Analysis of the Global Network Access Control Market

Transcription

1 50 Years of Growth, Innovation and Leadership Analysis of the Global Network Access Control Market Abridged Report Provided Courtesy of ForeScout Technologies, Inc. A Frost & Sullivan excerpt from Analysis of the Global Network Access Control Market, Enterprise Bring-Your-Own- Device Strategies Stimulate NAC Adoption July

2 Frost & Sullivan Executive Summary... 3 NAC Overview (highlights)... 3 Technology Trends... 4 Key Drivers (Highlights)... 4 NAC Enables Businesses to Address New Trends such as Bring Your Own Device (BYOD)... 5 NAC Supports and Enhances Deployed Network and Security Technologies... 5 NAC Optimizes and Automates IT Operations Thereby Improving Customers Return-on-Investment (ROI)... 5 Advanced Threats Necessitate End-to-End Network Protection, Including Wireless, Wired, and Remote Connections... 6 Vendors have Reduced Complexity Resulting in Decreased Customer Confusion... 6 NAC Market and Competitive Landscape (highlights)... 7 The NAC Market is Poised for Strong Market Growth Resulting from Customer Concerns About BYOD Security Risks... 7 Competitive Factors and Assessment Explanation... 9 Last Word Predictions Assessment of ForeScout Technologies and ForeScout CounterACT (NAC) CONTENTS

3 Frost & Sullivan 2013 Analysis of the Global Network Access Control Market Abridged Version EXECUTIVE SUMMARY NAC products are quickly gaining a reputation as an indispensable solution to top IT challenges. A leading reason for this success is the shift in the NAC value proposition away from that of restrictive, device authenticationbased security. NAC has matured well beyond that of strict security and now enables network access rather than preventing access. Furthermore, NAC enables enterprises to streamline or automate IT operations such as guest registration, wireless access, device management, network monitoring, remediation, and network visibility. As a result, the NAC market shows much potential for strong growth in the coming years. NAC offers a quantifiable value by automating and simplifying essential IT practices. Presently, the NAC market is sustained by interest in its ability to address BYOD practices in the enterprise. Going forward, NAC will gain a reputation as an essential network management technology. NAC acts as a central management console capable of coordinating access systems, network infrastructure, endpoint software, reporting systems, and security tools. NAC enables businesses to pursue a Bring-Your-Own- Device (BYOD) or Choose-Your-Own-Device (CYOD) strategy that allows employees to access the corporate network with their personal devices. Centralized visibility, reporting, policy-enforcement, and remediation of formerly unknown, unwanted or non-compliant systems helps businesses to ensure and demonstrate compliance with IT governance, risk management, and compliance (IT-GRC) requirements. The early NAC market was filled with dozens of vendors with different product architectures and strategies. Most of these products failed and customers grew disillusioned with NAC. The remaining NAC vendors have invested heavily in product development to address the problems with earlier solutions such as overly-strict enforcement options, product complexity, and endpoint agent requirements. The latest generation of NAC products are able to solve top IT challenges and deliver tangible business value to customers. NAC is poised for a secondary growth stage resulting from its improved functionality, usability, business value, and relevance to key enterprise IT challenges. NAC OVERVIEW (HIGHLIGHTS) NAC empowers IT administrators to define, implement, and enforce granular access policies for connecting endpoints based on user identity, role, device type, security posture, location, and other factors. To accomplish this objective, platforms must be able to detect connecting endpoints regardless of device (e.g., smartphone, laptop, or wireless router) or connection type (e.g., wired, wireless, or remote). NAC products are delivered as a hardware appliance or a virtual appliance. Appliances are rated to support a range of network sizes ranging from 500 to 1,000, 5,000, 10,000 or 20,000 concurrently connected endpoints. Because hundreds of appliances can be connected to support greater numbers of connecting endpoints, NAC solutions can be deployed to manage networks with millions of endpoints Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies. 3

4 Frost & Sullivan NAC appliances should operate out-of-band and not inline with network traffic. In earlier NAC products, the requirement for 802.1X authentication limited NAC sales X is the protocol that enables layer 2 network authentication. Modern network switches have 802.1X capabilities and simple network management protocol (SNMP) as built-in features. However, this is a very limited and restrictive solution that is difficult to implement as a NAC solution. NAC solutions now consider 802.1X authentication as optional rather than a strict requirement for functionality. NAC products should operate agentlessly, though an agent may be offered optionally for organizations that require more visibility and control over the endpoint. NAC can be set up to simplify or automate IT operations and coordinate disparate identity, network, security, and reporting tools. NAC products have associated licensing fees based on number the of concurrently connecting endpoints and advanced features. NAC prices increased in 2011 and 2012 as vendors developed new feature sets to support enterprise mobility and BYOD challenges. Prices for NAC platforms will increase over the forecast period owing to new product development and greater customer adoption of advanced NAC features. Vendors will continue to invest in product development to address future network security challenges introduced by new computing devices, cloud computing practices, machine-to-machine (M2M) communications, and other new technologies. Increasing product prices will further enable new product development needed to address ever changing enterprise network requirements. TECHNOLOGY TRENDS Key Drivers (Highlights) NAC enables businesses to address new trends such as Bring Your Own Device (BYOD) 1 2 yrs 3 4 yrs 5th yr H H H Market Drivers NAC supports and enhances deployed network and security technologies NAC optimizes and automates IT operations thereby improving customers return-on-investment (ROI) Advanced threats necessitate end-to-end network protection, including wireless, wired, and remote connections NAC vendors have reduced complexity, resulting in decreased customer confusion H M L Impact: High Medium Low Note: Drivers are ranked in order of impact. H H M M H H M M H M L L Source: Frost & Sullivan Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies.

5 Frost & Sullivan 2013 Analysis of the Global Network Access Control Market Abridged Version NAC Enables Businesses to Address New Trends such as Bring Your Own Device (BYOD) BYOD is a top concern for many enterprise organizations that need to enable employee mobility while maximizing flexibility of device selection and reducing security risks. Multiple strategies are emerging to deal with the massive numbers of personal computing devices that employees seek to bring onto the enterprise network. NAC is valuable for organizations that want to understand and manage what devices are accessing the network, including guest and employee personal devices. IT administrators can use NAC to detect, profile, and manage all devices, including corporate-owned devices, based on the user s identity/role, device health, and other characteristics. Without NAC, IT administrators have little control over the personal devices that employees and guests use to access the network and may not even be aware of the devices entering the network. Customers may also consider NGFWs as a solution for their BYOD challenges. These firewalls can understand application type and user type but lack insight into the device s security posture, device type, and lack the ability to control access for policy violations. Mobile device management (MDM) solutions are becoming increasingly popular as a method to enhance employee mobility and manage enterprise security risk. MDM requires software to be installed on the device, which introduces additional complexity and effort on behalf of end users and IT staff, and lacks the broad network-level control offered by NAC. However, NAC alone lacks the deep device-level controls offered by MDM. The combination of NAC and MDM provides the visibility, management, and granular control of all connecting devices necessary to secure a BYOD strategy. NAC Supports and Enhances Deployed Network And Security Technologies NAC deployment enables businesses to utilize the advanced functionality in modern network infrastructure to achieve more efficient and secure networks. NAC can leverage and coordinate many separate IT technologies including directory services such as RADIUS and LDAP, network management systems, endpoint management tools, and security solutions such as vulnerability scanners and anti-malware software. NAC supplements the effectiveness of deployed MDM solutions by discovering and enforcing policies for unmanaged (user-owned) devices or non-traditional network devices. Leading NAC solutions can integrate with security systems such as intrusion prevention systems (IPS), next generation firewalls (NGFW), and security information event management (SIEM) tools, which can be used to detect security or policy violations. Thus, NAC greatly benefits enterprise organizations that have made investments in these advanced network infrastructure technologies. NAC Optimizes And Automates IT Operations Thereby Improving Customers Return-On- Investment (ROI) NAC s value can now be demonstrated in a quantifiable and profitable way by reducing help desk and IT staff workload. Businesses can identify NAC s potential return-on-investment by measuring their help desk and IT staff work load in order to quantify the business cost per request. NAC s real-time visibility features and automated remediation capabilities will reduce the number of trouble tickets over a defined time period. For example, the BYOD trend is increasing the burden on IT help desk teams who are challenged to support a rapidly growing number of network connecting devices from a range of different end users. Organizations are also utilizing NAC solutions to ensure and demonstrate compliance with IT-GRC control requirements. For example, NAC s device profiling capabilities have been used effectively to secure organizations in healthcare, manufacturing, and utilities. These organizations networks are characterized by large concentrations of unique, non-traditional, network endpoints such as health monitors and industrial control systems (ICS) that 2013 Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies. 5

6 Frost & Sullivan cannot be monitored with traditional network tools. NAC s centralized view of formerly disparate reporting mechanisms, along with automated endpoint remediation, can ensure and demonstrate compliance with industry and government regulations. NAC s ability to address IT-GRC concerns helps businesses to avoid costly fines and enables business strategies that are critical for continued growth. Advanced Threats Necessitate End-to-End Network Protection, Including Wireless, Wired, and Remote Connections Advanced persistent threat (APT) is the term used to describe the targeted and sophisticated attacks that penetrate enterprise and government networks to silently steal sensitive data, including state secrets, intellectual property, and trade secrets. Attackers may also steal resources or sabotage systems over an indefinite period. The fear of a costly security breach and malware infection spurs interest in security technologies, including NAC. NAC can ensure that devices meet minimum security requirements such as the presence of active, updated malware software depending on the organization s security goals and risk posture. As stated above, NAC interfaces with network, identity, and endpoint management tools, as well as security tools such as anti-malware, vulnerability scanners, next-generation firewalls (NGFW), intrusion prevention systems (IPS), and security information event management (SIEM), to enable IT to have greater intelligence while allowing them to respond more effectively and efficiently to mitigate threats and violations. NAC Vendors have Reduced Complexity Resulting in Decreased Customer Confusion Early NAC products were hampered by extensive requirements for specialized network switches, endpoint software, or tedious manual changes to access control lists. In some cases, the installation of a 802.1X client or other endpoint agent was required. Many NAC solutions do not require agents to be installed on the endpoint, though optional agents for some NAC vendors may provide deeper insight into device health. Additionally, customers have already invested in upgraded infrastructure capable of supporting NAC. Some NAC vendors will not have the requirement of a fully upgraded operating environment to enable NAC capabilities. NAC solutions are much more automated and do not require extensive manual start-up effort they have built-in device discovery and classification, templates for assessment and enforcements policies, and reporting capabilities that vary by vendor. Customers may also invest in NAC as a managed security service if they lack the in-house expertise or resources to implement and manage a NAC solution. MSSPs also enable customers to reduce their capital expenditures in favor of a more manageable operational expense Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies.

7 Frost & Sullivan 2013 Analysis of the Global Network Access Control Market Abridged Version NAC MARKET AND COMPETITIVE LANDSCAPE (HIGHLIGHTS) The NAC Market is Poised for Strong Market Growth Resulting from Customer Concerns About BYOD Security Risks Enterprise IT organizations are now challenged to enable access from any type of device, from corporate laptops and smartphones to employee-owned tablets and smartphones. Accordingly, the NAC market generated $235.5 million in revenue for Despite its history, the NAC market is now poised for strong market growth. The market grew by 24.3% in 2011 and is and is forecast to grow by an additional 23.3% through 2017 (CAGR ), reaching $670.7 million. Key buyer segments are enterprise, large enterprise organizations and technologically sophisticated SMB organizations. The NAC enterprise segment is poised for strong market growth in 2013 and 2014 this segment is the primary focus for NAC vendors. These organizations have thousands of users and devices concurrently connecting to the enterprise network. Each user may have a corporate-issued laptop and smartphone as well as a personal smartphone, laptop, and/or tablet. Enterprise organizations require a robust NAC system to identify end users and their devices. As a result, enterprise organizations with tens of thousands to hundreds of thousands of devices have implemented NAC or are considering a NAC deployment to manage access policies. Greater adoption by financial organizations and federal government agencies will help the market grow at a much faster pace than in previous years. Higher education and healthcare industries are also important vertical markets for NAC vendors. Any organization that has valuable intellectual property or unique access control requirements is a strong candidate for a NAC solution, which includes a wide range of verticals. There are 15 NAC vendors in the market. Cisco Systems, ForeScout Technologies and Juniper networks are the overall major market participants, in which these top three competitors have a 63.3% market share. In the enterprise segment, those customers with 20,000 or greater endpoints, the top three vendors, Cisco Systems, ForeScout Technologies and Juniper networks, have 64.2 share. In the SMB segment, those companies with fewer than 2,500 endpoints, Cisco Systems, ForeScout Technologies and Juniper Networks, the top three vendors, have a 60.7% share. Cisco and other infrastructure vendors (such as Aruba and Enterasys) are short-listed by their customers, but pure-play NAC vendors compete well in heterogeneous networks. Notable market changes include the acquisition of Napera by OPSWAT and McAfee s partnership with ForeScout Technologies as McAfee exited the market. McAfee and Symantec no longer sell NAC products. As McAfee s Preferred NAC Partner, ForeScout has many potential avenues for continued market growth Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies. 7

8 Frost & Sullivan Competitive Landscape Total NAC Market, Global, 2012 Meets Market Demands ForeScout Market Penetration Competitor Market Contender Market Leader Other vendor names referenced in this chart from the original study have been removed. Interested parties may contact Frost & Sullivan to attain the complete report. Source: Frost & Sullivan 2012 SWOT Analysis of Top Three Vendors Company Strengths Weaknesses Opportunities Threats Cisco Network infrastructure integration; identity and context-based policies Lack of support for competing network infrastructure; complex product/difficult deployment Existing Cisco customers; new infrastructure customers Easily deployed point products with broader integration capabilities ForeScout Leads in MDM and network integration; enables GRC compliance; extreme scalability; operates agentlessly Premium price tag limits adoption by smaller organizations Organizations with best-of-breed NAC requirements; mixed network environments NAC add-on sales by network infrastructure vendors Juniper Supports TCG TNC s IF-MAP program; interoperates with other vendors equipment BYOD and guest registration functionality requires investment in Junos Pulse gateways Juniper customers with guest registration challenges; organizations with unique endpoints Competition from other infrastructure vendors and easilydeployed, pure-play NAC vendors Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies.

9 Frost & Sullivan 2013 Analysis of the Global Network Access Control Market Abridged Version NAC provides a number of benefits for IT operations by streamlining or automating guest registration, centralized management, device on-boarding, remediation, and network visibility. NAC delivers useful functionality to help address the security risks associated with BYOD practices, which is a top of mind concern for many IT organizations. However, this value proposition is multi-faceted and vendors are challenged to distill this message into a concept that can be easily communicated to customers. Vendors that can solve these challenges can displace competitors and acquire new competitors in the coming years. COMPETITIVE FACTORS AND ASSESSMENT EXPLANATION Competitive Factors and Assessment Total NAC Market: Global, 2012 Competitor Scalability Flexibility/ Integration Security Efficacy Deployment/ Management Features/ Functionality Product Value/Cost Aruba Networks Bradford Networks Cisco Enterasys Networks ForeScout Impulse Point InfoExpress Juniper Key: Excellent Strong Average Weak Source: Frost & Sullivan 2013 Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies. 9

10 Frost & Sullivan Scalability Ideally, multiple NAC appliances can be combined to support networks with hundreds of thousands of endpoints. Flexibility/Integration Vendors should offer virtual appliances and physical appliances to support different network environments. NAC must integrate with a wide range of identity systems, security tools, and network infrastructure to be effective. Security Efficacy NAC products should detect agentless devices pre-connection and also provide post-admission monitoring. Deployment/Manageability NAC should be easily deployed in the network. Special network equipment and endpoint agents should be optional. NAC policy creation should be intuitive and provide a central view of all NAC-controlled devices. Features/Functionality The current generation of NAC products offer tremendous functionality for IT operations automation, guest registration, sponsorship/automation, BYOD policies, network inventory, and remediation. NAC vendors continue to develop new applications to solve customers device access management challenges. Product Value/Cost NAC solutions are generally designed for enterprise organizations and have a high price tag. However, vendors should focus on reducing total cost of ownership including, requirements for supporting hardware. THE LAST WORD PREDICTIONS 1. BYOD is the highest-demanded usage case that will introduce many customers to the full capabilities and extensive value of modern NAC solutions. 2. The NAC market has been tarnished by poor historical performance but will soon evolve to its final form focusing on IT optimization, automation, and value with a secondary focus on security. 3. NAC will become an essential portfolio offering for any IT infrastructure provider which will encourage another round of merger and acquisition activity as a means of overcoming barriers to market entry Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies.

11 Frost & Sullivan 2013 Analysis of the Global Network Access Control Market Abridged Version ASSESSMENT OF FORESCOUT TECHNOLOGIES AND FORESCOUT COUNTERACT (NAC) ForeScout Strengths Strong product and market execution; virtual appliance, mobile security, NAC as a service, channel development, and selling into larger enterprise accounts. Integration, usability, and deployment advantages are well suited for medium-to-large enterprises and government agencies as those have greater functional and management requirements. ForeScout's focus on building out a platform to support bi-direction integration with network and security infrastructure satisfies new demand for continuous compliance and mitigation products. ForeScout has demonstrated the ability to meet customer needs and address key NAC challenges. The company is poised for continued market success. Competitor Opportunities ForeScout competes with larger infrastructure competitors and their highly-diversified product lines. Network infrastructure and wireless vendors can bundle NAC sales with other products. ForeScout will have to broaden its portfolio through strategic partnerships or consider mergers and acquisitions. Product Features Hybrid 802.1x and non-802.1x support. Virtual appliance for CounterACT and CounterACT Enterprise Manager. Mobile security functions identify and apply policies for guest registration and limit network access for personal mobile devices. Extensive network, security, identity, wireless, and mobile infrastructure integration. Data Exchange Module allows for external structured data sources to be imported and applied as operational attributes into CounterACT and for data within CounterACT to be sent to external sources, allowing for rapid integration of new devices and customer applications Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies. 11

12 Frost & Sullivan Security and Operational Automation Leadership Real-time device discovery and classification provides timely and in-depth network device visibility. Plug-in architecture enables rapid interoperability with popular network and security infrastructure. Flexible controls from policy monitoring to broad enforcement options. Extensive endpoint compliance, remediation, and reporting features. Interoperability with Mobile Device Management, Next-Generation Firewall/VPN, Vulnerability Assessment, Advanced Persistent Threat, and Security Information Event Management platforms via add-on modules. Managed Security Service Strategy ForeScout is offering channel partners the means to offer NAC as a managed service. Product packaging, subscription-based licensing and support designed for MSSP. NAC as a managed service allows customers to offset capital expenditure and management expertise. Product Meets Customer Needs Out-of-band installation and agentless device inspection ensures that CounterACT is non-intrusive and provides for rapid deployment. Integrated NAC functionality, including built-in and customizable policy sets. Optional dissolvable and persistent agent offers broader endpoint inspection and enforcement Frost & Sullivan. All rights reserved. Report Compliments of ForeScout Technologies.

13 Silicon Valley 331 E. Evelyn Ave. Suite 100 Mountain View, CA Tel Fax San Antonio 7550 West Interstate 10, Suite 400, San Antonio, Texas Tel Fax London 4, Grosvenor Gardens, London SWIW ODH,UK Tel 44(0) Fax 44(0) GoFrost ABOUT FROST & SULLIVAN Frost & Sullivan, the Growth Partnership Company, works in collaboration with clients to leverage visionary innovation that addresses the global challenges and related growth opportunities that will make or break today s market participants. For more than 50 years, we have been developing growth strategies for the Global 1000, emerging businesses, the public sector and the investment community. Is your organization prepared for the next profound wave of industry convergence, disruptive technologies, increasing competitive intensity, Mega Trends, breakthrough best practices, changing customer dynamics and emerging economies? Contact Us: Start the Discussion For information regarding permission, write: Frost & Sullivan 331 E. Evelyn Ave. Suite 100 Mountain View, CA Auckland Bahrain Bangkok Beijing Bengaluru Bogotá Buenos Aires Cape Town Chennai Colombo Delhi / NCR Detroit Dubai Frankfurt Iskander Malaysia/Johor Bahru Istanbul Jakarta Kolkata Kuala Lumpur London Manhattan Mexico City Miami Milan Mumbai Moscow Oxford Paris Pune Rockville Centre San Antonio São Paulo Seoul Shanghai Shenzhen Silicon Valley Singapore Sophia Antipolis Sydney Taipei Tel Aviv Tokyo Toronto Warsaw Washington, DC