Challenge
A manufacturer with several sites had firewalls that were managed one at a time. Their logs were difficult to read, so in practice nobody read them.
Administrators shared a login. When a setting changed, there was no way to tell who had changed it or why.
Approach
When the firewalls were due for replacement, we used the change to put security management on a sounder footing.
- Replace the firewalls with gateways managed from one console.
- Keep the equipment's software current, with the ability to roll an update back.
- Require two-factor sign-in for every administrator.
- Move administrators to individual accounts, with every change logged.
- Review policy and intrusion logs each working day.
Result
The company can answer three questions it could not answer before: how the firewalls are updated, who can sign in, and who is watching.
- One place to manage firewalls and wireless at every site.
- A record of every change and who made it.
- Suspicious activity seen the day it happens.
Our advice
A firewall nobody reviews is a locked door nobody checks. Choose equipment whose logs a person can actually read.
Related service: IT security & penetration testing.