2010 be damned, firewalls are still very important to network security

By now, you may have seen the full 2018 State of the Firewall Report we produced, or you might have seen the 35,000-foot view blog post of the findings that we produced last week.

One of the reasons we commenced the project back in was because there was increasing discussion in the network security arena about the demise of the firewall. In October 2010, for example, SC Media was arguing that the firewall was in decay much like a reduction in operating systems and mobile phones.  In 2012, Palo Alto Networks declared the firewall dead, but not really if you consider the context of the firewall’s demise points to how you define its purpose.  So why are we looking so far back in time? Simple, it is still very relevant today!

We’re always trying to be aware of new trends and emerging technologies, but we never saw the demise of the firewall as that drastic — and, five years into this report, our respondents don’t either.

Rather, 94% of respondents report that firewalls are as critical as always or more critical than ever.

Open Ended Up to 1024 Px Wide - Chart1.jpg

This is the good news, then: 8 years later we still find the firewall of foundational importance to our security architecture.

Most enterprise CISOs find themselves with 70 to 80 different point solutions in their security arsenal.  These solutions provide security services for the network, servers, desktops, and applications they “own.”  So while there is no shortage of technology, the problem most often expressed to me is the growing cost of ownership and uncertainty of security investment return.

During a recent conversation I had with a Director of Information Security, this individual relayed several items they consider for any new technology adoption:

  • Does it replace, augment, or add new services to existing technology in use?
  • Initial acquisition cost
  • Annual maintenance and/or subscription services
  • Projected growth cost requirements
  • Projected consolidation cost reductions
  • Personnel training costs
  • Architectural, maintenance, and operational resource requirements
  • If applicable, actionable response resource requirements

I was told that unless there was a specific mandate requiring new technology adoption to achieve a specific company strategic goal, the only other way to justify any new technology purchases was to prove consolidation.  A two-to-one consolation is enough for review but more often a reduction of three or greater was viewed more favorably.

Therefore, it comes as no surprise that at the top of most strategic initiatives is an action item to significantly reduce the total number of security point solutions — and better quantify the return on security investment for those they keep.

It’s also no surprise that a clear champion was needed to lead the charge around consolidation of security services and what better technology positioned to do so than the firewall.  The firewall’s next generation evolution has given it new life and has once again positioned it as the cornerstone of security architectures for the hybrid on-premise and cloud based enterprise.

But the report also had a flip side.

We’ll cover the flip side fully in the next blog post in this series, but let’s cue it up with a quote from our CMO, Dan Lamorena, in a recent eWeek article:

“We continue to see an increase in the number of firewalls that need to be managed every year. What is changing is that we are seeing more firewalls that are virtual and potentially residing in the cloud.”

And therein lies the issue: as firewalls remain relevant, they remain relevant in a time of increasing complexity around their use. Stay tuned for the next blog. In the meantime, download the full report here: