Policies… Policies… Policies…
That has been my life the last few weeks. I have been working with one of my Sr. Engineers on migrating all of our policy base over. Crunch time is here and we are prepping for go-live this weekend. We’ve reviewed every policy individually. On each, we have identified the application if available, the purpose, and tried to restrict things more wherever possible. We are loving the new Palo Alto firewalls. Let’s hope we’ll be saying the same thing on Monday…
The reality is that my team has come a long way over the last 10 years. We may be an oddity in the technology world in that I have managed to keep the same team together for a decade. We lost one of our team members to cancer last year, but other than that the team has been static and has grown together. This will be our third core firewall replacement in a decade. When my team took over security for the company, it was being outsourced to an individual in Florida for $3k a month. We were on Checkpoint on AIX at the time. There is nothing like having your firewall several software releases behind with no updates in site due to the operating system. We never felt like Checkpoint did a good job supporting the AIX platform, so we decided to migrate away from them. At the time, we were a huge Cisco shop – everything was Cisco. If Cisco had a solution for it, you can bet we were using it in our world. So, the Pix line was a natural fit for us. We went through a similar migration, only we had a lot less information about our environment than we did now. Because of that, it was a disaster. We spent the next two weeks cleaning up problems.
The second replacement was a transition from Cisco Pix to Juniper Netscreen. We were having a host of VPN problems at the time that were due to Pix issues holding the VPN tunnels open after a hiccup in the network connection at the remote site. Cisco could not provide a reasonable fix, so we evaluated the Netscreen platform. We really liked the interface and the ease of getting things done, so we began an orderly migration to Juniper. At the same time, we were replacing branch office routers so we felt it was an opportune time to firewall our branch offices. This was unusual at the time, but we wanted to improve our security on our inside network as well. After the Juniper core firewall replacement, it took us a couple of days to get everything straight. This was largely due to the fact that our Pix firewalls had the standard any any any outbound policy in effect because of the security levels of our interfaces. So, we took a big step forward in building up our rule-set from a deny all policy.
Now we approach our third and likely most significant core firewall replacement in my 15 year technology career. It is significant largely because we are moving to an application aware firewall. We have decided rather than just migrating our policy base over and stick with the traditional source ip / destination ip / port model, we would dive in and embrace application awareness. Additionally, we would utilize A/D groups and user accounts where possible to further isolate the policy base and present a more secure rule set. As I reflect on the past decade I realize that this migration has been more time-consuming and significantly more complex than ever before. As we increase the awareness of our firewall, we also assume more responsibility for the traffic. Can I be sure that our firewalls are going to be up to the task? Am I certain that the traffic that traverses the firewall will be properly identified and thus hit the correct policy? Do we have unusual traffic patterns that are going to trigger my drop rules in my scanning engine?
At any rate, we are as prepared as we can be at this point. We have thought and re-thought. We have scoured through our policy base line by line. We have cleaned up our rules and identified more secure ways of doing things. I have no doubt that we have created a policy base that is as secure as we can make it within our business requirements. The question is, will these Palo Alto firewalls really do the job we have come to expect? We will find out the answer on Sunday as we begin our transition into the world of Next Generation Firewalls. We fully believe in the platform we are migrating to. We have proven it in the field in smaller deployments. However, there is always some apprehension in my mind when we begin to pass our core data center traffic through a new box… In the end, it is a new world for me and my team. We will have visibility like we have never had before. We will have significantly increased our security posture and ability to report on individual user traffic rather than hunting an IP address down. It will help us every day in helping to protect our organization. And it is to that new world that we travel to this weekend. Here’s hoping the journey will be pleasant…
