The firewall market has always been full of options, with a number of vendors each offering a variety of models. This is truer today than ever, with cybersecurity companies now developing firewalls for the cloud — for example, the Microsoft Azure Firewall and the SonicWall NSv.

If you’re curious about the differences between the two, you’re not alone. To help shed some light, we’ve put together a short guide on which product is best in which situation, and why you’d pick one over the other.

Microsoft Azure Firewall

Before Azure Firewall, there were Azure Network Security Groups (NSG). NSGs are often auto-generated when deploying a new compute resource. NSGs serve the same purpose as access lists on routers and switches, but they directly pre-empt critical resources. Unlike old style access lists, NSGs are stateful filters: for convenience, rules only have to be written in the client-to-server direction. NSGs offer similar features to firewalls of the late 90s, sufficient for basic packet filtering.

The Azure Firewall itself is primarily a stateful packet filter. Packet filters, regardless of whether they’re stateful or stateless, have no visibility into the actual data stream that is transported over the network. They have become much less effective, as virtually everything on the Internet uses port 80 (HTTP) and 443 (HTTPS) today. They also miss application identification and decoding.

With the introduction of Azure Firewall, Microsoft appeared to monetize on NSGs, but added only a small bit of new functionality — for example, rudimentary application-layer rules and Network Address Translation (NAT). Application-layer rules in Azure Firewall can ONLY filter web traffic by URL name by looking into the application layer’s HTML header, and for encrypted traffic by doing a reverse name lookup.

This is, by firewall standards, less than a percent of what a NGFW like the SonicWall NSv can do. Deep packet inspection is one of the core requirements for getting visibility to encrypted data. TLS 1.3 is partially supported on Azure Firewall. The TLS tunnel from client to the firewall is based on TLS 1.2.

The user can enable intrusion prevention services, but Microsoft does not provide many details on this service. Microsoft neither reveals the number of signatures supported, nor discloses how often these signatures are updated. There is no sandbox or in-memory analysis of zero-day threats.

Moreover, Network Address Translations normally allow for the mapping of any part of source/destination IP and source/destination ports. Azure natively supports the one-to-one mapping of private IPs to public IPs. Beyond that, Azure Firewall only adds the mapping of destination ports, which has very limited use in reality because most services run over port 80 and 443 and do not accept different ports. Other NAT combinations are often used to merge networks of trade partners, but corporate acquisitions are not supported.

Managing and reporting tend to be problematic in the Azure Firewall. NSGs can generate traffic logs, but you need a third party to review them. This is mostly useful for debugging. Azure Firewall has a monitoring resource, but it only gives you an overview — meaning it’s not useful for audits or troubleshooting.

Managing Azure Firewall is very similar to managing NSG and must be done via typical Azure settings management. Once you set it, you cannot change it.

You may be used to the quirks of Azure user interface, but imagine using it to manage a large rulebase with groups, nested objects and the need to periodically clean it up while you grow it — for example, changing the names of objects. This is close to impossible with Azure Firewall. Plus, Azure Policy does not offer any structured policy elements, such as object-based rule creation or nested objects.

SonicWall NSv Series Virtual Firewall

SonicWall’s NSv Series virtual firewall provides all the security advantages of a physical firewall with the operational and economic benefits of virtualization — including system scalability and agility, speed of system provisioning, simple management and cost reduction.

Modern firewalls such as the NSv Series, also known as next-generation firewalls (NGFWs), offer application-layer filtering on top of stateful socket filtering. Instead of just filtering out some traffic going to TCP ports 80 or 443 — the two ports utilized by almost all internet traffic — you can filter on the actual traffic flowing over these ports and distinguish between legitimate traffic and malware.

NSv delivers full-featured security tools to shield all critical components of the private/public cloud environments from resource misuse attacks, cross-virtual-machine attacks, side-channel attacks, and common network-based exploits and threats. With infrastructure support for reliable distributed clustering and scaling, the SonicWall NSv Series ensures system resiliency, operational uptime, service delivery and availability, and conformance to regulatory requirements.

NSv is available for VMware ESXi, and also runs for lab use on VMware Workstation and VMware Fusion, Hyper-V, KVM, AWS and Azure. You will find the same features on the virtual and cloud versions as you find on the appliances, including Deep Packet Inspection (DPI) and Gateway Anti-Virus (GAV), with real-time cloud support and our award-winning, patented RTDMI™ in-memory scanner, which captures dormant malware and zero-day threats. NSv is rated by the independent NetSecOPEN as one of the most effective next-generation firewalls on the market.

In addition, the SonicWall NSv Series offers three major features that take NGFWs into the 21st century. SonicWall NSv has the ability to intercept, decode, inspect and reencode encrypted traffic so that an intruder cannot evade the firewall altogether (DPI-SSL). It also features the ability not just to classify known traffic into good or malicious, but also to detonate and test unknown traffic in real-time in a safe sandbox environment (Capture ATP). Finally, with RTDMI, it has the ability to analyze malicious software that lays undetected and dormant until some trigger activates it.

These three features cover a large percentage of today’s malware — malware for which traditional signature-based filters such as the Azure Firewall are not effective.

NSv can also terminate VPN tunnels, either to a physical office, vendor or work-from-home employee, or within the cloud. In addition, NSv is a fully functional security router. Besides standard dynamic routing protocols, it also offers smart routing according to traffic content and congestion.

As far as reporting and analytics, NSv is the clear winner. In addition of a clean and easy to operate WebUI, SonicWall NSv offers highly scalable rule management, monitoring and analytics via cloud-based SonicWall NSM, managing hundreds or thousands of instances.

In short, Azure Firewall offers the sort of functionality you can find on a $100, big-box-purchased broadband router. It offers none of the many features that you find on an enterprise firewall — and for that matter, not a lot of valuable functionality over free NSGs.

Do yourself a favor: Save your organization some money and look at an actual cloud-based firewall. If you are familiar with managing enterprise firewalls, the SonicWall NSv is an instinctive choice for a cloud firewall.

Emotet began as a banking trojan in 2014 — but from this inauspicious start, it grew to become “the world’s most dangerous malware” according to Europol, and one of the Cybersecurity and Infrastructure Security Agency’s “most prevalent ongoing threats.”

The botnet earned its reputation in a number of ways.

• It was strikingly common. By 2021, Emotet was involved in one-third of malware attacks.
• It was resilient. The botnet was capable of spreading laterally once it had gotten access to just a small number of devices in a network.
• It was targeted. One Emotet module collected a portion of each email in a victim’s inbox, enabling highly targeted phishing attempts capable of replying to and quoting legitimate emails.
• It was automated. Once it gained control of a device, it distributed itself to the user’s contacts and attempted to brute force its way onto any other devices connected over the same network.

And in many cases, it was just the beginning. In the SonicWall 2021 Cyber Threat Report, we detailed the meteoric rise of Ryuk ransomware. While Ryuk is certainly formidable in its own right (see rapid growth in graph below), a key to its swift success was the leg up it received in the form of Emotet. Emotet was offered for hire to Ryuk operators, who used access already established by Emotet to deploy the ransomware upon networks of those deemed valuable targets.

To compare it to crime in the physical space, consider a group of burglars with plans to rob a bank. What would be easier: finding a way to break in themselves, or hiring someone on the inside to simply leave a door open?

The End of Emotet

But in the end, it was Emotet’s success and versatility that led to its downfall. In response to the rampant proliferation of the botnet, law-enforcement agencies from at least eight different countries formed a multinational organization with the goal of disrupting it and taking it down.

In January 2021, law enforcement and judicial authorities succeeded in gaining control of the servers used by Emotet. Then, they replaced the Emotet malware on these servers with a harmless file created by law enforcement. By preventing new devices from downloading the malware, the spread of Emotet to additional targets was halted.

While this disruption will likely prevent a number of infections — some costing more than a million dollars to mitigate — in the short term, the long-term impact remains much less clear.

As Fernando Ruiz, Europol’s European Cybercrime Centre head of operations, told ZDNet, “We expect it will have an impact because we’re removing one of the main droppers in the market. For sure there will be a gap that other criminals will try to fill, but for a bit of time, this will have a positive impact on cybersecurity.”

History Repeating

It’s possible that, in a best-case scenario, this disruption will eliminate Emotet for good, and have a long-term positive effect on the amount of malware going forward.

For an idea of how a worst-case scenario might play out, however, we only have to look back about six months — to none other than the rumored Emotet heir apparent, Trickbot.

Since its development in late 2016, the operators of Trickbot have successfully infected over a million devices globally. As with Emotet, there are a variety of factors that contribute to make Trickbot an oversized threat, including its ever-evolving modular capabilities, ability to infect IoT devices and its proficiency at stealing information.

But it was Trickbot’s potential to deploy ransomware or DDoS attacks in advance of the 2020 U.S. presidential election that presented the most pressing danger.

Hoping to prevent a large-scale disturbance in the democratic process, Microsoft obtained a court order allowing it to shut down Trickbot’s operations. In a joint effort with global telecommunications companies, Microsoft was able to disable Trickbot’s infrastructure, taking down new servers that Trickbot was attempting to use as replacements almost as soon as they went online. The actual operation itself took less than a week, and by October 18, 2020, the vast majority of Trickbot’s critical infrastructure had been disabled.

While the takedown was a success in terms of preventing election tampering, this respite wasn’t long-lived: By the time the U.S. Electoral College held its confirmation vote in December, Trickbot was already showing signs of a resurgence. A new version was spotted that included upgraded means of evading detection, along with other features. And in January, ZDNet reported a malware campaign that “has the hallmarks of previous Trickbot activity.”

Will Emotet take a similar path and come roaring back to life? We don’t know yet, but with so much money to be made, it certainly isn’t out of the realm of possibility.

In the meantime, the takedown of Emotet in early 2021 seems to be fueling the ongoing resurgence in Trickbot, which is rising to fill the void left behind.

Until both are gone for good, the best protection against botnets like Emotet and Trickbot is a sound and proven security posture, frequent software and firmware updates, and comprehensive cybersecurity awareness. The latter includes everyday vigilance and adherence to best practices, along with staying up to date on current trends in cybercrime.

For more on Ryuk, Emotet and other malware, download the 2021 SonicWall Cyber Threat Report.

Know The Threats. Know Your Exposure.

Download the complete 2021 SonicWall Cyber Threat Report to find out how 2020 changed cybercrime forever — and what you need to do to stay ahead of the latest threats in 2021 and beyond.

READ IT NOW