Looking for Opinions

[ccorinthos]

Hello,

I'm hoping to get some input from you guru's out there...

My company has been asked if we want to be a part of a WAN with other companies (not related to or having anything to do with us) in an effort to cut costs.  While they claim it will be safe, I just see this as a bad idea for the following reasons:

- I have no idea what the other companies are running in terms of security

- I have no control (nor do I want it) of what goes on in those companies regarding security policies

- If someone at one of these other companies manages to create a security hole which gives a hacker access to their network, isn't there a possibility the same hacker would have access to the sites on the WAN?

If you could let me know if you would be for or against this and why, I would greatly appreciate it.

Thanks in advance.

[Marvin Rhoads]

Any external connection from your network should at a minimum have some security controls. The most common method is via a security appliance (like a Cisco ASA) which may or may not have advanced services like IDS/IPS (i.e ASA with FirePOWER services) built-in.

You can do some basic firewalling on your routers but that's not as commonly used and doesn't provide the same broad protections that a dedicated appliance can.

The right solution for you depends in part on your current network vs. the planned solutions looked at in the context of what you have to protect internally and what other measures you may have in place to protect it.

[ccorinthos]

Thank you.  But from the postion of sharing a a WAN with other organizations who have nothing to do with us or answer to us in any way, should we even entertain this concept?  Even with an ASA in place on our end, doesn't sharing a WAN put us at a higher risk than if we were on our own with only our own offices on the WAN?

[Marvin Rhoads]

The term WAN is not precise.

Some people use is as synonymous with their ISP circuit. Others use it to refer to an MPLS network may or may not be Internet isolated (usually via the use of VRF instances in the provider backbone). Still others use it to refer to dedicated point to point circuits between offices that have no Internet access at all.

Depending on it's use in your case, it may or may not be less secure.

[ccorinthos]

I see. 

So lets say this is my scenario :

Several organizations would be a part of a network which all go through  a "hub site" for Internet access.  The hub site would be responsible for monitoring this network.  Keep in  mind the hub site is not in the ISP or cyber security business.  They would also have the ability  to manipulate the network  allowing one company  to connect to another if we wanted to share resources.  Based on that, am I at risk  if we participate?

Is there something i should ask which would tell me if this solution is secure?

Thank you for your time!