Support: 0330 332 7933 Sales: 0808 500 1436

Next-generation firewall (NGFW) vs. traditional firewall


Next-generation firewall (NGFW) vs. traditional firewall: How they differ

The purpose of any business firewall is to protect the network against intruders and to safeguard systems and data.

But not all firewalls are created equal. They all share the same basic goal, but specific features, capabilities and levels of sophistication can vary enormously.

The two most basic categories for enterprise-level firewalls are traditional and next-generation. Next-generation firewalls (NGFWs) are, as you might expect, the more advanced of the two types, offering the most robust protection for business networks.

But what are the differences between traditional and NGFWs, and how do they benefit your business?

Before we get into the finer details, it’s important to clarify that next-generation firewalling is not a new concept, despite what its name suggests. It is, however, the most advanced form of firewall that is currently available – and therefore the most recent.

The features of a traditional firewall

A traditional firewall is designed to police the flow of traffic that goes in and out of a network, based on port, protocol, source address and destination address.

When we talk about ‘traditional’ firewall features, we’re essentially talking about the functions that preceded NGFWs – functions such as:

  • Packet filtering, which ensures that incoming and outgoing packets are inspected before they are allowed to pass through. Packets that match the filter’s set of rules are forwarded; packets that do not are dropped.
  • Stateless inspection or stateful inspection, which refers to the way in which packets are inspected (more about that below).
  • Virtual private network (VPN) support, to keep the private network secure when users traverse public networks such as the internet.

Stateless or stateful?

Stateless inspection means that the firewall can only check each packet individually, and is unable to discern its wider context. Many traditional firewalls only operate on a stateless (or ‘state-unaware’) level.

The more sophisticated traditional firewalls have stateful inspection capability, which means that they can identify the operating state of packets that are trying to enter the network. In other words, they are ‘state-aware’ and can distinguish between the safe, the potentially unsafe and the outright malicious.

NGFWs, as we’ll cover further down, go one step further than standard stateful inspection.

The features of a next-generation firewall

NGFWs have many of the traditional firewall’s common functions – plus several more. In plain terms, NGFWs have more layers of security built into them, to protect against more sophisticated threats. Crucially, they go beyond the static inspection that traditional firewalls are limited to, instead having application-level control.

Application awareness

Application awareness enables an organisation to view packets through proper context, and set application-specific rules.

Intrusion prevention system (IPS)

An extension of the intrusion detection system (IDS), IPSs have the capability to actively block intrusions once detected – dropping malicious packets, and logging the IP addresses and blacklisting all future traffic from them.

Deep packet inspection (DPI)

Whereas standard packet filtering only reads the header of a packet, DPI ensures thorough inspection of the packet’s contents, including its source, which means that the NGFW is able to see the full context of each packet.

Don't be left vulnerable by outdated security technology

Modern businesses need modern protection. The cyber threat landscape is forever expanding along with innovations in technology, which unfortunately means that cyber criminals are far from finished. If anything, their job is getting easier.

It’s also essential not to fall foul of the common misconception that cloud-enabled businesses are automatically protected using their cloud-native security tools. That is not the case, the chosen cloud environment itself may be well-protected, but every organisation has a wider infrastructure – which may have its weak-spots, such as unsecured devices.

With it’s more sophisticated features for detecting and protecting against threats, next-generation firewalling is currently the most effective solution to enterprise cyber security in the cloud age.

Touch Secure: featuring NGFW

Touch Secure is our managed, cloud-based NGFW service, providing multiple levels of security for your network.

As a fully managed service, we take the burden of responsibility away from your in-house resource, enabling your staff to concentrate on the important day-to-day work that keeps your business running.

Find out more about Touch Secure.

Up next

Which cyber security threats are most feared by UK businesses?

Our new report, the Cloud Security Maturity Index, investigates the extent to which UK businesses are adapting (or not) to cyber security in the cloud age. During our research, we surveyed 100 IT decision-makers from organisations across a diverse range of sectors, including professional services, finance, manufacturing, IT and transport.

As you might expect, the attitudes towards cyber security and the concerns of IT leaders varied greatly between sectors, but the fear of specific cyber threats was present across all of them.

Here are the three security threats that cloud-enabled UK businesses currently fear the most, and what to do to protect against them:

1) Phishing scams

Two-thirds of IT decision-makers are worried about their staff being duped by phishing emails. The two sectors most worried about this are financial services and IT, closely followed by business and professional services.

When you see the attention to detail that the more serious phishing attackers attempt, it’s easy to see why this is such a widespread worry. Scammers pose as real (well-known) companies, often with convincing email copy written in flawless English, and an email design that’s indistinguishable from the real thing.

To spot phishy emails, you need a sharp eye and up-to-date knowledge of cyber fraud trends. Here are some key things that all of your staff should be looking out for:

  • The sender’s email address. If it doesn’t look kosher, it won’t be.
  • Requests for login details, passwords and other sensitive data. Email is not the channel to ask for this sort of information – and no genuine company will do it.
  • Alarmist language. A reputable company will not write to you in a way that is designed to make you panic.
  • Poor English. This is unfortunately not as prevalent as it once was, but it’s still a clear giveaway. Misspelled words, missed-out apostrophes, uncapitalised names, a lack of punctuation, the list goes on.
  • Unexpected attachments. Unless you’re actively expecting an attachment from the sender (or the perceived sender) in question, you shouldn’t be receiving one. Attackers often send innocent-looking files that contain malware such as viruses and trojans.

2) Malware

Speak of the devil, malware is the second-biggest fear among IT decision-makers, with 52% citing it as a serious worry.

Financial services organisations are the most concerned about malware infection (65% of them), followed by IT and manufacturing companies (60% each).

Of course, nobody intentionally encounters malware. It comes invisibly (at first, anyway) via phishing emails, compromised or outdated software, pop-ups, infected removable drives such as USB sticks and hard-drives, and so on.

To keep your organisation protected, you’ll need to take two steps:

  • First, invest in cyber security that includes next-generation firewalling and threat detection at the very least.
  • Second, ensure that your employees are educated – and regularly re-educated – on the various types of malware and the means through which they are spread.

3) Lack of threat awareness among staff

Although not a direct or malicious threat, a lack of staff knowledge on cyber security threats is troubling 54% of the IT decision-makers we surveyed.

It’s a recurring theme, but staff education and vigilance are crucial to keeping your network secure. If your users are aware of the various threat vectors and are trained to take precautions, they will be less susceptible to at least some of the smaller-scale attacks that cyber criminals try.

But internal knowledge only goes so far. To be properly protected against the ever-expanding threat landscape, you need to have future-proof cyber security in place, from a provider that proactively monitors your network and acts on your behalf.

The Cloud Security Maturity Index

UK businesses are in the middle of a mass migration to the cloud. They are saying goodbye to physical, on-premise IT infrastructure and saying hello to a new, infrastructure-free world of convenience and scalability.

However, the burden of responsibility for cyber security doesn’t die with physical infrastructure. If anything, moving to the cloud – and thereby becoming more connected and mobile as an organisation – opens you up to even more threats.

We’ve developed the Cloud Security Maturity Index to gauge the extent to which UK businesses are coping with cloud security challenges. Download the report for full insight on attitudes, concerns, vulnerabilities and more – and then see how your organisation compares.