Array gear protects healthcare provider

Humana Health Care used to rely upon a mix of remote-access [i]modus operandi[/i]s but wanted a single, flexible technology that would bring the number of network ingress points for malicious activity As a originate it is standardizing on SSL VPN for all distant access - and saving cash at the same time.

The health provider in Louisville, Ky uses a pair of Array Networks SPX5000 unfolded in tandem to handle thousands of simultaneous connections as a replacement for IPSec VPN and dial-up far off Access Services servers, which can take away from hundreds of dollars per connection, says tap [i]or[/i] pat Deaton, security manager for the company's security infrastructure architecture design team. by dint of comparison, the Array gear require to be paid [i]or[/i] undergones about $10 per connection, he says.

Humana has about 10000 users authorized to access its network distantly and it needed a way to simplify access and maintain tight rule over who gets into the network and what rights they have one time there, Deaton says. About 2500 users are logg upon at any given time.

About 18 month ago the company started considering SSLVPN to replace Cisco and Nortel IPSec VPN gear, Microsoft Point-to-Point Tunneling Protocol software and dial-up server in its network. The IPSec VPN gear worked, on the other hand it required installing and maintaining clients upon all machines, making it more difficult to lay open the network to business partners or allow Humana employee access from their have a title to computers.

Because of limits upon how many users the other access productions supported, these options required multiple gateways displayed in a secure network section between firewalls - a DMZ "Each single represents an attack vector," Deaton says. "The more doorways and avenues that you have for data to pour the more costly it is to maintain accountability and ascendency of that."

In addition, as the number of devices increases so does the cost.

"If we could minimize the number of different things we have to measure and monitor and purchase technologies for, then it becomes a more economical approach to securit," he says."

Humana trialed Array gear as well as SSL VPN returnss from Aventail, Citrix, F5 Networks, Juniper and NetScaler (since bought by dint of Citrix). The company chose Array for its range of features - SSL VPN encryption acceleration, TCP multiplexing, compression, load balancing - and because each SPX5000 accommodates 64000 coincident users, according to a trial by Tolly Group.

The Humana SSLVPN is place up so that remote users pass to a URL, and their machine is probed for whether it's a Humana machine. If it is, it's scanned by dint of Symantec endpoint-checking software to diocese whether its configuration meets corporate security policy single after their machines pass that proof are users asked to authenticate, Deaton says. "This avoids brute-force attacks and password guessing," he says.

Users' logon are matched against Lightweight Directory Access Protocol or Active Directory data stores to find on the outside what user group they belong to and what access rights they've been assigned. To alter an individual's rights, an administrator changes the clump that person belongs to in the directory, Deaton says. The business doesn't have to maintain a separate user data store just for distant access.

Trusted employees upon trusted machines get Layer 3 access - like an IPSec connection - that is as shut to LAN access as possible, Deaton says. For less-trusted users and machines, the same SSL VPN gear grants limited access via Web delegate

"We use SSL as an IPSec replacement," he says, helping his consolidation put in motion "We're adding users every day to [the SSL] gateway and finding ways to take those same users' access away from other, more traditional paths."

An additional benefit of the SSL VPN came up during hurricanes Rita and Katrina last year, when employee unable to win to Humana offices accessed the VPN via their hold computers and were able to do work, Deaton says.

Because the Array gateways make communications with server more efficient via TCP multiplexing and load balancing, they have slowed growing in the number of server Humana wants

In the long confine Humana is trying to establish the SSL VPN gear as the central gateway for distant access, behind which the company can open other security technologies such as intrusion-detection and -prevention platforms, firewalls, traffic logger and router protections. Operationally, using a single access technology requires fewer employee helping to retain expenses down. He would not say by what mode much.

Copyright Network World Inc. Aug 7 2006

Provided by means of ProQuest Information and Learning Company. All rights Reserved