The hardest thing about teaching IT (and Cyber Security) is keeping up with the speed at which technology changes. When long-held beliefs are only held for 5 to 10 years (or less), it’s hard to determine what should be taught. This was brought to my attention last week in an article from Dark Reading, Why the firewall is becoming irrelevant. The author, Asaf Cidon, makes two good points regarding the possible irrelevance of firewalls:
- Data resides on company servers and unsecured employee devices. The BYOD revolution, and the use of cloud-based software such as Dropbox to store data, has made it easy for employees to do work from the office by syncing company data to their mobile devices. The problem, of course, is that a firewall can’t protect data once it’s left the secured company server.
- Consequently, as he points out, that data ends up everywhere – with employees, suppliers, partners, clients, etc., and it’s likely that none of them are securing your data. How can a firewall protect that data?
From an academic point-of-view, is that this is rather disturbing. Our second Cyber Security course at Armstrong is entitled Network Security: Firewalls and VPNs. Is it reasonable to be teaching our students firewall concepts and practices if they’re “irrelevant?”
I would like to think that’s not the case – companies still place their data on corporate servers that must be protected. And, in a “point-counterpoint” kind of article, Firewalls sustain foundation of sound security, author Jody Brazil makes the point that firewalls are still a valuable tool in securing the enterprise. As he states:
While paradigms including mobility, virtualization and the cloud have created a new set of challenges (along with opportunities) to invoke additional security controls, the resulting distribution and hyper-segmentation of networks has in fact only made effective firewall management more important than ever before.
His defense of firewalls stands on three points:
- Firewall dependencies are expanding, not contracting. 95% of 700+ respondents to the 2014 FireMon State of the Firewall Report indicated that the use of effective firewalls are more important to protecting their security management.
- Firewalls provide an effective and important means of securing virtualized network environments
- “Firewalls are one of the few security technologies with a positive whitelist security model – allowing only necessary network traffic while denying the rest –the best defense against evolving threats.”
I read Dark Reading daily, and when I read the first article, my initial thought was “oh no, we’ve devised and implemented a curriculum that’s already obsolete.” Then I read the second, and felt somewhat vindicated. We still need to teach our students the basic components of an effective, layered defense of systems and networks. What we have to do going forward is recognize that IT is always changing, and that while we continue to teach the basics, we embrace the future, and ensure that our students understand how change is affecting the way we defend our information systems.