Automating Security Compliance with SOLIDServer IPAM and Tufin Integration

You can’t secure what you don’t know

As we know at EfficientIP, managing security of the IP Infrastructure nowadays is challenging. The move to cloud, deployment of SD-WAN networks and Zero Trust requirements increase complexity by adding new devices and configuration processes. Users are more ubiquitous, application deployment more frequent, hybrid cloud deployments present in most enterprises while threats have never been stronger. This is why we developed our SOLIDserver solution around our IPAM.
Tufin is a leading vendor in the security field. The Tufin Orchestration suite enables organizations to automate their security policy visibility, risk management, provisioning and compliance across multi-vendor, hybrid environments. SecureTrack is their security vendor-agnostic visibility and control application to set and assess security compliance. It basically defines what are the security policy rules between Security Zones made of IP subnets.
Though it would sound obvious that NetOps, CloudOps and SecOps teams should be working together, the reality is that the security team is more often than not the last one to be made aware of changes made on the networks and the clouds.

How can Security be in sync with network data?

Even if these teams were working closely together, which is rarely the case, the update processes of the SecureTrack Security Zones would still be made out-of-band and manually as each team uses their specific sets of tools and applications – network and cloud orchestrators on the one hand and security policy management suites on the other. As a result, as long as security policies are not updated in real-time as the network and the cloud evolve, Security cannot be assessed, let alone guaranteed. This can lead to risks of misconfigured security equipment (firewalls, routers, switches), increased management overhead and complexity leading in turn to operational inefficiencies and significant loss of time, and last but not least, non-compliance to unified security policies.

The need for a common IP repository and Automation

A sure way to create confusion on an information supply chain is to permit several sources of information and allow them all to update any other. It’s easy to understand that it is only a matter of time before the entire system will be completely misconfigured, and worse it will then be impossible to identify the legitimate source of information for the remediation. So, there must only be one “single source of truth” for all information related to the IP infrastructure and all systems should refer to it.
The second aspect is to ensure any changes on the IP infrastructures, (creation/change/deletion of IP informations) are updated in real-time in all systems involved, starting with SecureTrack as the Security compliance tool, to ensure that there is no gap in the security shield at any time.In today’s world this is achieved via Automation.
The “single source of IP truth” is called an IPAM and the way to automate the updates of the IP infrastructure information within other systems is to use APIs.
In the case of EfficientIP IPAM and Tufin SecureTrack, both solutions offer APIs to automate the updates of IP subnets content of the Security Zones. You can use one API or the other or both. Following the model described above, Security Zones created on SecureTrack -their unique repository- are updated on the SOLIDServer IPAM and in turn any IP subnet added/changed/deleted from the IPAM will be reflected automatically with the proper Security Zone into SecureTrack.
This integration works well technically, and beyond this operational aspect it allows the NetOps and CloudOps teams to focus on their daily work, with automation taking care of keeping both repositories in sync.
At the same timeAt the same time, the SecOps team can focus on defining and assessing Unified Security Policies between Security Zones (which apps and protocols are permitted/denied) while no longer having to worry about new subnets not being associated with a Security Zone or not to the proper one.This translates into frictionless operational efficiency between these teams and Automated Security Compliance.

Benefits of combined Tufin SecureTrack and EfficientIP DDI solution

• Accelerate IT service delivery & increase business agility

No time is ever wasted trying to keep up with changes between NetOps, CloudOps and the SecOps teams. All administrators can focus on their core responsibilities and be sure they always have and use the most up-to-date information from the other parties. The velocity and agility of IT services are increased without additional effort or staff.

• Unify & enforce network security controls across physical, virtual & cloud environments

No matter where the changes are made, on prem, in the cloud, on physical or virtual appliances; the resulting management complexity is reduced to a minimum using dedicated suites for each team and allowing them to exchange their data automatically via APIs.

• Reduce business impact of network downtime

On top of eliminating the risk of misconfiguring subnet addresses within Security Zones (which prevents network connectivity issues), having a common repository helps assess the expected nominal situation and compare it with the current one in case of network failures. Like firemen using the Emergency Evacuation Plan plan to navigate into a building during a fire, troubleshooting should always start by assessing “what is” against “what should be”. The EfficientIP IPAM as the Single Source of Truth for the IP repository allows that. The gains are in the time saved to understand what does not work as expected and focus the remediation on this part. As a result no time or energy is wasted mitigating network downtime and business get back on track much faster.

• Ensure continuous compliance & audit readiness

Thanks to the integration, security compliance is now about assessing whether or not the security equipment on the networks are conforming to the Unified Security Policies and no longer whether these Securities Policies themselves are up-to-date and reflecting the current state of the IP network infrastructure, as this part is fully managed by EfficientIP’s IPAM. This guarantees compliance to Unified Security Policies.

Easy integration for compliance to all security regulations

The combination of Tufin’s SecureTrack together with EfficientIP SOLIDserver DDI capabilities creates a best of breed solution for controlling and orchestrating network security throughout a company’s infrastructure. Together they ensure that Unified Security Policies defined by each organization are adhered to and updated automatically in real time by using a common repository, usable by other orchestrators and APIs. The joint solution also ensures up-to-date data for compliance with internal and external regulations.