Today’s cyberthreat landscape demands robust threat protection, and traditional firewalls aren’t up to the task. NGFWs can block advanced malware, and they’re better equipped to thwart advanced persistent threats (APTs), such as Cozy Bear, responsible for the SUNBURST supply chain attack of 2020, and Deep Panda, who are notorious for exploiting the Log4Shell vulnerability.
Plus, with integrated threat intelligence and options for networking and security automation, NGFWs have given organizations the opportunity to not only simplify security operations, but also take the first step toward a fully realized security operations center (SOC).
All of this potential upside, however, comes with some challenges.
Challenges for NGFWs
Limited by their hardware, there are many cases where physical NGFW appliances can’t effectively perform to meet the needs of today’s modern environments, introducing multiple issues.
Backhauling Traffic for Security
Backhauling to an NGFW made sense when data centers, endpoints, and resources were mostly on-premises. But now, as user mobility and cloud adoption continue to trend upward, NGFW hardware in a traditional data center just can’t keep up.
Cloud apps like Microsoft 365 are designed to be accessed directly via the internet. But for VPNs and NGFWs in an organization’s data center to provide access and security, all traffic needs to go through that data center, slowing everything down. To deliver a fast user experience, organizations need to route internet traffic locally.
Securing Local Internet Breakouts
You can secure local internet breakouts with NGFW hardware, but to do so, you need a separate security stack in each location—NGFWs and potentially more appliances in every branch office, all of which need to be manually deployed, maintained, and eventually replaced, which can quickly get prohibitively complex and expensive.
Inspecting TLS/SSL-Encrypted Traffic
Almost all of today’s web traffic is encrypted. To perform SSL inspection, most NGFWs use bolt-on proxy capabilities that execute the inspection in software, rather than at the chip level. This heavily impacts performance, which hurts the user experience—but without inspection, you’re blind to more than 85% of attacks.