Name: Rebuilding Trust at the Edge: A Smarter Approach to Firewall Security
Uploaded: 2025-08-07T19:06:08.586Z
Duration: 50 min 8 s
Description: Rebuilding Trust at the Edge: A Smarter Approach to Firewall Security

Transcript for "Rebuilding Trust at the Edge: A Smarter Approach to Firewall Security": Hello. Welcome, everyone. Thanks for joining us today to have a look at firewall security and how you can easily improve your organization's network security using a smarter approach. In this session, we'll have a quick look at why most firewalls are struggling to secure your network and the essential best practices they're most likely missing. That will lead us nicely into a look at critical capabilities you should have in your next firewall, and we will also take a quick look at how Sophos can uniquely help you in many of these ways. Now before we start, how many of you have had one or more of these complaints with your existing firewall or network security solution? What we hear most often is, you know, when I bought my firewall, I had no idea there were all these additional licenses or products required to get it working the way it was advertised. Or maybe you're struggling with too many management consoles or products that are more complex than they really should be. Or you want to change something about your network security, but you find out it's either not possible because it's not supported or it's gonna be something that's gonna cost you a lot more than you thought. Or maybe you feel your firewall should integrate with other products, especially from the same vendor you buy your firewall from, but it's either not possible or overly complicated. And then how many times have you received a notification for vulnerability or security patch where you then needed to schedule downtime to do a firmware update. And do you feel your firewall should let you go when you have an attacker on your network? Of course. Right? And should it actually do something to stop it? You would think so, but most don't. And as I said, if you share any of these pains, you're really not alone. They are very common. They're extremely common complaints from most of the people we talk to. And today, we have some good news. We're gonna share how you can solve all of these issues. Another aspect to consider is that network infrastructure, like firewalls, are constantly under attack. As you might expect, they are what separates your network from the rest of the world or the outside world, and they are literally under siege. Nearly every month, there's a new story in the news like what you see here that talks about some firewall being under attack. And listen, at Sophos, we know this firsthand. We've been under attack by nation state attackers, and we know how they operate. But more importantly, we've learned a lot about how to detect and protect against these kinds of attacks. But the fact remains, new vulnerabilities are being discovered by vendors, researchers, attackers all all the time, and no vendor is immune. But it really comes down to how well prepared you are and how you respond that makes a big difference. Now we recently published our latest report on ransomware. And no surprise, the leading root cause of successful ransomware attacks were compromised credentials and exploited vulnerabilities. So in the case of, compromised credentials, attackers are literally logging on to corporate networks to take, hold of them and deploy ransomware. And, of course, exploited vulnerabilities, we've just talked about how those are a prime target for attackers. And as I said earlier, no firewall vendor is immune to these. It's how well prepared you are and how you respond, and we're gonna show you what you need to best protect yourself against these kinds of root causes. So let's look at how to be prepared, and let's look at best practices to protect your network. They really fall into three categories. Best practices to prevent being attacked or targeted in the first place are perhaps most important. These reduce your surface area of attack or risk of being attacked, which is largely focused on things like minimizing exposed infrastructure and ensuring that what you do have that's exposed is hardened. So it's not an attractive target or at least not as attractive as the next vendor. Now as the old saying goes, if you and your friend are out hiking in the woods and encounter a bear, you don't need to outrun the bear. You just need to outrun your friend. But that same applies here. You want to make yourself a least attractive target. Then there are best practices to block an attack before it gets on your network, which is all about ensuring you have the best protection possible. And these days, that means AI protection. And then if an attack does get on your network, it's absolutely critical that you can stop it getting its tracks before it does serious damage. So you need capabilities that can identify those attacks that the attacker is on your network and then automatically respond to an active adversary on your network. Now the problem is, and why most firewall struggle today, is that they are really only focused on this middle best practice, set of, features and capabilities. They're really only focused on protection, and most of them out there struggle or ignore mitigation strategies or simply haven't invested in secure by design principles and implementing features aimed at reducing the surface area of attack or hardening access or ensuring stolen credentials aren't a risk and so on. And virtually all firewalls out there on the market, except for one, which you're gonna learn about today, have any detection or response capabilities at all that will help you identify an active attacker on your network and then shut them down. No firewall, except for one, has that. So this is the challenge. Most firewalls are strictly focused on protection and ignoring these other important best practices. So that leads us into what to look for in your next firewall. One of the calls to action for the entire industry is to build products that are secure by design and to hold vendors to a higher standard. CISA is one of these organizations in The US, cybersecurity and infrastructure security agency. It's one of the many organizations globally that are really calling for change, calling for vendors to build products that are secure by design, which means to make the security of the customers buying these products and, thus, the devices themselves a top priority. And it's a pledge we personally, as an organization, strongly believe in. Now there are three things you want to look for in this area when you're shopping for a new firewall. First, as I said, new vulnerabilities will be discovered in any product over time. It's a fact of life. But as I mentioned earlier, it's how well prepared you are and how you respond that makes the difference. When a new vulnerability is discovered, many vendors will issue a patch and a firmware update, but it may take several months. And if you need to apply that patch, you need to schedule downtime to do the firmware update. And sometimes, if there's a lot of vulnerabilities, vendors will just completely deprecate or end of life a feature rather than try to fix it, which is very unfortunate for any customer that may be relying on that feature. So this can be frustrating for many of you, I know. So make sure you look for a vendor that can provide automatic over the air updates or critical patches that don't require you to lift a finger. You shouldn't have to schedule a firmware upgrade or reboot your network every time there's a new vulnerability discovered. That's a sure way to have a vulnerability remain unpatched, right, because people just don't have time to schedule these kinds of downtime on their network. Next, ensure any of your infrastructure and systems exposed to the Internet is secured by design, meaning it's hardened. Access is limited and guarded carefully. Portals are hardened, VPN and everything else is locked down with multifactor authentication. You want products that are designed to make attacks extremely difficult, encouraging attackers to move on to easier targets. And then you want a vendor that's actually gonna be your partner in security, actively monitoring their products for you so you don't have to monitor them and, thus, your network for signs of compromise or attack. Wouldn't that be nice? Now I can't stress enough the importance of utilizing zero trust network access or ZTNA, which is all about trusting nothing and verifying everything. You know, we saw earlier how credential theft was a key root cause of ransomware attacks. That's because many firewalls, many organizations, network security is trusting that if you have those credentials, we trust you. But don't do that. ZTNA solves this problem. It provides very elegant way to provide secure access to applications and systems and your management solutions than old school VPN because it doesn't just rely on the credentials. You need to use multifactor authentication, and ZTNA will enforce that. Plus, it makes all your applications invisible to the Internet and thus to attackers. So get ZTNA. And if you're buying a firewall in the near future, make sure ZTNA is part of it. It's way easier to work with and manage than old school VPN, and it's much more secure, and it's actually an easier experience for end users as well. So what to look for? Make sure your next firewall has ZTNA integrated, and it's easily managed from the same management console so that every aspect of your network infrastructure is utilizing multifactor authentication so that anyone that might get their hands on some stolen credentials is not gonna be able to use them. And avoid any ZTNA solution that requires backhauling traffic through the cloud. If you have a user on your local network accessing an app that you host on the same network, you shouldn't have to be back hauling that traffic through the cloud. Use a ZTNA solution that's going to recognize that user and the app are on the same network and direct the traffic locally. And ideally, get a ZTNA solution that integrates not with just with your firewall and network security, but also with your endpoint protection. You have to have that as well. All users' laptops and computers need endpoint protection, so why not integrate the ZTNA capabilities directly with your endpoint? Make it man making management and deployment a lot easier. Now let's talk about protection. As you can guess, AI is having a dramatic effect on everything these days, including the threat landscape, both how hackers operate and how we need to defend against these kinds of attacks. AI defenses are absolutely critical today, and these will be the primary engines driving defenses over the coming months and years. Gartner says the same thing. In the next few years, multiple AI engines are going to be a key component of any cybersecurity solution, but not to replace people, to help augment them and enable them to focus on what's important. So what to look for when it comes to protection and performance in your next firewall? Make sure you're getting the latest AI protection to detect new zero day threats that haven't been seen before and active adversaries that may be already on your network. A lot of threat activity uses encryption, and a lot of you out there are not using encrypted traffic inspection for a variety of legitimate reasons in most cases. But there are technologies out there now that you can use that leverage AI to discover encrypted threat communications and network traffic without you actually having to do the heavy lifting of decrypting that traffic. So make sure you get a firewall that can do that. And finally, a lot of firewalls out there are quickly obsolete within a few months or certainly a couple years because they lack a flexible and programmable architecture internally that allows them to adapt to new threats and threat detection technologies over time. So avoid any firewall that's built with custom silicon or ASICs as they're often called because that means your protection capabilities are limited to whatever that chip could do at the time it was built, and it can't change. So if you want to expand its capabilities and performance later on, you're gonna have to upgrade your entire entire firewall device hardware. Get an architecture that's programmable that allows changes to be made over time without having to buy new hardware. Now complexity is the enemy of security. These days, you need more and more products to keep your organization secure. In fact, I was blown away when I found the stat from Gartner that says the average enterprise has 60 to 70 cybersecurity products working to protect their organization. Now I suspect in the mid market, it's probably, you know, closer to half that, but that's still a lot. Right? And that many products creates a huge management burden for you and often leads to gaps in security. I mean, how many management consoles do you have to use to manage that many products? I mean, how many management consoles would you like to have? Ideally, one. Right? So how to simplify? Look for a vendor that can seriously help you reduce the number of management consoles you need, if not the number of products you need. Imagine if you could manage your firewalls, your network switches, your wireless networks, your ZTNA, your endpoints, email, SD WAN, and everything else you need from a single console. But also look for a vendor that offers cross product automation. It's one thing to manage everything from a single console, but do these products talk to each other, share information, and work together? Do the firewalls talk to the endpoints and share thread info and other helpful telemetry? That's important. If not, keep looking. And these days, the threat will eventually get on your network or an attacker will, despite your best intentions, so be prepared. Have a firewall that includes network detection and response to quickly identify suspicious or malicious activity operating on your network so it can alert you before it's too late. Okay. So let's summarize all of the capabilities we just discussed that you will want to look for in your next firewall. First, secure by design, a firewall that allows over the air patches for critical vulnerabilities so you don't need to schedule downtime to reboot to reboot your network. Then you need hardened systems, access, and MFA support for all aspects of your network to make credential theft a nonissue. You need proactive monitoring by your vendor to help identify if your firewall is being targeted by attackers. You need zTNA. Please make sure your next firewall has integrated ZTNA. It's so much better than having old school VPN, and make sure it doesn't need to backhaul everything through the cloud. It can work on your local LAN if that's where everything is. And get a solution that doesn't add to your management console count, ideally integrating with both your firewall and your endpoint protection. Make sure you have the latest AI capabilities to detect threats entering the network, but also detect threats already operating on your network. Make sure you have AI tech that can identify encrypted malicious communications in your network. Make sure your next firewall has programmable architecture so it's easily updated over time and future proof. Simplify your security. Try to get down to a single management console to manage most of your cybersecurity. Lease your firewall switches, Wi Fi, and other network security like zTNA. Also, look for products that offer easy and seamless cross product automation and integration. So they're sharing information, firewall talking to endpoint. It's out there. Make sure you have it. And make sure your next firewall includes integrated NDR to detect active adversaries that may be already on your network. Alright. So let's have a look at how Sophos can help you with all this. At Sophos, of course, we make firewalls, but we also offer much more than a firewall. We have a full suite of top shelf products in every category that allows you to greatly simplify your life, managing everything from a single cloud console with seamless cross product automation that can help you identify and shut down attackers automatically on your network even if it's late on a Friday afternoon after you've left the office. Every network needs switches, wireless, remote access, a firewall, so why not have them managed together and working together. Right? Makes sense. Now there are a lot of reasons customers choose Sophos firewall to replace their previous firewall, and these are the most common here on the screen. They like our focus on secure by design and how we view with vulnerabilities in a much more efficient way with our over the air updates and how we are partners in monitoring their security. And they like the integration of many things other vendors charge extra for and make unnecessarily complex. So we have integrated ZTNA. We make high availability deployments easy at any time. We make zero touch deployment easy at any time and much more. There's we've really got simplicity built into our DNA and that shows. They also like our programmable architecture. I mentioned how that's important. That allows us to add improved performance and protection with every release. And so your your firewall is getting faster while most other firewalls out there are getting slower over time. They like that we've introduced new innovative features like NDR at no extra cost that can really help identify an active attacker on your network and warn you before it becomes an issue. They love our single cloud management console, Sophos Central. That is perhaps one of the top reasons most companies choose Sophos is because of it's such an easier management experience with Sophos Central, one cloud console to manage it all. And they like hard automated cross product response with features like synchronized security and active threat response that allows the products themselves to leap into action when an attacker is discovered and shut it down all automatically. So let's dive into a few of these in more detail. When it comes to secure by design, we have your back. We take security seriously, and the security of our customers and, thus, our own devices is our top priority. So we fully embrace that, and we are leading the charge on secure by design principles. We ensure the firewall security posture is optimal out of the box, that there are no easy targets on the firewall with an extremely hardened VPN portal and encrypted central management. We're also unique in the industry in offering these over the air automated hotfix, as I mentioned, which allows us to patch a critical vulnerability quickly without any downtime normally associated with a firmware update. So you don't need to lift a finger, we can patch a critical vulnerability automatically without you having to do a thing. And we are also unique in proactively monitoring our massive customer install base out there and being super responsive to we And we also pride ourselves in being extremely transparent with one of the best bug bounty programs in the industry. Now as I mentioned, Sophos Central is a favorite of all Sophos customers. It makes management easy. It's been designed from the ground up for the average IT generalist to be easy to use, and it works equally well for very advanced analysts and for managing large estates of firewalls or even multiple customers if you're a Sophos partner. It offers great dashboarding and reporting included with every product and working across products in many cases. It makes deployment easy for firewalls and endpoints. And in the case of firewall, it makes zero touch deployment, we call it, which is basically drop shipping a firewall out and having it connect and and download its config from Sophos Central automatically. We make that extremely easy, and it's included with all of our products. We don't charge extra for cloud management for any of our products. We're reporting. We've invested heavily in making firewall management for organizations of any size easy, and that goes through the reporting as well. You get great insights. You can see your entire network at a glance. You can drill down into certain parts of your network. You can do cross, you know, network reports, aggregate reports. You can, do on box reporting. You get seven days of data retention in the cloud included for no extra cost, and buying more if you need more in the cloud is very affordable. Now I mentioned how important zTNA is, and Sophos firewall integrates zTNA into the product. So you don't need to deploy anything extra if you wanna have zTNA running on your network. And with our zTNA agent, sometimes you don't even need it if you're using web based apps. But if you do, it is integrated with the Sophos endpoint to make for a single agent install and, of course, of course, ZTNA firewalls, endpoints, all managed from Sophos Central. So one cloud console to manage it all. So you get a ZTNA solution with a single gateway integrated into your firewall, a single agent integrated into your endpoint with a single management console. No one makes it easier to use and deploy ZTNA than we do. And we also make common deployment scenarios easy, and some vendors want to make this way more difficult than it needs to be. The things like zero touch deployment, whereas I mentioned you could drop ship a new firewall to a remote location that you've just, set up. You can have someone plug it in and it will download its config from Sophos Central automatically, and then you can finish the configuration from there. Or high availability. Sometimes you wanna add a second firewall for added business continuity in case there's an outage. No problem. You can add that at any time. And we don't charge extra for these capabilities. Of course, you'll have to pay extra for the extra firewall in a environment, but we don't charge extra licensing or extra products to to make this work like many of our competitors do. It's super easy to do both, plug and play, literally. Now as I mentioned, we're also unique in having implemented our extreme architecture in a way that's programmable. So we can make changes to the firmware to optimize the performance or add new capabilities to our sort of network flow processor in our devices without you having to upgrade your firewall device. Now this chart shows you the various performance enhancements that we've been implementing since 2021 when we first launched this new architecture. So customers with firewalls they bought in 2021 have been getting faster and faster over the last few years without them having to pay anything extra. And like I said, most firewalls these days, with every release, they're getting slower and slower. And it's probably not surprising that with Sophos, you're getting the best price per protected megabit in the industry thanks to that architecture, plus our latest second gen XGS series desktop appliances we just launched recently. These offer up to double the performance with significant power efficiency, enabling whisper for quiet operation or even zero dB in the case of our fanless models. And they come equipped with higher speed connectivity and even an optional five g cellular module that's very affordable. So make sure you check out these, these great new devices. And as I mentioned, we continue to innovate in some major ways. We recently added network detection and response or NDR capabilities to the firewall. This is unique in the industry. No one else is doing this, and we added it for no extra charge. So technologies like NDR, are typically something you would only find in large enterprise networks, but we're making it available to everyone and for free. The best part is NDR Essentials, as we're calling it, runs in the Sophos cloud, so it has zero impact on your firewall performance, ensuring all the heavy lifting that is done off box. Basically, your firewall collects some metadata and sends that to the cloud for analysis. And this provides two important capabilities that really bolster threat detection or active attacker detection. First, encrypted payload analysis enables us to detect malware communications that are encrypted without having to do normal TLS inspection or man in the middle TLS decryption. That's huge. And it also does domain generation algorithm to detect suspicious domains that DNS or web protection might not detect yet because they're so new, but we'll detect it with this technology even before it's been registered. So great AI driven protection and detection technologies that you must have. Now the other great thing customers love about our Sophos products is that we make them work better together. Synchronized security and active threat response are really game changers. Every network needs these products. Right? Firewall switches, wireless endpoints. So why not have them talking to each other and working together? With synchronized security, a threat can be identified by any of the products. Maybe it's the firewall or the endpoint or MDR or an MDR analyst. It doesn't matter. Since they are all sharing information, they can kick off an automated response to limit access or isolate the compromised device on the network and limit lateral movement of an active adversary essentially stopping it dead in its tracks. This sharing of information between the firewall and endpoint in particular can also be used for many other important, sharing of information such as maybe the endpoint can help identify an app that the firewall doesn't identify. The endpoint has a lot more insights into what's running on that device, so it can help the firewall understand what app it is. And if it's a custom app the customer needs, then they can use that information in the firewall to help prioritize that traffic. As I said, this cross product automation or synchronized security, as we call it, is a game changer, and it's included when you buy multiple Sophos products for free. You don't have to pay extra for this. You buy our firewall, you buy our endpoint, you get this for free. It's a it's a fabulous capability, and customers love it. Now let's have a deeper look at how this works. So here you have an illustration of a typical network with managed and unmanaged devices, wireless access point servers, IoT devices, and everything else. Sophos firewall, of course, is the heart of the network, and it's continually monitoring for threats matching anything published via one of the various threat feeds that you can set up. If if you're an MDR customer, that'll be one threat feed, or if you're doing your own XDR cross product threat hunting, it'll it'll be plugged into that as well. You can also get threat feeds from third party sources or, of course, our Sophos Labs x ops team provides threat feeds, by default out of the box. And now NDR Essentials is another source of potential threat intelligence. So if a threat is detected by any of our products or an analyst, that information is shared immediately with all other Sophos products, and the response kicks off automatically. As I said, if you're away on a Friday afternoon and an attacker is discovered on your network, this will all trigger automatically, not take days to get addressed. So what it does is the firewall will start blocking any related traffic immediately from leaving the network or traversing the network. It will also flag the compromised device and inform all the healthy endpoints because we can't trust the compromised one. It'll inform all the healthy endpoints that they should not accept any traffic from that compromised device, effectively stonewalling it. And then what happens is the analyst can further isolate that compromised device by sending a threat feed to our Sophos switches and wireless access points that will actually shut it down at the, lowest level on the network. And this can all happen automatically, as I said. It could potentially stop a ransomware attacker dead in their tracks and reduce response time from what could be days or hours into just seconds. And as I said, you get all of this for no extra charge with the softest solution. The more products you buy, the more they're they're gonna work together. Alright. So to recap, most firewalls are struggling to protect networks today because they've been myelopically focused on stopping threats entering at the gateway, that protection pillar in the middle. And they are not focused on these other important best practice pillars of security, mitigation and detection and response, which unfortunately is making themselves an attractive target, making patching more difficult than it needs to be, and offering no way to detect an active attacker on a network or contain it. So hopefully, you see why a lot of organizations are switching to Sophos for their network security because we are heavily invested in all three of these best practice pillars. To ensure your network is optimally secure, you have the best fighting chance of stopping an active attacker before real damage is done. You get ZTNA, MFA, secured by design principles. You get encrypted traffic inspection, multiple AI models, sandboxing. You get active threat responses, synchronized security, cross product automation. You get NDR, and you get all of this managed from a single cloud console that's gonna make it easy for you. All of this adds up to delivering the best value for your investment. With our extreme protection bundle, which nearly every customer of ours purchases, you get extreme value. You get everything we offer, as you can see on the chart here, for a very competitive price and many features you just can't get anywhere else, like NDR, synchronized security, cloud based central management for free. And to make it easy to switch and get the full benefits of Sophos network security, we have five network in a box bundles for you, which are a great starter kit that can fit any size of business from a small office or retail branch all the way up to a PowerHQ. Each bundle includes a choice of one or two firewall models suitable for your size of business along with one or more perfectly paired switch and wireless access point options to get you started. You can, of course, add more switches, wireless firewalls, of course, or buy multiple of these bundles if that helps. And it's all managed from Sophos Central, as I mentioned. It's a great way to start consolidating, simplifying, and saving while getting the full benefits of a Sophos network security solution with all these products talking to each other. And what's more, that's not all. If you're switching from a competing firewall, for a limited time, you could save up to 50% on both the hardware and our extreme protection bundle that has everything you need and nothing you don't. Of course, there will be some model and regional exclusions that that, are, applicable in some locations, so reach out to your local Sophos partner for further details. But this is an extremely appealing offer as you will find many of our competitors may discount their hardware, but in our case, you're also gonna save on the subscription cost for a three year extreme protection license, which is unheard of, really. So take advantage of this. But please don't take my word for it. Check out Gartner Peer Insights for first hand reviews. Gartner themselves has even said Sophos is the ideal network security vendor for midsize organizations. But read all of the all the reviews on, Gartner Peer Insights. Many of your peers have already posted reviews there. And another popular review site is g two. We're also top rated by customers on g two in every aspect of the product and by a significant margin over most popular competitors. So please check out what customers have to say on g two as well. And with that, thank you very much for joining us today.