NC1811

OPINION
FIREWALL
GRANULARITY
IN-DEPTH FIREWALL DEFENCE
IS BEING USURPED. LINDSAY
BRECHLER, PRODUCT MANAGER
AT FIREMON, GIVES AN INSIGHT
INTO HOW TO DESIGN, TEST
AND MANAGE FIREWALLS FOR
THE CLOUD ERA
The corporate firewall is more critical now
than it's ever been, and this is confirmed
in our latest (2018) State of the Firewall
Report. The majority of respondents believe
that the firewall is still an important part of their
overall security architecture, with 94 per cent
saying that firewalls are as critical as always or
more critical than ever.
But the way in which businesses are defining
firewalls is changing. We're seeing a continued
trend towards smaller, host-based firewalls that
support micro-segmentation and zero-trust
strategies. This it seems is because businesses
now think less about centralised firewalls and
more about cloud.
DESIGNING A FIREWALL DEFENCE
Sadly there is no one-size fits all solution, so
some effort is required. The old approach
was defence in-depth, that is, build as many
firewalls as possible. Now, best practice is to
implement zone-based networks which
create defined network zones covering a
number of different endpoints, based on the
data that those networks carry. When
defining zones it's important to think beyond
geography, as permission and data
protection may have more impact on what
defines a zone than a location.
Over the next several years, zone-based
architectures will be the predominant strategy
used to build firewall defence. Eventually, this
will create fine-grained control using zero-trust
and micro-segmentation architectures that
establish enforcement near to a host, endpoint
or server. In the meantime, zone-based
approaches are also trying to bridge the gap
to offer more fine-grained control based on
broad data protection categories.
FIREWALL TESTING
If a firewall isn't managed or tested properly
then a false and dangerous sense of security is
created. We know that when firewalls are
involved in breaches it's generally because of
exploitation of weaknesses within the
configured policy, and not hacking of the
firewall itself.
With regard to testing, this hard and fast
testing rule - make sure that you're testing
against the most current policy configuration -
sounds very obvious: testing an outdated
configuration is pointless. In some
organisations firewalls are updated hourly, so
the first step in testing is to have real-time
visibility into these updates, so that you can be
certain to identify the most recent
configuration to test.
Following that, the network operations team
needs to run relevant compliance checks
against industry-standards, corporate policies
and other best practices. For example, ensure
that practices are in place to prohibit
unencrypted protocols being sent to the web.
In general, it is best to automate firewall
testing as much as possible. By doing so you
will know as soon as anything is misconfigured
and be able to deal with it promptly.
FIREWALL MANAGEMENT
It's critical to have a well-defined process in
place within the network operations team that
is used each time firewall changes are made. It
should include an analysis of whether a new
rule is necessary, for example, by identifying
whether access is already configured. Then,
network operations must run a compliance
check before the rule is added.
Processes like these can uncover
inconsistencies. When you determine there are
things to remediate, order them by severity, for
example, clean up anything overly permissive
(on too many services with too much access)
before you remove an unused rule.
FIREWALL FUTURE
As organisations move more computing to the
cloud, a shift in mindset is needed to manage
security intent as a means to manage cloud
scale. It won't be possible, with the dynamic
and scaled nature of cloud, to manage the
point-to-point address implementation
manually (which is what has happened
historically), as these networks grow.
We're now at a transition point. Zone-based
approaches are becoming the new normal,
with zero-trust and micro-segmentation not
far behind. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards NOVEMBER/DECEMBER 2018 NETWORKcomputing 21