You have to admire the chutzpah of startup Palo Alto Networks. The company has raised $28 million to sell a "next-generation" firewall based on ideas that are 20 years old.
Here's how it breaks down. Palo Alto Networks (PAN) says its new firewall can identify over 400 applications, including Web applications, that traditional firewalls can't. Using the "new" technology, PAN can spot IM, Web mail, P2P and other traffic. These apps are common vectors for malware and data leakage, can steal bandwidth from business apps and may disrupt employee productivity.
PAN says its firewalls let administrators create fine-grained policies to deal with these applications, such as allowing Yahoo IM but no others. It also can detect attacks in these traffic streams. By contrast, stateful inspection firewalls are more blunt. If a stateful inspection firewall allows HTTP via port 80, any application that tunnels inside the protocol and uses that port will get into or out of the enterprise, whether security admins like it or not.
PAN's approach is both valid and useful, but here's where the chutzpah comes in. Co-founder Nir Zuk was a principle engineer for Check Point Software and a pioneer of stateful inspection technology. Check Point spent a great deal of effort badmouthing a competing firewall technology, the application proxy. Application proxy firewalls essentially do the same thing that PAN does???identify a variety of applications, inspect them and enforce granular policies on them.
However, back in the 1990s Check Point and its stateful inspection brethren (such as Cisco PIX) did such a great job of denigrating application proxy firewalls that today their share of the firewall market looks like a rounding error.
There are major technological differences between PAN and application proxies (and I'll get to those in a subsequent post), but I find it ironic that Zuk's newest venture is based on concepts Check Point tried to marginalize so many years ago.
To realize the benefits of cloud-native software, an application must actually be cloud-native—designed to run in the cloud, interacting with disaggregated cloud services, fully manageable as code—to deliver the expected benefits.
By combining resources and expertise, the AI-Enabled ICT Workforce Consortium will offer a blueprint for how industries can adapt to an AI-dominated future.
IT leaders should heed the guidance of cybersecurity insurance providers who think businesses should prioritize security education, incident preparedness, regular internal audits, and ongoing vulnerability scanning and patching.
