Cyber Security Myth Debunked – Costly firewall is the best protection for IT Security

by Prashant Posted on
Prashant
Latest posts by Prashant (see all)

Fact : Its not the cost of firewall, but how you configure it securely is what matters the most

Year : 2018

Said by : IT head of a mid-size Pharma company

“We are running without a security problem for past 4 years. You know how we achieved it? Its because I had this organization invest into a USD 12000 firewall. My management was reluctant first but then I convinced them and thats it. I proved them over time, that the firewall is doing its job right, so there is no need of VAPT or ISO27001 compliance. So thanks for meeting but as you can see, we really really do not need anything in cyber security space”.

Myth Debunked With The Fact Below

Irrespective of the firewall’s make or model or firmware version or its cost, the configuration setup is very important. Cost of firewall defines the features, speed and other relevant details which vary based on the manufacturer. However the security features are the important ones. At its basic level, each firewall comes with security policies which allows the network administrator to decide on IP addresses and ports to be allowed or disallowed. Most of the modern firewalls come with advanced features which allow detecting and stopping various attacks such as Syn Flood, Ack Flood, Denial Of Service, Layer 3 IP spoofing, SNMP packet injections. Some features such as deep packet injection, layer 7 packet analysis etc. allow a better control on the firewalls.

While performing firewall configuration audits, Valency Networks technical team comes across firewall rules which allow any source IP and any source port, to connect with any destination internal IP and any destination port. This is typically called as Any To Any rule and is a serious security loop hole.

Many network administrators are proud of their latest and greatest firewall, which is great. Although they should be proud of the tight configuration of those firewalls in order not to let any wrong configuration rule sneak in and let a hacker attack that vulnerability. Moral of this story is – the cost is not a deciding factor for the security. The right configuration is very important and must be tested occasionally to prevent security loop holes.
Senior management must update their knowledge about information security. They must open their minds up about compliances such as ISO27001, as well as the vulnerability assessment penetration testing (VAPT) which is imperative for their corporate networks, web and cloud applications and also the mobile applications. Right approach for companies, is to find a best cyber security vendor company or a top of the class information security consulting partner, and improve their organization’s data security via threat modelling and various other apt approaches.

References:
1. https://www.valencynetworks.com/security-management/firewall-audit.html
2. https://www.valencynetworks.com/security-management/system-hardening.html
#cybersecurity #mythbusters #myths #ethicalhacking #datasecurity #ciso #cio #cisos