Product review: Tufin's Tufin SecureTrack 4.1

FIREWALL MANAGEMENT

This article can also be found in the Premium Editorial Download: Information Security magazine: Security Readers' Choice Awards 2008:

FIREWALL MANAGEMENT


Tufin SecureTrack 4.1
REVIEWED BY BRAD CAUSEY

Tufin
Price: Starts at $10,000 for base appliance and software

Enterprise firewall management is a headache. An ever-growing labyrinth of access control lists, complex change management over geographically distributed organizations, plus audit and compliance requirements make it tough to bring under control. SecureTrack 4.1, a comprehensive firewall operations management solution, helps cut the job down to size, especially for Check Point Software Technologies firewalls.


Configuration/Management B-  
SecureTrack is available as a software package or an appliance. For our evaluation, we utilized the software version that runs on either CentOS version 4 or Red Hat version 4.

The Web-based GUI is intuitive, and where possible, the rules interface strives to give the look and feel of each type of firewall. For example, it mimics the Check Point interface when viewing and managing firewalls from a SmartCenter NG system, which is nice, but we'd like the ability to switch to a standardized view of rules across all platforms. You can use SecureTrack to manage Check Point, Cisco PIX and Juniper firewalls, but, in the current version, most of the key features are limited or nonexistent for the latter two.

A straightforward wizard is used to add a firewall to the system. SecureTrack passively pulls down the configuration and status of each firewall. You can view the rules and policy information side-by-side, so reviewing changes and other pertinent information is easy.

Policy Control B  
Although you can view firewall policies within Secure-Track, you have to use the respective Check Point, Cisco and Juniper native firewall interfaces to make changes or update configurations. We'd like to see a tool that can analyze and actively manage multiple types of firewalls for heterogeneous environments.

You'll spend most of your time in the Compare and Analysis interfaces. The Compare view allows you to see current rules, objects and global properties, offering a side-by-side comparison of current and previous versions. This is also where you can browse and drill down into firewall objects and properties, including any changes made. The revisions component is useful and allows you to view changes incrementally.

The Analyze tab allows you to make simple and effective queries, providing quick insight into any rule set. When you use the comparison and analysis tabs together, you can find conflicting and high-risk rules. Overlapping rules or gaps in rule sets between firewalls can lead to an unpredictable or insecure configuration. This risk assessment capability goes a long way toward helping you mitigate these issues.


Reporting B  
SecureTrack has a number of features that provide value beyond simple reports, especially the ability to have reports emailed on a set schedule. Reports are fully customizable and include rule usage, rules and policy changes, and even node-specific object changes such as user membership, and OS modifications. Rule usage shows what firewall rules are triggered most, revealing unused or unnecessary rules.

These reports can be filtered by date, firewall, or nearly any other specific criteria. In addition to the canned reports, compliance and regulatory reports can be defined manually with custom policies that identify problem rules.

On the downside, the rule usage feature is currently not available for Cisco and Juniper firewalls.


Verdict
Tufin has done a very good job of creating a centralized management solution, primarily for Check Point firewalls deployed in distributed environments. It should have broader application with enhanced Cisco and Juniper support, planned for the next release.



Testing methodology: Our lab included a single instance of SecureTrack on Red Hat, two Check Point firewalls and one Cisco firewall. Rules were imported from production environments.

This was first published in April 2008
This Content Component encountered an error

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close