Cyber Defense eMagazine December 2019

101
• Centralizing Network Security Policy Management: Managing security configurations across
vendors and platforms, on-prem and hybrid cloud, from a single console will reduce the effort of
managing multiple platforms and ensure consistency across the distributed network.
• Providing Network Visibility: Understanding the connectivity of your network allows you to identify
the specific elements to be modified, meaning change requests can be fulfilled easier and with
better accuracy.
• Documenting Network Changes: When it comes time to proving compliance, if all network change
requests are documented, searchable and readily available, your audit tasks will be fulfilled, and
your staff’s time will be freed up for other critical functions.
• Policy Cleanup Automation: As time goes by, firewall policies tend to grow in size and complexity.
New access is added, but rules and objects are never removed. Cleaning up redundant rules can
create a more readable, easier-to-manage policy, but firewall teams seldom have the time for a
cleanup project. By automating the decommissioning of redundant rules and objects this can be
achieved quickly and with a fraction of the effort.
Automate Network Changes
Far too many organizations manually process routine and low-risk connectivity requests. These manual
processes not only require a significant amount of time, but they’re also prone to errors and
misconfigurations which can lead to serious downtime, a failed audit, or worse yet, a breach.
Automating network changes through a well-documented process increases an organization’s
operational efficiency, without the need for additional staff. It also eliminates resource-intensive mistakes
and re-dos. Ultimately, this means gaining better control over access changes and reducing overall risk,
using the staff that you already have in place.
Empower Novice Engineers
In many cases the skill shortage means that the team has diverse knowledge levels leading to an uneven
distribution of the workload. Experienced engineers who are very familiar with the network and/or the
security standards will be assigned with most routine changes and tasks and will not have time to work
on any strategic projects. The only way to distribute the load more evenly is to integrate the expertise into
an automated process to empower the novice staff with the daily changes.
For example, a large utility company in the US leveraged security policy automation to empower their
entry-level engineers and free their experienced staff to focus on strategic projects. By leveraging
automated risk analysis against a unified security policy (USP) they were able to ensure that access
requests did not violate their network segmentation policy and did not introduce new risks. By leveraging
policy-driven automation, the company ensured valid implementation of changes even by those
engineers who hadn’t memorized every routing table. The automated process itself also helps ensure
consistent implementation and documentation of all changes across the team.