Most small businesses think of the firewall as the thing that protects them. It is. It's also one of the most attractive targets on your network.
Firewalls, VPN gateways, Wi-Fi controllers and SD-WAN boxes sit on the edge of your network, face the internet all day, and usually hold the keys to everything behind them. And they're often configured once, then left alone for years.
Late October, in Three Headlines
| What happened | Why it matters |
|---|---|
| CISA added an Arista VeloCloud Orchestrator flaw (CVSS 9.9) and a Collabora Online flaw (used in Nextcloud) to its Known Exploited Vulnerabilities list | Actively exploited |
| HPE patched 72 flaws in Aruba AOS-8 and AOS-10, eight of them maximum severity, including unauthenticated remote code execution | Patch available, no known exploitation yet |
| Researchers reported 70,000+ credentials exposed from breached Fortinet and Palo Alto firewalls and VPNs, using known flaws and brute-forcing | Credentials already out |
Different vendors, same story. None of these are exotic attacks. They're known holes in devices that didn't get patched, and management pages that were reachable from the internet.
Your laptops get patched automatically. Your firewall usually doesn't. Firmware updates on edge devices often need a maintenance window and a reboot, so they get put off — and attackers count on that.
A Simple Edge-Device Routine
Keep a list of every edge device
Firewalls, VPNs, Wi-Fi controllers, SD-WAN, remote-access appliances, NAS boxes reachable from outside. Make, model, firmware version, who manages it.
Subscribe to vendor advisories
Fortinet, Palo Alto, SonicWall, Ubiquiti, Aruba and the rest all publish security advisories. Someone should be reading them — and checking CISA's exploited-vulnerabilities list.
Patch on a schedule, and fast-track the critical ones
A monthly maintenance window for routine updates. Anything on CISA's list gets patched within days, not at the next window.
Never expose management interfaces to the internet
The admin page of your firewall should only be reachable from inside your network or a dedicated management connection. This one change blocks a huge share of attacks.
MFA on every VPN account
Brute-forcing only works when a password is all it takes. Remove old VPN accounts while you're at it.
Replace end-of-life hardware
If the vendor no longer ships firmware for it, it's a liability, not a firewall.
If You Run Fortinet or Palo Alto
Check that your firmware is current, look at VPN logs for repeated failed logins, and consider resetting VPN and admin passwords if your device was ever exposed while unpatched. Credentials stolen months ago still work if nobody changed them.
Patch status changes quickly, so check your vendor's current advisory before you act on anything above.
Free Edge-Device Review
We'll inventory your firewalls, VPNs and Wi-Fi gear, check firmware against current advisories, and make sure no management page is sitting on the open internet.
DM us "FORTI" on LinkedIn or schedule a free consultation · (646) 791-2137