If security moves from the network, what happens to the network budget?
Sep 25th, 2023 by Jesper Kråkhede
Following my post on point to point access, a question for management: If security moves from the network to identity and devices, what does that mean for what we spend on the network?
For decades, a large part of the security budget went into the network. Firewalls at every border, VPN concentrators, network access control, internal segmentation, intrusion detection. Expensive hardware with expensive support contracts and specialised people to run it.
In a world where most applications are in the cloud and users work from anywhere, much of that protects a perimeter that hardly exists any more. When access is decided per application, based on identity and device, the network becomes more of a transport. It still needs to be reliable and fast, but it doesn´t need to carry the whole weight of security.
That doesn´t mean the network costs disappear. You still need firewalls at the edge of your datacenters, segmentation for critical systems and OT, and good connectivity. But over time, the balance can shift. Fewer VPN appliances to buy and patch. Simpler internal networks. Money that can be moved to identity, devices and detection.
For organisations short on resources, this is an opportunity. The network team doesn´t have to protect everything any more.
Spend where the attacks are, not where they used to be.