As a networking veteran, one of the more interesting aspects of my job is the opportunity to meet with enterprise network and IT teams at organizations of all sizes across various industries and discussing their challenges provisioning and maintaining their networks. During the past couple of years, the number one issue I hear from teams is the need for firewall automation. Think about it – today’s enterprise networks are faced with increasing security threats. With this constant threat, security policies and/or firewall rules need to be created or modified to allow connectivity for users, applications, data center, and cloud use cases.
With this increased threat comes the increased need for changes, causing most teams trying to keep with the never-ending demand for firewall changes with manual processes. In today’s environment it’s nearly impossible to hire enough people to deal with the deluge of firewall provisioning requests and as a result it takes multiple days and sometimes even weeks for some teams to get a rule or policy updated within their firewall infrastructure. The hard truth is that application teams can’t wait weeks for firewall changes to deploy a new application and users can’t wait multiple days to get access to critical infrastructure and applications.
Automation is the only way teams can keep up with the demand for firewall changes.
The Hidden Challenges of Current Firewall Automation Solutions
The only way to decrease the amount of time it takes enterprise network teams to deploy firewall changes is through automation, but current firewall automation solutions still have their challenges.
Multiple teams mean multiple issues.
Firewall changes require multiple teams to be involved; security, networking, etc. This causes bottlenecks and increases the likelihood of manual errors. Security teams are verifying the requests and providing approvals while the networking team is responsible for provisioning the firewall changes.
The demand outpaces the available resources.
As we’ve already discussed, the demand for firewall changes is never-ending. This increase in demand far outpaces the available resources that can make the changes to secure the infrastructure using manual processes. These processes require accessing different systems to gather data, update documentation and request tickets, and notifying other teams in order implement any security changes. This means automating just the change itself won’t scale to mitigate the entire backlog.
Current firewall policy automation solutions fall short.
Current firewall policy automation solutions typically focus on the actual change itself and don’t integrate well with your entire ecosystem (ITSM, security policy applications, firewall controller applications, firewalls, etc.) and often provide very static implementations. While automating the firewall policy change itself is a step in the right direction, network and security teams are still stuck dealing with the lack of integration manually, limiting their effectiveness. These issues are further compounded by organizations that have multi-vendor firewall solutions deployed with a stitched together manual process.
How Itential Helps Teams Reach Their Full Firewall Automation Potential
The only way to increase the rate at which network and security teams can deploy firewall policy changes at scale is not just through change automation but through end-to-end automation of the entire change process. Automation efforts must include all of the systems involved in the firewall change process including ITSM systems, security policy applications, and firewall controllers.
End-to-end automation means reducing the opportunity for human error, removing time consuming manual tasks, and scaling the process to meet the demand.
The Itential Automation Platform is an API-first automation platform that bridges the gap between security and network teams. It offers a low-code workflow canvas that enables both teams to participate in network automations that work together to make changes more securely. The platform also offers a Pre-Built Collection of integrations to any IT system or source truth and automations for security use cases such as device configurations, firewall rules, cloud security policies, and more.
At Itential, we’re helping security and network teams work together to manage and deploy best-of-breed technology and create end-to-end firewall policy automations that scale in today’s environment, while also providing the flexibility to deal with tomorrow’s security automation challenges.
To see our platform in action, check out this recent demo I did showcasing how to integrate with your existing firewall solutions and safely running an automation from start to finish.
Dan Sullivan
Principle Solutions Architect ‐ Itential
Dan Sullivan is a Principal Solutions Architect at Itential who has spent his career focused on networking and distributed systems, holding roles within software development and architecture teams, professional services, and sales organizations. Over his career, he’s received numerous patents for his work on distributed systems and high availability routing/switching platforms. During the past 10+ years, Dan has been delivering and deploying automation solutions for the largest Service Provider and Enterprise customers across the world. At Itential, Dan works closely with customers to implement Itential’s automation solutions to drive both transformational business and technical outcomes.
