Insight Event: Palo Alto Networks

Summary

This post recaps a blueAPACHE Insight Event lunch briefing featuring Palo Alto Networks security evangelist Tim Treat, covering how enterprise security needed to shift from a "detect and repair" model to a prevention-first model built around visibility of network traffic, applications and users. It is written for IT and security leaders evaluating next-generation firewall and network security platforms rather than legacy port-based approaches. The underlying argument, that prevention rather than after-the-fact detection is the more effective security posture, and that visibility into applications and users (not just ports) is a foundational requirement, still holds today even though the specific product references are from 2015.

Key facts

Article

blueAPACHE recently hosted an exclusive lunch with Palo Alto Networks Security evangelist, Tim Treat. On loan from Palo Alto Networks’ head office, Tim started his career in the United States Air Force where he led global fixed and deployed organisations performing Engineering and Installation, Combat Communications, Network Operations and Security Operations. After transitioning from active duty, he delved into leading federal and commercial Network and Security Operations. Today, Tim uses his twenty year experience to help organisations incorporate enterprise resilience, prevention and protection into Network Operations and Defence convergence strategies. blueAPACHE integrate Palo Alto Networks directly in to our core. Adding this technology at the core network level, supporting this with firewalls deployed at the edge and the new endpoint security offers organisations a complete security platform, which Tim acknowledged.

• IT security is now the responsibility of the organisation, not the IT department. The Executive and Board need to better understand their responsibilities and the security profile being deployed, for they will be held accountable.
• Security traditionally has always been about detect and repair known problems. This has changed – today it is about prevention, prevention, prevention. With more targeted attacks (malware being distributed to a single organisation, directly or indirectly as we saw with Target), traditional security methods don’t see the problem until too late – if at all. Today, you need a security solution that tests and monitors everything – not just the known threats.
• You will receive malware, it is going to happen. Palo Alto Networks’ Wildfire sees around 400,000 malicious samples per day. Once you accept that you will be directly or indirectly targeted, you can plan for it.
• Palo Alto Network’s hardware is new – the first build was released in 2009. Other leading security vendors solutions are a patch-work platform developed in the early 1990s and simply refreshed to allow additional modules to be bolted on ever since.
• Palo Alto Network’s solution is unique – it operates on the application and user layers. Other traditional solutions build their Intrusion Prevention Systems (IPS) around ports, which hackers can easily exploit. The success of Cryptolocker reinforces the effectiveness of Palo Alto Networks’ approach. Cryptolocker is not spreading across networks protected with Palo Alto and Wildfire – but it is running rife across networks leveraging traditional firewall technologies.

“You need two fundamental requirements to operate and defend your enterprise. One; know and control all network traffic, applications and users at all times. Two, beat attackers before the kill chain ‘install’ stage” said Tim. “blueAPACHE is the first ITaaS organisation in Australia to integrate Palo Alto Networks directly into their core – and by doing so blueAPACHE is best placed to defend their clients with both fundamental requirements.” Key learnings shared by Tim at the luncheon included:

Additional information

If you would like to be invited to future blueAPACHE Insight Events, click here.
To learn more about Palo Alto Networks and blueAPACHE security platform, contact our account management team.

Related

• Core network and data centre interconnect
• Connectivity
• emPOWER Security
• Security services

Frequently asked questions

Why does this 2015 briefing still matter for a security decision today?The core argument, that security must shift from reactive detection to proactive prevention, and that visibility must extend to applications and users rather than just network ports, remains a standard principle of modern network security architecture. Palo Alto Networks technology remains part of blueAPACHE's current security stack, per blueAPACHE's published vendor partnerships.

What was the main criticism of traditional, port-based security in the briefing?The briefing argued that traditional intrusion prevention systems are built around ports, which attackers can exploit relatively easily, whereas an application- and user-aware approach closes that gap because it inspects what traffic actually is and who it belongs to, not just which port it arrives on.

Who is accountable for an organisation's security posture, according to the briefing?The briefing made the point that IT security is the responsibility of the whole organisation, not just the IT department, and that executives and boards need to understand their organisation's security profile because they will ultimately be held accountable for it.

Where does Palo Alto Networks technology sit in blueAPACHE's own network?blueAPACHE states it integrates Palo Alto Networks technology directly into its core network, supported by firewalls deployed at the edge and endpoint security, which the briefing frames as a complete security platform covering both fundamental requirements of visibility and prevention.

Is prevention-first security still the industry standard approach?Yes, in principle. The shift away from purely reactive, signature-based detection toward proactive prevention and continuous monitoring described in this 2015 briefing reflects the direction the security industry has continued to move in, though the specific products and threat volumes cited are specific to that period.

What kind of event was this, and can I attend a future one?This was a blueAPACHE Insight Event, a briefing lunch for clients and prospects featuring an external security specialist. The original post noted that readers could register interest in future Insight Events through blueAPACHE directly.

Does blueAPACHE only use Palo Alto Networks for security, or other vendors too?blueAPACHE's published vendor list includes several security and networking vendors beyond Palo Alto Networks, including Cisco for core routing, Microsoft for identity and endpoint security, and CrowdStrike as a supported integration within its managed detection and response service.

What should a business do if it is still relying on port-based firewall rules alone?The briefing's practical recommendation is to move toward a security architecture that inspects traffic by application and user rather than by port alone, and to accept that some malware will get through so that detection and response capability, not just prevention, needs to be part of the plan.

Source

https://www.blueapache.com/blog/insight-event-palo-alto-networks-2/

Knowledge Base