Business at risk from unidentified network traffic, report warns
A lack of network traffic visibility poses significant security challenges to businesses, a report on network firewalls warns
IT managers cannot identify 45% of their organisation’s network traffic, an international survey has revealed.
In fact, nearly one in four cannot identify 70% of their network traffic, according to a report by security firm Sophos, based on a survey of 2,700 IT managers in mid-sized organisations in 10 countries, including the UK.
The lack of visibility creates significant security challenges for today’s businesses and impacts effective network management, according to the Dirty secrets of network firewalls report.
Considering the debilitating impact cyber attacks can have on a business, the report said it is unsurprising that 84% of respondents agree that a lack of application visibility is a serious security concern.
“Without the ability to identify what’s running on their network, IT managers are blind to ransomware, unknown malware, data breaches and other advanced threats, as well as potentially malicious applications and rogue users,” the report said.
The report coincides with a joint warning to the UK and the US about Russian compromises of networking equipment, urging all network equipment operators to take the necessary mitigating measures.
The report also coincides with warnings to the UK telecommunications sector against using networking equipment and services from Chinese supplier ZTE because of security concerns.
Read more about network security
- Network security in the digital transformation era.
- Network security features available in a virtual switch.
- Cloud, AI and security driving network monitoring industry.
- Palo Alto Networks confident of taking security into SaaS era.
Network firewalls with signature-based detection are unable to provide adequate visibility into application traffic due to a variety of factors such as the increasing use of encryption, browser emulation, and advanced evasion techniques, the report states.
“If you can’t see everything on your network, you can’t ever be confident that your organisation is protected from threats,” said Dan Schiappa, senior vice-president and general manager of products at Sophos. “IT professionals have been ‘flying blind’ for too long, and cyber criminals take advantage of this,” he said.
With governments worldwide introducing stiffer penalties for data breach and loss, Schiappa said: “Knowing who and what is on your network is becoming increasingly important. This dirty secret can’t be ignored any longer.”
On average, organisations spend seven working days remediating 16 infected machines per month. Smaller organisations of 100 to 1,000 users spend on average five working days remediating 13 machines, while larger organisations of 1,000-5,000 users spend on average 10 working days remediating 20 machines per month, according to the survey.
“A single network breach often leads to the compromise of multiple computers, so the faster you can stop the infection from spreading the more you limit the damage and time needed to clean it up,” said Schiappa.
“Companies are looking for the kind of next-generation, integrated network and endpoint protection that can stop advanced threats and prevent an isolated incident from turning into a widespread outbreak.
“Sophisticated exploits such as MimiKatz and EternalBlue reminded everyone that network protection is critical to endpoint security and vice versa. Only direct intelligence sharing between these two can reveal the true nature of who and what is operating on your network.”
Upgrading firewall protection
IT managers are aware firewalls need an upgrade in protection, with 79% of IT respondents saying they want better protection from their current firewall.
Almost all respondents (99%) said they want firewall technology that can automatically isolate infected computers, and 97% want endpoint and firewall protection from the same supplier which allows for direct sharing of security status information.
After security risks, lost productivity was cited as a concern for 52% of respondents when it comes to a lack of network visibility. Business productivity can be negatively impacted if IT is unable to prioritise bandwidth for critical applications, the report notes.
For industries that rely on custom software to meet specific business needs, the report said an inability to prioritise these mission critical applications over less important traffic could be costly.
Half of IT professionals who had invested in custom applications admitted that their firewall could not identify the traffic and therefore were unable to maximise their return on investment. Lack of visibility also creates a blind spot for the potential transfer of illegal or inappropriate content on corporate networks, making companies vulnerable to litigation and compliance issues, the report said.
“Organisations need a firewall that protects their investment in business-critical and custom applications by allowing employees to have prioritised access to the applications they need,” said Schiappa.
“Increasing network visibility requires a radically different approach. By enabling the firewall to receive information directly from the endpoint security, it can now positively identify all applications – even obscure or custom applications.”
