3

What are the advantages of firewall based on cloud? Does it cause heavy traffic and make it slower? If it does, is the impact significant?

A firewall based on a cloud, as I understand it, will send the packets to the cloud for a check, after that, it will return only the appropriate packets to the company.

For example, if I want to visit the company's website, I will send a http request which will go to the cloud for a check. Then it will pass the packet to the company itself.

Will it cause traffic overload? (Because in this scenario, I will send each packet to the cloud and get answer from it).

closed as unclear what you're asking by S.L. Barth - Reinstate Monica, Xander, Iszi, DKNUCKLES, Rory Alsop Jul 24 '16 at 22:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Welcome here! Last line is difficult to understand. Can you please rephrase it? – one Jul 21 '16 at 16:52
  • The first two sentences/questions are also not clear. @adi . Apart from rephrasing the question, perhaps you could add some examples/links to what you've read ... – Jedi Jul 21 '16 at 18:32
  • The main advantage is that it does not require custom built hardware which is always very pricey. Everything else depends on what product you have in mind. – Aria Jul 21 '16 at 19:28
  • @Jedi, I attached an example – adi Jul 21 '16 at 19:32
  • @one , I hope that the example helped you to uderstand it better – adi Jul 21 '16 at 19:33
4

Depending on the type product you are asking about and the environment you are trying to defend there are several pluses and minuses.

Some potential pluses depending on the product:

Pluses:

1.) This isn't the norm but if you are talking about managed firewall services the product may have integration with larger analytic databases which allow the company to see a lot more traffic and respond faster to new attacks than a typical individual organization would.

2.) Anti-DDoS / Anti-DoS capability, again this really depends on the product/company (you didn't specify) but some third parties companies have multiple large connections to the Internet where they can build unique defenses against DDoS and DoS attacks and also have specialized infrastructure to leverage different DNS and BGP security components to reduce large-scale attacks. (This is a huge topic)

3.) The two above do not typically apply to basic cloud-compute firewalls (again I'm not sure which you are asking about) but in the case of some cloud services like Amazon's AWS there is better integration for whats known as elastic services where you can start and stop servers as needed and the firewalls "can" be automatically configured dynamically. This can be done on non-cloud firewalls but it's MUCH easier to do this type of orchestration in cloud-based environments designed around this task.

4.) If it's a managed service that has 24x7 teams and your organization is not staffed 24x7 this could be a huge benefit but do note that many cloud compute platforms leave all the security up to the end user so this answer really depends on which type of service you are talking about (could be a plus or a minus depending on the product).

Minuses:

1.) It's harder to see when things are misconfigured such that data can leave the organization. Note: I'm not saying this isn't manageable but lots of people new to cloud compute environments make many mistakes such that wouldn't have happened when all the data is forced through a physical cable that people can see.

2.) Hypervisor flaws underneath the firewalls may create risks to an entire environment in a cloud compute environment. There are other more interesting CVE's but as an example a recent one affecting some cloud compute providers is CVE-2016-5363

3.) A third party has access to all of your traffic and can control your security configurations. Weaknesses in the third party network are now weaknesses in your network. This can increase your attack surface dramatically.

4.) In most cloud compute environments you lose access to infrastructure-based NetFlow, or it's harder to get, or the data is not complete especially if your environment uses any serverless compute services. Some people add this back on at the host level but if the host's kernel is compromised it's TCP/IP stack may not be reporting malicious communications which then won't be accurately reflected in your NetFlow. Out of band NetFlow is a more accurate measurement specifically due to this issue.

5.) Capability to change hardware/software in an emergency is reduced. If your cloud-based firewall goes down there may not be anything you can do about it until the provider can correct the issue.

6.) You are outsourcing this security work to an organization who will not care about your data or your business as much as you do. Not a horrible thing but something to keep in mind.

There are many other smaller pluses and minuses but I'd need to know more about the specific system or service you are asking about. Likewise depending on the product or specific cloud platform (depending on which you are talking about) there may also be a lot of other issues that you will want to consider which are unique to that platform. Far too many to go into detail here.

The choice between the two is based on what you are trying to defend, the specific risks to your organization, and the trade off of any advantages either one brings to the decision.

Both cloud and traditional solutions can be really good but they are very different and they require good integration into your environment. These aren't products that you buy and just forget about.

It's always important to look at the security problem as a whole and see how these components fit your organization and what you are trying to achieve.

To answer your "speed" question. If and only if you are talking about having a cloud-based firewall in front of a traditional network there can actually be really big speed increases as some of the companies who do this have faster, lower-latency connections to the Internet backbone and they can cache content locally. This has the effect of moving parts of your services or services your organization is accessing closer to your users. Similarly they may add compression where it's supported by the various clients accessing the servers (this is a smaller issue speed-wise as most people configure their servers to do this but where that was not done their will be a speed increase). Some companies like Imperva can also cache content for you and act as a Content Delivery Network (CDN) which will give you additional speed improvements. But a lot of this depends on what your situation is.

Generally there are benefits in the form of the co-op model in that a large company offering these services can bring more technology to the solution than a smaller individual organization would tend to buy on their own. None the less for high-security data this may not be worth the additional risks.

I'll also mention that some organizations use both as a way to get the best of both worlds. I like this when it's appropriate.

Finally I need to mention that this answer is also very time sensitive as that market is still emerging so the pluses and minuses will change a lot over time.

  • Thank you for the detailed answer. well, I am trying to defend the inner network of my company, it contains dmz perimeter, web server of the website of my company, and some worker's computers. I try to develoap a firewall based on cloud and ask if in this case - Will it slow down and overload my network? Can an attacker get those packets and change them? By the way, I ask in general and don't mean to some specific product. – adi Jul 21 '16 at 19:21
  • 1
    But all of this is based on public cloud. Firewalls normally run in private cloud on-site. – Aria Jul 21 '16 at 19:30
  • Why is it different? My guess is that it will slow my traffic because I pass each packet that the company get to the cloud and wait for an answer – adi Jul 21 '16 at 19:35
  • 1
    @adi It could but keep in mind that Internet route geography is VERY different than physical geography. Sending packets to your next door neighbor could send them on a thousand mile path to go 50 ft down the street. So the way you end up looking at this is how are things peered BGP-wise and then look at things like latency, and in rare cases you also have to analyze Jitter. Larger cloud providers like AWS and Google have VERY good Internet peering. You definitely DO want to test this if you can. That said for many services it's a net improvement but mainly because of performance tweaking. – Trey Blalock Jul 21 '16 at 20:58
  • 1
    @Aria Firewalls of some form are needed for all locations public and private. For regulatory purposes or for things like PCI they are mandatory. Keep in mind this may be something as simple as IPTables or could be something very elaborate. You may also be interested in the topic of Zero Trust Firewalling if you're not familiar with it. This is a common deployment technique for systems running on public cloud compute platforms. – Trey Blalock Jul 21 '16 at 21:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.