Non-profit CyberRatings.org completed an independent test of eight security vendors in its first cloud network firewall comparative evaluation. Forcepoint, Fortinet, Juniper, and Versa Networks’ achieved the highest ‘AAA’ rating, while Cisco fell short with a ‘CC’.

The test covered capabilities considered “essential” in a firewall including basic routing, access control, SSL/TLS decryption, threat prevention (exploits), evasion, performance, stability and reliability, and management. Ratings also took into account pricing, and can be found in the chart below.

CEO Vikram Phatak said CyberRatings.org chose to conduct the industry’s first-ever comparative evaluation report for cloud network firewalls because “it's something that, finally, everybody was ready for.”

“I think the first big takeaway would be that the cloud firewall market, in general, now is one that enterprises can rely upon, which is something that's a new development,” Phatak told SDxCentral.

To achieve its ‘AAA’ rating, the CyberRatings.org results noted that Versa’s product, for example, blocked 35 out of 35 evasion techniques and 977 out of 977 exploits.

Palo Alto Networks was also tested and received an ‘AA,’ while Sophos secured an ‘A’.

TLS 1.3 cipher suites in particular account for about 68% of internet traffic, according to Phatak, who said the main reason for Cisco’s low rating is that its firewall doesn’t cover these suites.

Phatak added that the vendor’s 7.2 version that CyberRatings.org tested has a checkbox to enable TLS 1.3, but the “checkbox doesn't work.”

“There's nothing in the logs to tell you that it failed. And the only reason we knew is we tested and we saw with a key negotiation what was happening,” he explained. “They've got a problem with TLS 1.3. It fails, and it fails silently.”

Cisco's device still provides “roughly 96% protection,” and while Phatak said that number “is not bad,” he added the lack of support for TLS 1.3 cipher suites is "a huge problem."

Phatak said that security vendors have overcome a lot of inconsistencies and problems with the cloud products of the past. But vendors are used to controlling the platform on which their products are installed, and without that control in the cloud, they are still learning how to operate under these new conditions.

Hyperscalers like Amazon Web Services (AWS) and Microsoft have a shared security model. “They'll take care of the underlying infrastructure and networking in the cloud, but securing the applications is the responsibility of the tenant,” Phatak said.

CyberRatings.org data showed supply Chain attacks are on the rise, and using the cloud means relying on third parties to maintain software supply chain integrity. APIs, code reuse, open-source libraries, not maintained code, and other shared resources introduce unknown risks, according to the organization.

“What we're finding is a lot of folks don't really understand that Amazon provides a basic firewall, but it doesn't provide any of the threat protection services. It's just access control, basically,” Phatak said. “And the general rule, I think that people should apply as if they would have a firewall or next-gen firewall in their network, in their data center, nine times out of 10 you need the same thing in the cloud.”

SDxCentral reached out to Cisco for a comment but the company had not yet responded by the time of publication.