<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
BLOG

What’s the 2020 on Firewalls?

May 26, 2016

As businesses place more emphasis on mobility and the cloud, some corners of the industry have begun to wonder out loud about whether it's time to re-think firewalls to keep pace with today's evolving data security challenges. Adaptation is survival, and security platforms will need to do precisely that in 2016 and beyond.

So, how did we get there, and who's leading the way on the technology side today?

Firewalls Then and Now

More than two decades have passed since the enterprise network firewall market was born. There were earlier iterations of firewalls, but the market took off when network administrators gained the ability to set sharply-tailored rules limiting only highly specific bands of IP traffic. Then and now, that's always been the name of the game—having the agility to block nothing but the undesirable traffic.

These days, the old-school “live wire” standard, based on a physical connection between peers on a LAN, has given way to something much nimbler—and Palo Alto Networks, a Garland Technology partner, has been leading this charge.

Next Generations aren't just the purview of Star Trek. Since 2007, Palo Alto Networks has typified the notion of the Next Generation Firewall (NGFW), the newest stage of integration in data security. NGFWs allow administrators an unprecedented level of freedom in adjusting their security configuration using a broad range of tools from a single console, even on networks distributed across numerous remote locations.

Palo Alto Networks’ system is unique due to its Single-Pass Architecture, a design that boosts efficiency by contextualizing all traffic in real-time. This isn't just a firewall, but a comprehensive security platform that incorporates intrusion detection systems (IDSs), which reveal internal network threats your typical firewall just won't see on its own. Due to these and other innovations, Palo Also Networks was ranked #2 on Gartner’s 2015 Magic Quadrant.

internal vs external network taps

The Fight for the Future

As cyber attackers become increasingly sophisticated, firewalls will have to change accordingly. From any angle, the firewall market is trending toward three particular ideas:

  1. The ability to wall off certain threatened subsections of the network without sacrificing ease of communication in other subsections
  2. Focusing on threat identification outside the boundaries of the firewall, rather than simply preparing to react once malicious traffic has breached
  3. Not depending solely on human-configured firewall parameters, but establishing systems that can “learn” on-the-fly as cybersecurity threats evolve

cyber security firewallsParameters must change just as the nature of threats themselves have done, with a particular emphasis on the cloud and mobile environments.

Working within the cloud, as a shared model, requires a shared approach to security, which places some real pressure on customers themselves: as “cloud-first” continues to take hold, customers are more and more likely to entrust their personal data to these networks, particularly through mobile payment applications.

In this brave new world, security isn't just about external threats. Palo Alto Networks predicts that this shared model requires administrators to pay specific attention to the data that regular users can and cannot access inside the network because, for now, internal traffic generally isn't monitored with the same real-time tools as the external.

Cyber security has never looked more like a frontier as we gaze into the technological crystal ball. You've got to be prepared to respond swiftly to every threat, from malware programs to exploit attacks that legacy platforms just won't detect.

As the future of firewalls comes to fruition through 2020, one thing will always remain the same—the need for 100% network uptime and visibility.

Download our free white paper, Internal vs. External Network TAPs to learn the best practices for properly connecting your NGFWs and other security appliances to guarantee network visibility and access while maintaining 100% network uptime.

 

 

See Everything. Secure Everything.

Contact us now to secure and optimized your network operations

Heartbeats Packets Inside the Bypass TAP

If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.

If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.

While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.

Some of you may have noticed a flaw in the logic behind this solution!  You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.

Glossary

  1. Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.

  2. Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.

  3. Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.

NETWORK MANAGEMENT | THE 101 SERIES