93% of the Respondents Conduct Firewall Audits Manually; 60% Cited Lack of Time is the Weakest Link in Network Security; Reported Cheating on Audits Has Doubled Since 2010
Tufin, the market-leading provider of Security Policy Management solutions, today announced the results of its annual firewall management survey. Having sampled 100 network security professionals directly involved in firewall management and auditing, this year's survey reveals that manual processes - and the time constraints they create - are the biggest challenge facing today's network security professionals.
Despite confirmation that regulatory and corporate compliance requirements such as SOX, PCI DSS and ISO 27001 are driving security operations, only 7% of the sample automates the firewall audit process. As a result, 40% of organizations spend up to a month or more a year on firewall audits. With 85% of respondents reporting that up to 50% of firewall rule changes require modification because they were not designed correctly, it comes as no surprise that 67% believe their change management processes put them at risk of a breach.
"This year's survey reveals that, more than budget constraints or any other factor, time is the security manager's most precious resource," said Shaul Efraim, vice president of Marketing and Business Development, Tufin Technologies. "We were surprised to learn that half the sample is still doing basic tasks manually such as tightening up permissive rules, looking for shadowed rules or recertifying rules. There is no benefit to having experienced administrators spend their days searching for needles in haystacks. Automating these tasks saves a significant amount of time and money, dramatically increases the accuracy and efficiency of operations, and improves the organization's overall network security posture. And, with 86% of the sample managing or planning to manage Next Generation Firewalls in the next 12 months, the time to do it is now."
Perhaps the greatest indicator that the problem is reaching critical mass is that 22% of the sample knew of someone that cheated on an audit, citing lack of time as the main reason - up from 10% in Tufin's April 2010 survey. Also disturbing is how many organizations don't audit their firewalls at all - almost a quarter of the sample (23%) has never conducted a firewall audit.
The survey also unearthed interesting trends across all three components of Security Policy Management: Firewall Operations, Risk Management and Compliance, and Security Change Automation. Highlights include:
Firewall Operations/Risk Management/Compliance:
- In addition to those network security managers that don't perform firewall audits, 11% have no idea how much time it takes to conduct one.
- 84% of the sample either has no way of knowing when a firewall rule needs to be recertified or decommissioned (41%), or manages the process manually (43%.)
- Almost half the sample - 47% - locates redundant or overlapping rules manually; almost 20% have no way of locating them at all.
- While the number one reason for cheating on audits was lack of time, it was followed with two other reasons: that the parameters of the audit were irrelevant to the business (30%), and concerns that the network security the team would look bad (also 30%.)
Security Change Automation:
- 28% reported that it takes them on average, several hours to several days to design a firewall rule change.
- Despite the time spent crafting rule changes, 85% reported that up to 50% of firewall rule changes require modification later on because they were not designed correctly.
- 66% of the sample felt their change management processes do or could place the organization at risk of a breach. The main reasons cited were lack of formal processes (56%), followed by manual processes with too many steps or people in the process (29%).
"Despite our success, this survey reveals the maturity curve for Security Lifecycle Management is still on the upswing," said Mr. Efraim. "Without process automation, auditing network security systems - especially as organizations continue to use more firewalls in virtualized environments and embrace Next Generation firewalls - is simply not possible. 60% of the sample cited lack of time as the weakest link in their network security. If that is not business justification for automating fundamental but time consuming, error prone, network security processes, then what is?"
Tufin's firewall management survey was executed online via Survey Monkey, and sampled 100 administrators worldwide from companies ranging from less than 500 people (40%) to more than 5,000 (30%) in a wide range of verticals including telecommunications, financial services, energy, pharmaceuticals, and transportation.
About Tufin Technologies
Tufin® is the leader in Network Security Policy Orchestration for enterprise cybersecurity. More than half of the top 50 companies in the Forbes Global 2000 turn to Tufin to simplify management of some of the largest, most complex networks in the world, consisting of thousands of firewall and network devices and emerging hybrid cloud infrastructures. Enterprises select the company’s award-winning Tufin Orchestration Suite™ to increase agility in the face of ever-changing business demands while maintaining a robust security posture. The Suite reduces the attack surface and meets the need for greater visibility into secure and reliable application connectivity. Its network security automation enables enterprises to implement changes in minutes with proactive risk analysis and continuous policy compliance. Tufin serves over 2,000 customers spanning all industries and geographies; its products and technologies are patent-protected in the U.S. and other countries.
Follow Tufin on:
- Twitter: http://twitter.com/TufinTech
- Facebook: http://www.facebook.com/Tufintech
- LinkedIn: http://www.linkedin.com/companies/tufin-technologies
- YouTube: http://www.youtube.com/user/Tufintech
- The Tufin Blog: http://www.tufin.com/blog