Speaker: Gidi Cohen, CEO and Founder – Skybox Security, Inc. Whether you are planning a transition to next-gen firewalls or have already done so, maximizing your next-gen firewall investment is imperative. Yet, most enterprises experience common management challenges that can slow down deployments, complicate existing firewall operations processes, and delay use of the most advanced next-gen firewall features. In this session, Gidi Cohen, CEO and founder of Skybox Security, shares customer case studies and research to illustrate these transition challenges and outline a phased approach to evaluate, adjust, and implement updated processes and tools so you can effectively manage your next-gen firewall deployment.

1. Transitioning to Next Generation
Firewall Management
presented by
Gidi Cohen
CEO and Founder
Skybox Security
November 14, 2012
www.skyboxsecurity.com
© 2012 Skybox Security 1

2. Skybox Security Overview
Leader in Proactive Security Risk Management
• Leveraging predictive risk analytics technology
• Designed for continuous, scalable operation
Global 2000 Customers
• Proven deployments in complex networks
• Financial Services, Government, Defense, Energy,
Retail, Service Providers, Manufacturing, Tech
Complete Product Portfolio
• Firewall Assurance - Automated Firewall Management
• Change Manager - Secure Change Management
• Network Assurance - Network modeling & compliance
• Risk Control - Risk and Vulnerability Management
© 2012 Skybox Security 2

3. Security Challenges in the
Extended Enterprise
BYOD
demands
BYOC (Cloud)
data and
applications
Rapidly
mutating
threats
Roll-out new
services
Protect the
Business
© 2012 Skybox Security 3

4. Old Gen Tech Is Not Effective
• Traditional Firewalls –
Unable to keep up with
new challenges
• Vulnerability scanners –
Often disruptive, not
suitable for daily use
• SIEM – Reactive, too
much irrelevant data
• Pen Test – Not cost
effective at large scale
© 2012 Skybox Security 4

5. 2012 Skybox Survey:
Reasons for Selecting NGFW’s
0 10 20 30 40 50 60 70
Protection against complex attacks
Firewall performance
Malware identification
Control access to external apps
BYOD
Control access to internal apps
Cut management time
Fewer security devices
Trim operating costs
Get the newest tech
Nearly 80% use or plan to use NGFWs as
an improved layer of protection
© 2012 Skybox Security 5

6. 2012 Skybox Survey:
NGFW’s will be the new norm
30
% of orgs
25
20
15
Today
10 In 12 Months
5
0
None Less than 10-24% 25-49% 50-74% 75-100% % of NGFW
10%
We estimate that within 12 months 75% or more of
organizations will have Next-Gen Firewalls deployed
© 2012 Skybox Security 6

7. 2012 Skybox Survey:
#1 Anticipated Feature - Network IPS
Integrated network IPS
Standard firewall capabilities
Content-specific policy enforcement
Application-aware policy…
Address blacklisting and whitelisting
User-aware policy enforcement
Integrated malware detection
Other
0 10 20 30 40 50 60 70 80
93% use or plan to use the network IPS feature.
62% in active protection mode.
© 2012 Skybox Security 7

8. But, How Will You Manage?
Effort Today Real Strain Tomorrow
• 500 Network devices Now ,add in:
• 15,000 FW rules • User and Application
• 100 daily changes
ouch! policies
• Infrastructure • New security zones
spanning three • 4,000 IPS
continents signatures
© 2012 Skybox Security 8

9. Management Challenges
Traditional Firewall Management Challenges
• Continuous Compliance
• Change Management
• Optimization, Troubleshooting
New, Added Challenges
• New network architecture and zoning
• Migration from old gen to next gen
• Effective Threat Protection
© 2012 Skybox Security 9

10. 2012 Skybox Survey:
Top Migration Challenges
Managing multiple firewalls and
vendors
Validating correct operation of NGFW
Training administrators on NGFW
platform
Creating new, more granular policies
Planning architecture changes
Changing management processes
Converting trad to NGFW configs
2.8 2.9 3 3.1 3.2 3.3 3.4 3.5 3.6
Respondents took an average of 6.5 months
to implement next-gen firewalls
© 2012 Skybox Security 10

11. 2012 Skybox Survey:
Top Operational Challenges
Optimizing rule-sets
Maintaining set of IPS signatures
Verifying access policies enforced…
Managing firewall changes
Verifying rule compliance
Internal reporting
Maintaining best practice config
Demonstrating policy compliance
Troubleshooting connectivity issues
Managing trad & NGFWs together
0 5 10 15 20 25 30 35
“A lot of manual fine-tuning continues to be necessary.”

12. Verifying Protection is a
Daily Challenge
Did change Vulnerabilities
• CVE 2009-203
expose a • CVE 2006-722
vulnerability? • CVE 2006-490
Sensitive
Risky
assets
Access
Path?
A Different Approach is Needed
Misconfiguration?
© 2012 Skybox Security 12

13. Need Network and Risk-Aware
Firewall Management
Firewall & Network
Change Vulnerability and
Management Threat Management
Topology and apps Identify, prioritize,
aware, ensure daily remediate critical risk,
policy & configuration enable IPS, Malware
compliance
© 2012 Skybox Security 13

14. Better Approach: Network
Modeling & Risk Analytics
Vulnerabilities
• CVE 2009-203
• CVE 2006-722
• CVE 2006-490
Enable IPS
signatures
Check
Access
Paths
Simulate
Prevent
Possible
potential
Attacks
breach
© 2012 Skybox Security 14

15. Firewall Migration Planning
• Model and visualize
the network topology
• Optimize legacy
rulesets before
migration—maximize
performance
• Plan zone-based
policies
• Check ‘what if’
scenarios
© 2012 Skybox Security 15

16. Access Path Troubleshooting
• Validate changes with access path analysis
• Troubleshoot outages or connectivity issues in seconds
• Enhance visibility of network security process
© 2012 Skybox Security 16

17. Application Policy Management
• Enable automated
policy compliance
• View access policy
violations by
application
• Block or limit access
checks by
applications
• Network modeling of
users and
applications
SURVEY:
46% enable BYOD and external social apps
© 2012 Skybox Security 17

18. Ensure Effective IPS Coverage
• Review and report on
configuration of recent
threats
• Understand overall
signature coverage
• Activate only necessary
signatures, maximize
performance and
prioritize vulnerabilities
SURVEY:
62% plan to use IPS in active protection mode
© 2012 Skybox Security 18

19. Show Results Quickly for your
NGFW Investment
• Ensure Fast, Successful Firewall Migration
• Model and visualize deployment plan
• Optimize legacy rulesets
• Use Advanced Features to Prevent Attacks
• Optimize IPS signatures for best protection
• Exclusive Skybox and PAN capability
• Show Continuous Policy Compliance
• Ensure configuration best practices
• Check access by applications
© 2012 Skybox Security 19

20. Automate daily security tasks
Maintain compliance, prevent attacks
Please visit Skybox at our booth at Ignite!
Download the survey at www.skyboxsecurity.com
Thank you!
© 2012 Skybox Security 20