In some organizations you can ask "which firewall do you have?" and immediately get an answer with the vendor and model. But the more important question is: how is it configured today?
A security product can be excellent. But the level of protection is also largely determined by the configuration, maintenance and changes made over time.
A firewall does not work by intentions
It works by rules: allow and deny, addresses, ports, networks, users and applications. When a rule is opened, the firewall does not know whether it was meant to be temporary. It keeps enforcing it until someone changes it.
"Opened just for a moment" can stay for years
A vendor needs access. A new system is installed. There is an urgent issue. A rule is opened. The system works. Everyone moves on. Two years later, nobody remembers why the rule was created.
This is not unique to firewalls. It is a natural result of an IT environment that keeps changing. That is why configuration requires maintenance, not just initial setup.
So what does a VPN actually give you?
A VPN creates a protected communication channel. That is important. But encryption does not answer the questions:
- Who is the user?
- Is their device secure?
- Which resources can they reach, and do they need to reach the whole network?
- How long is the account valid?
- Is this an employee or a vendor?
Remote access is much more than the connection technology itself, and it is directly tied to access management.
A vendor does not always need the whole network
Sometimes a vendor needs access to a single system. But for historical or convenience reasons, they are given broader access. If the vendor's account is compromised, the breadth of that access immediately becomes part of the risk.
The principle of access based on need applies at the network level too. We covered this in more detail in our article on vendor and third-party risk.
What about segmentation?
A flat network, where many systems can talk to each other without needing to, can allow a fault or an attack to spread more widely. Segmentation is meant to create boundaries.
But like a firewall, it is not just "installing a VLAN". You need to understand which systems need to talk to each other, and why.
Security equipment ages too
Firmware, versions, subscriptions, new capabilities and new vulnerabilities. Equipment that was well configured five years ago is not necessarily in the same state today. Infrastructure security is an ongoing maintenance process.
"We have a firewall" is not an answer to the risk question
A firewall is a very important security control, and a VPN is an important tool. But they are part of an architecture that also includes identities, permissions, endpoints, cloud, network, monitoring and backups. It all connects, which is why it is worth reviewing all of it together as part of a cyber risk assessment.
Network security with Marom Cyber
Marom Cyber helps organizations plan, deploy and harden firewalls, VPNs and remote access as part of the overall security program. It is part of our information security and cyber advisory services.
The important question is not which firewall you have. It is what it allows today, and for whom. Talk to us about reviewing your network and remote access.