News
High Profile U.S. Federal Government Agency Takes Back Control of Complex IP Network
May 2009 by Marc Jacob
A well-known U.S. Federal Government Agency was under significant pressure to improve its network configuration assessment process. The security, compliance, and availability of the agency’s IP network infrastructure were also paramount, particularly given the sensitive nature of its operations and the high level of public scrutiny that it endured.
Over time, the agency’s network grew more complex as it needed to support a fast-growing number of applications and IP devices, leading to a significant drain on network management resources. The problem accelerated as performance decreased, and it became increasingly difficult and inefficient to remain in compliance with regulatory standards and conduct mandatory, intensive bi-annual network audits on time and on budget.
Navigating a Complex Network Jungle
With more than five hundred IP network devices, such as routers, switches, firewalls, VPN concentrators, and load balancers provided by myriad third-party vendors, the agency was spending several months per year supporting both bi-annual and supplemental audits of its internal IP network infrastructure by the Government Accounting Office (GAO). Additionally, it had to support multiple Web-based applications for internal users and external partners, as well as a newly introduced Voice over IP (VoIP) network for employees. There were other complexities linked to the dynamic nature of the agency’s network configuration. Often, after spending months supporting the GAO audits, which had to be performed manually, results were not completely accurate, given the daily configuration changes made to various IP network devices. There was also no established process for ensuring that the network complied with the Federal Information Security Management Act (FISMA), legislation designed to bolster IT and network security within the Federal Government and affiliated parties by mandating yearly audits as compliance checkpoints.
“As a result of the rollout of Telcordia IP Assure, the agency can easily accommodate the largest, most complex and dynamic IP infrastructures.”
Taking Back Control
The agency urgently needed a solution that could immediately help it reduce the cost of supporting the GAO audit, while improving network security and reliability and VoIP Quality of Service (QoS), and ensuring compliance, as a publicly accountable body, with FISMA. Given the participation of the agency’s network engineering and security groups in the GAO audit, the solution had to provide clear value to both groups, without increasing the workload for either. Essentially, the agency needed a way to gain unprecedented visibility into its network, take back control, and stem the drain on IT resources while improving overall performance — all while under the watchful eye of the public. Upon conducting extensive research and testing of leading market solutions, the agency selected Telcordia® IP Assure, a flexible software solution for automated and non-intrusive assessment and awareness of IP networks, based on cost and, most importantly, its ability to meet the agency’s stringent needs and requirements.
THE RESPONSE
Telcordia conducted a comprehensive analysis of the agency’s IP network infrastructure over a period of three months. This analysis included reviewing data related to device configurations, interacting with the network engineering and IT security personnel, and identifying pain points and associated issues.
A Customized Approach
As part of the deployment, Telcordia defined custom rules to enforce the agency’s VoIP QoS and security policies. Separate Telcordia IP Assure access accounts were created for security and network engineering personnel to enable them to rapidly find the precise network data they needed, empowering them to work more efficiently and more effectively.
Telcordia IP Assure was also integrated with the agency’s existing Network Configuration Management Software (NCCM) to extract IP network device configuration data on a weekly basis and match it against a built-in knowledge base of best-practice rules, custom rules, and the FISMA requirements. This ensured that the agency could be confident it was at all times compliant with FISMA guidelines without needing to poll the network manually to discover issues and correct them.
Firewall information was provided to security personnel and data from routers, switches, and other non-security devices was sent to the network engineering team to enable them to quickly take any necessary corrective measures. This enabled the network management team to stay incredibly organized and proactively address newly discovered issues before they became problems.
Additionally, utilizing Telcordia IP Assure in simulation mode to test configurations before pushing them out to the network helped to prevent many common issues entirely.
“The agency has reduced the time spent conducting the bi-annual GAO audits by 65 percent, and since the deployment of Telcordia IP Assure it has not encountered the need to conduct supplemental audits.”
Access On Demand
To gain considerable efficiencies in the time consuming, bi-annual auditing processes, a Telcordia IP Assure account was created for GAO personnel that enabled them to view detailed data every week, and create summary reports as needed.
THE RESULTS
The agency has fully deployed Telcordia IP Assure and experienced significant gains in efficiency and performance, achieving:
• Cost Reductions – The agency has reduced the time spent conducting the bi-annual GAO audits by 65 percent, and since the deployment of Telcordia IP Assure it has not encountered the need to conduct supplemental audits.
• Performance Boosts – IP device configuration errors are proactively detected, further reducing network configuration management costs and improving network security and reliability.
• Error Reductions – Since the deployment of Telcordia IP Assure, the agency has not encountered any network issues that could be traced to incorrect IP device configurations.
• Compliance – The agency can now efficiently manage compliance with regulatory bodies, including FISMA, with much less internal work.
• Scalability – As a result of the rollout of Telcordia IP Assure, the agency can easily accommodate the largest, most complex and dynamic IP infrastructures.
“Since the deployment of Telcordia IP Assure, the agency has not encountered any network issues that could be traced to incorrect IP device configurations.”
