Firewall are the grok of decades and have been a mainstay for network security but the key concept has not changed: inspect traffic, match it against a policy defined by you, allow or block. What has changed dramatically is the environment that firewall needs to protect. The deployment challenge for a firewall that is protecting a single on-premises network with an obvious physical boundary is quite different than one that must protect traffic traversing between on premises infrastructures, one or more public cloud providers and the ever-increasing population of remote users accessing from outside any traditional perimeter.
More generally still, hybrid cloud environments add a layer of complexity to firewall deployment in a number of distinct ways. Traffic no longer traverses a single, easily identified choke point through which all traffic flows and may be inspected by an appliance. Instead, traffic flows over a myriad of paths in parallel: between on-prem and cloud workloads, between independent public clouds from one vendor, and more recently across multiple vendors as organizations seek to avoid the perils of becoming locked into a single supplier. Every one of these paths represents a position at which firewall policy must be enforced uniformly, and the gaps between them are precisely where attackers first look.
The first step to recognizing that one single firewall deployment model will most likely not provide full coverage of the hybrid landscape is gaining a good network firewall for hybrid cloud environments. Most organizations need mixed modes of protection: appliances, physical or virtual protecting the on-prem perimeter, cloud-native firewall services guarding traffic flowing within a given cloud provider, and an orchestrating policy plane that maintains consistency of rules across these enforcement points instead of treating each one in isolation as its own island.
Limitations of Traditional Firewall Deployment Models
Traditional firewall deployments were based on a relatively small number of clearly defined, delineated network perimeters. For an organization, there exist at most a handful of perimeters exposed to the Internet, each secured with dedicated appliances, and the north-south traffic between the internal network and the outside world is well defined. Almost completely breaks the assumption of hybrid cloud environments. East-west traffic traffic between systems in the same environment rather than in and out of it, L7-optimized, previously low-volume has exploded as applications break down into more clustered services, and almost all this traffic needs to be inspected too (for a long time it was just the crap crossing the outer perimeter).
As a result, this has driven a more distributed model of firewall deployment. Instead of centralizing inspection at a few select chokepoints, organizations are now distributing firewall capabilities as close to the workloads they protect, whether it be in the form of virtual firewalls running natively alongside cloud workloads or micro-segmentation policies intermixed directly with individual workload requests. This more distributed approach suits the way that traffic moves in a hybrid model but also increases the number of points where policies are enforced and require synchronization.
Policy Consistency Across Environments
Maintaining consistency of policy across fundamentally different underlying platforms is, in fact, the single biggest operational challenge with hybrid firewall deployment. An on-premises firewall appliance, a cloud provider’s native firewall service and often even a virtual firewall running inside a cloud workload, can all use different rule syntax, different management interfaces and different logging formats. If security teams are not intentional in unifying these, they wind up with multiple separate rule sets that can start to drift and create gaps missed until an incident reveals them once scrutinized.
Although the underlying infrastructure has matured, basic firewall policy guidance continues to be directly pertinent here. Federal guidelines on firewall policy describe the foundations of good firewall policy, including that all traffic should be denied by default unless there is a rule to allow it, this is just as applicable to a cloud-native firewall rule set as it is to a legacy perimeter appliance. The real security gap opens when you apply these principles strictly on-premises and loosely in the cloud, instead of consistently across hybrid deployment types.
Policy-Based Segmentation (A Layer Next to Your Firewall Policy)
Firewall deployments donot happen ina vacuum, they are partof more widespread network segmentation strategy. So in a hybrid environment, where you have segmentation and firewall policy together, it limits how far the attacker can go after coming so far inside the fence. By partitioning a hybrid network into multiple smaller zones with firewall-enforced boundaries, the blast radius from a compromise can be contained while security teams will have a much greater chance of detecting lateral movement before reaching critical systems.
Organizations need a segmentation strategy which may span on premises as well as cloud and firewall policy to providing enforcement at not only the outermost edge of the network but also between internal zones. This principle is perhaps best captured in a simple infographic guide to segmentation security that visualises segmentation as a defensive measure using layers, partitioning the different sections of your network into zones so that when one segment withined gets compromised, an attacker isn’t guaranteed free access to the rest of the environment something as relevant to cloud workload isolation today as it ever was for a traditional on-prem enterprise network zone.
Creating a Scalable Deployment Strategy
No matter which tools are being used, there are a few common characteristics to successfully deploying a hybrid firewall. This type of centralized policy management ensures that rule sets do not drift from one platform to another over time, even when the enforcement takes place across many different platforms. Standardized logging formats, or at best a separate normalization layer that will be accountable for translating heterogeneous log entries from all the different sources making up the hybrid environment into a common structure, allowing security teams to correlate events detected in one environment with events happening elsewhere instead of analyzing each source’s logs separately Policies should be reviewed regularly firewall rules are something that undergo active maintenance rather than just a set-and-forget configuration, catching overly permissive rules or outright obsolete rules as the environment matures.
Five practices, none of which involve walking away from existing infrastructure investments. Most organizations work their way towards this type of cohesive hybrid firewall approach in small stages, beginning with the most salient traffic paths at risk, then gradually expanding coverage bit by bit rather than attempting a full-on architectural disruption in one go. The key is to treat the hybrid environment holistically as one system to defend, with unified firewall policy that reflects that single view, instead of securing each piece of infrastructure according to whatever model made sense at its introduction.
FAQs
Why is east-west traffic inspection a must-have in hybrid cloud environments?
As apps are split into microservices, the traffic that is actually meaningful moves between systems within the outer perimeter vs crossing it, and traditional perimter-only firewall deployment misses this traffic entirely.
What are the dangers of using different sets of firewall rules on-premises and in the cloud?
Each platform has different rule syntax and management tools (just to make that so much more difficult and even if you do it actively, shit happens over time) allowing for policies to drift out of alignment, creating gaps in environments and making that a nightmare to catch until an incident blots your records.
What is the relationship between network segmentation and firewall deployment?
Segmentation divides the network into smaller zones, and firewalls enforce boundaries between those zones. They work together to restrict the lateral movement of an attacker post-compromise, as opposed to solely depending on a defence-in-depth outer perimeter.
