(light music)
- [Narrator] Welcome to another video
in the series Choosing the Right Next Generation Firewall.
Choosing the right next generation firewall
can be a daunting task.
What is it that you need to look for
to make the right decision?
What are the pitfalls that you need to be aware of?
Each vendor will tell you how great their product is,
emphasize its strength, and downplay other vendors
so that you will be convinced
that their solution is the best.
Well, to make it easier for you
to choose the right next generation firewall,
we will share some questions that you should ask each vendor
and test for yourself as well.
We will focus on three areas.
First, is the product's security architecture really secure?
Second, does the management platform provide the right tools
to get the job done?
And third, is the performance
as it should be without sacrificing security?
Let's go through some questions you might want to ask.
Are both directions of traffic always scanned?
A truly effective next generation firewall needs
to provide visibility into and control
of both inbound and outbound traffic.
Are application detection results cached
in an attempt to improve performance?
Don't sacrifice your security for performance improvements.
Application caching mechanisms can be prone
to cache poisoning techniques used
to bypass application security.
Are all ports left open by default?
Keeping all ports open on a firewall leaves it vulnerable
to reconnaissance attacks, such as port scans.
Are all bytes within a session inspected by default?
Scanning only a portion of a session improves performance,
but at the cost of security.
Can both IPS and Application Control run simultaneously?
IPS and Application Control are at the heart
of a next generation firewall.
Without both of them,
it cannot be considered a next generation firewall.
Is a robust event analysis solution provided?
With the complexity of a next generation firewall comes
the need for an event analysis solution that provides
effective security event correlation and forensics.
Are you able to easily create an IPS exception
based on a security event?
Logs are helpful to research security events,
but it can be troublesome and time consuming
if there's not a good way to create a policy exception
based on those events.
Do you have a fast, efficient way to troubleshoot a session?
When a security event happens, you need the right tools
to be able to drill down into the event
and quickly arrive at a mitigation solution
before hackers can penetrate your network.
Do you have the ability to use parameters
such as hit count and expiry in security rules?
Features such as hit count and rule expiry can help you
to build and fine tune effective, flexible policies
that allow you to optimize your security rule base
to fit your organization's needs.
Are the performance claims based on testing
that uses real-world traffic?
Most performance claims are
based on fixed byte length UDP traffic.
Testing with a real-world traffic blend
that includes HTTP, SMTP, HTTPS,
and other protocols gives a more realistic result
on how it will perform in your own network.
Is testing performed with realistic security policies?
Test results are commonly based on a single allow all rule.
It is common for an organization to have 100 or more rules
in its security policy.
Testing with multiple security rules provides a better
real-world representation of performance.
Are NAT and logging enabled during benchmarking?
Most organizations use network address translation,
or NAT, in their network and also enable logging.
Since NAT and logging have an impact on performance,
they should be enabled during testing.
Check Point's Next Generation Firewall always scans
both directions of traffic,
uses no shortcuts for application detection,
is a firewall and has all ports closed by default,
scans all parts of a session,
and runs both IPS and Application Control in parallel.
The Check Point security management platform
with SmartDashboard, SmartEvent, SmartView Tracker,
and SmartLog provides clear security analysis and forensics,
enables IPS exception creation from logs,
provides drill-down capabilities
into events for easy troubleshooting,
and enables flexible policy creation
and provides efficiency features
such as hit counter and rule expiry.
And Check Point SecurityPower provides performance numbers
based on real-world testing, shows test results
based on a policy with 100 firewall rules,
and uses benchmarking with logging and NAT enabled.
Check Point Next Generation Firewall,
the right next generation firewall.
(light music)