After many years in the wilderness of non-innovation, there has been a lot of activity in the network security space over the past few years. Your grand-pappy’s firewall is dead and a lot of organizations are in the process of totally rebuilding their perimeter defenses. At the same time, the perimeter gradually becomes even more a mythical beast of yesteryear, forcing folks to ponder how to enforce network isolation and segmentation while the underlying cloud and virtualized technology architectures are built specifically to break isolation and segmentation.

The good news is that there will be lots of good stuff to see and talk about at the RSA Conference. But, as always, it’s necessary to keep everything in context to balance hype against requirements, with a little reality sprinkled on top.

Whatever the question, the answer is NGFW…

For the 4th consecutive year we will hear all about how NGFW solves the problem. Whatever the problem may be. Of course that’s a joke, but not really. All the vendors will talk about visibility and control. They will talk about how many applications they can decode, and how easy it is to migrate from your existing firewall vendor and instantaneously control the scourge that is Facebook chat.

As usual they will be stretching the truth a bit. Yes, NGXX network security technology is maturing rapidly. But unfortunately it’s maturing much faster than most organizations’ ability to migrate their rules to the new application-aware reality. So the catchword this year should be operationalization. Once you have the technology, how can you make best use of it? That means talking about scaling architectures, policy migration, and ultimately consolidation of a lot of separate gear you already have installed in your network.

The other thing to look out for this year is firewall management. This niche market is starting to show rapid growth, driven by the continued failure of the network security vendors to manage their boxes, and accelerated by the movement towards NGFW – which is triggering migrations between vendors, and driving a need to support heterogenous network security devices, at least for a little while. If you have more than handful of devices you should probably look at this technology to improve operational efficiency.

Malware, malware, everywhere.

The only thing hotter than NGFW in the network security space are network-based malware detection devices. You know, the boxes that sit out on the edge of your network and explode malware to determine whether each file is bad or not. Some alternative approaches have emerged that don’t actually execute the malware on the device – instead sending files to a cloud-based sandbox, which we think is a better approach for the long haul, because exploding malware takes a bunch of computational resources that would better be utilized to enforce security policy. Unless you have infinite rack space – then by all means continue to buy additional boxes for every niche security problem you have.

Reasonable expectations about how much malware these network-resident boxes can actually catch are critical, but there is no question that network-based malware detection provides another layer of defense against advanced malware. At this year’s show we will see the first indication of a rapidly maturing market: the debate between best of breed and integrated solution. That’s right, the folks with standalone gateways will espouse the need for a focused, dedicated solution to deal with advanced malware. And Big Network Security will argue that malware detection is just a feature of the perimeter security gateway, even though it may run on a separate box. Details, details.

But don’t fall hook, line, and sinker for this technology to the exclusion of other advanced malware defenses. You may go from catching 15% of the bad stuff to more than 15%. But you aren’t going to get near 90% anytime soon. So layered security is still important regardless of what you hear.

RIP, Web Filtering

For those network security historians this may be the last year we will be able to see a real live web filter. The NGFW meteor hit a few years ago, and it’s causing a proverbial ice age for niche products including web filters and on-premise email security/anti-spam devices. The folks who built their businesses on web filtering haven’t been standing still, of course. Some moved up the stack to focus more on DLP and other content security functions. Others have moved whole hog to the cloud, realizing that yet another box in the perimeter isn’t going to make sense for anyone much longer.

So consolidation is in, and over the next few years we will see a lot of functions subsumed by the NGFW. But in that case it’s not really a NGFW, is it? Hopefully someone will emerge from Stamford, CT with a new set of stone tablets calling the integrated perimeter security device something more relevant, like the Perimeter Security Gateway. That one gets my vote, anyway, which means it will never happen.

Of course the egress filtering function for web traffic, and enforcement of policies to protect users from themselves, are more important than ever. They just won’t be deployed as a separate perimeter box much longer.

Protecting the Virtually Cloudy Network

We will all hear a lot about ‘virtual’ firewalls at this year’s show. For obvious reasons – the private cloud is everywhere, and cloud computing inherently impacts visibility at the network layer. Most of the network security vendors will be talking about running their gear in virtual appliances, so you can monitor and enforce policies on intra-datacenter traffic, and even traffic within a single physical chassis. Given the need to segment protected data sets and how things like vMotion screw with our ability to know where anything really is, the ability to insert yourself into the virtual network layer to enforce security policy is a good thing. At some point, that is.

But that’s the counterbalance you need to apply at the conference. A lot of this technology is still glorified science experiments, with much better logos. It is still very very early for private cloud deployments, and we all know that security lags every new technology innovation by years. So we will see some cool stuff on the show floor, and you should check it out – if only to understand how vendors are trying to solve the problem of enforcing security policy within the new virtualized datacenter. Just keep in mind that they are competing for 2015 mindshare.

Your application is DENIED

The other big trend in network security is trying to figure out how to deal with increasingly common denial of service (DoS) attacks. We recently wrote a paper describing the technologies and solution architectures, so check it out as a primer before you hit the show. As with network-based malware detection, you’ll hear some best of breed vs. integrated solution hyperbole, but it’s more complicated than that.

With DoS attacks, you also need to deal with the network services side of the equation. Which means you need to talk to anti-DoS service providers and CDNs, who can absorb the brunt of attacks while trying to keep your applications up and running. There is some technology to check out, including common signaling protocols between DoS equipment and anti-DoS service providers. Keep in mind that you need to redirect traffic very quickly, which means the network ops processes to trigger and implement redirection must be nailed down in advance. Also be sure to dig deep into the anti-DoS capabilities of your existing network security gear. Odds are you don’t yet have good anti-DoS defenses available. So challenge your vendor on how you can keep things up and running while their boxes are falling down.

**Don’t forget to register for the Disaster Recovery Breakfast if you’ll be at the show Thursday morning. Where else can you kick your hangover, start a new one, and talk shop with good folks in a hype-free zone? Nowhere, so make sure you join us… **