We are witnessing a massive transition towards cloud computing, which is welcomed for scalability, flexibility, and cost-effectiveness. When transitioning to the cloud, the providers get you secure "cloud security" terms. Therefore, this very common question arises: do we need any physical firewalls anymore if the cloud safeguards our data and applications? And the answer is that there has to be one! Regardless of how important cloud security practices are in protecting resources within a cloud environment, nothing can replace a firewall at the actual network boundary of your location.
To understand why there is no way you could manage without an installed firewall, let us begin by examining what cloud security is, as opposed to what the function of a firewall is.
Diving Deeper into Cloud Security:
Cloud security protects cloud systems, data, and infrastructures using policies, technologies, procedures, and controls. Providers implement extremely robust security to ensure their services are maintained in their integrity, confidentiality, and availability:
- Physical Security: Security of physical data centers.
- Network Security: Controls are put within their network infrastructure.
- Data Encryption: Encrypting data at rest and in motion in the cloud.
- Identity and Access Management (IAM): Access management of individuals with access to cloud services.
- Compliance and Governance: Adherence to legislation and standards of the respective industry.
- Threat Detection and Response: Monitor and respond to security threats in their environment.
These are crucial for securing what is in the cloud. But for the most part, they are aimed at the infrastructure of the cloud providers and thus the security of the cloud, not the security of the cloud or protection of your local network and endpoints.
The Undying Relevance of a Firewall:
The firewall is a protector that functions between your internal network (your office, your computers) and the outside world (the Internet). Its role is to monitor incoming and outgoing network traffic according to predetermined security rules and to prevent anything labeled as malicious or unauthorized from passing through. Its main functions are:
- Network Perimeter Security: Establishing a virtual barrier, the purpose of which is to block unauthorized entry into your internal network.
- Traffic Filtering: Depending on parameters like source/destination IP address, port, and protocol, network traffic is filtered.
- Intrusion Prevention: Detects and stops any attempts to attack over the network.
- Application Control: Specifying and restricting applications that have access to the network.
- Content Filtering: Blocks access to sites that engage in malicious or inappropriate activities.
Let’s break down the specific reasons why a firewall remains a meaningful element of your overall security posture even with strong cloud security:
Protecting Your Network Infrastructure
Cloud security guards your information and applications that reside in the cloud. It comes without security for your particular local network infrastructure, comprising your computers, servers, printers, and other devices that are network-connected. Those dangers exist for these devices through the internet. The firewall acts as your on-premises network's first layer of defense against malicious flows to its internal systems.
Imagine your office network connecting to various cloud services. While data within those cloud services may be secure, your office devices used for accessing them may be vulnerable to malicious software, phishing attacks, and other forms of threats originating from the internet. At the same time, a firewall would protect these endpoints by allowing network traffic in and out of your local network.
Filtering Internet-Aggregated Access:
While the cloud security handles access to your cloud resources, the firewall governs Internet-wide inbound and outbound traffic for your network. You can set extremely granular rules to specify what kinds of traffic can course into and out of the internal organization network. This way, they can, for example, limit which internal devices can access an external resource and block any unsolicited inbound connections that may be an attack.
For example, you might allow HTTP and HTTPS traffic to your web servers in the cloud, but you want all other inbound connections to the office network to be blocked. With the help of a firewall, you can enforce these policies at the network perimeter, providing a layer of control not offered for your entire network by cloud security.
Defense in Depth:
One of the most recognized principles of cybersecurity is referred to as "defense in depth," meaning that more than one layer of security controls is utilized. Relying solely on cloud security leaves a massive gap in your overall security design, network perimeter, and endpoint protection. Your cloud provider's security and the firewall are complementary to some degree, and therefore, the firewall is a defense-in-depth layer.
Defense Against Client-Side Attacks:
Cloud security is the security of the cloud itself, whereas vulnerabilities may be on the client side, which includes numerous devices and applications through which individuals access the cloud (thus the term "client-side"). If, for example, some form of malware infects the victim's machine, it could then be used to access cloud resources maliciously. Firewalls, particularly Next-Generation Firewalls (NGFWs), might minimize these threats by scanning traffic for malicious material and shutting down communication from infected systems to known command-and-control servers.
For instance, if an employee's laptop is ransomware-infected, a firewall may be able to inhibit communication with the attacker's server, and in doing so, reduce the impact of the attack. Cloud security measures may also provide a guard against the data in the cloud being encrypted by this infected device (depending on the cloud service and its configuration), but a firewall will help fight against the initial malicious communication.
Network-level logging and monitoring:
Firewalls provide an extensive number of useful logs of network traffic that can greatly assist your security monitoring/incident response and regulatory compliance activities, offering insight into connection attempts, blocked traffic, and potentially blocked malicious activity at the perimeter. Cloud providers also typically make logging available, too, but the log messages from a firewall offer a different view of what is happening, specifically the traffic going in and coming out of your organization's network.
An impactful analysis of firewall logs can uncover suspicious activity that you might not notice in cloud security logs alone. Visibility at the network level is crucial for understanding your overall security posture.
Compliance obligations:
Many regulatory regimes and industry standards mandate that businesses implement network firewalls as part of a baseline approach to securing their networks. Merely relying on cloud security will not be enough if these compliance obligations state that perimeter security is a requirement in order to protect the organization's network.
For example, standards such as PCI DSS (for organizations that process credit card data) require, among other things, that a firewall be in place and actively being maintained.
The Changing Nature of Firewalls in the Cloud:
The type of firewall, too, has changed with cloud computing. While organizations still need a firewall as part of an on-premises network environment, we have also begun to see the adoption of cloud firewalls or Firewall-as-a-Service (FWaaS). These are virtualized firewalls operating in the cloud to protect cloud environments themselves or implement consistent security policies across hybrid environments (on-premises AND cloud).
Although it may appear you are using the cloud exclusively, the implementation of a cloud firewall to protect your cloud assets does not eliminate or substitute the need for a firewall at the perimeter of your network to protect your on-premises infrastructure and your control of access to the internet. Firewalls have differing but complementary functions.
Conclusion:
In sum, Cloud Security provides security in your cloud environments, which protects your assets and your resources, but does not remove the need for firewalls.
A firewall is still an essential part of a security strategy that protects your network infrastructure by regulating internet access and creating a defense-in-depth strategy. It is dangerously misleading to think cloud security is sufficient on its own, and not continuing to have the protection afforded by a firewall will put your organization at risk.
You should be investing in the implementation of a firewall solution for your network perimeter, even if you have strong cloud security in place or other cloud security measures. Proper controls will secure your organization against the changing dynamics of cyber threats.
