WHITEPAPER. Five Pillars for Controlling Firewall ACLs and Rules

Transcription

1 WHITEPAPER Five Pillars for Controlling Firewall ACLs and Rules

2 Abstract Leading network and security experts across the world are all facing the same challenge trying to control the complex, time-consuming process of managing ACL and rule changes for network security devices. IT teams struggle to walk the fine line between trying to meet the business goal of virtually seamless deployment of new services and applications against stagnant IT budgets and headcount. The legacy processes used over the past decade are beginning to cause a huge bottleneck which slow deployment SLAs. The power of network automation can be a key driver to bridge the gap between targeted goals and IT reality. The Setting The days of a single firewall being the last line of defense to the Internet are long gone! Instead of punching a hole through a single firewall, today s requirements often include a plethora of security devices (firewalls as well as integrated routers and switches) from multiple vendors that require several ACL and rule changes just to provision one new service request. Years ago, network and security teams may have received a handful of requests a month that would be implemented on a few devices. In today s dynamic world, it s spiked to multiple fistfuls of daily or weekly requests that need to be implemented across a growing number of devices. If staff or resources are not added, something will either break or delays will continue to grow. The Challenges When it comes to dealing with provisioning access for ACLs and rules, it is becoming a perfect storm of complexity and pain for network and security teams. For virtually every IT team, there is a massive explosion in the number of requests for additional services and applications with a spike of new, dynamic options being implemented. As mentioned previously, each of these changes typically impacts several devices which add to the amount of effort needed and risk of incorrect settings. However, in today s economic environment, the IT budget and headcount hasn t kept pace with the new influx of requirements. So now the individual has to decide which of their many demands has precedence, and often, modifying the ACLs is not on the top of their list as they have other pressing priorities. One of the biggest challenges many IT teams face is keeping legacy processes developed years or decades ago although the environment has changed so rapidly. So where CLI access, custom scripts or using vendor-specific tools may have worked in a less dynamic world these encumbering processes become the major bottle neck when dealing with network security devices today. 1 1 WHITEPAPER Five Pillars for Controlling Firewall ACLs and Rules

3 Typically, the most experienced and skilled senior network engineer or architect is used for these repetitive, routine changes. The expertise is needed because each vendor has complex commands and unique syntax for doing the same thing. More junior staff will often miss small, but key differences which negatively impacts availability. While the most senior staff can handle the repetitive tasks, they are often needed for other business-critical initiatives. The Impacts Combining the three major challenges leads to three major impacts: lengthening of SLAs, inefficient use of resources and standardization/compliance requirements. Lengthening of SLAs For most organizations, there is a major difference between the targeted deployment SLAs and the actual results. While a typical goal may be to have a new service deployed with a few hours or a day, the reality is most changes are measured in days or weeks because of the multiple steps and manual processes. Inefficient Use of Resources Traditionally, changes are made manually through CLI access or scripts. The senior network manager creates the planned configuration change, goes through thousands of lines of code and hopes the new change will not negative impact something anything else. But with the explosion in number of requests, this becomes a single point of failure because the demands increase while available staff time does not. Even the best network staff makes simple mistakes which are often time consuming and costly to remediate. Standardization/Compliance Requirements As security becomes more of a concern, the internal best practices and external compliance mandates are getting more attention. IT teams are forced to prove there are proper controls as well as configurations policies are followed. If an audit is ever required, it typically takes several people a few days or weeks to manually go device to device, line by line to prove success. These manual processes are normally measured in both amount of staff and number of days or weeks to complete. This in turn adds the recurring cycle of ever growing daily requirements. 2 2

4 The Example The best way to look at the pain of the legacy processes is to think about the steps required to make a single change to allow access through the firewalls and security devices. 1 The network staff must have a complete understanding of every device connected to the network as well as understand the differences if multiple vendors are deployed. 2 Since virtually every service path will have multiple devices, the staff must decide which devices are impacted and will need changed. 3 The network manager must determine the right configuration with the correct vendor syntax to allow (or deny) access for this change. In addition, they also need to verify the new change won t negatively impact existing services. 4 The new ACL or rule needs to be compared to the standards to make sure there are no policy or compliance violations. 5 The change request is opened and typically implemented manually through CLI, custom script or vendor-supplied tool. 6 Verify and reconfirm everything is working properly and manually check to find any overlapping, unused or duplicate rules. Normal process flow for provisioning ACL/rule changes manually. Typically, each of these steps has a gate and a possible handoff, so it is easy to see why the time to provision a change can grow out of hand. By the way, these steps must be followed for each and every change so the multiplying affect shows how staff can become quickly overburdened. The Option Most experienced staff sees the risk in following the same legacy processes when things have become so dynamic. So most organizations often have three potential paths: 1 Add staff to meet the growing needs 2 Allow the provisioning SLA to lengthen 3 Try something different For most organizations, it is fiscally impossible to throw enough headcount to meet the growing demands. Conversely, most executives will not accept a response of We need a week to provision a new service. This requires the networking team to try something different or ultimately fail. 3 3 WHITEPAPER Five Pillars for Controlling Firewall ACLs and Rules

5 The Power of Network Automation Network automation is a great way to move from legacy processes so you can better handle today s dynamic requirements. The power of automation isn t pushing a magic button and everything is done for you. It is reducing the amount of time and effort needed to make effective changes while still maintaining control of your devices and infrastructure. For example, it s leveraging machine-speed analysis to sift through thousands of lines of codes instead of slowly going from one line to the next over and over and over again. The Five Pillars of Security Device Automation Many IT teams have started to see the power of automation and have developed initiatives across different fronts using different tools and processes. While some automation is better than none, the disjointed approach does not provide all of the potential benefits. Infoblox Security Device Controller was developed to help network and security teams control the changes for ACLs and rules for network security devices. Security Device Controller provides five key pillars of automation all within a unified platform. 1) Automated discovery knows exactly what is on the network and how everything is connected to visualize what needs changed. Complete network discovery with powerful topology map to visualize path. 4 4

6 2) Embedded expertise finds unused, overlapping or duplicate rules quickly and easily for multiple vendors which enables quick clean-up and remediation of poor configurations. Built-in intelligence provides detailed ACL/rule views and detects unused, overlapping and duplicate rules out of the box. 3) Powerful search can find specific criteria in a matter of seconds so network teams do not manually search device by device, rule by rule. Customizable search criteria for one or multiple devices across multiple vendors using human-readable GUI. 5 5 WHITEPAPER Five Pillars for Controlling Firewall ACLs and Rules

7 4) Leverage customized alerting finds when whitelisted services cannot connect or when blacklisted services add risk. Create alerts for both Blacklisting and Whitelisting to either alert on allowed or denied access issues. 5) Provision the actual changes for multi-vendor deployments reduce the amount of manual time and effort needed to make the changes. Provision changes in the same platform and see the vendor-specific syntax while maintaining user-based access rights and change process controls. 6 6

8 The Wrap Up If things are running perfectly smooth for your IT team and the provisioning of access policies meets or beats your targets, consider yourself in the very, very small population. For the majority of organizations, the sheer workload is causing many problems. Automation can help you control your network. So instead of the days or weeks it might take to make a firewall change today, you can have better, more accurate and faster provision. Automation allows the network to keep up with the growing requirements securely and effectively. Infoblox is the leader with automation to help you Control Your Network. To learn how you leverage automation to shorten time to deploy, improve staff efficiency and maintain a secure network, please visit WHITEPAPER Five Pillars for Controlling Firewall ACLs and Rules

9 CORPORATE HEADQUARTERS: (toll-free, U.S. and Canada) EMEA HEADQUARTERS: +32 (0) APAC HEADQUARTERS: +(852) Infoblox Inc. All rights reserved. infoblox-whitepaper-sdc-january-2013