Weighing Firewall and Cloud Security Challenges
August 3, 2015
By Brian Monkman, Network Security Programs Manager

Explaining the purpose of a firewall is often very easily answered with a simple analogy: it is like a gatekeeper, border control, or security at the entrance of a building. The firewall’s role is to decide what can pass through your network, and what cannot.

We were asked recently to give a real-world analogy to explain where the cloud resides in this picture – where is the cloud in relation to the firewall? Is it above it? Beside it? Inside it?

We had a very hard time coming up with an answer. There is simply no easy, real-world comparison for how and where the cloud fits in with the firewall, and more broadly in the current enterprise security environment.

This is a perfect illustration of the sometimes inexplicably complex security landscape that IT professionals are facing today. It’s not as simple as keeping threats on the outside, or keeping employee data safe on company servers. We now live in an interconnected world in which employees use a combination of mobile devices, home computers and the cloud in order to get things done.

This modern and flexible work environment is, without a doubt, here to stay. However, fierce debates remain about how to properly secure company data in the modern age.

Some cloud security experts have argued that firewalls are irrelevant, while firewall experts maintain that cloud security is ineffective. The truth is that neither of these assertions are true. Cloud security solutions can be very effective, and firewalls are certainly not dead. It is up to IT professionals to learn how to make these both co-exist.

In order to address these challenges, IT professionals must first and foremost become educated about the amount of institutional third-party testing that has been done on these technologies. At ICSA Labs, we’ve thoroughly tested countless firewall and cloud security products, and we strongly believe that third-party vendor certification is a crucial element for addressing this challenge.

From a certification standpoint, the fact that firewalls have been around for decades is a distinct advantage. Firewalls have been thoroughly vetted and validated so repeatedly that they have become commoditized items. While firewalls continually evolve and advance with the security industry, firewalls are a tried and true solution, propped up by decades of testing by countless experts.

Cloud security products, on the other hand, are still a relatively young technology. Many cloud security products currently on the market have not gone through rigorous testing. Additionally, they’re run on a remote infrastructure, which adds significant challenges and unknown vulnerabilities due to lack of control.

When it comes to cloud security certification, there is no one-size-fits all solution. Due to the nascent and complex nature of current cloud security solutions, we believe the security of these devices should be questioned. 

So what should IT professionals be considering first and foremost?

Fitting the Device to Your Needs

First, you need to consider whether the solution you’re implementing truly meets your needs. Not every enterprise is created equal. One of the biggest things one should ask when it comes to cloud security devices is – do these cloud solutions reside alone on a particular machine, or do they share real estate with others?

Take the recent example of an entertainment website. After Facebook changed the algorithm for populating the News Feed, this particular site started to get 40x the traffic than it was used to. The traffic overwhelmed the web server, and took that site down, along with five others on the server.  

IT professionals need to be concerned not just about the functionality of the device and product, but also about what resources are being shared. As soon as something goes public, you lose control.  IT professionals need to consider the whole package together – hardware, underlying operating system, and everything else it may touch.  

Testing is Key

Ultimately, we believe the number of unknown variables facing cloud security solutions and firewalls today necessitates rigorous third-party testing by experts who understand these complexities. Ensuring your chosen cloud and firewall security product has been thoroughly tested and vetted is crucial.

This is where credible third-party testing labs come in.  Knowing these products have been thoroughly tested and implemented will give you the assurance and confidence that you’ve made the right purchasing decision.

Comments

Post new comment

  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image.