Managed firewall or run it yourself? A decision-making aid

July 20, 2023

The firewall - an established component in company networks since the 1990s. Since then, the firewall has regulated communication into and out of a network. In the meantime, many functionalities have been added with "next-gen" firewalls and supplement the core benefits.

However, this also brings with it a new level of complexity and increased effort in researching the provider and product portfolio. The correct configuration and administration of firewalls is a key element and should only be carried out by specialised personnel. This poses a crucial question for many companies:

Operate it themselves or outsource it?

Because models such as Firewall as a Service(FWaaS) or Managed Firewall Security Services (part of MSSP) have been around for some time. Is this the right decision for everyone? Hardly. Therefore, fundamental considerations should be made as to whether a Managed Security Service Provider (MSSP) is the right solution.

The key question is: As a company, do I have the necessary resources available or do I have the budget to hire these resources? If neither is possible, you should consider the possibility of outsourcing.

We recommend considering the following points:

Flexibility and scalability
Costs / benefits
Control and customisation
Network architecture

Depending on the nature of the corporate strategy, e.g. expansion or similar. expansion or similar, future changes can already be included in the planning. In addition to these considerations, a risk analysis should also be carried out. After all, outsourcing firewall operations is a sensitive decision.

Possible risk factors:

Risk of misconfiguration due to lack of expertise
Insufficient monitoring or patch management
Vulnerabilities and exploits
Insufficient rule management
Insufficient logging
Single point of failure

In the end, the decision between FWaaS, using an MSSP and managing firewalls yourself depends on your organisation's specific requirements. If you sit down together, here's a possible agenda:

How can we provide resources and expertise?
Are we able to react to business changes with the setup?
What influence do our compliance regulations have?
What does the current network architecture look like?
What SLAs would we like to see?
Cost-benefit analysis
Service provider research

For more details, a white paper is also available below.

Managed firewall or operate it yourself? A decision-making aid