SPEAKER_00 0:08

Welcome to the Technology Translator. I'm Vic. Every episode we break down technology, cybersecurity, and AI into plain English for Australian business leaders. Welcome to the podcast. G'day, g'day, and welcome back to another episode of the Technology Translator. Last episode, we talked about networking. And I did admit, networking is one of those areas of technology that I've personally had to spend a bit of time wrapping my own head around. Talked about Wi-Fi, routers, switches, LANs and WANs. And we finally also answered my question as to why LAN parties were apparently such a nerdy thing to do, besides the fact that you actually had people walking out of their house with their full computer in hand back in the day. Ultimately, though, we realized that networking is just all about communication. It's about connecting things together and allowing information to travel from one place to another. Your laptop with the internet, your phone with the Wi-Fi, your computer with the printer. Everything is talking to everything. Which sounds great. Except do we actually want everything talking to everything? Because if my laptop can communicate with computers and services all over the world, surely we don't want every computer in the world to have the same ability to communicate back with my laptop whenever it feels like it. And that brings us very nicely to something that I briefly mentioned at the end of last episode and promised we'd come back to firewalls. So today we're actually going to talk about what a firewall is, what we're allowing in and out of our networks, and how this has changed as businesses have moved more and more of their technology to the cloud. And importantly, we're also going to talk about what a firewall does not do. Because having a firewall does not mean that your business is magically secure. But we'll get to that. So what actually is a firewall? When I first heard the word firewall, I genuinely pictured exactly what the name suggests: a great big brick wall, possibly one side on fire, the other side not, sitting between your computer and all the horrible things on the internet. Good stuff on one side, bad internet stuff on the other. And while that technically isn't what's happening, as a starting point, it's actually not the worst way to think about it. A firewall is essentially a security control that monitors network traffic and decides what is allowed in and what is allowed to not come in. And that's the bit I really want you to remember. Allow or block. Something wants to communicate, the firewall looks at that communication against the rules that's been given and makes a decision. Yep, you're allowed through, or nope, you're not. And that can apply to traffic coming into your network, but it can also apply to traffic going out of your network. So let's use a simple example. I'm sitting at my laptop, I open my web browser and go to a website. My computer has initiated communication out to the internet because I have asked for something. That's outbound traffic. Information is also going to come back because otherwise I'd be staring at a completely blank browser. That's inbound traffic. But compare that with some random computer somewhere on the internet deciding, hello Victoria's laptop, I'd quite like to connect directly to you. Uh no thanks. There was no reason for that communication. I didn't ask for it. And depending how everything is configured, our firewall and other network controls can prevent that connection from being made. Now, there are a lot of technical things happening underneath that explanation. IP addresses, ports, protocols, packets, different types of traffic, different firewall technologies, and we're not going to go there. Because unless you're actually configuring a firewall, you don't really need to know about it in order to understand the business concepts. The important thing to understand is simply there is traffic moving around our network, and we need rules determining what we are going to allow and what we're going to block. And this brings us to a concept that you will hear across cybersecurity all the time: default allow versus default deny. And this one's actually nice and simple. Imagine I'm having a party at my house. One approach could be everyone can come in unless you're specifically on my list of people who aren't allowed. And that's essentially default allow. You're allowed unless I've got a reason to keep you out. The other approach is nobody's coming into this house unless you're specifically on my guest list. And that's default deny. You're blocked unless I've explicitly decided that you are allowed. From a security perspective, default denying gives you significantly more control because we're not assuming everything is trustworthy until we discover otherwise. We're saying prove there is a reason this should be allowed. And now I do want to make a distinction here because you'll hear the phrase default deny used in other areas of cybersecurity as well. And it doesn't always mean the same thing. For example, there's something called application control, where they do use a similar philosophy, but it's all about uh softwares that are allowed to be used or executed on an endpoint. This is very different because what we're talking about here is network communication. And I think that's an important distinction because cybersecurity does love reusing terminology, and they expect that everyone just somehow understands what version of it we're actually talking about. Now I'm sure at some point I can already imagine someone listening to this thinking, okay, this sounds great if you're a big company with servers and IT people and a giant office full of equipment. But I'm just a small business. I've got a laptop, I've got Wi-Fi, everything I use is in the cloud. Do I actually need a firewall? And this is where I think the conversation gets more interesting. So if I decide to build a company tomorrow, I go down to JB Hi-Fi, buy a laptop, take it home, connect it to my Wi-Fi, start setting everything up. I create Microsoft 365 for my email and documents. Maybe I use Xero for accounting, HubSpot for my CRM, Canva for marketing, maybe a bit of cloud storage there. I've got Chat GPT, whatever my particular combination of applications happens to be. But I don't have a server, I don't have a server room, don't even have an office, I definitely don't have an IT department. So where is my firewall? Well, you actually probably have more protection than you realize. Firstly, modern operating systems have their own software firewalls. If you're using a Windows laptop, for example, Windows includes Microsoft Defender firewall. The firewall operates on the device itself. Then you've got the network that you're connected to. If you're sitting at home, you've probably got a router or modem router connecting to your home internet to the internet. So your home network to the internet. And that device is also doing a range of things that can help separate the devices inside of your home network from everything sitting out on the public internet. And then we get to all those cloud apps. Microsoft isn't running 365 on a computer under your desk. Those providers have their own enormous technology environments within their own networks, firewalls, security controls, monitoring, and infrastructure. So starting a business or being a small business does not necessarily mean you need to go and immediately buy an expensive enterprise firewall and stick it next to your modem. But it also doesn't mean that everything's in the cloud, so security isn't something I have to worry about. Because what we've actually done is change where the responsibility sits. Your laptop still needs to be secured, still needs updates. The firewall on it still needs to be enabled and configured appropriately. Your Wi-Fi still needs to be secure. Your router still needs to be secure. Your accounts need to be protected. You need MFA, and you need to think about who has access to what. What happens when you hire an employee or five or fifty? What happens when you've got people working from everywhere accessing dozens of different cloud applications with hundreds of devices trying to communicate every single day? So let's just say we've grown. We're now sitting a few hundred employees, we've got a lot going on. We've got people working from offices, home, we've got people traveling, laptops, phones, printers, iPads. We've got Microsoft 365, there's our CRM, accounting software, whole bunch of other cloud applications that different parts of the business actually use. And potentially we've even got applications that the IT team doesn't even know about. Someone in marketing signs up for a new AI tool. Someone in finance finds a handy website that converts PDFs into Excel spreadsheets. Who knows? And suddenly the simple picture we started with, my network, firewall, internet, really can't describe our business anymore. Because people aren't sitting behind one firewall in one building. Our technology isn't sitting inside that building either. It's actually everywhere. So the job of controlling what's allowed in and out has become considerably more complicated. Firewalls have, however, become a lot smarter. Older firewalls were based much more focused on basic network information. Where is this traffic coming from? Where is it going? What type of connection is it? Is it using something we've allowed? Yep, okay, there you go. You can go through. Modern firewalls can understand a lot more context. They may be able to identify the application generating the traffic. They can potentially understand what users are involved. They can inspect traffic for known threats. They can block certain categories of websites. They can identify suspicious behavior, and they can make much more sophisticated decisions about what should and shouldn't be allowed. And this is where you may hear the term next generation firewall. Which does sound incredibly futuristic until you realize we've actually been calling them next generation firewalls for quite a long time now. And when someone's talking about a next gen firewall, they're talking about something that goes beyond that basic, where are you coming from? What door are you using? Okay, you're actually allowed through. It's looking at more information and making more intelligent decisions about that traffic. And this does matter because threats have changed too. If I'm an attacker, I don't necessarily need to dramatically smash through a front door of your network anymore. I might be able to convince one of your employees to let me in. I might steal someone's login details. And I might hide malicious activity inside traffic that otherwise looks relatively normal. I might compromise a legitimate website. Or I might target one of the many cloud applications that your employees use every single day. So our security controls have had to become better at understanding what is actually happening rather than simply whether a connection technically meets a rule. And this is where we do actually come back to cloud because we have talked about this throughout the last few episodes. Businesses have progressively moved away from having everything physically sitting inside their own offices, and they have moved into the cloud. And now we've also got an enormous number of AI applications being thrown into the mix as well, which creates an interesting security problem. Imagine I've got an employee working from home. They're on their laptop, they open their browser, log into 365, then Hubspot Zero, Canva, Chat GPT. They're not necessarily sending all that traffic through one physical firewall sitting in an office. So how do we actually apply security controls when the applications and the people using them are both outside the traditional company network? And this is where you start hearing a whole new collection of cybersecurity acronyms, and one of those is CASB, Cloud Access Security Broker, which is another excellent example of the technology industry taking a relatively understandable concept and giving it a name that makes it sound very, very complicated. At a high level, a CASB helps organizations apply security policies to how people access and use cloud services. So it asks, which cloud applications are people using? Are they approved? Is someone uploading company information from somewhere they shouldn't? Are people downloading information to devices that they shouldn't be? Are there applications being used across the organization that IT don't even know existed? Because this happens a lot. And there's the term for it, shadow IT, which is essentially where the business is having applications and technology used without the appropriate people necessarily knowing about it or approving it. So do we still need firewalls? Absolutely. The firewall hasn't disappeared, just the environment around it has changed. There's still networks that need protecting, especially in the operational technology space. And there's still devices communicating with each other. And there's still cloud environments where network traffic needs to be controlled. But the idea of that we can put one giant firewall in and officially declare, excellent, our cybersecurity is sorted, definitely does not work anymore. We do not need a moat around our one little fortress because our fortress is has turned into a city and a wider city and essentially a whole country without sort of us having too much control over what happens in every element of it. So a firewall is a security control, but it's not necessarily your whole cybersecurity strategy. So let's talk about what a firewall doesn't do. If we invest in a firewall, we've configured it properly, we've got sensible rules, and we've got modern security features switched on. Say one of our employees gets an email, it looks like it's from Microsoft, says their password is about to expire, they click the link, they enter their credentials in, and they've just handed them directly to an attacker. What exactly was our firewall supposed to do about that? Maybe someone receives an MFA notification. They won't try and log in, but they're busy, they're distracted, and so they just press approve to make it go away. Again, the firewall hasn't failed. It's just that a person has authorized the attacker. Same sort of idea. If someone uses the same password across five different services and one of those services is actually breached. Someone downloads something malicious. Someone shares confidential information with an AI tool that they shouldn't be using. Say someone leaves the company and still has access to an application no one remembered they actually had. Someone gets a phone call from a person claiming to be from IT and then gives them information they shouldn't. None of those things mean a firewall is useless. It just means that we're asking, or that we've got additional problems that a firewall was not ever designed to solve. So this is something I think businesses really need to understand about cybersecurity. There is definitely not one product that you can buy that makes you secure. There isn't one firewall, one antivirus product, one Microsoft license, one particular company, one piece of AI. There needs to be layers, different controls to manage different risks. And eventually, every single one of those layers comes up against perhaps the most unpredictable component in the entire technology environment. Us. People. Because here's the thing. Over the last few episodes, we've spent a lot of time talking about technology. Talked about servers, clouds, networks, firewalls. We've been essentially building out the technology environment underneath a modern business. But every single piece of technology we've talked about ultimately exists for one main reason. A person needs to use it. And people are complicated. We forget things, we click things, we get distracted, we do reuse passwords, we find shortcuts, we trust to other people. We get frustrated when technology makes our jobs harder. And if the approved tool takes 20 minutes to do something and an unapproved tool takes 30 seconds, well, you can guess which one we're going to end up using. And that's where technology gets really interesting. Because sometimes the biggest security problem isn't that someone has done something stupid. It's just that we've designed a system that makes doing the right thing unnecessarily difficult. So next episode, we're going to move away from the boxes, the networks, and the cloud platforms for a moment, and we're going to talk about the most important and definitely the most unpredictable component in any technology environment. People. Why do people second vent technology? Why do we click on stuff when we've been told a thousand times not to? Why did we create Shadow IT? And why after spending millions of dollars on technology can one completely normal human decision still cause an enormous problem? But that's next time on the Technology Translator because technology might run the business, but people still have to use it. I'll chat to you next episode. Speak then. Thanks for joining the episode. If you do want to follow me on Instagram at all, you can find me under the Technology Translator. If you would like to email me, Vic at the Technology Translator.au And I guess I wouldn't be doing this properly if I didn't say, if you like what you hear, hit the follow button. There will be more of these episodes coming up.