After ransomware virus, Merck's medicine was network automation

After suffering close to $1 billion in losses following a debilitating ransomware attack two years ago, pharmaceutical giant Merck & Co. treated itself with network automation tools designed to make its far-flung network more nimble and resistant to future outbreaks.

Merck was rocked by the 2017 NotPetya ransomware virus. The company, whose network connects 25,000 devices across 360 sites and 38 manufacturing plants worldwide, knew it needed to lock down its operations and find a way to modernize its networking infrastructure so it could run the latest Microsoft software and other cloud-based applications.

The answer, according to Merck associate director of network engineering and architecture Salvatore Rannazzisi, was network automation tools from Gluware, which streamlined network configuration changes and reduced the time necessary to fine-tune cloud-based applications.

Before deploying Gluware, Merck took up to nine months to manually tune cloud applications, Rannazzisi said. With the company looking to migrate to Windows 10 and Office 365, Merck couldn't wait nine months to get the Microsoft apps up and running. With Gluware doing the heavy lifting, Merck used the network automation software and quality of service (QoS) to manage the bandwidth load created by network traffic generated to the cloud.

Salvatore Rannazzisi

"With Gluware, we can handle QoS in under two hours across the global backbone worldwide," Rannazzisi said. "In the past, we would try network automation with Python or Ansible, but it could not scale due to disparate platforms or versions of code in our network."

Merck took about three months to write the automation models, which was 90% of the deployment work. The models are based on standard configuration from industry platforms, Rannazzisi said, but Merck was able to create customizations when needed. Merck used existing internal standard configuration templates to build the templates in Gluware. Once the models were in place, Merck could automate the network and make networking changes at scale.

Rannazzisi said network automation cut the time spent on global network configuration changes by 98%. This created a cost avoidance of at least $220,000 per change on the global backbone, which helped Merck save more than $2 million in the first year of deployment alone.

Cloud forcing companies to retool operations

Operating programmatically is becoming necessary in today's networking environment, Gartner analyst Andrew Lerner said, adding that the cloud is forcing companies to become nimbler. Managers and executives don't want to hear from the networking team that it will take weeks to set up a VLAN or several months to migrate productivity apps to the cloud.

Andrew Lerner

"Adding to the challenge is that most organizations have large deployments of infrastructure with legacy equipment that's often decades old," Lerner said. Citing Gluware's feature set, Lerner said the software "offers organizations an automated and programmatic way to manage existing, multivendor networking environments. The user interface lets networking teams operate in a more programmatic way, much more like a DevOps approach."

In addition to configuration management, the software is designed to help companies improve security by automating network access control. That was another benefit to Merck, which now shields its switch ports with specific versions of code that permits only authorized equipment access to the network.

Gluware also lets Merck automate several other important network functions, including "code promotions" or software updates so that all the network devices are up to date.

"This is not like an update on a Mac or PC," Rannazzisi said. "All the networking code is Linux-based. We haven't really been able to do code promotions in a safe, automated way until now." Simple Network Management Protocol addresses, meantime, are managed automatically, enabling the company to update the protocol across the network in hours, rather than the months it formerly required.

"It's a lot like Lego blocks," Rannazzisi said of the network automation tools. "It took us three months to go into production, but now that it's set up we can just go into Gluware and push out an automation function."