layers 2 and 3 and is sometimes called a layer 2.5 protocol. Most traditional network switches operate at OSI layer 2, but newer devices use advanced techniques to provide more sophisticated switching capabilities at OSI layer 3.

Recall that traditional layer 2 switches use the Media Access Control (MAC) addresses in each packet to forward the packet to its proper destination. One type of layer 3 switch extends the concept of a traditional layer 2 switch by implementing fast Internet Protocol (IP) routing using hardware. Most routing using IP addresses requires software to examine each packet. Software is always slower than hardware and, thus, routing has historically been slower than switching. A layer 3 switch can greatly speed up routing by using advanced hardware to make the routing decision.

Layered Protocols in Real Life

The idea of layered protocols sounds complex, but it really reflects what happens in normal human-to-human communication. You use layers and translations in subtle ways every time you talk with a different person. Here's an example that demonstrates the obvious need for multiple layers.

Consider how ambassadors communicate in the United Nations. Assume a U.S. ambassador wants to send a written note to the ambassadors of China, Russia, and Italy. In this example, protocol requires all written messages be presented in French. Here is how the message travels through the United Nations:

1. The U.S. ambassador writes a message in English, then hands the message to a translator.

   The ambassador layer passes the message to the translator layer.

2. The translator translates the message into French, then hands it to an aide to take to the mailroom. The translator layer passes the message to the aide layer.

3. The aide makes three copies of the message, addresses each copy, and places the messages in the U.S. outbox in the mailroom.

   The aide layer duplicates and passes the messages to the mailroom clerk layer.

4. The mailroom clerk picks up the messages from the U.S. outbox and places them in the appropriate inboxes for China, Russia, and Italy.

   The mailroom clerk handles the physical transfer.

5. An aide for each country—China, Russia, and Italy—picks up the message and delivers it to the translator.

   The aide layer collects a message from the mailroom and passes it to the translator layer

6. The translator translates the message from French into the country's natural language and gives it to the appropriate ambassador.

   The translator layer translates the message and passes it to the ambassador layer.

7. The ambassador for each country reads the message and takes appropriate action.

   Figure 12-5 illustrates the process.

Figure 12-5. Message flow in the U.N. example.

Monitoring the traffic and performance of your WAN Domain can directly translate into concrete results. WAN usage might cost money, but it always costs in time. Any time you can reduce WAN usage, you are saving time and perhaps money as well. Recall that a secure network is one that provides smooth operation and only allows authorized traffic on the network. Access to your WAN is one of the necessary pieces in a distributed environment. If the WAN is down or unreachable, your distributed applications can't function. As you learned in Chapters 10 and 11, which covered the LAN and LAN-to-WAN Domains, network problems could cause service interruptions and could result in noncompliance. You need to be aware how all parts of your network are working to ensure you are compliant.

Traffic monitoring and analysis for a WAN are nearly identical to the process you learned about in Chapter 11. The WAN Domain differs from other domains in that you probably don't own or control the hardware or the software in the WAN. Your organization pays a subscription fee to connect to another organization's WAN. You generally pay the WAN service provider either by bandwidth usage or a flat fee for a specified bandwidth limit. Because you likely pay for WAN access, managing WAN traffic proactively can reduce your need for additional bandwidth and reduce your WAN costs.

You can implement WAN traffic monitoring and analysis software and devices in two ways. You can install software or devices on the perimeter of the WAN where you connect to it or rely on your WAN service provider to supply traffic flow data. You gain far more control monitoring the WAN yourself but you only have limited capability to affect the WAN's performance. One technique is to send a message to another node on the WAN and have that node echo a response. The first node can analyze the route and duration the message took for the round-trip. Comparing sample traffic with baseline data will reveal if the current performance is normal.

Several vendors provide tools to help monitor WAN traffic and optimize your WAN's throughput. Real-time WAN optimization software can analyze current WAN performance and then modify how new traffic is sent across the WAN. WAN optimizers can exclude unnecessary traffic, use compression to maximize bandwidth, cache data, and prioritize traffic to make the best use of your WAN. The result can be a noticeable increase in network speed. In this case, you haven't made the network any faster but you have used the available bandwidth more efficiently and increased your data throughput. Table 12-2 lists some WAN optimization products.

You can choose from many products to help optimize your WAN usage. Explore the solutions presented here, as well as other solutions, and select a product that best meets your security goals.

You learned about the importance of managing network configuration settings in the previous chapters on the LAN and LAN-to-WAN Domains. You don't have nearly the control over the WAN network components because most of the actual devices belong to your WAN service provider. However, you still need to proactively manage the components you do control. You can manage the settings of at least these WAN Domain components:

The strategies and techniques for managing configuration settings and controlling configuration changes should match your activities in the LAN and LAN-to-WAN Domains. Refer back to Chapters 10 and 11 for more information on proactively managing configuration setting changes. Just as with other domains, managing the configuration settings of your WAN Domain components is an important part of keeping your overall environment compliant and secure.

Because the WAN service provider bears the responsibility of maintaining the actual WAN, there isn't much left to do to manage components in your WAN Domain. It is important to ensure all of the components in the WAN Domain are doing their jobs, but there isn't much you can do to manage the actual WAN. You learned about WAN optimization tools earlier in this chapter. Managing components in the WAN Domain primarily means managing how well your organization uses the WAN resources. There are three main categories of WAN management tasks, including:

In this respect, the WAN optimization tools from Table 12-2 are also WAN management tools. Your organization likely has different needs for WANs. As a result, you will likely use different WAN solutions. You may make the decision of which WAN to use in other domains but the actual access point exists in the WAN Domain. It is important to ensure each WAN access is configured and optimized to provide the best level of service for your needs.

Because there are limited components in the WAN Domain, there are also limited opportunities to enforce access control for the domain. There are essentially two places to control access to the WAN. First, you can deploy controls to limit access to the WAN access device. Device and user authentication and authorization controls should limit which users can access the WAN access point. The second opportunity to control WAN access is in the access device itself. The WAN access point also has the ability to enforce access controls. In this way, the WAN access device controls which users can get through the device and onto the WAN.

WAN access devices and WAN optimization devices both contain the ability to selectively grant access to the WAN. Although the WAN access device generally operates like a firewall or gateway, WAN optimization devices can make more sophisticated decisions about WAN access. Granting access may include decisions regarding time- or bandwidth-sensitive rights. Some users might only be granted WAN access during slow periods, while other users might get access on demand. You have the ability to grant or deny WAN access based on your security and functional needs.

Implementing more complex controls means you should spend more time testing the controls under different circumstances. If you implement load-based controls using WAN optimization, ensure you test the controls under different network loads, either real or simulated. Use auditing to create logging entries for repeated access denials to ensure your controls aren't degrading the ability of your users to do their jobs. As always, avoid auditing too many events. Only audit the ones you'll need to analyze your WAN's ongoing performance.

You have seen in previous chapters that your main goal in all domains is to deploy and maintain controls that support all of the A-I-C properties of security for your data. The WAN Domain contains several components that play critical roles in providing secure access to your organization's data; maintaining that security requires diligence and the right controls.

Statement on Auditing Standards (SAS) 70, Service Organizations is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA).

A SAS 70 statement of compliance signifies that a service organization has had its control objectives and control activities examined by an independent auditing firm. Because so much emphasis is placed on security and compliance with multiple sources of requirements, service providers must demonstrate that they have adequate controls in place to securely handle their customers' data. In addition, the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70 audit reports even more important to the process of reporting on the effectiveness of internal control over financial reporting.

According to the SAS 70 Web site, "SAS No. 70 is the authoritative guidance that allows service organizations to disclose their control activities and processes to their customers and their customers' auditors in a uniform reporting format. The issuance of a service auditor's report prepared in accordance with SAS No. 70 signifies that a service organization has had its control objectives and control activities examined by an independent accounting and auditing firm. The service auditor's report, which includes the service auditor's opinion, is issued to the service organization at the conclusion of a SAS 70 examination."¹

SAS 70 defines two different types of service auditor reports, Type I and Type II. A Type I report describes the audited organization's security controls as of a specific point in time. A Type II report includes a description of the audited organization's security controls and a detailed examination of the performance of the controls over at least a six-month time period. Table 12-5 compares the contents of a SAS 70 Type I and Type II report.

A SAS 70 compliance audit demonstrates that a WAN service provider stands behind its security controls and has confidence in its ability to protect customer data. You should insist on doing business only with WAN service providers who can show evidence of a SAS 70 audit.

Compliance in the WAN Domain depends on implementing the best controls you can, and ensuring your WAN service provider's controls are compliant as well. As with other domains, explore alternate controls for each security goal. You must ensure the correct controls are in place to balance each of the three A-I-C security properties.

As you analyze controls in the WAN Domain to meet compliance requirements, ensure each control satisfies your security policy. If a control does not support any part of your security policy, you should question its value to your organization. Although different legislation, regulations, and vendor standards have different requirements, Table 12-6 lists the types of controls for which you'll likely need to ensure compliance in your WAN Domain.

Implementing multiple types of controls decreases the likelihood an attack will be successful and makes your WAN Domain more secure.

The WAN Domain allows multiple locations to establish network connections without having to manage the physical networks yourself. Because this domain connects your environment to an untrusted WAN, you must ensure the controls protect your internal resources. Solid planning, along with aggressive management, can provide both easy access across an untrusted WAN and the ability to maintain your data's security.

The following best practices represent what many organizations have learned. Plan well and you can enjoy a functional WAN Domain that makes internal information and resources available for use to WAN users. Here are general best practices for securing your WAN Domain:

These best practices give you a brief overview of the issues you'll need to consider when implementing WAN access. Consider each of the best practices and add your own that will make your organization safer when transporting data across a WAN.

The WAN Domain allows your users to connect to your resources and applications through a WAN from anywhere the WAN reaches. Opening your environment up to a WAN also opens new possibilities for attacks from WAN users. Connecting to a WAN offers many advantages and pitfalls. Learn about the components in the WAN Domain and how to secure them. Through solid planning, you can empower your environment with the flexibility and functionality of WAN access while minimizing the security issues.

1. "About SAS 70" (SAS70.com, 2009). http://www.sas70.com (accessed 4/30/2010).