Pros and cons of multitenant firewall provided by ISP

Question

I was reading a bit about firewalls, and I came across this story type questions, but I don't think I fully know how to answer it, or grasp the implications. The question can be seen below:

You are the person in charge of the IT of a company, which manages and uses a firewall of its own until now. This firewall is located at the company premises. Now your ISP offers a private firewall-context on a central large firewall at the ISP. This firewall is multitenant, so that every company can administer a firewall-context of its own. Which considerations are important for the decision-making and which parameters are of interest and must be taken into account to come to a well-founded decision?

I totally agree that the question is opinion based, but I think that's also one side of security, to weight pros and cons, to make trade-offs. Anyway, as long as I know if it is multinenat there is actually no way that other tenants can break my configuration, right? So, if this is not actually a risk, what can be some risks or pros/cons of this approach?

Answer 1

there is actually no way that other tenants can break my configuration, right?

No, you don't know that from the information provided, it is only implied.

Nor do you know what is between the firewall and your network.

But the question posed does not say what choices/questions your decision is supposed to address e.g.

• does configuring a policy on the providers firewall pose any additional risk to your network?
• does using the providers firewall make your own firewall redundant?
• coke or pepsi?

what can be some risks or pros/cons of this approach?

As per above, which approach? Assuming you mean retiring your local firewall, then (in addition to the to the previous points about config and what else is behind the firewall....

• Management of the firewall platform (patching, monitoring, alerting)
• Has the providers network design been audited to verify the firewall is effective (no back doors)
• Do you want to be able to capture and analyze event information from the device? Can you? How is this provided?
• Do you have the skills available to configure the providers firewall? Is it an off-the-shelf product you get training or independent consultancy for?
• what is the SLA from the provider?
  • notification about scheduled maintenance
  • planned vs unplanned downtime
• How much does it cost?
• What would be the impact / likelihood of changing providers?
• Is there automated change management around the configuration (e.g. notification of config changes, config version control at the provider)
• are there routes into your network covered by current local firewall which are not covered by the provider firewall