​Turn on any “techy” TV show or movie these days and you are bound to see some reference to hackers trying to break into corporate or government networks by breaching firewalls. While many of the scenarios are unrealistic as they are portrayed onscreen, the real-life battle between security vendors and hackers does go on. In their effort to defeat the “black hats” firewall and security, vendors have dramatically increased the complexity of security devices and have started to incorporate firewall technology into all sorts of network infrastructure devices, like switches, routers, UC systems, etc.

Unfortunately, now that more devices are “responsible” for network security, that means more devices are potential targets for attack and therefore must be managed with the same higher level of attention that traditional firewalls receive. These systems must be scrutinized for their security postures, adherence to corporate governance policies, and have known vulnerabilities patched rapidly. Simple configuration errors may create holes in firewalls, VPN tunneling errors could expose data to the Internet, and inconsistent settings can cause issues with a regulatory framework.

In modern multi-vendor networks, administrators face many challenges in properly managing firewall configurations, ensuring compliance to regulations, carrying out changes, and minimizing network downtime caused by human error.

This blog looks at the need for an automated NCCM solution to address these concerns, and the main features that one should look for in an NCCM solution.
Configuration management involves identifying the configuration of a firewall system at given points in time, systematically controlling changes to the configuration, and maintaining the integrity and traceability of the configuration throughout the lifecycle.
It also involves the testing of the existing configuration vs known-good policies while simultaneously looking for any configuration that might expose the firewall to security or compliance risk.

​Configuration management in this context can be summarized as:

• Device hardware and software inventory collection
• Device software management
• Device configuration collection, backup, viewing, archiving, and comparison
• Device configuration generation and “push”
• Device configuration policy checking
• Restore firewall configuration back to a recent good working state
• Interwork with fault and performance management to monitor and ensure availability and performance of the firewall platform installations

Let’s explore each of these as they relate to firewall and security devices:

​Device hardware and software inventory collection

The first step in being able to manage any system is to have accurate information about that device. Therefore, any good firewall NCCM system needs to also contain related information from a CMDB, e.g. containing up to date inventory information. It should (at minimum) contain a hardware (chassis, daughter cards, memory, etc) and software (OS, Firmware) information that is regularly updated. Once a week at minimum – once a day is preferred, and changes should be tracked even short-term.

​Device software management

This refers to the ability to push software updates (patch) the OS/Firmware of the firewall. A best-practice ability is to both patch on a regular basis – we have seen larger enterprises standardly push two updates per year – as well as to have the capability to push emergency bug fix/vulnerability updates on an ad-hoc basis. The NCCM system needs to be able to perform OS and hardware checks such as software check-sums, available memory, license compatibility, and so forth as part of the update process.

​Device configuration generation and “push”

One of the most common activities that cause network downtime is simple human error when making an “on the fly” configuration change.

​Device configuration policy checking

Corporate governance policies such as Sarbanes Oxley (SOX), NERC, PCI-DSS, HIPAA, MiFID II, SAS 70, Basel II, and GDPR have all been introduced to ensure levels of security and integrity are maintained for company financial information and any stored personal details of customers.

 Thank you to Peter Moessbauer, of Infosim, for the article.