Click here to close now.

Welcome!

Cloud Security Authors: Liz McMillan, Elizabeth White, Pat Romanski, Lori MacVittie, John Wetherill

Related Topics: Cloud Security, JAVA IoT, Microservices Expo, Open Source Cloud, CloudExpo® Blog

Cloud Security: Article

Why Your NGFW Needs Granular and Contextual Access Control

understand how these evolving feature sets can help contain costs while reducing management complexity

Global information technology networks that are rich in services are typically complex and require hard-to-manage security solutions. The latest versions of next-generation firewalls now offer multiple security layers that can complicate management, particularly as more and more features are added. This complexity can also serve to reduce the effectiveness of controls by obscuring noteworthy events or failing to recognize trends detected by multiple security systems integrated into the overall system. The answer is a common, unified management approach with granular and contextual access control.

Instead of employing multiple and distinct dashboards offering minimal if any integration to manage network security, administrators should be able to access a single dashboard to gain a consistent, unified view across all firewall protected segments. The data must be granular and contextual, empowering IT and network security administrators to execute and control all NGFW operations from a single perspective. And to assure logging of all actions taken and events observed, without regard to operator location.

Consistency is key. This level of administrative awareness and control should be available regardless of modality (physical or virtual) or configuration. Here are five critical control features to look for when evaluating a next generation firewall.

1. Integrated VPN
Secure virtual private network (VPN) connections provide for inter-office and mobile user connectivity to corporate resources. First-tier NGFWs typically provide high-performance remote access with integrated management supporting the use of multiple ISPs to ensure access in the event of link failure. Such solutions typically offer VPN client software to take full advantage of various deployment options. Look for the capability to cluster the firewall configuration to assure availability and session survivability in the event of a firewall appliance update or failure. Flexibility in licensing is also necessary to address burst utilization or pandemic usage requirements. Additionally, support for deep inspection is highly recommended as a necessary precursor to support DLP requirements.

2. Email and Web Security
Email advertising and social media services can flood a network with traffic of little to no business value. And this traffic stream can be a wide conduit for malware. One response is to deploy your NGFWs with additional services such as deep-inspection, web filtering, anti-virus, and anti-spam services. Combining these services under one NFGW umbrella ensures that they are available (especially if the firewall solution is clustered for high availability) and implemented at all relevant chokepoints within an organization. Superior traffic control based on users and groups, as well as contextual awareness of attacks and their use by would-be attackers across the entirety of an organization, improves an organization's resistance to a breach. Furthermore, solutions that support contextual awareness may be able to share details on detected attacks across all firewalls under the same management control, and take broad actions. For example, the actions of an attacker against one firewall may be used to blacklist that attacker across all firewalls of the organization. This amplifying effect is particular pronounced if the NFGW management solution is multi-tenant capable and used to protect multiple divisions or firms.

3. Precise Security Policies
Control over traffic based on a variety of options will enable Network security administrators need great flexibility in granting privileges to employees to perform their jobs. In addition to typical firewall IP Address and port filtering, NGFW solutions also typically support the control of traffic by service (protocol), application, user identity, group affiliation, URL categorization, site reputation, time of day, method(s) of authentication, and context. Precise security policies can provide QoS directives so access control is governed by dynamic business requirements or the availability of underlying communications resources. For example, transaction traffic may be given preferential treatment over social media access by employees, and lower priority traffic is automatically shed if a circuit failure reduces available bandwidth.

4. Integrated Authentication Services
Independent authentication mechanisms often lack integration with the firewall. However, the integration of authentication services with NGFW policies can allow administrators to constrain, track, and log access to services. Such access controls often use a variety of authentication methods including token and virtual token systems. Virtual token applications for mobile phones and tablets reduce costs over traditional key fob tokens. In addition, integration to the NGFW unifies the management of how an individual or members of a group are authenticated.

5. Traffic Management and QoS
Firewalls that feature traffic management and quality of service (QoS) can provide detailed control on what traffic is permitted and at what priority, while assuring end-to-end capacity to meet session requirements. QoS selections such as bandwidth floors and ceilings help to differentiate traffic streams, assuring the streams are treated fairly and not inadvertently precluded in their entirety, or allowed to consume bandwidth to the detriment of other business activities. For isochronous (time sensitive) traffic such as VoIP or video conferencing, the proper handling of long-haul priority directives is necessary to ensure that in-band traffic with specific bandwidth and jitter requirements is accommodated on an as-needed basis.

In addition, traffic management can help triage traffic if sufficient networking bandwidth is unavailable to meet all approved needs. For example, transactions take priority over backups or social media access.

The NGFW can improve the utilization effectiveness of the network and its security posture. It is also a network chokepoint of access from WAN connectivity to remote facilities, mobile employees, and the Internet. Pay attention to all options available with NGFW products and understand how these evolving feature sets can help contain costs while reducing management complexity.

More Stories By Darren Suprina

Darren Suprina is an IT systems designer and security professional with more than 30 years of experience. This has included intellectual property creation, research, development, software and infrastructure design and validation, systems auditing, work as a professional witness, and author.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
Can call centers hang up the phones for good? Intuitive Solutions did. WebRTC enabled this contact center provider to eliminate antiquated telephony and desktop phone infrastructure with a pure web-based solution, allowing them to expand beyond brick-and-mortar confines to a home-based agent model. It also ensured scalability and better service for customers, including MUY! Companies, one of the country's largest franchise restaurant companies with 232 Pizza Hut locations. This is one example of WebRTC adoption today, but the potential is limitless when powered by IoT.
One of the biggest challenges when developing connected devices is identifying user value and delivering it through successful user experiences. In his session at Internet of @ThingsExpo, Mike Kuniavsky, Principal Scientist, Innovation Services at PARC, described an IoT-specific approach to user experience design that combines approaches from interaction design, industrial design and service design to create experiences that go beyond simple connected gadgets to create lasting, multi-device experiences grounded in people's real needs and desires.
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
SYS-CON Events announced today that MetraTech, now part of Ericsson, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Ericsson is the driving force behind the Networked Society- a world leader in communications infrastructure, software and services. Some 40% of the world’s mobile traffic runs through networks Ericsson has supplied, serving more than 2.5 billion subscribers.
The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will addresses this very serious issue of profound change in the industry.
SYS-CON Events announced today that BMC will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BMC delivers software solutions that help IT transform digital enterprises for the ultimate competitive business advantage. BMC has worked with thousands of leading companies to create and deliver powerful IT management services. From mainframe to cloud to mobile, BMC pairs high-speed digital innovation with robust IT industrialization – allowing customers to provide amazing user experiences with optimized IT per...
The Internet of Things is not new. Historically, smart businesses have used its basic concept of leveraging data to drive better decision making and have capitalized on those insights to realize additional revenue opportunities. So, what has changed to make the Internet of Things one of the hottest topics in tech? In his session at @ThingsExpo, Chris Gray, Director, Embedded and Internet of Things, discussed the underlying factors that are driving the economics of intelligent systems. Discover how hardware commoditization, the ubiquitous nature of connectivity, and the emergence of Big Data a...
The world is at a tipping point where the technology, the device and global adoption are converging to such a point that we will see an explosion of a world where smartphone devices not only allow us to talk to each other, but allow for communication between everything – serving as a central hub from which we control our world – MediaTek is at the heart of both driving this and allowing the markets to drive this reality forward themselves. The next wave of consumer gadgets is here – smart, connected, and small. If your ambitions are big, so are ours. In his session at @ThingsExpo, Jack Hu, D...
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
SYS-CON Events announced today that DragonGlass, an enterprise search platform, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. After eleven years of designing and building custom applications, OpenCrowd has launched DragonGlass, a cloud-based platform that enables the development of search-based applications. These are a new breed of applications that utilize a search index as their backbone for data retrieval. They can easily adapt to new data sets and provide access to both structured and unstruc...
We’re entering a new era of computing technology that many are calling the Internet of Things (IoT). Machine to machine, machine to infrastructure, machine to environment, the Internet of Everything, the Internet of Intelligent Things, intelligent systems – call it what you want, but it’s happening, and its potential is huge. IoT is comprised of smart machines interacting and communicating with other machines, objects, environments and infrastructures. As a result, huge volumes of data are being generated, and that data is being processed into useful actions that can “command and control” thi...
As the Internet of Things unfolds, mobile and wearable devices are blurring the line between physical and digital, integrating ever more closely with our interests, our routines, our daily lives. Contextual computing and smart, sensor-equipped spaces bring the potential to walk through a world that recognizes us and responds accordingly. We become continuous transmitters and receivers of data. In his session at @ThingsExpo, Andrew Bolwell, Director of Innovation for HP's Printing and Personal Systems Group, discussed how key attributes of mobile technology – touch input, sensors, social, and ...
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo, June 9-11, 2015, at the Javits Center in New York City. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, discussed how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists will peel away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud environment, and we must architect and code accordingly. At the very least, you'll have no problem fil...
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
"People are a lot more knowledgeable about APIs now. There are two types of people who work with APIs - IT people who want to use APIs for something internal and the product managers who want to do something outside APIs for people to connect to them," explained Roberto Medrano, Executive Vice President at SOA Software, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect at GE, and Ibrahim Gokcen, who leads GE's advanced IoT analytics, focused on the Internet of Things / Industrial Internet and how to make it operational for business end-users. Learn about the challenges posed by machine and sensor data and how to marry it with enterprise data. They also discussed the tips and tricks to provide the Industrial Internet as an end-user consumable service using Big Data Analytics and Industrial Cloud.
Building low-cost wearable devices can enhance the quality of our lives. In his session at Internet of @ThingsExpo, Sai Yamanoor, Embedded Software Engineer at Altschool, provided an example of putting together a small keychain within a $50 budget that educates the user about the air quality in their surroundings. He also provided examples such as building a wearable device that provides transit or recreational information. He then reviewed the resources available to build wearable devices at home including open source hardware, the raw materials required and the options available to power s...