Click here to close now.


Cloud Security Authors: Liz McMillan, Cloud Best Practices Network, Teresa Schoch, Marc Crespi, Elizabeth White

Related Topics: Cloud Security, Java IoT, Microservices Expo, Open Source Cloud, @CloudExpo

Cloud Security: Article

Why Your NGFW Needs Granular and Contextual Access Control

understand how these evolving feature sets can help contain costs while reducing management complexity

Global information technology networks that are rich in services are typically complex and require hard-to-manage security solutions. The latest versions of next-generation firewalls now offer multiple security layers that can complicate management, particularly as more and more features are added. This complexity can also serve to reduce the effectiveness of controls by obscuring noteworthy events or failing to recognize trends detected by multiple security systems integrated into the overall system. The answer is a common, unified management approach with granular and contextual access control.

Instead of employing multiple and distinct dashboards offering minimal if any integration to manage network security, administrators should be able to access a single dashboard to gain a consistent, unified view across all firewall protected segments. The data must be granular and contextual, empowering IT and network security administrators to execute and control all NGFW operations from a single perspective. And to assure logging of all actions taken and events observed, without regard to operator location.

Consistency is key. This level of administrative awareness and control should be available regardless of modality (physical or virtual) or configuration. Here are five critical control features to look for when evaluating a next generation firewall.

1. Integrated VPN
Secure virtual private network (VPN) connections provide for inter-office and mobile user connectivity to corporate resources. First-tier NGFWs typically provide high-performance remote access with integrated management supporting the use of multiple ISPs to ensure access in the event of link failure. Such solutions typically offer VPN client software to take full advantage of various deployment options. Look for the capability to cluster the firewall configuration to assure availability and session survivability in the event of a firewall appliance update or failure. Flexibility in licensing is also necessary to address burst utilization or pandemic usage requirements. Additionally, support for deep inspection is highly recommended as a necessary precursor to support DLP requirements.

2. Email and Web Security
Email advertising and social media services can flood a network with traffic of little to no business value. And this traffic stream can be a wide conduit for malware. One response is to deploy your NGFWs with additional services such as deep-inspection, web filtering, anti-virus, and anti-spam services. Combining these services under one NFGW umbrella ensures that they are available (especially if the firewall solution is clustered for high availability) and implemented at all relevant chokepoints within an organization. Superior traffic control based on users and groups, as well as contextual awareness of attacks and their use by would-be attackers across the entirety of an organization, improves an organization's resistance to a breach. Furthermore, solutions that support contextual awareness may be able to share details on detected attacks across all firewalls under the same management control, and take broad actions. For example, the actions of an attacker against one firewall may be used to blacklist that attacker across all firewalls of the organization. This amplifying effect is particular pronounced if the NFGW management solution is multi-tenant capable and used to protect multiple divisions or firms.

3. Precise Security Policies
Control over traffic based on a variety of options will enable Network security administrators need great flexibility in granting privileges to employees to perform their jobs. In addition to typical firewall IP Address and port filtering, NGFW solutions also typically support the control of traffic by service (protocol), application, user identity, group affiliation, URL categorization, site reputation, time of day, method(s) of authentication, and context. Precise security policies can provide QoS directives so access control is governed by dynamic business requirements or the availability of underlying communications resources. For example, transaction traffic may be given preferential treatment over social media access by employees, and lower priority traffic is automatically shed if a circuit failure reduces available bandwidth.

4. Integrated Authentication Services
Independent authentication mechanisms often lack integration with the firewall. However, the integration of authentication services with NGFW policies can allow administrators to constrain, track, and log access to services. Such access controls often use a variety of authentication methods including token and virtual token systems. Virtual token applications for mobile phones and tablets reduce costs over traditional key fob tokens. In addition, integration to the NGFW unifies the management of how an individual or members of a group are authenticated.

5. Traffic Management and QoS
Firewalls that feature traffic management and quality of service (QoS) can provide detailed control on what traffic is permitted and at what priority, while assuring end-to-end capacity to meet session requirements. QoS selections such as bandwidth floors and ceilings help to differentiate traffic streams, assuring the streams are treated fairly and not inadvertently precluded in their entirety, or allowed to consume bandwidth to the detriment of other business activities. For isochronous (time sensitive) traffic such as VoIP or video conferencing, the proper handling of long-haul priority directives is necessary to ensure that in-band traffic with specific bandwidth and jitter requirements is accommodated on an as-needed basis.

In addition, traffic management can help triage traffic if sufficient networking bandwidth is unavailable to meet all approved needs. For example, transactions take priority over backups or social media access.

The NGFW can improve the utilization effectiveness of the network and its security posture. It is also a network chokepoint of access from WAN connectivity to remote facilities, mobile employees, and the Internet. Pay attention to all options available with NGFW products and understand how these evolving feature sets can help contain costs while reducing management complexity.

More Stories By Darren Suprina

Darren Suprina is an IT systems designer and security professional with more than 30 years of experience. This has included intellectual property creation, research, development, software and infrastructure design and validation, systems auditing, work as a professional witness, and author.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

@ThingsExpo Stories
Too often with compelling new technologies market participants become overly enamored with that attractiveness of the technology and neglect underlying business drivers. This tendency, what some call the “newest shiny object syndrome,” is understandable given that virtually all of us are heavily engaged in technology. But it is also mistaken. Without concrete business cases driving its deployment, IoT, like many other technologies before it, will fade into obscurity.
SYS-CON Events announced today that Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, will keynote at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi's VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driving this change including privacy controls, data transparency and integration of real time context w...
The IoT market is on track to hit $7.1 trillion in 2020. The reality is that only a handful of companies are ready for this massive demand. There are a lot of barriers, paint points, traps, and hidden roadblocks. How can we deal with these issues and challenges? The paradigm has changed. Old-style ad-hoc trial-and-error ways will certainly lead you to the dead end. What is mandatory is an overarching and adaptive approach to effectively handle the rapid changes and exponential growth.
There will be 20 billion IoT devices connected to the Internet soon. What if we could control these devices with our voice, mind, or gestures? What if we could teach these devices how to talk to each other? What if these devices could learn how to interact with us (and each other) to make our lives better? What if Jarvis was real? How can I gain these super powers? In his session at 17th Cloud Expo, Chris Matthieu, co-founder and CTO of Octoblu, will show you!
Today’s connected world is moving from devices towards things, what this means is that by using increasingly low cost sensors embedded in devices we can create many new use cases. These span across use cases in cities, vehicles, home, offices, factories, retail environments, worksites, health, logistics, and health. These use cases rely on ubiquitous connectivity and generate massive amounts of data at scale. These technologies enable new business opportunities, ways to optimize and automate, along with new ways to engage with users.
The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new data-driven world, marketplaces reign supreme while interoperability, APIs and applications deliver un...
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data shows "less than 10 percent of IoT developers are making enough to support a reasonably sized team....
Developing software for the Internet of Things (IoT) comes with its own set of challenges. Security, privacy, and unified standards are a few key issues. In addition, each IoT product is comprised of at least three separate application components: the software embedded in the device, the backend big-data service, and the mobile application for the end user's controls. Each component is developed by a different team, using different technologies and practices, and deployed to a different stack/target - this makes the integration of these separate pipelines and the coordination of software upd...
Mobile messaging has been a popular communication channel for more than 20 years. Finnish engineer Matti Makkonen invented the idea for SMS (Short Message Service) in 1984, making his vision a reality on December 3, 1992 by sending the first message ("Happy Christmas") from a PC to a cell phone. Since then, the technology has evolved immensely, from both a technology standpoint, and in our everyday uses for it. Originally used for person-to-person (P2P) communication, i.e., Sally sends a text message to Betty – mobile messaging now offers tremendous value to businesses for customer and empl...
"Matrix is an ambitious open standard and implementation that's set up to break down the fragmentation problems that exist in IP messaging and VoIP communication," explained John Woolf, Technical Evangelist at Matrix, in this interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
The IoT is upon us, but today’s databases, built on 30-year-old math, require multiple platforms to create a single solution. Data demands of the IoT require Big Data systems that can handle ingest, transactions and analytics concurrently adapting to varied situations as they occur, with speed at scale. In his session at @ThingsExpo, Chad Jones, chief strategy officer at Deep Information Sciences, will look differently at IoT data so enterprises can fully leverage their IoT potential. He’ll share tips on how to speed up business initiatives, harness Big Data and remain one step ahead by apply...
Nowadays, a large number of sensors and devices are connected to the network. Leading-edge IoT technologies integrate various types of sensor data to create a new value for several business decision scenarios. The transparent cloud is a model of a new IoT emergence service platform. Many service providers store and access various types of sensor data in order to create and find out new business values by integrating such data.
The broad selection of hardware, the rapid evolution of operating systems and the time-to-market for mobile apps has been so rapid that new challenges for developers and engineers arise every day. Security, testing, hosting, and other metrics have to be considered through the process. In his session at Big Data Expo, Walter Maguire, Chief Field Technologist, HP Big Data Group, at Hewlett-Packard, will discuss the challenges faced by developers and a composite Big Data applications builder, focusing on how to help solve the problems that developers are continuously battling.
There are so many tools and techniques for data analytics that even for a data scientist the choices, possible systems, and even the types of data can be daunting. In his session at @ThingsExpo, Chris Harrold, Global CTO for Big Data Solutions for EMC Corporation, will show how to perform a simple, but meaningful analysis of social sentiment data using freely available tools that take only minutes to download and install. Participants will get the download information, scripts, and complete end-to-end walkthrough of the analysis from start to finish. Participants will also be given the pract...
WebRTC services have already permeated corporate communications in the form of videoconferencing solutions. However, WebRTC has the potential of going beyond and catalyzing a new class of services providing more than calls with capabilities such as mass-scale real-time media broadcasting, enriched and augmented video, person-to-machine and machine-to-machine communications. In his session at @ThingsExpo, Luis Lopez, CEO of Kurento, will introduce the technologies required for implementing these ideas and some early experiments performed in the Kurento open source software community in areas ...
Internet of Things (IoT) will be a hybrid ecosystem of diverse devices and sensors collaborating with operational and enterprise systems to create the next big application. In their session at @ThingsExpo, Bramh Gupta, founder and CEO of, and Fred Yatzeck, principal architect leading product development at, discussed how choosing the right middleware and integration strategy from the get-go will enable IoT solution developers to adapt and grow with the industry, while at the same time reduce Time to Market (TTM) by using plug and play capabilities offered by a robust IoT ...
“In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Through WebRTC, audio and video communications are being embedded more easily than ever into applications, helping carriers, enterprises and independent software vendors deliver greater functionality to their end users. With today’s business world increasingly focused on outcomes, users’ growing calls for ease of use, and businesses craving smarter, tighter integration, what’s the next step in delivering a richer, more immersive experience? That richer, more fully integrated experience comes about through a Communications Platform as a Service which allows for messaging, screen sharing, video...