Welcome!

Related Topics: Cloud Security, Java IoT, Microservices Expo, Open Source Cloud, @CloudExpo

Cloud Security: Article

Why Your NGFW Needs Granular and Contextual Access Control

understand how these evolving feature sets can help contain costs while reducing management complexity

Global information technology networks that are rich in services are typically complex and require hard-to-manage security solutions. The latest versions of next-generation firewalls now offer multiple security layers that can complicate management, particularly as more and more features are added. This complexity can also serve to reduce the effectiveness of controls by obscuring noteworthy events or failing to recognize trends detected by multiple security systems integrated into the overall system. The answer is a common, unified management approach with granular and contextual access control.

Instead of employing multiple and distinct dashboards offering minimal if any integration to manage network security, administrators should be able to access a single dashboard to gain a consistent, unified view across all firewall protected segments. The data must be granular and contextual, empowering IT and network security administrators to execute and control all NGFW operations from a single perspective. And to assure logging of all actions taken and events observed, without regard to operator location.

Consistency is key. This level of administrative awareness and control should be available regardless of modality (physical or virtual) or configuration. Here are five critical control features to look for when evaluating a next generation firewall.

1. Integrated VPN
Secure virtual private network (VPN) connections provide for inter-office and mobile user connectivity to corporate resources. First-tier NGFWs typically provide high-performance remote access with integrated management supporting the use of multiple ISPs to ensure access in the event of link failure. Such solutions typically offer VPN client software to take full advantage of various deployment options. Look for the capability to cluster the firewall configuration to assure availability and session survivability in the event of a firewall appliance update or failure. Flexibility in licensing is also necessary to address burst utilization or pandemic usage requirements. Additionally, support for deep inspection is highly recommended as a necessary precursor to support DLP requirements.

2. Email and Web Security
Email advertising and social media services can flood a network with traffic of little to no business value. And this traffic stream can be a wide conduit for malware. One response is to deploy your NGFWs with additional services such as deep-inspection, web filtering, anti-virus, and anti-spam services. Combining these services under one NFGW umbrella ensures that they are available (especially if the firewall solution is clustered for high availability) and implemented at all relevant chokepoints within an organization. Superior traffic control based on users and groups, as well as contextual awareness of attacks and their use by would-be attackers across the entirety of an organization, improves an organization's resistance to a breach. Furthermore, solutions that support contextual awareness may be able to share details on detected attacks across all firewalls under the same management control, and take broad actions. For example, the actions of an attacker against one firewall may be used to blacklist that attacker across all firewalls of the organization. This amplifying effect is particular pronounced if the NFGW management solution is multi-tenant capable and used to protect multiple divisions or firms.

3. Precise Security Policies
Control over traffic based on a variety of options will enable Network security administrators need great flexibility in granting privileges to employees to perform their jobs. In addition to typical firewall IP Address and port filtering, NGFW solutions also typically support the control of traffic by service (protocol), application, user identity, group affiliation, URL categorization, site reputation, time of day, method(s) of authentication, and context. Precise security policies can provide QoS directives so access control is governed by dynamic business requirements or the availability of underlying communications resources. For example, transaction traffic may be given preferential treatment over social media access by employees, and lower priority traffic is automatically shed if a circuit failure reduces available bandwidth.

4. Integrated Authentication Services
Independent authentication mechanisms often lack integration with the firewall. However, the integration of authentication services with NGFW policies can allow administrators to constrain, track, and log access to services. Such access controls often use a variety of authentication methods including token and virtual token systems. Virtual token applications for mobile phones and tablets reduce costs over traditional key fob tokens. In addition, integration to the NGFW unifies the management of how an individual or members of a group are authenticated.

5. Traffic Management and QoS
Firewalls that feature traffic management and quality of service (QoS) can provide detailed control on what traffic is permitted and at what priority, while assuring end-to-end capacity to meet session requirements. QoS selections such as bandwidth floors and ceilings help to differentiate traffic streams, assuring the streams are treated fairly and not inadvertently precluded in their entirety, or allowed to consume bandwidth to the detriment of other business activities. For isochronous (time sensitive) traffic such as VoIP or video conferencing, the proper handling of long-haul priority directives is necessary to ensure that in-band traffic with specific bandwidth and jitter requirements is accommodated on an as-needed basis.

In addition, traffic management can help triage traffic if sufficient networking bandwidth is unavailable to meet all approved needs. For example, transactions take priority over backups or social media access.

The NGFW can improve the utilization effectiveness of the network and its security posture. It is also a network chokepoint of access from WAN connectivity to remote facilities, mobile employees, and the Internet. Pay attention to all options available with NGFW products and understand how these evolving feature sets can help contain costs while reducing management complexity.

More Stories By Darren Suprina

Darren Suprina is an IT systems designer and security professional with more than 30 years of experience. This has included intellectual property creation, research, development, software and infrastructure design and validation, systems auditing, work as a professional witness, and author.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Latest Stories
Keeping pace with advancements in software delivery processes and tooling is taxing even for the most proficient organizations. Point tools, platforms, open source and the increasing adoption of private and public cloud services requires strong engineering rigor - all in the face of developer demands to use the tools of choice. As Agile has settled in as a mainstream practice, now DevOps has emerged as the next wave to improve software delivery speed and output. To make DevOps work, organization...
My team embarked on building a data lake for our sales and marketing data to better understand customer journeys. This required building a hybrid data pipeline to connect our cloud CRM with the new Hadoop Data Lake. One challenge is that IT was not in a position to provide support until we proved value and marketing did not have the experience, so we embarked on the journey ourselves within the product marketing team for our line of business within Progress. In his session at @BigDataExpo, Sum...
The modern software development landscape consists of best practices and tools that allow teams to deliver software in a near-continuous manner. By adopting a culture of automation, measurement and sharing, the time to ship code has been greatly reduced, allowing for shorter release cycles and quicker feedback from customers and users. Still, with all of these tools and methods, how can teams stay on top of what is taking place across their infrastructure and codebase? Hopping between services a...
Virtualization over the past years has become a key strategy for IT to acquire multi-tenancy, increase utilization, develop elasticity and improve security. And virtual machines (VMs) are quickly becoming a main vehicle for developing and deploying applications. The introduction of containers seems to be bringing another and perhaps overlapped solution for achieving the same above-mentioned benefits. Are a container and a virtual machine fundamentally the same or different? And how? Is one techn...
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex softw...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
What sort of WebRTC based applications can we expect to see over the next year and beyond? One way to predict development trends is to see what sorts of applications startups are building. In his session at @ThingsExpo, Arin Sime, founder of WebRTC.ventures, will discuss the current and likely future trends in WebRTC application development based on real requests for custom applications from real customers, as well as other public sources of information,
Interoute has announced the integration of its Global Cloud Infrastructure platform with Rancher Labs’ container management platform, Rancher. This approach enables enterprises to accelerate their digital transformation and infrastructure investments. Matthew Finnie, Interoute CTO commented “Enterprises developing and building apps in the cloud and those on a path to Digital Transformation need Digital ICT Infrastructure that allows them to build, test and deploy faster than ever before. The int...
Whether you like it or not, DevOps is on track for a remarkable alliance with security. The SEC didn’t approve the merger. And your boss hasn’t heard anything about it. Yet, this unruly triumvirate will soon dominate and deliver DevSecOps faster, cheaper, better, and on an unprecedented scale. In his session at DevOps Summit, Frank Bunger, VP of Customer Success at ScriptRock, discussed how this cathartic moment will propel the DevOps movement from such stuff as dreams are made on to a practic...
ChatOps is an emerging topic that has led to the wide availability of integrations between group chat and various other tools/platforms. Currently, HipChat is an extremely powerful collaboration platform due to the various ChatOps integrations that are available. However, DevOps automation can involve orchestration and complex workflows. In his session at @DevOpsSummit at 20th Cloud Expo, Himanshu Chhetri, CTO at Addteq, will cover practical examples and use cases such as self-provisioning infra...
The cloud competition for database hosts is fierce. How do you evaluate a cloud provider for your database platform? In his session at 18th Cloud Expo, Chris Presley, a Solutions Architect at Pythian, gave users a checklist of considerations when choosing a provider. Chris Presley is a Solutions Architect at Pythian. He loves order – making him a premier Microsoft SQL Server expert. Not only has he programmed and administered SQL Server, but he has also shared his expertise and passion with budd...
"My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, represent...
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
With billions of sensors deployed worldwide, the amount of machine-generated data will soon exceed what our networks can handle. But consumers and businesses will expect seamless experiences and real-time responsiveness. What does this mean for IoT devices and the infrastructure that supports them? More of the data will need to be handled at - or closer to - the devices themselves.