I'm almost finished with a concept brief on how I describe and liken Enterprise UTM security service layers to a model I define as a Security Service Oriented Architecture (SSOA.)
(Ed: If you like, you can read the brief here -- it is a summary compilation of thoughts that forms the basis of several presentations.)
I'll post the entire brief shortly, but here's the abstract from the paper titled "Delivering Enterprise Risk Mitigation Utilizing a UTM Security Service Oriented Architecture":
The evolution of modern enterprise information architecture has driven tectonic shifts in how information is made available and consumed across constituent layers within the Enterprise ecosystem. The paradigm itself has undergone fundamental changes as the delivery mechanism and application model has transitioned from Client/Server to Internet/Web-based and now loosely-coupled componentized Service Oriented Architectures (SOA.)
SOA provides for transformational methods of producing, accessing and consuming information across a delivery “platform” (the network) and provides quantifiable benefits across multiple boundaries: the reduction of integration and management total cost of ownership (TCO), asset and resource modularity and reusability, business process agility and flexibility, and the overall reduction of business risk.
Enterprise information architects have responded to this paradigm change by adopting methodologies such as Extreme Programming (XP) which is designed to deliver on-demand software layers where and when they are needed. XP enables and empowers developers and information architects to rapidly respond to changing business requirements across the entire life cycle. This methodology emphasizes collaboration and a modular approach toward delivering best-of-breed solutions on-demand.
These highly dynamic, just-in-time solutions pose distribution, management, protection and scaling issues that static product-centric network and security paradigms cannot adapt to quickly enough; each new technology presents new architectural changes, new vulnerabilities and new attack surfaces against which threats must be evaluated. Unfortunately, there is no analog to Extreme Programming in the security world.
The networks charged with the delivery of this information and the infrastructure tasked with its secure operation have failed to keep evolutionary pace, are still mostly rigid and inflexible and are unable to deliver given a misalignment of execution capabilities, methodologies and ideologies.
This brief will first demonstrate that pure network infrastructure is, and always will be, fundamentally and unfortunately at odds with the technology and services designed to protect the information that is transported across it.
The brief will then introduce the concept of a Security Service Oriented Architecture (SSOA) that effectively addresses the network/security conflict. By using an Enterprise Unified Threat Management (UTM) system overlaid across traditional network technology it becomes possible to eliminate individual security appliance sprawl and provide best-of-breed security value with maximum coverage exactly where needed, when needed and at a cost that can be measured, allocated and applied to most appropriately manage risk.
I'll be interested in your comments regarding the abstract as well as the entire brief once I link to it.
/Chris