CONTACT US
1-844-4ZPE-SYS
ZPE CLOUD

Providing Out-of-Band Connectivity to Mission-Critical IT Resources

Home » Archives for June 2023

Best Practices to Protect your Infrastructure & Combat Ransomware with ZPE Systems Services Delivery Platform

by | Jun 28, 2023 | Webinars & Presentations

Home » Archives for June 2023

Webinars & Presentations

GO TO WEBINARS & PRESENTATIONS
Cisco Live Koroush Presentation

Best Practices to Combat Ransomware

Protect your Infrastructure & Combat Ransomware with ZPE Systems’ Services Delivery Platform

Presented by Koroush Saraf, VP of Marketing and Products

CLUS23-KS-Presentation

Why do ransomware attacks continue despite 2,000+ #cybersecurity companies and 10,000+ products? Most organizations aren’t aware of the best practices used by the top brands and tech giants. In this presentation, ZPE Systems’ VP of Products and Marketing, Koroush Saraf, covers this problem in-depth and shows you the safe, reliable way to defend against attacks using #automation.

Take this story with you and download the slides now

Log in to the Cisco Live Portal to View the Recording

Having trouble with the Cisco Live portal? Fill out the form below and we’ll help you out.

Listen to Vapor IO put these best practices to the test

Vapor IO is re-architecting the internet. They deployed these best practices using ZPE Systems’ Nodegrid, which enabled full lights-out management and automated patching. Not only do they keep ops running at up to twelve-nines reliability, but they also have the isolated management network to keep systems patched and up-to-date.

Hear the story from Frank Basso, EVP of Ops at Vapor IO, on the recent Packet Pushers podcast.

PP-ZPE-Vapor

ZPE Systems delivers innovative solutions to simplify infrastructure managment at the datacenter, branch, and edge.

Learn how our Zero Pain Ecosystem can solve your biggest network orchestration pain points.

Watch a Demo Contact Us

Video Wall

How to Implement Zero Trust for OT

by | Jun 26, 2023 | Improve Network Security, Micro-segmentation, Remote Network Management, Zero Touch Provisioning (ZTP), Zero Trust Security

zero trust for ot
Enterprise security teams traditionally focus on IT networks, but operational technology (OT) security is just as important. OT comprises equipment that interacts with the physical world, such as sensors, temperature gauges, and motors, as well as the systems used to control that technology. Attacks on OT systems have a huge impact on business operations and customers, often causing more devastation than an IT breach. For example, an attack on an oil pipeline’s control systems could shut down production for weeks and affect millions of people in the region.

“Zero trust” is a security methodology designed to reduce the risk of attack through network segmentation, granular access policies, and advanced security technologies. Many organizations use zero trust to protect their IT networks, but it’s just as critical to the safeguarding of operational technology. This post defines zero trust security before explaining how to implement zero trust for OT.

Table of Contents:

What is zero trust for OT?

According to recent research by Barracuda Networks, more than 90 percent of manufacturing organizations saw cyberattacks hit their production or energy supply in 2021 alone. OT is a frequent target because of how devastating an attack can be on business operations and because it often lacks the same security policies and controls that protect IT infrastructure. To solve this problem, teams need to apply zero trust security principles, policies, and technology to their OT networks. The zero trust security methodology follows the motto “never trust, always verify.” That means operating under the assumption that no users or devices should be trusted, even if they’re logging in from within the main office. Achieving a zero-trust architecture means segmenting IT and OT networks and creating micro-perimeters of highly specific security policies and controls to protect each segment. Zero trust often uses advanced security technologies like AIOps and machine learning to enforce those policies, identify subtle signs of compromise, and quickly resolve security incidents.

How to implement zero trust for OT

Let’s discuss the requirements and best practices for implementing zero trust for OT.

Isolate critical systems with segmentation

Zero trust requires custom-tailored security policies and controls to protect specific network resources. That means network teams must logically segment the network based on which resources need to be protected by which policies and technologies, a practice known as micro-segmentation.

OT is often grouped together into a single micro-segment under the assumption that all OT needs the same protection. However, not all OT is created equally, especially in the eyes of a would-be attacker. For example, a programmable logic controller (PLC) gives cybercriminals control over manufacturing processes, but compromising an access control system lets them physically infiltrate the building. Some organizations take zero trust even further by using nano-segmentation to isolate individual systems, applications, or containers to create extremely effective micro-perimeters to address specific vulnerabilities.

Micro- and nano-segmentation are the backbone of a zero-trust architecture, enabling the creation of micro-perimeters using granular access policies and security controls customized for the protected resources.

Create and enforce strong security policies

Zero trust security policies determine who can pass through each micro-perimeter and who can access each OT resource. These policies should follow a least-privilege approach, meaning everyone gets the bare minimum privileges required to complete their workflows and nothing more. The best practice is to use role-based access control (RBAC), categorizing individual accounts based on their role (e.g., system administrators or machine operators) and giving each role least-privilege access to the resources required for that job.

The best way to create and enforce zero trust security policies is with an identity and access management (IAM) solution. A zero-trust IAM solution monitors each micro-perimeter to verify the identities of all accounts requesting access and attempts to establish an account’s trustworthiness using methods like two-factor authentication (2FA). Some advanced IAM solutions even use machine learning technology like user and entity behavior analytics (UEBA) to monitor account activity on the network and spot anomalous behavior that could indicate compromise.

  • IAM = Identity and Access Management: Creates and deploys policies, verifies identities, and establishes trustworthiness.
  • 2FA = Two-Factor Authentication: Requires an additional form of identity verification (besides the username and password), such as a code sent to an authorized mobile device.
  • UEBA = User and Entity Behavior Analytics: Uses machine learning to monitor account activity, creates baselines for normal behavior, and identifies anomalies that could mean an account is compromised.

Strong, granular security policies and zero-trust IAM solutions help protect OT by limiting account privileges and preventing compromised accounts from accessing network resources.

Leverage advanced security technologies

There are additional security technologies that support or enhance zero trust for OT. For example, a next-generation firewall (NGFW) makes network segmentation easier and includes advanced features such as application-aware filtering and deep-packet inspection. Secure access service edge (SASE) delivers zero trust security solutions to the network edge, safeguarding OT at remote branch sites with the same policies and controls as the central enterprise network. AIOps uses artificial intelligence for better threat detection and faster incident recovery.

Organizations use advanced security technologies to fortify micro-perimeters, extend zero trust to the edge, and gain enhanced detection and recovery capabilities.

Implement zero trust for OT with Nodegrid

Zero trust security protects operational technology using network segmentation to create micro-perimeters of strong security policies and advanced security technologies custom-tailored to each individual resource’s requirements and vulnerabilities. Achieving zero trust is typically a long and tedious process because of how many solutions and devices you must deploy.

The Nodegrid solution from ZPE Systems alleviates this challenge by providing a vendor neutral platform capable of hosting and deploying all your zero trust security technologies. For example, Nodegrid network edge routers deliver all the networking capabilities required to spin up an OT branch and can directly host your choice of third-party security solutions. Nodegrid reduces hardware expenses by consolidating network functionality onto fewer devices while unifying network and security management under a single umbrella for greater operational efficiency.

In fact, Nodegrid is an entire Services Delivery Platform that you can deploy anywhere in your network architecture to host your critical third-party SaaS (software as a service) solutions. That means you can create a customized branch-in-a-box that combines gateway routing, switching, out-of-band (OOB) management, NGFW, SASE, infrastructure automation, and more in a single device.

Ready to Learn More?

Contact ZPE Systems to learn more about implementing and enhancing zero trust for OT with the Nodegrid Services Delivery Platform.

Contact Us

SD-WAN ROI Calculator & Cost Reduction Strategies

by | Jun 26, 2023 | Increase Productivity, Minimize Impact of Disruptions, SD-WAN, Secure Access Service Edge (SASE), Simplify Branch Infrastructure, Streamline Deployments

sd-wan roi calculator

As an organization expands by adding new branches, its WAN also expands. The larger the WAN grows, the more network traffic needs to flow through MPLS (multi-protocol label switching) circuits, which have much more expensive bandwidth fees than traditional circuits. Some organizations improve their network performance by deploying security appliances at regional data centers, so they don’t need to backhaul traffic through the central firewall, but this only increases MPLS expenses and operating costs. Plus, spinning up each branch takes time, partly because of how long it takes to install a new MPLS circuit, which reduces agility and increases overhead costs.

SD-WAN, or software-defined wide area networking, abstracts WAN management to a separate control plane, streamlining workflows and allowing for a high degree of automation. SD-WAN makes it possible to leverage 5G and other networking technologies to reduce the reliance on MPLS circuits while still applying security policies and controls. With SD-WAN, you can lower your MPLS bandwidth costs, reduce the number of security appliances deployed around the enterprise, and deploy new branches faster.

In this post, we describe how SD-WAN decreases branch networking costs. We also explore strategies to reduce your expenses, providing an SD-WAN ROI calculator for a more personalized estimate of your potential savings.

How SD-WAN reduces branch networking costs

 

Reducing branch networking costs with SD-WAN
SD-WAN decreases MPLS bandwidth expenses by leveraging 5G and other available networks when possible.
An SD-WAN on-ramp to SASE means fewer security appliances deployed around the enterprise.
SD-WAN results in faster branch deployments by decreasing the reliance on new MPLS circuit installations.

 

Implementing SD-WAN can result in the following cost reduction benefits.

Decreased MPLS bandwidth expenses

In a traditional WAN architecture, MPLS circuits are installed at each branch to create a semi-private connection back to the primary enterprise network; this traffic isn’t encrypted, but it is partitioned from the public internet and other MPLS customers. MPLS networks are very reliable, but the bandwidth is significantly more expensive than public internet bandwidth. Finding ways to reduce the amount of traffic over MPLS circuits can reduce the ongoing operational costs of each branch.

SD-WAN leverages whatever networks are at its disposal—including MPLS, public ISPs, and 5G/4G cellular—to find the best and most efficient path for branch traffic. An organization can use SD-WAN software to prioritize specific kinds of traffic based on parameters such as the apps or resources being requested, so precious MPLS bandwidth is only used when needed. Many organizations are able to move away from MPLS completely by using SD-WAN. Providers are also required to build their SD-WAN fabric from encrypted tunnels, allowing SD-WAN to direct traffic over the public internet with less risk.

Cost reduction strategy: secure access service edge (SASE)

Even with SD-WAN’s encryption, branch traffic still needs to pass through a security appliance in the central data center so enterprise security policies and controls can be applied, which likely means using the MPLS anyway. Secure access service edge, or SASE, rolls up multiple enterprise security technologies (such as next-generation firewalls (NGFWs) and data loss prevention) into a single solution delivered as a service, which means organizations can deploy it to regional data centers or even the branches themselves. SD-WAN’s intelligent routing feature can determine when branch traffic is destined for cloud or web resources, then direct this traffic through the SASE stack instead of using the MPLS to reach the central firewall. SASE can help eliminate MPLS usage completely while reducing bottlenecks for greater cost savings.

With SD-WAN and SASE, your organization can reduce the ongoing monthly expense of MPLS bandwidth at each branch without sacrificing reliability or security.

 

Fewer security appliances

To ensure that branch traffic is as secure as the primary enterprise network, teams usually backhaul that traffic through the same central firewall for inspection and policy application. This creates a massive bottleneck that can slow the entire enterprise down, so some organizations choose to deploy security appliances at smaller regional data centers near their branch locations to distribute the load. However, that usually means additional MPLS circuits are provisioned at each data center, increasing startup and bandwidth costs. Plus, there are the hardware, software, and licensing costs for all the additional security appliances.

We’ve already mentioned how SD-WAN leverages alternative networks (as well as encrypted tunnels) to reduce MPLS bandwidth usage and how SASE applies enterprise security controls to branch traffic while bypassing firewalls entirely. These two benefits also result in cost savings from needing to purchase and license fewer security appliances. Since vendors deliver SASE as a service, it doesn’t necessarily require special hardware to run, and some providers even offer it as a managed cloud service, eliminating the hardware cost altogether.

Cost reduction strategy: vendor-neutral solutions

On-premises versions of SASE usually don’t need vendor-specific hardware so you can deploy the software on any available server as a VM. However, many branches lack the extra server storage or computer headroom needed for this kind of deployment. To ensure you can deploy SASE without buying additional resources, consider vendor-neutral branch networking solutions that can directly host and run third-party VMs. That means you can get gateway routing, switching, out-of-band serial console management, and SASE in a single device, consolidating the branch networking stack to reduce hardware expenses and management complexity.

With SD-WAN, SASE, and vendor-neutral solutions, you can streamline your branch deployments to reduce costs and increase efficiency.

 

Faster branch deployments

Generally speaking, the faster a company can deploy a new branch, the faster it will see a return on investment (ROI). However, getting a new MPLS circuit provisioned can take a long time—several months is typical—which can delay deployment timelines and increase overhead expenses while an organization sits on a non-productive branch.

SD-WAN makes it possible to leverage alternative network technologies to get a branch up and running before the MPLS circuit is ready. For example, SD-WAN can direct branch traffic across a 5G network even before the main fiber or cable connection is installed. When all of the branch circuits are provisioned, SD-WAN can seamlessly incorporate them into its routing policies based on preconfigured policies and automation triggers for a smooth deployment. In short, SD-WAN eliminates the organization’s reliance on MPLS for revenue generation, with branches that can be fully operational as soon as LTE or ISP links are set up.

Cost reduction strategy: zero touch provisioning (ZTP)

Another way to reduce branch spin-up times is with zero touch provisioning, or ZTP. ZTP uses software scripts to execute new device configurations over the network, reducing the need for pre-staging or manual, on-site programming. Typical branch deployments involve sending engineers on-site to manually copy and paste configuration files, which is time consuming and increases the risk of human error. With ZTP, unskilled on-site staff simply plug in new device cables and the configuration scripts are automatically retrieved and executed to fully build the environment without human touch. Plus, ZTP scripts are reusable, so you can use the same ones to deploy many different branches.

With SD-WAN and ZTP, your organization can reduce branch deployment delays and see a faster ROI from new branches.

 

SD-WAN ROI calculator

ZPE Systems provides vendor-neutral branch networking solutions that can directly host or integrate your choice of SD-WAN and SASE applications. ZPE’s platform also allows you to extend ZTP and other automation to every device in every branch on your network. Check out our SD-WAN ROI calculator for a customized estimate of how much money you can save by deploying SD-WAN on ZPE’s platform.

ZPE System’s Nodegrid solution combines branch networking, out-of-band management, and vendor-neutral orchestration into a single platform.

To learn more about using Nodegrid as your on-ramp to SD-WAN, or for help with the SD-WAN ROI calculator, contact ZPE Systems today

Contact Us

IoT in Finance Industry and Security Challenges

by | Jun 26, 2023 | Data Logging, Improve Network Security, Micro-segmentation, Network Automation, Remote Network Management, SD-WAN, Secure Access Service Edge (SASE), User Management, Zero Trust Security

IoT in Finance Industry and Security Challenges
The Internet of Things (IoT) drives new innovations in the finance industry by empowering organizations to harvest more data, improve operational efficiency, and provide better customer service. However, adding dozens of low-touch devices to the network’s edge creates major security, privacy, and compliance challenges.

This post discusses how to take advantage of IoT in the finance industry by overcoming security challenges with automation, secure platforms, and vendor-neutral orchestration

IoT in the Finance Industry: Security Challenges and Solutions

The challenge: Unpatched, out-of-date IoT devices are easier to compromise for harvesting sensitive data.

The solution: Automated patch management using vendor-neutral management platforms that can dig their hooks into multi-vendor IoT.

The challenge: Unsecured remote management interfaces can be used by cybercriminals to access IoT devices and data.

The solution: Secure management hardware and software protected by robust security features like self-encrypted disk (SED) and two-factor authentication (2FA).

The challenge: It’s difficult to enforce security and privacy policies on remote IoT devices that process regulated financial data at the edge of the network.

The solution: A vendor-neutral security orchestration platform that extends Zero Trust Security policies and controls to multi-vendor IoT at the edge.

The challenge: It’s difficult to troubleshoot and resolve security incidents involving remote IoT devices without expensive, time-consuming truck rolls.

The solution: Secure out-of-band (OOB) management solutions that integrate with (or even directly host) third-party automation and AIOps tools.

The challenge: A lot of complexity is involved in gaining holistic security coverage over a distributed, multi-vendor financial network without leaving any gaps.

The solution: A vendor-neutral platform that unifies security and network management for the entire architecture behind a single pane of glass.

 

IoT in the finance industry: security challenges and solutions

There were over 10.54 million global IoT cybersecurity attacks in December 2022 alone. In the finance industry, a breach can result in significant consequences, including regulatory fines and irreparable reputational damage, which means IoT security must be a top priority. Let’s discuss the specific security challenges of using IoT in the finance industry.

Challenge #1: Keeping IoT devices up-to-date

IoT typically uses low-touch, set-it-and-forget-it devices, so they’re deployed around the network’s edge and receive little interaction from operators or technical staff. For example, IoT devices collect sensitive financial data from ATMs, self-service payment kiosks, and smartphone applications with little-to-no human oversight. That makes it easy for network teams to forget about operating system (OS) and software updates, especially when dozens or thousands of IoT devices are in use.

In fact, a recent report found that teams wait an average of 205 days to patch their infrastructure. This is a frightening statistic given that out-of-date software is rife with vulnerabilities just waiting to be exploited by cybercriminals looking for valuable financial data.

Solution: Automated patch management

Automating patches is the best way to ensure they’re installed on time. For example, many IoT device management systems provide dashboards where admins can see IoT device versioning information at-a-glance, manually deploy or roll-back updates, or create automated schedules/triggers to deploy those updates without manual intervention. However, most of these platforms only work within specific vendor ecosystems, which limits your capabilities. The best practice is to use a vendor-neutral IoT device management platform that can dig its hooks into multi-vendor IoT devices. This will ensure that critical IoT devices like credit card payment readers are kept secure and up-to-date.

 

A vendor-neutral IoT device management platform with automated patch management ensures that all devices are kept up-to-date and no vulnerabilities fall between the cracks.

Challenge #2: Securing remote management interfaces

Network admins typically work from a centralized location, which means they remotely access and manage IoT deployments at the branch and edge using jump boxes or serial consoles. If these remote management devices and interfaces aren’t adequately secured, malicious actors could use them to access IoT data and move laterally to other sensitive resources on the network. However, many admins deploy jump boxes without onboarding them with IT, which means they’re not added to security monitoring software and don’t have enterprise policies or controls applied. Serial consoles, on the other hand, often lack the advanced security features and integrations needed to protect them from cybercriminals.

Solution: Secure management hardware and software

The newest generation of serial consoles includes robust hardware security features and supports advanced authentication methods to safeguard remote management interfaces from compromise. A 3rd generation – or Gen 3 – serial console has onboard security features like a self-encrypted disk (SED), secure boot, BIOS protection, and geofencing, so malicious actors can’t access a stolen device. In addition, it supports SAML 2.0 authentication (via integrations with providers like Okta and Ping) and other advanced authentication methods to prevent unauthorized access to its software.

 

A Gen 3 serial console solution uses robust onboard security features and third-party security integrations to protect management hardware and interfaces.

Challenge #3: Complying with data privacy regulations

In a highly-regulated industry like finance, organizations must keep track of which people and devices can access sensitive data and ensure that permissions are granted on a least-privilege basis. Typically, achieving this level of granular control requires applying strict Zero Trust Security policies to every device and user accessing the network, including IoT devices at the edge. However, extending enterprise security policies and controls to the edge is difficult in a distributed, heterogeneous environment due to vendor lock-in.

For example, some branch networking solutions don’t support integrations with third-party identity management tools, forcing you to use their built-in access management settings. That means admins must manually recreate their Zero Trust data access policies in the router settings at every single branch and ensure they’re kept up-to-date.

Solution: Vendor-neutral Zero Trust Security orchestration

A centralized Zero Trust Security orchestration platform allows admins to deploy and manage security policies and controls across the network from a single place. A vendor-neutral platform can extend policy enforcement and other vital security controls to any device or application on the network. For example, you can apply the same Zero Trust data policies to all branch routers in the entire architecture to ensure consistent enforcement.  Such a platform makes compliance easier because financial organizations gain greater control over data access privileges and monitoring for IoT devices deployed anywhere in the world.

 

A vendor-neutral Zero Trust Security orchestration platform simplifies IoT data compliance by providing a centralized control panel to deploy and manage security policies across the entire distributed network architecture.

Challenge #4: Quickly resolving IoT security incidents

When malicious actors compromise an IoT device, financial organizations must act quickly to avoid regulatory fees and reputational damage. However, these devices are often deployed in remote, hard-to-reach locations with no technical or security staff nearby, such as in rural or island communities. That means problems require an expensive, time-consuming truck roll to resolve. Even with a team on-site, manual root cause analysis (RCA) and recovery efforts take a lot of time and effort, increasing both the duration and the expense of incidents.

Solution: Secure OOB with automation and AIOps support

The solution to this IoT security challenge involves out-of-band serial consoles and automation.

  • Out-of-band (OOB) serial consoles create a dedicated control plane to manage, troubleshoot, and recover remote devices and infrastructure. Admins access this control plane via alternative network interfaces that don’t rely on the production network at all. This means teams can still reach remote IoT devices even if the ISP goes down or the LAN is compromised by ransomware. The best practice is to use a Gen 3 serial console with advanced security features, as discussed above.
  • Automation and AIOps streamline the incident resolution process by automating RCA and recovery workflows. A Gen 3 OOB serial console solution can integrate or even directly host third-party automation and AIOps tools, ensuring teams always have remote access to their recovery toolkit during an outage or breach.

 

A secure, Gen 3 OOB serial console ensures 24/7 remote access to edge IoT deployments and supports automation and AIOps for faster security incident resolution.

Challenge #5: Gaining holistic security coverage

A distributed financial services network with many branches, ATMs, edge sites, and IoT devices has a large attack surface, so it requires several different security solutions to cover all potential vulnerabilities. Gaining complete security coverage over every IoT device in every location means deploying many appliances, each of which needs to be installed, patched, and managed, adding a lot of complexity to network and security operations and further increasing the attack surface. The need to orchestrate so many moving pieces increases the risk that security teams will make mistakes and prevent organizations from operating efficiently.

Solution: Unified, vendor-neutral security orchestration

A vendor-neutral security orchestration platform unifies a company’s security solutions and workflows under a single management umbrella. For example, the Nodegrid platform from ZPE Systems can dig its hooks into other vendors’ security appliances and virtual solutions, giving security analysts a holistic overview of the entire architecture from a single centralized portal. Teams can use Nodegrid to orchestrate firewalls, identity and access management (IAM), patches, secure access service edge (SASE), and more.

Nodegrid’s hardware can even directly host third-party security applications for a streamlined, consolidated branch deployment. You can use the Nodegrid platform to build a complete DCIM (data center infrastructure management), network management, and automation orchestration solution, streamlining operations with a truly unified experience.

A vendor-neutral security orchestration platform provides holistic security coverage while reducing complexity, which prevents human error and increases operational efficiency.

IoT in the finance industry and security challenges

Deploying IoT in the finance industry comes with security challenges, including patch management, unsecured management interfaces, policy enforcement, incident resolution, and complexity. The Nodegrid platform provides finance industry solutions to help you overcome each of these challenges, including:

A truly vendor-neutral platform that unifies security, network, and infrastructure management behind a single pane of glass for holistic coverage.

Ready to Learn More?

To learn more about deploying IoT in the finance industry and overcoming security challenges with Nodegrid, contact ZPE Systems.

Contact Us

Atsign: Why Choose ZPE Systems to Host IoT Security?

by | Jun 22, 2023 | Application Hosting, Data Logging, Edge Computing, Improve Network Security, Increase Productivity, Network Automation, Out of Band Management, Remote Network Management, SecOps, Virtualization, Zero Touch Provisioning (ZTP), Zero Trust Security

Colin

A Conversation with Atsign CTO & Co-Founder, Colin Constable

This is a guest post composed by Atsign, creators of zero-attack-surface solutions including atProtocol.

We recently sat down with our CTO and Mariposa Rotary Club extraordinaire, Colin Constable, to discuss our partnership with our friends over at ZPE Systems. Let’s explore the driving force behind this powerful partnership, and how together we’re securing IoT devices and the data shared between them.

Why is this partnership strategically important?

We are a software company that helps people connect beyond the edge of the Internet. And as a software company, we need to have hardware to run our software on. After looking at a number of hardware platforms, ZPE stood out as an organization that provides a strong array of network connectivity options. Our software running on ZPE’s hardware serves as an edge platform that gives customers reliable access to edge-generated data.

What are some of the synergies between Atsign and ZPE?

First and foremost, ZPE’s hardware was designed from scratch to provide the openness and flexibility that we were looking for in a hardware platform. If I were going to design something like this myself, it would look very much like a ZPE box! It is incredibly easy to drop our Docker containers straight onto the platform, and they just simply work, which is quite a joy. To have a Docker container environment on an edge box is really the thing that makes ZPE stand out as a platform. Combine that with the fact that ZPE boxes are running x86, which makes things easy–plus actually having dual SIM cards–we can work with our MVNO partners to provide constant connectivity; even if hardlines go down, there’s cellular backup. The thing we can offer ZPE and their customers is if the box can see the Internet, then you’ll be able to address it, get data to and from it, and actually even log into it, and get hold of the built-in UI on the box.

Tell us about ZPE’s Docker Container support

Our docker containers literally just ran perfectly on the ZPE hardware. I went into the UI, selected my docker container, and it just ran. It doesn’t get much easier than that. Plus, there’s the promise of being able to have the docker container talk to connected devices like V.24 cables to provide connectivity to IoT devices.

Once IoT devices become directly addressable, then it opens up all kinds of opportunities for more efficient delivery or sharing of information that can save customers tons of money by eliminating a lot of the current infrastructure they currently use to do that job.

What are some real-world use cases for Atsign and ZPE Systems?

Because ZPE boxes have lots of connectivity options (e.g. serial ports, 4/5G backhaul, and ethernet–with more coming!) for connecting IoT devices, then you can have always-on devices at the edge, and be able to address and get data to and from them. For example, a radio station that has DSL connectivity, and cellular backup would be able to just automatically move over to cellular backup, notify the radio station that it’s on cellular backup, but use that connectivity until the ADSL line comes back online and at all times be able to get information from the equipment at the radio station. This is critical for radio stations, as it eliminates “dead air,” that moment when the transmitter is not transmitting. Sponsors rely on radio stations to put out notifications for what their businesses are doing, so having constant, uninterrupted connectivity is essential.

Do Atsign & ZPE Systems improve sustainability?

Traditional solutions would have you installing many different boxes. What we really like about the ZPE platform is that although the hardware provides lots of connectivity options–that reduces the footprint for starters–there’s no need to have different modems and firewalls, and any other services can be added via docker containers, so you actually have an environment where you have a single box, and it can do multiple functions at the edge.

What are your final thoughts on the partnership between Atsign and ZPE Systems?

As a software company, we need hardware to deploy on. We especially need hardware that can sit on the edge with all the right connectivity points. Atsign and ZPE Systems is really a perfect combination of great software and great hardware at the edge.

Bonus: What is Colin’s favorite firewall configuration for a ZPE box?

My favorite firewall rule is the one that costs the least money, and is ultimately the most secure firewall ruleset: Deny All. If you’ve got Deny All, that means that you don’t have to deal with the pain and complexities of firewall rules in order to address devices, which is what the real cost of networking is these days; it’s not necessarily the hardware, it’s actually having people to administer firewall rulesets. Having zero network attack surfaces, having a Deny All ruleset, just means you don’t have to have people changing rulesets all the time, which is a good thing.

Learn more about IoT Security & our partnership with Atsign