2015 - Troy Roberts

### Overview In this presentation titled "Building a Security Strategy: Perimeter to Core Firewall Is No Longer Enough," Troy Roberts from Fortinet addresses the evolving threat landscape and explains why perimeter firewalls alone cannot protect modern organizations. Comparing perimeter-only security to medieval castles whose moats and drawbridges were rendered obsolete by archers and siege engines, Roberts illustrates how flat networks remain highly vulnerable to breaches, ransomware, and denial-of-service attacks. Drawing on data from the Ponemon Institute (commissioned by IBM), he outlines the steep financial and operational costs of security incidents, highlighting real-world examples primarily from the education sector. Roberts then presents a comprehensive, multi-layered framework encompassing next-generation firewalls (NGFW), unified threat management (UTM), internal network segmentation, strong authentication, secure wired and wireless access media, and comprehensive endpoint integrity.

### Key Topics - **The True Cost of Data Breaches:** Ponemon Institute research shows breaches in education cost roughly $300 per compromised record. Roberts reviews incidents such as the University of Maryland ($92 million estimated cost) and Indiana University ($43.8 million), alongside K-12 disruptions involving ransomware (Swedesboro-Woolwich), DDoS attacks (West Ada, New Brunswick, and a $17 DDoS attack ordered via ipstressor.com in Columbus School District), and credential/phishing attacks (Denver Public Schools). He notes insurance policies rarely cover the full financial fallout or indirect costs like lost goodwill. - **Next-Generation Firewalls and Internal Segmentation:** Modern NGFW and UTM platforms consolidate standalone capabilities—such as application control, deep packet inspection (DPI), IPS, antivirus, and web filtering—into single appliances powered by purpose-built ASICs (network and content processors). Beyond the perimeter, internal segmentation firewalls are necessary to isolate departments (e.g., finance) and stop lateral movement across flat networks. - **Robust Authentication:** Relying solely on DHCP and Active Directory is insufficient. Roberts emphasizes two-factor authentication (2FA) for critical IT infrastructure appliances, 802.1X certificate-based authentication, and automated onboarding/self-registration for BYOD devices. - **Securing Wireless and Switching Infrastructure:** With wireless devices surpassing wired switch ports in 2015, access media security is critical. Roberts analyzes controller-based versus cloud-managed wireless architectures, highlighting firewall-managed switches and access points that can automatically profile connected devices into appropriate VLANs, enforce quotas or time-of-day access, and correlate security events to isolate compromised devices directly at the switch port. - **Endpoint Integrity and Off-Network Visibility:** Organizations must deploy unified endpoint clients capable of vulnerability scanning, VPN access, and compliance enforcement. Endpoint tools must enforce web filtering and inspection policies even when devices go off-network, while offering centralized logging and automated file sandboxing for unknown files.

### Technical Details - **Hardware Acceleration:** Legacy firewalls relied on general CPUs; modern UTM/NGFW appliances integrate specialized ASICs, separating network processors for traffic throughput and content processors for intensive DPI, antivirus, and IPS inspection. - **Access Control & Granular Policies:** Incorporates IP reputation, geofencing (blocking traffic from specific regions like North Korea, Russia, or Iran), time-of-day shutoffs for wireless, and sub-application control (e.g., allowing Facebook browsing while blocking posting or games; setting bandwidth or time quotas on streaming services). - **Automated Remediation:** When a host connects to an external command-and-control server, integration between the firewall and managed switch enables the firewall to instruct the switch port to shut down or shift the endpoint to a quarantine VLAN with a captive portal remediation notice. - **Endpoint Sandboxing:** Unknown downloads on endpoints that bypass traditional signatures, IP reputation, or geofencing are automatically routed to a cloud or on-premises sandbox for execution in a virtual image before execution is permitted.

### Takeaways Defenders cannot rely on a single border appliance or assume insurance will absorb the damages of a breach. A resilient security strategy requires an end-to-end framework spanning the perimeter, internal segmentation, multi-factor authentication, intelligent LAN/WLAN access layers, and off-network endpoint visibility and sandboxing.