Top 5 Network Security Challenges in 2021 and Beyond

There are a lot of theories about which network security concerns are the most important at any given time. The issue is highly subjective, particularly in this world of advocates, specialists, and vendors, who are each fixated on their particular piece of the puzzle.

But in the end, what matters is that organizations properly align and continuously adjust their activities so they can mitigate or even prevent the most prevalent threats to network security. Because while the threats haven’t changed much – viruses, botnets, access control, and visibility are evergreen challenges – the way threat actors try to leverage vulnerabilities and the way we fight them changes all the time.

Right now and for the foreseeable future, the choice of weapon is automation. Hackers use automation to find the most valuable data inside a network, conduct brute force attacks, deliver loaders and cryptors, operate keyloggers, execute banking injects, operate bulletproof hosting services, and more. We have to fight fire with fire, and automation is the only way to protect a complex, dynamic network from modern network threats.

This list presents five specific network security issues, but they are all children of one overarching condition: IT infrastructure complexity. That’s the real issue, and there’s no way around it. The average enterprise has around 500 products in its technology stack and uses more than 1100 APIs. Add in the rise of remote work and we find ourselves managing more connections, users, and devices than ever before. We need the ability to understand security challenges and scale our responses at top speed if we want to secure our organizations from threats.

Talking about complexity doesn’t provide any actionable information. So dig into the list below to see which aspects of complexity you can actually manage and how to do it.

1. Firewall Misconfigurations

Perhaps the least glamorous of all common network security threats, misconfigurations continue to hold the top spot. According to Gartner, 99% of firewall breaches will be caused by misconfigurations rather than firewall flaws. Common misconfiguration include:

• Overly permissive rules allowing unrestricted access
• Outdated rules for defunct systems or applications
• Incorrect rule order bypassing critical security checks

Uncustomized default settings misaligned with security needs Firewalls are hard to manage because networks are complicated and getting more complicated by the month. In our State of the Firewall report, almost one-third of respondents said their organizations use more than 100 firewalls, and 12 percent use more than 500. At this scale, managing the products, optimizing their rules, and exposing gaps in firewall enforcement is a task that can’t be handled manually. Automation is essential.

But that doesn’t mean full automation – the best solutions provide adaptive control and visibility over networks and firewalls. The goal should be to minimize human error rather than replace humans, because analysis activities during triage and escalation require an understanding of nuance that no machine possesses.

Watch our webinar on avoiding common firewall misconfigurations

2. Lax Privileged Access Controls

Privileged access abuse is a favored method of hackers because it’s easier for them to exploit existing credentials than to hack into a network. That’s why 74% of breaches start with privileged access abuse.

Many organizations focus their firewall management activities on permitting access. That often leads to too many users being granted levels of permissions that are too high. This is a dangerous mistake. In order to make the firewall a more effective security device in the network, risk must be evaluated with the same weight as access.

Credentials alone do not give enough information about whether the user requesting access is legitimate. Credentials need to be authenticated in context with other factors, such as:

• Geolocation
• IP address
• Time of access
• Device used
• Behavioral patterns

Automation plays a critical role in stopping privileged access abuse by reducing the human errors that lead to network security threats and increasing security agility, maximizing the operational efficiency of your security team.

3. Weak Tool Integrations

The problem isn’t too many tools. The problem is too many tools that don’t share data seamlessly.

A network is not a single zone. It’s a system of software-defined networks, micro-segmentation, and network rules and assets that create exponential complexity. To try to understand what’s happening in the network, security teams must shift from console to console, struggling to make sense of what one metric means in context with the others. The result is an environment that fosters human error and leaves gaps that adversaries can exploit.

Some organizations think they’ll be safe even if their tools don’t integrate with each other because they do integrate with the SIEM. However, SIEM systems often fall short in addressing threats to network security because they:

• Lack intuitive interfaces, making it difficult for security teams to navigate and utilize them effectively
• Fail to provide easily accessible, actionable insights, hindering quick response to potential threats
• Generate overwhelming volumes of data, exceeding the capacity of most security staff
• Focus primarily on system-generated signals, potentially missing manually-executed attacks
• Struggle to identify user-specific anomalies, such as unusual access patterns across departments

Security analytics platforms simplify data analysis by offering natural-language search, automatic data collection, and automated correlation. This speeds up threat detection and reduces the technical expertise needed, making network security more efficient and accessible.

4. Lack of Asset Visibility

Asset visibility changes from moment to moment as new devices and endpoints join and leave the network. Typically, there is no way to tell if the network is secure or compliant at any given point in time – at best, security professionals can look back over historical data to tell if the network had been secure at some point in the past. That isn’t actionable information.

Organizations need to understand how and why firewall rules are configured, the consequences of any changes, and how the changes impact security and compliance postures. Few can achieve this due to common obstacles such as:

• Lack of IT staff availability
• Poor network management tools
• No visibility into app delivery paths
• Absence of IT at remote offices

Automation can provide the means to see, map, and manage changes to an infrastructure at any given point in time. This is true visibility, and it makes an impact that resonates beyond the SOC. Visibility supports the business as a whole by enabling changes to be made faster and more securely without breaking compliance. The gap between managing network security risk and delivering business opportunities that drive competitive advantages is filled in.

Discover how cyber asset management can improve your visibility.

5. Misaligned Infrastructure and Controls

Teams are not able to keep up with ever-increasing volumes of network security threats and vulnerabilities that need to be mitigated or patched. As well, new applications need to be tested and deployed, emerging threats need to be addressed and, of course, access requests must be granted, returned for further authentication, or denied. The solution to handling this volume and variety of work is orchestration.

Orchestration is often thought of as synonymous with automation, but that’s not accurate. Automation focuses on executing a particular task, while orchestration arranges tasks to function optimally within a workflow – for instance, by bringing together the entire body of security controls and automating change.

An orchestration solution should be:

• Comprehensive, automating network security in every aspect, from policy design to implementation
• Capable of monitoring a live stream of data in real-time to enable instant snapshots of a network’s security posture
• Scalable in all directions, collecting security details and normalizing device rules for storage in a unified database
• Contained within a single console that provides total network visibility and the ability to command security controls

Convey Health Solutions struggled to stay in compliance with healthcare regulations while maintaining over 40 firewalls that relied on manual processes and lacked centralized management. The organization asked FireMon to help them streamline their compliance efforts and automate their change management processes.

Convey Health Solutions’ decision was driven by FireMon’s out-of-the-box, customizable compliance assessments, automated rule documentation and reporting, and workflows for rule review and recertification. Now, the healthcare organization can analyze and report in real-time what systems have been calibrated together to prevent unauthorized access and protect critical assets. The business has also been able to clean and push out almost 300 rules that had not been reviewed in over three years and found over 150 “shadow rules” that FireMon helped them identify and remove quickly.

The use of FireMon helped Convey Health Solutions achieve its HITRUST certification and shrink its audit time by two-thirds.

Automation is not without risk. When planned poorly, it will increase operational costs and potentially subject organizations to financial fallout from network security breaches and regulatory fines.

But when done well, automation makes enormous business sense and will deliver:

• Consistency
• Cost optimization
• Ongoing visibility and assessment
• Network security profile management
• Support for proactive risk mitigation

Considering the complex, dynamic networks that organizations must govern across firewalls, applications, databases, data centers, cloud, and containers, automation isn’t optional any more. It’s the only way to stay operational. Our advice is to automate mindfully.

The FireMon approach to network security automation is built on providing a context around access requests to help system administrators and network engineers implement change that enables the business without introducing the new risks that come with handling thousands of change requests daily. Using our intelligent, automated workflow, security administrators can implement the right changes with absolute precision.

Learn more about how FireMon can help your organization resolve its network security issues while driving innovation at the speed of business.