Security took center stage during the Fortinet Cybersecurity Summit 2024 in Toronto. Experts from the leading cybersecurity solutions provider spoke about simplifying network operations through integrating security products, a method that can help managed service providers (MSPs) improve their security posture.
Fortinet is a global company that uses all of its products in the same environment, so it’s important to have strong integration practices and simplified security operations to utilize those products and deliver them to customers. Through managed security solutions and cloud-based solutions, Fortinet is dedicated to mitigating risks for customers in Canada and around the globe.
Fortinet’s three operational work streams
Not every company utilizes all the products that Fortinet has, but there is at least one: Fortinet itself. With all its security products and services, how does this large company simplify and integrate all these tools? As a global, multinational company that deals with R&D, cloud services, regulatory compliance, etc., Fortinet organizes all of its tools into three teams within its organization—a model that MSPs can exemplify.
Those three operational work streams include:
- Infrastructure & networking: This is managed by the global IT company, which secures all of the user traffic and manages all of the remote offices and users connecting remotely.
- Global SaaS operations: Fortinet offers 40+ cloud services and has a cloud operations team that manages and maintains a single platform across the public cloud and all of its data center locations.
- Security operations: Generally handled by the InfoSec team, this stream deals with all the logs and security use cases.
Fortinet’s host of security tools has evolved over time, integrating more capabilities such as SD-WAN and SASE. By maintaining these operational work streams, Fortinet can add new tools to provide customers while preserving its integration capabilities.
“We accelerated from just a niche player in the SD-WAN market, to now a far and away leader in that space, because we really focus on usability and simplifying the operations around it,” said Robert May, Executive VP, Technology and Product Management, Fortinet. “The next phase of that, I think you’re going to see, is around SASE, because it’s something that we support natively as part of that same OS.”
The evolution of cloud services
One can’t mention cybersecurity without considering cloud services and their flexibility. Cloud services help with the deployment of security updates and the integration of various services like Endpoint Detection and Response (EDR), Network Detection and Response (NDR), and Secure Access Service Edge (SASE).
SASE allows for global availability by leveraging both public and private cloud deployments, offering flexibility in data center selection. The conversation at the Summit highlighted how Fortinet has enabled SASE to run on both private and public clouds so companies can have services available globally and as close to the user as possible.
“Our customers can choose which data center locations they want to use and be able to selectively choose them based on where their offices are located and based on where their users are located as well,” said SVP of Product Development at Fortinet, Jordan Thompson. “And on top of these platforms, you’ve got managed services.”
Thompson added that Fortinet provides sovereign, or air gap deployments, for all of its cloud services. If a company needs to deploy one on-prem for specific regulatory compliance, Fortinet aims to have feature parity and continuous support for those products and services.
Fortinet has no problem standing up cloud capabilities, but securing them is the more difficult task.
“If you want to deploy something in the cloud, first, I need to secure the traffic that’s going in and out of the cloud or between the services in the cloud,” said Thompson. “This is the application access, the web access, the API access, and then dealing with load balancing and some of the unique threats such as bots that are trying to attack my web applications.”
Historically, this has required multiple different individual products, but in the fourth quarter of 2024, Fortinet consolidated those products under a unified management platform.
“These are all one platform now that I can just simply enable the features selectively as I need them,” said Thompson.
Securing the overall cloud platform is another key area for Fortinet. This requires technology that can scan an entire environment and alert users of incidents so that they can take the necessary actions.
Cloud-Native Application Protection Platforms (CNAPP) in modern security
Earlier this year, Fortinet acquired data-driven cloud security company Lacework. Lacework delivers an AI-powered cloud security platform that seamlessly integrates all critical CNAPP services. Fortinet has integrated Lacework’s CNAPP solution into its existing portfolio, forming a comprehensive, full-stack AI-driven cloud security platform.
CNAPPs play a key role in addressing the complexities introduced by cloud technologies, DevOps, and open-source dependencies.
“The cloud always sounds wonderful because we’re talking about it from a development standpoint, but I think that there’s a truth that when it actually comes to the security side of the house, the cloud actually creates a lot of very real challenges for all of you,” said Adam Larson, US CSE, Fortinet at the Summit. “There are a lot of real reasons why I think that cloud makes security much harder than it’s ever been.”
Larson says that CNAPP is essentially a gauntlet of protections, solving what was traditionally considered a very disparate problem. Organizations are not going to be able to eradicate all the risks from their systems or prevent threats from occurring, so instead, it becomes about composite risk.
“Looking at it through that lens of CNAPP is really taking all these kinds of traditional application security components and just blending them all together to give you a more comprehensive and more effective view of what things are going to be most worthwhile because you can’t do everything,” Larson said. “You need to take proactive steps or reactive steps to mitigate risk.”
CNAPP offerings, as part of Fortinet’s ecosystem of solutions, are important in securing all aspects of an organization’s security posture in cloud environments while also providing security for on-prem applications and employee devices.
The integration of CNAPP with other Fortinet security products helps position it as a seamless addition to an organization’s security story.
“Security is a very challenging problem because you don’t get points for trying in any one space,” said Larson. “Instead, you have to really be thinking about all of these things in totality. You’re going to be seeing a lot more of CNAPP in the near future.”
Fortinet’s cybersecurity summit brought together experts from all areas to discuss cybersecurity and share best practices. Read more about the summit here and how Fortinet is continuing to protect organizations’ ecosystems.