A Conviction of the Firewall Industry

In today’s firewall market, you have a lot of choices. When was the last time someone was fired for buying a firewall? A firewall is typically a infrastructure purchase and considered a best practice. Firewalls have been around for almost 2 decades. The first commercial firewall was shipped by DEC SEAL in 1992…thank you Marcus Ranum! Shortly following DEC SEAL, Secure Computing released Sidewinder. In the 90’s and early 2000’s, the perimeter was well defined and threat landscape was evolving and so was the protection. In the early era of the Internet, the web content was static and the focus was controlling traffic from coming into your network. Who would ever think the web browser was going to be one of the highest targets for exploitation. The interesting thing is that internal web traffic was and continues to be allowed outbound.  Without outbound connectivity, the Internet would be useless.  However, we’ve entered into some interesting times in terms of the threat landscape. We are not dealing with well defined perimeters and the change from static to dynamic content has placed our trusted outbound web connections at risk.

This is extremely important in terms of firewall protection value. The majority of the firewalls out their today can be classified as conventional and fail at providing you protection beyond access control and segmentation. One must step back and ask why? Why would I invest in a firewall that provides me the same protection I can find in a router? A lot of vendors out their today can provide access control and segmentation with a strong emphasis on application control. However, stopping at application control within the firewall is not enough. Adding protection value in the fabric of the firewall requires innovation and investment into a security research and development organization. Additionally, with the recent cross-over of Advanced Persistent Threat’s into the commercial sector like Aurora, require additional security intelligence that can be harvested worldwide through the Cloud and deployed at an instance to reduce your time to protection.

Simply adding additional protection value like IPS functionality to the firewall without the backing of an internal seasoned security research and development team should really place into question the value of the security content. Furthermore, if the vendor isn’t doing due diligence by collecting and analyzing million’s of threat feeds worldwide…this should also raise a red flag. Lastly but more importantly, does the firewall vendor have their security content validated by a 3rd party like NSS, ICSA or invest in FIPS validation or EAL certification? These attributes combined with a strong security research and development team demonstrate investment and commitment into placing what matter’s the most and that’s the highest level of protection value because your infrastructure deserves it.

In the coming year you might be faced with making a decision in purchasing a new firewall.   Just remember to ask the vendor what investments are they  making in validating their firewall technology. Lastly but more importantly, are they increasing the protection value through an internal security research and development organization.   Investing in the wrong technology that looks and feels like a “Firewall” that lacks the key attributes I mentioned above is like deploying a stage prop in your network.  Would you get fired for deploying a stage prop in your network?  For more information on the McAfee Firewall Enterprise, follow the link: http://www.mcafee.com/us/enterprise/products/network_security/firewall_enterprise.html

Tags: McAfee, Network Security, Operation Aurora