A modern firewall solution can defend against the most common and perilous adversarial strategies: ransomware, phishing and exploiting cloud vulnerabilities.
“Ransomware is a form of malware, and the malware service in a next-generation firewall will protect against that,” says Rich Campagna, senior vice president of products at Palo Alto Networks. When a user clicks a suspicious link in a phishing email, the NGFW “will prohibit the user’s browser from going to that malicious site.”
Features such as ATP “will guard against vulnerabilities, including cloud vulnerabilities,” Campagna says. “It protects against threats — not only in the data center but also in the cloud — for remote users, Internet of Things and operational technology assets. It’s a comprehensive set of capabilities that guards against any threat that’s coming into the enterprise.”
Practical Factors in NGFW Selection
There are several ways to deploy NGFWs. Solutions can be hardware-based physical appliances or software-based virtual appliances, and they can be deployed in the cloud or in a hybrid physical-virtual combination.
BEST PRACTICES: Take these eight steps to ensure interoperability between your agency’s zero-trust tools.
From a practical standpoint, agencies need to consider integration with existing systems and ease of management. “Security efficacy is absolutely the top priority,” Campagna says. “That’s first and foremost.”
Ideally, that robust security will be delivered via an NGFW platform, a single solution that standardizes its fragmented firewalling tools. This approach “helps them gain some of the operational efficiencies that they otherwise lose when they’re working with disparate point products that don’t talk to each other,” Campagna says. That ease of use takes some of the pressure off IT teams that are already stretched thin.
Cost and Future Proofing Your Investment
Because of the federal budgeting process, agencies will likely not be able to revisit an NGFW with any frequency. Budget cycles are prolonged, and money is tight. That means agencies need to budget for an NGFW in a way that ensures longevity, by buying a future-proof solution.
Scalability is a factor worth considering, as network traffic will increase over time. Ideally, an NGFW solution will have the built-in ability to expand to meet future demand. With a scalable solution, “I can buy what I need today, and then as my needs grow, I can just add to it,” Deskin says.
DISCOVER: Native American tribes are defending their very heritage against ransomware.
A platform approach can also ensure that today’s NGFW can respond to the future threat of emerging exploits based on artificial Intelligence or quantum computing, Campagna says.
The platform provider can add enhanced features and capabilities to the existing solution over time, which “allows for increasing innovation and the introduction of new services,” Campagna says. “Agencies need to be looking for platforms that have been designed to add additional services, including FedRAMP-certified cloud capabilities.”
This helps agencies keep their defenses current during uncertain budget cycles. When enhancements are built into an existing platform that is already certified, “from a federal budgeting perspective, it becomes much easier to expand,” Miles says. “Rather than trying to bring some net-new thing in as a separate line item, it’s essentially a service that’s built into that platform.”
