Firewall traffic analysis: The complete guide

What is firewall traffic analysis?

Firewall traffic analysis (FTA) is a network security operation that grants visibility into the data packets that travel through your network’s firewalls. Cybersecurity professionals conduct firewall traffic analysis as part of wider network traffic analysis (NTA) workflows. The traffic monitoring data they gain provides deep visibility into how attacks can penetrate your network and what kind of damage threat actors can do once they succeed.

NTA vs. FTA Explained

• NTA tools provide visibility into things like internal traffic inside the data center, inbound VPN traffic from external users, and bandwidth metrics from Internet of Things (iOT) endpoints. They inspect on-premises devices like routers and switches, usually through a unified, vendor-agnostic interface. Network traffic analyzers do inspect firewalls, but might stop short of firewall-specific network monitoring and management.
• FTA tools focus more exclusively on traffic patterns through the organization’s firewalls. They provide detailed information on how firewall rules interact with traffic from different sources. This kind of tool might tell you how a specific Cisco firewall conducts deep packet inspection on a certain IP address, and provide broader metrics on how your firewalls operate overall. It may also provide change management tools designed to help you optimize firewall rules and security policies.

Firewall rules overview

Your firewalls can only protect against security threats effectively when they are equipped with an optimized set of rules. These rules determine which users are allowed to access network assets and what kind of network activity is allowed. They play a major role in enforcing network segmentation and enabling efficient network management.

Analyzing device policies for an enterprise network is a complex and time-consuming task. Minor mistakes can lead to critical risks remaining undetected and expose network devices to cyberattacks.

For this reason, many security leaders use automated risk management solutions that include firewall traffic analysis. These tools perform a comprehensive analysis of firewall rules and communicate the risks of specific rules across every device on the network.

This information is important because it will inform the choices you make during real-time traffic analysis. Having a comprehensive view of your security risk profile allows you to make meaningful changes to your security posture as you analyze firewall traffic.

Performing Real-Time Traffic Analysis

AlgoSec Horizon Security Analyzer captures information on the following traffic types:

• External IP addresses
• Internal IP addresses (public and private, including NAT addresses)
• Protocols (like TCP/IP, SMTP, HTTP, and others)
• Port numbers and applications for sources and destinations
• Incoming and outgoing traffic
• Potential intrusions

The platform also supports real-time network traffic analysis and monitoring. When activated, it will periodically inspect network devices for changes to their policy rules, object definitions, audit logs, and more.

You can view the changes detected for individual devices and groups, and filter the results to find specific network activities according to different parameters.

For any detected change, Horizon Security Analyzer immediately aggregates the following data points:

• Device – The device where the changes happened.
• Date/Time – The exact time when the change was made.
• Changed by – Tells you which administrator performed the change.
• Summary – Lists the network assets impacted by the change.

Many devices supported by Horizon Security Analyzer are actually systems of devices that work together. You can visualize the relationships between these assets using the device tree format. This presents every device as a node in the tree, giving you an easy way to manage and view data for individual nodes, parents nodes, and global categories.

For example, Horizon Security Analyzer might discover a redundant rule copied across every firewall in your network. If its analysis shows that the rule triggers frequently, it might recommend moving to a higher node on the device tree. If it turns out the rule never triggers, it may recommend adjusting the rule or deleting it completely. If the rule doesn’t trigger because it conflicts with another firewall rule, it’s clear that some action is needed.

Importance of visualization and reporting

Open source network analysis tools typically work through a command-line interface or a very simple graphic user interface. Most of the data you can collect through these tools must be processed separately before being communicated to non-technical stakeholders. High-performance firewall analysis tools like AlgoSec Horizon Security Analyzer provide additional support for custom visualizations and reports directly through the platform.

Visualization allows non-technical stakeholders to immediately grasp the importance of optimizing firewall policies, conducting netflow analysis, and improving the organization’s security posture against emerging threats. For security leaders reporting to board members and external stakeholders, this can dramatically transform the success of security initiatives.

AlgoSec Horizon Security Analyzer includes a Visualize tab that allows users to create custom data visualizations. You can save these visualizations individually or combine them into a dashboard. Some of the data sources you can use to create visualizations include:

• Interactive searches
• Saved searches
• Other saved visualizations

Traffic analysis metrics and reports

Custom visualizations enhance reports by enabling non-technical audiences to understand complex network traffic metrics without the need for additional interpretation. Metrics like speed, bandwidth usage, packet loss, and latency provide in-depth information about the reliability and security of the network.

Analyzing these metrics allows network administrators to proactively address performance bottlenecks, network issues, and security misconfigurations. This helps the organization’s leaders understand the network’s capabilities and identify the areas that need improvement.

For example, an organization that is planning to migrate to the cloud must know whether its current network infrastructure can support that migration. The only way to guarantee this is by carefully measuring network performance and proactively mitigating security risks.

Network traffic analysis tools should do more than measure simple metrics like latency. They need to combine latency into complex performance indicators that show how much latency is occuring, and how network conditions impact those metrics. That might include measuring the variation in delay between individual data packets (jitter), Packet Delay Variation (PDV), and others.

With the right automated firewall analysis tool, these metrics can help you identify and address security vulnerabilities as well. For example, you could automate the platform to trigger alerts when certain metrics fall outside safe operating parameters.

Exploring AlgoSec’s network traffic analysis tool

AlgoSec Horizon Security Analyzer provides a wide range of operations and optimizations to security teams operating in complex environments. It enables firewall performance improvements and produces custom reports with rich visualizations demonstrating the value of its optimizations.

Some of the operations that Horizon Security Analyzer supports include:

• Device analysis and change tracking reports. Gain in-depth data on device policies, traffic, rules, and objects. It analyzes the routing table that produces a connectivity diagram illustrating changes from previous reports on every device covered.
• Traffic and routing queries. Run traffic simulations on specific devices and groups to find out how firewall rules interact in specific scenarios. Troubleshoot issues that emerge and use the data collected to prevent disruptions to real-world traffic. This allows for seamless server IP migration and security validation.
• Compliance verification and reporting. Explore the policy and change history of individual devices, groups, and global categories. Generate custom reports that meet the requirements of corporate regulatory standards like Sarbanes-Oxley, HIPAA, PCI DSS, and others.
• Rule cleanup and auditing. Identify firewall rules that are either unused, timed out, disabled, or redundant. Safely remove rules that fail to improve your security posture, improving the efficiency of your firewall devices. List unused rules, rules that don’t conform to company policy, and more. Horizon Security Analyzer can even re-order rules automatically, increasing device performance while retaining policy logic.
• User notifications and alerts. Discover when unexpected changes are made and find out how those changes were made. Monitor devices for rule changes and send emails to pre-assigned users with device analyses and reports.

Network traffic analysis for threat detection and response

By monitoring and inspecting network traffic patterns, firewall analysis tools can help security teams quickly detect and respond to threats. Layer on additional technologies like Intrusion Detection Systems (IDS), Network Detection and Response (NDR), and Threat Intelligence feeds to transform network analysis into a proactive detection and response solution.

• IDS solutions can examine packet headers, usage statistics, and protocol data flows to find out when suspicious activity is taking place. Network sensors may monitor traffic that passes through specific routers or switches, or host-based intrusion detection systems may monitor traffic from within a host on the network.
• NDR solutions use a combination of analytical techniques to identify security threats without relying on known attack signatures. They continuously monitor and analyze network traffic data to establish a baseline of normal network activity. NDR tools alert security teams when new activity deviates too far from the baseline.
• Threat intelligence feeds provide live insight on the indicators associated with emerging threats. This allows security teams to associate observed network activities with known threats as they develop in real-time. The best threat intelligence feeds filter out the huge volume of superfluous threat data that doesn’t pertain to the organization in question.

Firewall traffic analysis in specific environments

On-Premises vs. Cloud-hosted Environments

Firewall traffic analyzers exist in both on-premises and cloud-based forms. As more organizations migrate business-critical processes to the cloud, having a truly cloud-native network analysis tool is increasingly important. The best of these tools allow security teams to measure the performance of both on-premises and cloud-hosted network devices, gathering information from physical devices, software platforms, and the infrastructure that connects them.

Securing the Internet of Things

It’s also important that firewall traffic analysis tools take Internet of Things (IoT) devices in consideration. These should be grouped separately from other network assets and furnished with firewall rules that strictly segment them.

Ideally, if threat actors compromise one or more IoT devices, network segmentation won’t allow the attack to spread to other parts of the network. Conducting firewall analysis and continuously auditing firewall rules ensures that the barriers between network segments remain viable even if peripheral assets (like IoT devices) are compromised.

Microsoft Windows Environments

Organizations that rely on extensive Microsoft Windows deployments need to augment the built-in security capabilities that Windows provides. On its own, Windows does not offer the kind of in-depth security or visibility that organizations need. Firewall traffic analysis can play a major role helping IT decision-makers deploy technologies that improve the security of their Windows-based systems.

Troubleshooting and forensic analysis

Firewall analysis can provide detailed information into the causes of network problems, enabling IT professionals to respond to network issues more quickly. There are a few ways network administrators can do this:

• Analyzing firewall logs. Log data provides a wealth of information on who connects to network assets. These logs can help network administrators identify performance bottlenecks and security vulnerabilities that would otherwise go unnoticed.
• Investigating cyberattacks. When threat actors successfully breach network assets, they can leave behind valuable data. Firewall analysis can help pinpoint the vulnerabilities they exploited, providing security teams with the data they need to prevent future attacks.
• Conducting forensic analysis on known threats. Network traffic analysis can help security teams track down ransomware and malware attacks. An organization can only commit resources to closing its security gaps after a security professional maps out the killchain used by threat actors to compromise network assets.

Key integrations

Firewall analysis tools provide maximum value when integrated with other security tools into a coherent, unified platform. Security information and event management (SIEM) tools allow you to orchestrate network traffic analysis automations with machine learning-enabled workflows to enable near-instant detection and response.

Deploying SIEM capabilities in this context allows you to correlate data from different sources and draw logs from devices across every corner of the organization – including its firewalls. By integrating this data into a unified, centrally managed system, security professionals can gain real-time information on security threats as they emerge.

AlgoSec’s Horizon Security Analyzer integrates seamlessly with leading SIEM solutions, allowing security teams to monitor, share, and update firewall configurations while enriching security event data with insights gleaned from firewall logs. Horizon Security Analyzer uses a REST API to transmit and receive data from SIEM platforms, allowing organizations to program automation into their firewall workflows and manage their deployments from their SIEM.