Firewalls Are Dead - How to Build a Resilient, Defendable Network

Traditional perimeter-based network security—an “insecure Internet” outside and a “secure internal network” behind a firewall—fails both to protect modern organizations and to enable business agility. Adversaries routinely bypass perimeter controls using spear-phishing, drive-by downloads, insiders, infected laptops off-network, malicious USB drops, and trusted third-party connections. Meanwhile, business needs (cloud use, partner connectivity, mobile workforces) force constant traversal of the perimeter, creating rigid bottlenecks and encouraging shadow IT that ignores the border entirely.

Perimeter firewalls also struggle operationally: rule sets commonly exceed 2,500 entries, many undocumented and retained out of fear of breaking business processes. Encryption reduces the effectiveness of deep packet inspection; attempting man-in-the-middle decryption creates privacy and legal issues and can be defeated by techniques like certificate pinning. The widespread use of ports 80 and 443 for legitimate applications also provides adversaries reliable channels for entry and data exfiltration. As a result, monitoring internal traffic provides diminishing value when networks are segmented, users access cloud services directly, and endpoints are predominantly mobile.

A resilient architecture starts by distinguishing data protection from control-system protection. Control systems may require layered “onion-skin” segmentation or micro-perimeters to compensate for unpatchable devices and legacy protocols. For enterprise data, organizations should perform a data-flow analysis and adopt a data-centric model: protect data consistently wherever it resides, move controls close to the data via micro-perimeterisation, mandate inherently secure protocols and encryption, and leverage identity (user, device, organizational) for granular, frictionless access. Centralized firewall management and logging, coupled with analytics and Real Time Security Intelligence (RTSI), provides visibility for proactive configuration and improved detection and response.

• Typical corporate border firewalls can have in excess of 2,500 rules.
• In one cited example of a flat internal corporate network, operations span 50 countries, include 100,000 active devices, and serve 60,000 users.
• Over 80% of endpoint devices in a typical organization are laptops.
• Port 80 (HTTP) and port 443 (HTTPS) generally must be open in any business environment.
• The Target breach involved access granted to a refrigeration and air conditioning supplier and resulted in 40 million stolen credit cards.
• New techniques such as certificate pinning can defeat attempts to decrypt traffic for inspection at the firewall.
• Programmable Logic Controllers in plant environments generally are not patched.
• Under 5% of organizational data is typically “Red Data” that would be share-price affecting if compromised.
• 802.1x is widely used to authenticate connections to corporate Wi‑Fi networks.
• Many organizations retain network logs without active monitoring so investigations are possible after major incidents.

• “A traditional 1990’s secure internal network protected from the Internet by a firewall is obsolete”
• “It could be argued that the majority of the organisation’s data is already outside the corporate boundary”
• “Data is the lifeblood of any company, and should be protected”
• “Google’s BeyondCorp initiative is moving to a new model that dispenses with a privileged corporate network.”
• “The data strategy should drive the identity strategy;”
• “Virtual LANs should be avoided as a security tool.”
• “Centralised logging coupled to analytics and real-time security intelligence (RTSI) should provide businesses with a greater level of visibility and insight.”
• “You should always assume that someone can easily plug a ‘black box’ into your network”
• “Having a single standard for protecting the entire ‘internal’ network is a complete waste of time, money and resources”
• “With a comprehensive data flow analysis driving the network security and architecture, it is possible using modern security appliances and supporting security technologies to deliver a flexible and agile network”