Cloud applications, such as Salesforce and Microsoft Office 365, were designed to be accessed directly via the internet. Therefore, internet traffic must be routed locally to deliver a fast user experience. Routing traffic back to NGFWs in corporate data centers to egress to the internet no longer makes sense.

However, traditional security for local internet breakouts means organizations would need to replicate the corporate security stack at every location. This requires deploying NGFWs or stacks of security appliances in every branch office, an option that is simply not viable in terms of the cost and complexity of deploying and managing them all.

In addition, NGFWs were never designed to support cloud applications. NGFWs are easily overwhelmed by cloud apps, because they cannot scale to support the high volume of long-lived connections the apps create. They also cannot natively handle SSL-encrypted traffic. This has become increasingly important with the exponential growth in encrypted traffic during the past several years. To execute SSL inspection, NGFWs must bolt-on proxy capabilities that execute SSL inspection in software, rather than at the chip level. This has a significant impact upon performance, and results in a negative user experience.

Better in the cloud

The next-generation firewalls (NGFWs) in use today were architected more than a decade ago. But, providing security and access controls for the cloud-first enterprise requires dynamic capabilities that NGFWs were not designed to deliver.

As organizations embrace a cloud-first approach, they still need to deliver enterprise firewall capabilities across their local internet breakouts. Unfortunately NGFWs are not designed to support cloud applications, and their virtual firewall counterparts leave you with many of the same limitations and challenges as traditional NGFW appliances. It makes sense that as applications are moving to the cloud, your firewalls move to the cloud as well.

A cloud-based firewall provides multiple benefits over appliance-based NGFWs, including:

• Proxy-based architecture - This design dynamically inspects traffic for all users, applications, devices, and locations. It natively inspects SSL/TLS traffic—at scale—to detect malware hidden in encrypted traffic. And, it enables granular firewall policies spanning multiple layers based on network app, cloud app, domain name (FQDN), and URL. A proxy-based architecture is required to stop today's advanced threats.
• Cloud IPS - A cloud-based intrusion prevention system (IPS) delivers always-on threat protection and coverage, regardless of connection type or location. It inspects all user traffic on and off network, even hard-to-inspect SSL traffic, to restore full visibility into user, app, and internet connections.
• DNS security and control - As the first line of defense, a cloud firewall protects users from reaching malicious domains. It optimizes DNS resolution to provide a better user experience and cloud application performance, which is especially critical for CDN-based apps. And, it provides granular controls to detect and prevent DNS tunneling.
• Visibility and simplified management - A cloud-based firewall delivers real-time visibility, control, and immediate policy enforcement across the platform. It logs every session in detail, and uses advanced analytics to correlate events and provide insight into threats and vulnerabilities for all users, applications, and locations from a single console.