Firewall management now concentrated on secure application connectivity
Posted on 01 March 2013.
Tufin Technologies announced the results of its annual Firewall Management Survey at RSA Conference 2013 in San Francisco.

200 network security professionals reported that 93.6 percent of all firewall change requests are application-related, validating that the function of firewalls has evolved to include secure application connectivity, in addition to their traditional role of perimeter security.

According to the respondents, there is still plenty of room for improvement when it comes to firewall management fundamentals:
  • Almost half of respondents audit their firewalls only once a year and 15% never audit their firewalls; 50% spend up to a week or more per quarter on firewall audits.
  • Almost 1/5 reported they knew of someone who cheated on an audit because they either felt the audit was a waste of time (39.3%) or they did not have enough time/resources (35.6%).
  • Almost 1/5 of the sample has no idea how current their firewall policy is.
  • 40% have no way to know when a rule needs to be expired or recertified.
  • 30% never test configuration changes before they are implemented.
  • Half of the sample has to redo more than 25% of all network security changes because they do not meet design requirements.
While survey data indicates firewalls are becoming increasingly relevant outside of their established function in security operations, their role has expanded - not shifted. Clearly, firewall management processes can have a significant impact on an organization's risk posture:
  • 62.4% either believe or are not sure if their change management processes puts them at risk to be breached.
  • 54.7% state their application connectivity management processes could or might create unnecessary IT risk; about 1/3 make 100 or more application related firewall changes per month.
  • 41.5% of those sampled track application connectivity changes via comments in the firewall rule base, almost 1/6 don't track these changes at all.
    46.9% report they might have or did have a breach due to an application related rule change.
    70% of respondents report application service disruptions up to 20 times per year due to configuration changes.
  • 60% or respondents were asked to make a change against their better judgment.
  • 1/3 of respondents report that much of their security budgets are spent on items that don't improve security; 1/3 had no idea how well their security budgets were spent.
"This year's survey results validate what our customers have been saying: that firewall management plays an increasingly significant role in maintaining availability and uptime, but the basics need to be in place," said Ruvi Kitov, CEO of Tufin. "Regular audits and efficient change management processes are the cornerstone of effective firewall management. The fact that many organizations audit their firewalls only once a year and some never audit their firewalls needs to change."

"The role firewalls play in managing application connectivity is both a cause and effect of sweeping trends in enterprise IT; understanding this enabled us to automate the right set of organizational processes between the right set of stakeholders," he concluded.





Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals itís our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //