Managing access to confidential information and application resources via firewalls is the foundation of network security, and firewall audits are central to any mature network security process. However, relying on security and network experts to review rules across multiple firewall zones and different firewall products is proving to be costly and ineffective. Few will dispute that when it comes to network security, automating best practices to reduce operating costs, complexity, human error, and streamline processes is a good thing. However, in what we call the age of Continuous Compliance – brought on by the reality that point-in-time audits done hastily to meet reporting deadlines rarely – if ever – deliver any security or compliance benefits once that point in time has passed, automation becomes more than just good. It becomes essential. Case in point: a November 2011 survey from Tufin of 100 firewall managers revealed that only 1.3% of configuration changes that cause network downtime or pose a security breach are identified during the quarterly audit, yet almost a third of the respondents spent 3 to 7 days per quarter of valuable network security team time on firewall audits (Disclosure: I work for Tufin). Organizations receive precious few benefits for the level of resources spent on manual firewall audits. This is proving to be an inefficient approach to maintaining a secure network and if you do the math, an extremely inefficient use of skilled security personnel.
In general, best practices in security are mandated in standards such as the PCI DSS, DISA Information Assurance Support Environment, or healthcare’s HIPAA. Most if not all of these regulations – and many others, either specifically mandate or implicitly require firewall audits.
The best practices of firewall audits are based on expert reviews of changes made by network and security administrators. In theory, errors are caught, corrections are made, and compliance is re-established as a result of the audit. In practice, errors are seldom caught and operational costs climb, in great part because audit teams discover security issues in firewall protection from manual audits at a very low rate.
As the discipline of IT security continues to evolve, knowing where and when to automate can make or break a CISO’s career – not to mention the morale and effectiveness of their compliance and IT operations teams. One of the important ways security teams gain efficiencies is to apply technology to evolve audit processes from disruptive quarterly or yearly events to daily standard operating procedures. The technology exists today to automatically verify compliance as firewall rules changes are implemented – ensuring continuous compliance with tight security and fewer calls to the security service desk.
The complexities of modern networks are often simply too much for a human to decipher without assistance. Not only do the best security experts have to interpret rules languages across vendors such as Check Point, Cisco, and Juniper Networks, but they must also translate application-based rules from next generation firewalls (such as those from Palo Alto, Check Point, SonicWALL, SourceFire) to ensure compliance with security policies across the organization. The concept of independent validation of firewall configurations is a good one – the best practice is now to have a security expert craft the new rules and then automate the impact on firewalls to ensure continuous compliance.
Seeking continuous compliance via automation of firewall management has the additional benefit of preserving the valuable time of security experts. Instead of expending critical resources conducting manual reviews of firewall rules that are unlikely to result in improved security or enhancements to compliance, security teams are able to contribute to the business in more productive activities. Too much time – the 3 to 7 days per quarter mentioned in the survey builds up to more than one month per year – is spent conducting ineffective audits and producing documentation for compliance reports. As with many IT disciplines, finding ways to automate activity is the key to freeing time for skilled resources to be more effective. Automating the best practices of firewall compliance returns direct cost savings to the organization.
With automation, organizations discover dangerous configuration changes before the business is exposed to security incidents, generate compliance reports whenever required by the regulations, and shift audit approaches to expert reviews of the security strategy more than manual reviews of firewall rules. Seeking continuous compliance moves the business closer to the goal of integrating security into business operations with fewer deviations from compliance that can put the business at risk. Spending significant security resources to find security problems only 1.3% of the time doesn’t make sense – if that is your ratio, then automating firewall management is a no brainer.
Shaul Efraim
Don't miss out on more Tufin blogs
Subscribe to our weekly blog digest
