How to manage your multivendor firewalls like a pro

Firewall management software can audit, and rules verification can be simplified, automated

Auditing firewalls to keep regulators happy and tracking rule changes - especially for businesses buying firewalls from multiple vendors - is a burden that a variety of third-party software can lighten dramatically.

Software from vendors AlgoSec, Secure Passage and Tufin, can report firewall statistics to prove compliance with industry and government standards, and it can consolidate rules so firewalls run more efficiently, customers say.

"That's very different from what individual firewall vendors do," says Greg Young, a research vice president at Gartner. "[Third parties] respond more to audit compliance and the real-world regulatory compliance that companies need."

Young says individual firewall vendors have tools to configure and logs to record rules changes, but don't have the capability to simulate inserting new rules in existing rule sets to see their impact. AlgoSec, Secure Passage and Tufin are the only vendors he knows of that offer this type of functionality, and they do so only for the major firewall vendors, Check Point, Cisco and Juniper.

Adam Forester, supervisor of network security for medical transaction processing firm Emdeon Business Services, says he turned to Tufin because Check Point tools couldn't do as good a job optimizing his 100-plus firewalls.

"I needed the real optimization, being able to go through the policy and say this rule is using services that another rule is also using and you can eliminate this rule. Check Point's products just do not do that," Forester says.

Tufin software runs through a firewall's rule set in less than five minutes, drastically cutting the time it would take to do the same optimization manually, he says. "We would spend a couple of months going through logs manually, printing out the entire rule base and just going through it by eye," he says. He says the software reduced the number of rules in one firewall from about 600 to 200, reducing the CPU power demanded to process traffic.

Trimming down the number of firewall rules means it is simpler to audit them, says Gartner's Young. That translates into lower prices for audits because they take less time, he says.

This type of software can help with regulatory audits, as well. For instance, when it came to meeting firewall security regulations, AXA Technology Services turned to AlgoSec's Firewall Analyzer. It can generate reports that help out demonstrating compliance with the Sarbanes-Oxley Act (SOX) and PCI industry standards, says Dan Raymonda, a technology specialist for the company. AXA Technology is the centralized IT provider for other AXA operating companies.

He says the AlgoSec gear generates reports that let him know whether his firewall rule-sets are within the range of compliance standards set for PCI.

AXA is more concerned about SOX compliance, and Raymonda uses the AlgoSec software to assess the risk of new firewall rules proposed by AXA operating companies.

Those risk-assessment reports are reviewed by the requesting operating company, which determines whether the risk is acceptable in light of SOX requirements, he says.

The software can gather data for risk assessment from multiple firewalls based on a single instruction. So if he needs to assess a new rule for external firewalls, he doesn't have to deal with each one individually. Instead the AlgoSec platform deals with them as one group and analyzes it, saving time and reducing errors.

"Everybody has made an error here or there in positioning a firewall rule," he says. "To have [Firewall Analyzer] do the calculations of literally millions and millions of potential access methods and evaluate it and come up with a risk assessment is just a godsend."

Raymonda says he has the AlgoSec software configured to poll firewalls regularly on its own to perform routine compliance checks.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?