Firewalls: Past, Present, Future.

A Firewall is a device for Network security that grants or rejects access to the network based on security protocols. These are the building blocks that eventually became Next Generation Firewalls.

Firewalls have existed for decades – since the late 80’s, designed to inspect packets transferred between computers. Though packet-filtering style firewalls are still in use today, firewall technology has come a long way due to industry advancements and developments throughout the years.

What Firewalls do:

Firewalls are an essential aspect of security architecture, taking the guesswork out of host protections and entrusting them to network security devices. Firewalls and Next-Gen Firewalls (NGFWs) focus on blocking malware and app-layer attacks, along with an integrated intrusion prevention system to react with speed and precision, to seamlessly detect and defeat outside attacks across the network. Security policies can be set in NGFWs to better defend the network and carry out assessments rapidly to detect and shut down invasive and suspicious activity.

We need firewalls to affect security policies in an efficient manner, to combat attacks across networks on multiple layers. By leveraging firewall technology for your security infrastructure, you are setting up your network for specific policies on allowing and blocking incoming or outgoing traffic.

With network layer or packet filter inspection, at a relatively low level of the TCP/IP protocol stack the packets are inspected and only permitted to pass through the firewall if they meet the parameters set out in the established ruleset for IPs and Ports. Network layer inspection firewalls perform better than devices that do application layer inspection, with the downside that unwanted traffic such as applications and malware can pass over allowed ports, e.g. outbound internet traffic over web protocols HTTP and HTTPS, ports 8 and 443 respectively.

Next Generation Firewalls (NGFWs) and beyond:

NGFWs inspect at the application level of the TCP/IP stack and are capable of identifying applications and enforcing security policy based on application type. UTM (Unified Threat Management devices), and NGFWs also include threat prevention tech such as IPS or Antivirus to detect and prevent malware and threats. These devices may also include sandboxing capabilities to detect threats in files.

As the threat landscape in cybersecurity continues to evolve and attacks become more sophisticated, NGFWs will continue to be an essential component of any security stack, from data centre, to network, and cloud infrastructures.

Palo Alto Networks Next-Generation Firewall Capabilities:

• User Identity Awareness and Protection: The user identity feature on NGFWs identifies users in all locations, irrespective of device types and operating system. However, the issue of user identity goes beyond classifying users for policy reporting. Protecting user identity is equally important. The 2017 Verizon Data Breach Investigation Report found that 81-percent of hacking-related breaches leveraged weak and/or stolen credentials2. Attackers use stolen credentials to access an organization, move laterally, and escalate privileges for unauthorized applications and data. A NGFW enforces capabilities like machine learning based analysis and multi-factor authentication (MFA) to prevent credential theft and subsequent abuse – and preserve the user identity.
• Application Usage, Visibility and Control: Users are accessing diverse types of apps, including SaaS apps, from varying devices and locations. Some of these apps are sanctioned, some tolerated and others unsanctioned. Security administrators want to have complete control over usage of these apps and set policy to either allow or control certain types of applications and deny others.  An NGFW provides complete visibility into application usage, along with capabilities to understand and control their use. For example, understand usage of application functions, such as audio streaming, remote access, posting documents etc., and then enforce granular controls over usage, such as uploading and posting to Facebook, file sharing on Box and file transfer.

• Secure Encrypted Traffic: Most enterprise web traffic is now encrypted, and attackers exploit encryption to hide threats from security devices.  An NGFW allows security professionals to decrypt malicious traffic to prevent threats, while at the same time preserving user privacy – with predictable performance.

• Detect and Prevent Advanced Threats: Today, most modern malware, including ransomware variants, leverage advanced techniques to transport attacks or exploits through network security devices and tools. An NGFW utilizes systems that can identify evasive techniques and automatically counteract them.  For example, it uses multiple methods of analysis to detect unknown threats, including static analysis with machine learning, dynamic analysis, and bare metal analysis. By using a cloud-based architecture, the threat detection and prevention can be supported at mass scale across the network, endpoint, and cloud.
• Architecture Matters: As the number of needed security functions continues to increase, there are two options: add another security device or add a function to an existing device. When the NGFW is built on the right architecture, it’s possible to add a function to a next-generation firewall, instead of adding another security device. This type of integrated approach offers benefits and advantages that discrete devices cannot.

• Deployment Flexibility: NGFWs are available in both physical and virtual form factors to fit a variety of deployment scenarios and performance needs.

• Shared Threat Intelligence: Organizations rely on multiple sources of threat intelligence to ensure the widest possible visibility into emerging threats, but they struggle to aggregate, correlate, validate and share indicators across different feeds. An NGFW automatically transforms this information into actionable controls that prevent future attacks.

Enterprise Firewalls:

The pandemic of Covid-19 turned cybersecurity professionals attention from securing the network, to securing the remote workforce as well. Enterprise Firewall vendors saw significant growth as customers felt the security talent shortfall with experienced talent seeking more lucrative opportunities in the industry, and work-from-anywhere benefits. Firewall vendors retooled their portfolios to apply AI technology, vendor-delivered services and partner services for network security. AI is starting to deliver in both security efficacy and configuration guidance, with vendors such as Palo Alto Networks also offering actual human intelligence in the form of their security services, and their managed service partners, through their platforms.

According to Forrester’s Security Survey, 2022, 74% of respondents admitted that their organization was potentially compromised or breached at least once in the previous 12 months. This is up from 63% in 2021.

Palo Alto Networks NGFWs:

Palo Alto Networks Firewall capabilities, in the form of their pioneered Next-Generation Firewall, demonstrate real innovation across multiple criteria in the Network Security space. The company’s vision for network security is infused with AIOps, and Zero Trust principles, with their AIOps elegantly translating security policies into best practices, consistently and continuously recommending best practices on any change, effectively providing real-time guardrails for the user. Palo Alto Networks is ahead of the game, and ahead of the competition, with TLS decryption that is amongst the best in the field, and expanded network security beyond the perimeter with Prisma Access, and Cortex services.

But don’t just take our word for it! Palo Alto Networks claims to fame:

10-time leader in the Gartner Magic Quadrant for Network Firewalls

A Leader in the Forrester WaveTM: Enterprise Firewalls, Q4 2022 Report

PA-400 Series beats the competition in head-to-head testing

ML-Powered NGFW receives highest AAA Rating

Conclusion

Secure IT Consult (SITC) works with Palo Alto Networks to provide both licensing and professional services across the entire Palo Alto Networks portfolio, and the Firewall range, and SITC can provide everything you need from start to finish on your cybersecurity projects; installation, integration, planning, deployment, and managed services – everything you need for your cybersecurity and cloud computing in one partner, with Palo Alto Networks Certified Network Security Consultants capable of delivering the whole range.

With SITC, you can find Palo Alto Networks Certified Network Security Consultants with the capability to deliver for your cybersecurity solutions across a wide range of scenarios and projects, to the highest standards, in every way. For all things Palo Alto Networks, look no further than SITC.