0

In recent years there's been a number of IndieGoGo or KickStarter projects for smart device protection, or next-generation firewalls. Some examples are: Anonabox, Cujo, Dojo, Firewalla, Keezel, RATtrap, Vektor

Now the established network/router manufacturers are getting in on it with their own new products: Avira Safe Things, Cisco Meraki, Eero, Fortinet FortiWiFi, F-Secure Sense, Google WiFi, Linksys Velop, Luma Surround WiFi, Ubiquiti Unifi Security Router, Securify Almond3...

While I can find 'reviews' on many of these, they all have one thing in common, the reviewers are repeating the features the original marketers listed. There is a lot of hype and marketing, but I've been unable to find substantial articles of proven performance.

Has anyone found/done any real-world testing? Do the one wire products reliably filter all packets to/from all devices, or do they miss large chunks of traffic? Do these things really protect any better than conventional routers? Are they more frequently patched for vulnerabilities?

  • I think your order is confused. Big players have had NGFWs of various capabilities for about a decade. The recent crowd funded options are newer and often meant as a "cheaper" alternative to the established players in the market. As an example, here is a 2011 blog post about NGFWs. – YLearn Apr 25 at 5:58
2

Has anyone found/done any real-world testing?

For example NSS labs does various tests. But since it is their business to help others decide what to buy the detailed test results are only available for money. Some vendors though provide the details on their own website - but of course only if these are good results.

Do the one wire products reliably filter all packets to/from all devices, or do they miss large chunks of traffic?

There is always a balance between speed, price and depth and quality of inspection. This means these firewalls can be bypassed and often in trivial ways (disclaimer: this is my own research) as NSSLabs shows too (which used my evasion tool). And while many of these reported problems have been fixed there are several unreported which still work.

But in general you can say that you get what you pay for. The cheaper a device for a specific throughput is the less analysis it does, which means it also protects you less. But none of the devices offers full protection. And no matter what some claim, I don't believe that any of the vendors has the secret "patent-pending" "military-grade" sauce which makes it possible to provide the same level of security and performance for a significantly lower price than all the others.

Do these things really protect any better than conventional routers?

Definitely. A router does not offer much protection in the first place. These NGFW analyze at the application level, check the reputation of sites you visit, analyze mail ... - nothing of this is done by a router.

Are they more frequently patched for vulnerabilities?

Some vendors have obviously more problems writing secure code while others have less problems. Just look at the reported vulnerabilities before you buy something.

But all of this does not mean that you need to buy the most expensive device to protect your network. What you actually need depends on your specific risk, which depends on what you protect but also how you protect it already. If all your sensitive data are offline than you don't need an NGFW but likely a better lock or a safe or a surveillance system since the main thing you have to worry about are physical attacks.

And even if the data are on networked systems it might be better to have separated networks depending on the sensitivity of the assets, use microsegmentation inside the network or your zero-trust concepts like BeyondCorp to protect your data. Depending on your specific use case and risk they might protect you better for the same costs than some next generation perimeter firewall.

In contrast to what especially the cheaper vendors tell you: security is not as simple as putting some fancy device on the network and be fully secure.

0

They absolutely protect better than traditional routers. I needlessly run a FortiWifi on my little home network and I have some experience with Fortinet, PaloAlto, and Checkpoint NGFWs. I've seen an improved security stance in my home vs when I just used the security apps baked into my Asus Router.

Like Steffen Ullrich stated you need to balance the value of what you are trying to protect vs. the cost of protecting it vs. your ability to properly configure, utilize, and maintain that protection.

That said, NGFWs are being relied upon more heavily these days as you can block/filter/scan/report on traffic in quite a few ways that a traditional router can't. (Source: My own experience in the security industry)

One thing I'll add is that in order to get the most out of these firewalls, SSL Decryption is necessary. It's not cheap or easy monetarily and resource wise so it doesn't make sense in all situations, but some of these firewalls have ASICS that are custom built for SSL decryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.