In plain language

Firewall consolidation, simply explained

No technical knowledge needed. If you can picture an office building with security gates, you can understand this.

First, what is a firewall?

A firewall is the security gate between a company's computers and the outside world. It checks everything coming in and going out, lets the safe traffic through and stops the rest.

Every office, branch and data centre has one. Most companies also have other security equipment around it: equipment that connects branches together, equipment that lets staff work from home safely, equipment that blocks dangerous websites.

Why look at it again now?

Some gates are too old to be repaired. Many firewalls installed five or more years ago no longer receive repairs and updates from their makers. An old gate that nobody fixes any more is easy to break through.
People no longer come through the front door. Staff work from home, and company systems now live in the cloud. A gate at the front of one building protects less than it used to.
Most visitors now arrive in sealed envelopes. Almost all internet traffic is encrypted. Checking inside the envelope takes a lot of effort, and older gates are often too slow to do it, so many companies stop checking.

A picture to keep in mind

Imagine a company with an office in Tokyo and branches in Singapore, Kuala Lumpur and Sydney.

The old way

Each building has a different gate company, a different alarm company and a different lock company. Each has its own contract, its own rulebook and its own control panel. The guards need to learn all of them.

The consolidated way

One security system covers every building: the gates, the alarms and the locks. One rulebook, one control panel, one contract. Change a rule once and every building follows it the same day.

That is the whole idea. Firewall consolidation is the second way.

Why is the consolidated way better?

Fewer things to pay for. One system and one contract instead of many.
Fewer things to learn. A small team can run one system well.
The same rules everywhere. No branch is left with weaker protection by accident.
Checking inside the envelope stays switched on. Equipment built for the job can check encrypted traffic without slowing everything down.
Easy to prove to auditors. Everything they ask for is in one place.
Small branches stay simple. One box can do the job of three.

The diaries, and the bill

Every gate keeps a diary of everyone who passed through. These diaries are called logs.

Companies send logs to the control room software, called a SIEM, which looks for signs of trouble. That software is usually priced by how much you send it. Gate diaries are huge, and most entries are ordinary visitors, so sending all of them costs a lot for very little benefit.

A better way: send the control room only the important entries, such as stopped attackers and changes to the rules, and keep the full diary in cheap storage in case it is needed later. You pay less and still keep everything.

When is the right time?

The best time to change is when the old gates reach the end of their life or their contracts come up for renewal. You were going to spend the money anyway; this way it buys something better.

If your gates are still young and supported, you do not need to replace them. A check-up can still remove old rules, switch on protection that was paid for but never used, and cut the diary bill.

Do it yourself, or have it looked after?

Some companies run their own security system. Others have a specialist company look after it, day and night, so their own staff can focus on the business. Many do a bit of both.

In one sentence: use your next firewall change to replace many separate products with one system, sized properly and checked properly. You pay less, you see more, and you have fewer things that can go wrong.

The words, in one place

Firewall: The security gate between a company's computers and the internet.
Consolidation: Replacing several separate products with one system that does all their jobs.
Encrypted traffic: Information sent in a sealed form so that only the intended receiver can read it.
Logs: The diaries security equipment keeps about everything that passes through it.
SIEM: The control room software that reads the logs and raises alarms. It is usually priced by how much information you send it.
End of support: The date after which the maker no longer repairs or updates a product.

Want the full detail? Read the in-depth version.