INTRO: This is the IT Roadshow.
We're taking you with us, as we go coast to coast, East to West, on the tricked-out CDW
Technoliner —anywhere and everywhere there's technology, talking to and learning from real
engineers, swapping stories with real techies, seeing real technology in action.
So if you're ready to geek out, hop on and let's go.
Nathan: Welcome to another Pit Stop on the IT Roadshow.
I'm Nathan Coutinho, and I'm joined today by Allen Schmidt to talk about next-generation
firewalls, right?
Allen: Correct.
Nathan: All right.
So we're going to talk about Palo Alto and their products?
Allen: Yes, we are.
Nathan: Awesome.
So what exactly is a next-generation firewall?
Allen: The simplest way to think of a next-gen firewall is it is an appliance that combines
a number of functions.
It combines the traditional security policy device at the edge, intrusion prevention,
malware protection and URL content control — doing all of those in one single device.
Nathan: There are a lot of other companies that have next-generation firewalls.
So what makes Palo Alto special?
Allen: You kind of have to look at how these things came about.
In the past, to get these kinds of protections, people would have different security components
on the network.
You'd have a stateful inspection firewall on the internet edge; you'd have an intrusion
prevention device in the network; you would have an anti-malware device potentially in
the environment and web content control for user internet activity.
But these would all be separate devices.
Eventually, people started combining these into a single device.
But the problem is even though they were on one device, the inspections were still sequential.
The firewall would look at it; it would hand it to the IPS; it might hand it to the anti-malware
or hand it to the URL.
And so you didn't necessarily save time.
What Palo Alto did was combine these intelligently into a single appliance that does a single
pass.
So their single-pass architecture does all of these inspections simultaneously, and so
you don't have the performance impact, but you're still getting all of the security protections.
So the thing that they also did differently, above and beyond the single-pass architecture,
is they looked at how to enforce these rules in a different way.
So instead of using stateful inspection, they came up with looking at the application as
the unit of protection, so they used what they call App ID and Content ID and User ID.
They're looking at it at in a very different way and looking at more application-oriented
protection, as opposed to just the traditional stateful inspection.
Nathan: So that's a game changer, right?
Allen: Right.
So with App ID, what we're doing is we're actually finding the applications that are
in use.
So we're able to look at metadata, for instance, and identify that it's a particular application.
Then we can dig deeper into that and say, "All right, maybe you're looking at web-based
email, but you're attaching files.
We don't allow that to happen."
For instance, in web conferencing, is it just displaying the video of the person or are
you actually sharing your desktop?
You might not want people to share their desktop, or to be able to transfer some file and some
kind of web application, so you can look more deeply within those.
So this is the App ID.
In addition to that, we have User ID.
So we can build policies based on the identity of the user.
We can build group-based permissions.
We can also do reporting based on user identity, so we know users that have particular policies
or particular issues have come up.
And there's also device identity within that as well, so we can figure out what devices
are participating in that.
On top of that, we have Content ID.
There are the traditional URL content categories; for instance, we might say no shopping or
something like that.
There's also file-type protections.
So we can say .exe files or JPEGs, or whatever, we're not permitting those to come into the
environment.
On top of that, there's anti-virus, anti-malware inspections.
And with anti-malware, when we see a file that's coming through, we can send that up
for sandboxing in the cloud so that the file can be examined.
Then a verdict can be rendered and sent back down to allow whether that's going to come
in or not.
All of these are the protections that Palo Alto incorporates into their firewalls.
Nathan: So a lot of companies have a really robust security infrastructure.
They're invested in it; they've already got it up and running.
But what would be the main reasons they would actually look at upgrading everything?
Allen: Well, as sort of “next-generation” implies, there's a last generation.
Nathan: Yeah.
Allen: So there's some older infrastructure out there and, you know, as some of that starts
to hit its end-of-life milestones, you can start to look to introduce these next-gen
features.
And, you only have to license the parts that you're going to use, so maybe it's just going
to do the firewall and the IPS functions.
Later on you, could move VPN to it; you can add the malware.
The other thing to consider is that you can introduce this for external firewalls, but
also for internal firewalls, enclave boundaries …
Nathan: That's true, yeah.
Allen: … separating the user access from the data center.
There's a number of ways that it can be introduced over time.
Nathan: Before we go, one last thing.
Allen: Mm-hmm.
Nathan: So how does the next-generation firewall really help with trying to identify and track
questionable activity on the network?
Allen: You know, the nice thing about this is it fits into a number of areas.
I mean you can obviously deploy this in your headquarters location, at the internet edge,
or you can employ it internally, between user access and the data center.
It can go into branch offices; it can go into the employee that works at home.
There are small appliances that you get the full capability from, just in a smaller format,
so that would work for that.
Even mobile users can put, you know, software on their endpoints that can contribute to
this — all of which can report back to Panorama, their central management application.
So now, you have visibility across all of those areas
And all of the things that I talked about are physical locations, but you can also get
access to the cloud.
There are visualized versions of the Palo Alto firewalls that you could run in a hosted
data center.
You could run it in Azure; you could run it in AWS.
And now, you have those full set of features in those cloud environments and visibility
in the same way that you have visibility in your data centers.
Nathan: Allen, this has been fantastic.
Thank you so much …
Allen: My pleasure.
Nathan: … for spending time with us.
And thank you so much for watching another Pit Stop on the IT Roadshow.
For more information, go to CDW.com/security.
Have a great day.