Lack of network firewall visibility causing Australian IT managers to fly blind

Network firewalls may be overrated and underperforming – particularly as Australian IT managers can't identify 41% of their organisation's network traffic.

As part of a global study called The Dirty Secrets of Network Firewalls, security firm Sophos found that nearly one in four IT managers across the globe can't identify 70% of their network traffic.

The lack of visibility into traffic is a blow to organisations' cybersecurity defences, and 87% of Australian respondents (84% globally) realise that that lack of application visibility is a serious security concern.

IT managers are blind to unknown malware, data breaches, ransomware, rogue users and malicious applications because they can't see what's running on their network, Sophos says.

50% of Australian IT managers say productivity is a concern relating to a lack of network visibility. Sophos says that if IT is unable to prioritise bandwidth for critical applications, it can have a negative impact on business productivity.

Accountability, legal liability and compliance, and return on investment were also cited as concerns.

"If you can't see everything on your network, you can't ever be confident that your organisation is protected from threats. IT professionals have been 'flying blind' for too long and cybercriminals take advantage of this," adds Sophos senior vice president and general manager of products, Dan Schiappa.

"With governments worldwide introducing stiffer penalties for data breach and loss, knowing who and what is on your network is becoming increasingly important. This dirty secret can't be ignored any longer.

The report suggests that Australian organisations take an average of seven hours to identify, isolate, and remediate infected machines within their networks, which may be as many as 12 machines per month.

Globally, 99% of respondents want firewall technology that can automatically isolate infected computers.

Schiappa says that a single network breach can compromise many computers and it's important to stop the spread of infection to limit damage.

 "Sophisticated exploits such as MimiKatz and EternalBlue reminded everyone that network protection is critical to endpoint security and vice versa. Only direct intelligence sharing between these two can reveal the true nature of who and what is operating on your network," he explains.

48% of Australian IT managers say that their firewall couldn't identify traffic coming from custom applications.

Sophos says lack of visibility also creates a blind spot for potential transfer of 'illegal or inappropriate content' that is hosted on corporate networks, which makes organisations privy to litigation and compliance issues.

"Organisations need a firewall that protects their investment in business-critical and custom applications by allowing employees to have prioritised access to the applications they need," Schiappa notes.

"Increasing network visibility requires a radically different approach. By enabling the firewall to receive information directly from the endpoint security, it can now positively identify all applications – even obscure or custom applications," he concludes.

The study polled more than 2,700 IT decision makers from mid-sized businesses in 10 countries including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India, and South Africa.