Tufin tool automates firewall switch-on

Israeli security outfit Tufin has added an automatic policy generator (APG) to its SecureTrack firewall analysis system. The new feature lets admins plan firewall deployments based on the traffic actually passing across their networks.

According to Tufin, the problem with new firewalls is that they have the potential to cause problems in ways that are almost impossible to predict. Using the APG it is possible to monitor traffic to reverse engineer security policies based on the applications and network protocols actually being used, allowing security personnel to switch on new gateways with a baseline of data to guide them.

"They [admins] know for sure that their phone is going to ring almost immediately," said Tufin's Shaul Efraim of the average firewall deployment "It's a business continuity issue."

The APG automated the hardest bit of using a firewall, which was the first few hours and days after it had been turned on, he said. "It allows you to put a firewall in place with the minimum of disruption."

"Well defined firewall rules lower the risk of creating holes in network security, eliminate many of the business disruption issues that can accompany firewall deployments, and reduce the number of costly support calls. Automation ensures that firewall rule bases act on the intelligence discovered from actual observed business traffic," said analyst Eric Ogren, principal analyst of the Ogren Group, on the announcement.

The company has also announced version 5.0 of its Tufin Security Suite (TSS), which features an architecture sophisticated enough to work out the effect of relatively small changes - the opening of a VPN being the example used by Efraim - to see whether they would cause security problems, break policies elsewhere in a business, or compromise compliance.

Efraim characterised this as a "secure change workflow".

In April, Tufin turned its software into an open source platform in an effort to get third party network hardware companies to integrate with its products. Despite being a relatively small name in a niche market, Tufin has always lived on its engineering-driven reputation - almost all the founders and senior personnel, including Efraim, arrived from another Israeli security company, Check Point.