Security and the Hybrid WAN

In the early days of the Internet, enterprise networks followed a well-established blueprint: applications ran in centralized data centers, and users accessed them over private WANs. Connectivity to the Internet-based applications of the time – email, file transfers, and web browsing – was likewise centralized, and the associated public traffic was carried over the same private WANs. This was an appropriate architecture when Internet traffic was modest and sub-second latency was acceptable. And because connectivity to public networks was limited to a few physical locations, it made the network easier to secure by minimizing the potential attack surface.

But as the Internet rose to prominence, the situation changed. Many internally hosted applications were replaced with powerful SaaS alternatives, and the amount of Internet traffic on the WAN increased substantially. Moreover, new bandwidth-hungry applications such as cloud-based storage began to overload legacy WAN links, and real-time applications such as UCaaS performed poorly across congested WANs with the latency overhead of centralized Internet access.

Consequently, enterprises scrambled to deploy hybrid WANs, adding local Internet access at each location. This had the desired effect of offloading Internet-based traffic from the private WAN, and it avoided the latency overhead of routing through centralized data centers. But these gains weren’t achieved without trade-offs: the network grew more complex and difficult to manage, and the potential attack surface increased significantly, making the hybrid WAN more difficult to secure.

SD-WAN: Harmonizing the Hybrid WAN

With the emergence of SD-WAN, the physical distinction between private WAN and public Internet has blurred: the private WAN has become a virtual “overlay” network running atop one or more public networks (the “underlay”), and SD-WAN software now determines how application traffic is routed. Internet-based applications can be broken out locally to use the underlay natively, while private traffic is encrypted and tunneled between locations in the overlay.

Although SD-WAN adds intelligence and flexibility to the hybrid WAN, it is subject to the same security and latency trade-offs. Using local breakout minimizes latency, but it expands the attack surface to include every location, and some of SD-WAN’s most powerful features such as Forward Error Correction and packet level link steering are only available in the overlay.

Cloud Firewalls to the Rescue

Fortunately, there is an alternative wherein the benefits of centralized security can be achieved while keeping latency in check. Managed secure SD-WAN providers who operate their own backbone networks can offer cloud-based firewalls for regionalized secure Internet access. This avoids the need to open up public network access at all locations, and it allows Internet traffic to enjoy the full benefits of riding the SD-WAN overlay. A well-designed cloud-based firewall design will align with the geographical footprint of the enterprise, ensuring all locations can reach the Internet without excessive delay. From a performance and security perspective, SD-WAN combined with regional cloud-based firewalls offers the best of both worlds!

Acerca de GTT

GTT connects people across organizations, around the world, and to every application in the cloud. Our clients benefit from an outstanding service experience built on our core values of simplicity, speed, and agility. GTT owns and operates a global Tier 1 internet network and provides a comprehensive suite of cloud networking services. We also offer a complementary portfolio of managed services, including managed SD-WAN from leading technology vendors.


Aerial Car Factory 3D Concept: Automated Robot Arm Assembly Line Manufacturing Advanced High-Tech Green Energy Electric Vehicles. Construction, Building, Welding Industrial Production Conveyor

SD-WAN in Manufacturing

Next-generation networking will help manufacturing companies respond quickly to rapid change and enable broader transformation. A recent survey by IDC* sponsored by GTT took the pulse of the industry across the U.S. and Europe to find the top drivers for transformation. Manufacturing enterprises that use a managed SD-WAN service do so for a wide variety of reasons: the top 2 are managing technology upgrades and getting better protection against security threats. Read the paper for more.

Blog Featured Image

Five reasons for Managed Detection and Response

This new blog from global director of security products at GTT, Erik Nordquist, looks at the myriad reasons MDR can save you time and money, while looking for threats 24/7.

Blog Featured Image

5 Tips for Defending Against DDoS Attacks

A blog that discusses the evolution and increasing sophistication of DDoS attack, and the steps to take and tools to implement that will help mitigate that threat.

Our Gartner Rating

Gartner Peer Insights Reviews

62 Reviews

as of the last 12 months