How to manage your multivendor firewalls like a pro

Network World - Auditing firewalls to keep regulators happy and tracking rule changes -- especially for businesses buying firewalls (compare products) from multiple vendors -- is a burden that a variety of third-party software can lighten dramatically.

Software from vendors AlgoSec Inc., Secure Passage LLC and Tufin Software Technologies Ltd. can report firewall statistics (compare security information-management products) to prove compliance with industry and government standards, and it can consolidate rules so firewalls run more efficiently, customers say.

"That's very different from what individual firewall vendors do," said Greg Young, an analyst at Gartner Inc. "[Third parties] respond more to audit compliance and the real-world regulatory compliance that companies need."

Young said individual firewall vendors have tools to configure and logs to record rules changes, but don't have the capability to simulate inserting new rules in existing rule sets to see their impact. AlgoSec, Secure Passage and Tufin are the only vendors he knows of that offer this type of functionality, and they do so only for the major firewall vendors, Check Point Software Technologies Ltd., Cisco Systems Inc. and Juniper Networks Inc.

Adam Forester, supervisor of network security at medical transaction processing firm Emdeon Business Services in Nashville, said he turned to Tufin because Check Point tools couldn't do as good a job optimizing his 100-plus firewalls.

"I needed the real optimization, being able to go through the policy and say this rule is using services that another rule is also using and you can eliminate this rule. Check Point's products just do not do that," Forester said.

Tufin software runs through a firewall's rule set in less than five minutes, drastically cutting the time it would take to do the same optimization manually, he said. "We would spend a couple of months going through logs manually, printing out the entire rule base and just going through it by eye," he said. He added that the software reduced the number of rules in one firewall from about 600 to 200, reducing the CPU power demanded to process traffic.

Trimming down the number of firewall rules means it is simpler to audit them, said Gartner's Young. That translates into lower prices for audits because they take less time, he said.

This type of software can help with regulatory audits as well. For instance, when it came to meeting firewall security regulations, AXA Technology Services turned to AlgoSec's Firewall Analyzer. It can generate reports that help out demonstrating compliance with the Sarbanes-Oxley Act and Payment Card Industry (PCI) standards, said Dan Raymonda, a technology specialist at the company. AXA Technology is the centralized IT provider for other AXA operating companies.