AlgoSec Reviews

We have deployed the first brick of AlgoSec solution suite, Algosec Firewall Analyzer (AFA).

We wanted to get a live Network Mapping and to directly be able to check if a flow is allowed or not, without needing to test and then check the logs. We also need to check for compliance, baselines, and risks over our network.

This solution provides visibility and comprehension of the network in our organization. It assists us in network security reviews and audits. In the end, a lot of time, we add context and build a security matrix matching our own standards. The optimization tools are much appreciated by the network operators.

The What-if analysis allows us to check the security rating under hypothetical rules that may be implemented on our firewalls.

Baseline compliance allows you to run and check the results of commands on the Firewalls and Routers. This solution is perfect for checking compliance against best practices, as proposed by the CIS.

The user interface is better than some competitors, but it is starting to get old. Space is not always fully used, especially for the risk and compliance part. As example today, Excel file should be used to deal with network segment definition and risk matrix, it is hard to do it directly from user interface and there is no way to organize, order a set of test.

Priority should be to improve the user interface for the risk and compliance part, making it more responsive and user-friendly.

We have had no problem with stability to this point. We have High Availability and have tested it correctly. Disaster recovery mode is also available.

Scalability seems to be one of the strongest points of this solution. Worldwide architecture with remote agents, or slave master architecture. Be careful in terms of how you will deal with the log management as to not impact your network. A distributed architecture can help.

We have one ongoing ticket to solve an issue with SSO. They are working on it seriously.

We did not use another solution prior to this one.

The initial setup is long. The more knowledge you have of your network, the faster it will be.

We implemented with the help of Orange Cyberdefense.

Their expert is very good, and honest with respect to the solution's capabilities.

Licenses are provided by firewall and routers. Do not underestimate the number of routers because the price can be significantly reduced as you buy more licenses. Same if you go for more than one product (i.e. FireFlow, BusinessFlow)

Before choosing this solution we evaluated FireMon and Tufin.

The solution helps us to accurately determine rule use and where we can make improvements across our checkpoint firewall products. We had originally designed a few dozen clusters of firewalls that experience a heavy network flow with a multitude of rules, and it has been a doddle to harness the power of AFA to get the ball rolling.

AlgoSec has highlighted to us a huge number of unused rules and restored the confidence in us to remove them where appropriate. At the same time, it enables us to consolidate and enforce the point of reach prior to searching a rule base to check access for an application or user. Breaking down a rule to specify used objects within groups and protocols has proven invaluable for us because we are able to narrow exposure to potential threats, and more generally, areas in which we are exposed.

Reporting features are a godsend when it comes to executive review and monthly directorship calls.

Most of the features proved to be very useful within our massive setup, with some getting additional airtime during production changes. Our perimeter team uses the policy optimizer to search out unused objects in rules and determine when the rule was most recently hit accurately.

From my personal experience, the traffic simulator can be used to check if a request from a user or project is already a function enabled, or instead, we have an access change to implement. This saves an enormous amount of time during CAB calls.

The risk and compliance area is key to ensuring we conform to company regulation and our perimeter detection policy. Having a number of compliance options to baseline ensures that we get the basics right before looking at advanced risks and remediation.

Some UI experience is a little clunky (for e.g. MAPS module) and could be made more user-friendly.

We experienced some initial challenges with technical support, although this considerably improved once the teams got to know one another.

The API support isn't as versatile as we would like it to be. It needs more integration.

The product and appliances have been very stable.

This solution has no problem with scalability and is easily able to integrate with firewalls in their thousands.

We had some initial struggles due to communication, but once ironed out it was smooth sailing.

Straightforward initially, and versatile well into production.

We implemented this solution through our vendor.

I use this solution to have full visibility of the network, to simulate traffic queries, and to generate security reports according to the security policies of my company. We also use AlgoSec to perform audits concerning Firewalls and Network compliance.

AlgoSec AFA and AFF automate lots of things for my organization. The products are really useful for both security and network teams. It had also provided more control over the network. After Firewalls are boarded into AlgoSec, the first results appear quickly.

AlgoSec is not completely deployed inside my organization, so for the moment the most valuable features are the network map, which provides the full visibility of the network, and the security reports. The AFF module is really valuable for different teams.

The risk matrix implementation is not easy from an Excel file, so it would be nice to have a solution for creating it directly within the web interface. This would be an improvement.

This was the first solution I chose.

The price is adapted to the product's utilization for each company.

We also did a PoC with Tufin and FireMon.

The product is a very good tool to manage network traffic and devices.

AlgoSec is used on a daily basis by both our IT and IS groups to manage BAU and FW change requests. It integrates with ServiceNow, PaloAlto, and our SIEM tool. It helps to perform FW cleanup, regulations requirement, FW migration projects, etc.

AlgoSec has helped me in the last three companies that I have worked for. I was working to do Firewall migration projects, FW cleanups of risky rules (FW policy optimization), process def between IT and IS, audit, SOC reports, GRC support, and Cloud support in both native and Hybrid environments that we use. 

The features that I have found most valuable are:

• Great visibility for High-risk firewall rules
• Mapping business risks
• Mapping risky applications
• Informative regulation reports for PCI-DSS, ISO 27001 and many more
• FW cleanup recommendation
• Easy logging capabilities with leading SIEM products in both LEEF and Syslog formats

I would like to see Bi-Directional API support in order to integrate with SOAR platforms that provide SOC automation and IRR.

Integration with CISO dashboards would be an improvement.

It would be nice to have support for IaaS, CASB, and DLP tools, which will allow full life cycle management of security incidents.

It would be nice to have an out of the box "best practices recommendation" with the relevant "what-ifs". 

This solution scaled to our entire enterprise in a seamless way.

We also used Tufin, but AlgoSec provided us better visibility and ease of use.

My advice is that you must do a POC and show value.

We did not evaluate options other than AlgoSec and Tufin.

We use it to find unused objects and rule cleanup. However, we also found a use case by letting developers read access so they can see rules and open ports so they can request firewall changes as needed. This opened up time for our firewall engineers because they did not have to answer questions anymore to developers. 

By letting developers access AlgoSec, we cut down the questions and time we had to spend explaining what ports are open and where. They can now see in one panel. Since there are multiple firewall vendors, they can see what rules apply where using one tool.

I think finding the firewall's rules with the highest risk is valuable. In the old days, we had to run reports and look through rule bases trying to find risky rules and that can also lead to human error. Now we see it via AlgoSec. It also helps because we see those risks across multiple vendors. 

I would like to see more object-based reports on groups and object usage. When cleaning up old rules, it is easy to disable the rule and then delete after a while. Trying to find unused groups or used objects in groups gets a little harder and I would like to see an easier view into those objects. 

We have never had an issue with its stability.

This product does scale very well and we never had a problem with performance.

Whenever we did have a question on setup or changes, the tech support was very willing to work with us even on basic questions. 

We have used Tufin which does a good job looking at groups and objects but AlgoSec adds more of a risk approach to it. 

It was very easy to setup and easy to get firewalls working with the manager. 

We were able to set it up in-house without any help. That is how easy it was.

Our ROI was seen very quickly since we gave developers the option to look at rules. IT opened up so much time where our firewall engineers had to deal with questions and explanations. 

I would start with only a few firewalls and then grow. You can get your feet wet and add more firewalls in next year's budget. 

We evaluated Tufin. 

The solution is pretty solid and intuitive.

Our company has a very large technical estate, with over 90,000 staff and 80,000 computing devices, it was imperative that we found a firewall security management tool that allowed us to speed up the process of change requests when it comes to our firewall IPS team, as they were becoming overwhelmed with the volume of requests.

AlgoSec has improved our organization in terms of improving efficiency within our firewall setup. It has added automation to working process that has helped us achieve our initial goal of reacting faster to incoming requests, which as a result of allows the relevant teams time to focus on other areas of importance.

The best feature for us is the ability to automate the change requests that come through our service desk, which is done via the tool's intelligence to analyze the conditional rules. As previously mentioned, this used to be a big time sink for the guys which is now less of an issue. This means that the company can claim back valuable man-hours for other means (also showing a labour cost saving to the board).

For the most part, this AlgoSec tool does meet our needs. If I was to think of any improvements I think the main one that stands out to me is confidence in future proofing. A good example is that we are looking at various SOAR which we'd like it to be fully compatible with (but not entirely convinced it is yet). Lastly, I have also heard a few qualms about the technical support and that it could be improved. However, this doesn't detract from the value the tool brings to our business.

The automation and orchestration of security-related change requests on our selected firewall (in our case Checkpoint) to decrease the time it takes to raise, manipulate, and execute change requests. This is all done with minimal interaction from our Firewall and IPS team, allowing them to more effectively use their time.

It has eased the process of streamlining our firewall configuration management considerably. Our firewall and IPS team now has the ability to budget their time and focus on other tasks, rather than dealing with repetitive change request functions. This has enabled the team to work much more efficiently and effectively.

The feature we found most useful is the automation of the change process within our organization for firewalls. This feature has reduced the number of mundane tasks the firewall and IPS team undertake on a regular basis. We have been able to increase the effectiveness of the team, allowing them to prioritize more complex and business-critical tasks in a faster manner.

In terms of integrations, we would like to see a greater number with the upcoming and next-generation tools (i.e. SOAR and a selection of other SIEMs). This has been a problem for us, as we are going through the process of enhancing our security and some of the products we are looking at are lacking built-in support (integration). 

It is currently used by the network security, audit, and internal control departments of organizations where I have deployed the application. It gives overall insight/visibility and enhances security across the enterprise.

Our company environment used old fashioned firewall devices for a long time and we hardly touched on old firewall rules. With this product, we were able to clean up our firewall rules and organize them neatly. It actually gave us a very straightforward report of what is being used, and not used, for firewall rules. 

AlgSec is used for in-depth firewall analysis and intelligent policy tuning and optimization. It helps in regulatory compliance metrics and overall firewall security optimization.

I like the auto-mapping features and configuration overview. We use this for many things, but primarily for quick reactions to security events, audit, project management, and quick operational efficiencies.

• Firewall rule optimization
• Regulatory and baseline compliance analysis/mapping
• Policy tuning
• Application discovery
• Automated Change management

The reporting portion is weaker than other competitors, although this is good enough to utilize in our environments.

Enhanced integration via API (typically, this is only known by few AlgoSec users).

The user interface could be a little more user-friendly. Other competitors have more of a dashboard look and feel. With AlgoSec, you have to launch new windows to see rule usage reports. It can be a little bit difficult when trying to find more information.

Our company was using old fashioned firewall devices.

We did POC on FireMon and AlgoSec. We chose AlgoSec for our company environment.

Our primary use case for this solution is FW analysis and compliance.

We have hundreds of FWs to manage and check. It is normal that similar rules, and perhaps not so good ones, can be set up. AlgoSec helps to make our network security better and improves our internal customer relationships by using FireFlow.

AlgoSec helps us to manage hundreds of FWs and take care of policy compliance.

The most valuable features are the FW report, traffic simulation, and the FireFlow system to help manage requests.

We have a complaint about the compliance check, in that sometimes we want to keep rules rather than merge them.

This is a stable solution.

I believe that it could be better, and make sure different scenarios are possible.

The customer support is very good. They really show that they want to make the product better, and take care of the customer's needs.

We did not use a previous solution.

The initial setup is straightforward. The complexity sometimes comes from the fact that the company scenario is not so easy.

We implemented the solution internally with support from AlgoSec.

We did evaluate other options, but I am not sure of the reasons for choosing this one because it was a management decision.

We use AlgoSec to provide compliance and for the ease of automating everyday security tasks. We have more than five hundred firewalls and automation is a must. This was the best product in terms of the flexibility and visibility that we needed to manage them across different regions. We can modify policy according to our maintenance schedule and time zones.

AlgoSec has reduced the need for additional manpower and we can now use the time to tackle other security-related issues. For incident response, you can automatically isolate compromised servers from the network.

It helps remove rules with limited impact on other applications. By maintaining a clean security policy, it reduces the risk from the most common attacks and also improves performance.

AlgoSec has also helped increase collaboration between departments. It helps our network department to reduce third-party involvement in policy creation and management.

So far, we are using AlgoSec Analyzer and FireFlow. The Analyzer is more for compliance, risk, and auditing. FireFlow is more for automating rule changes and installation.

Right now I am loving FireFlow for its easy to use interface. You can also get as complex as you are comfortable with. You can add email, scripts, and hooks to certain aspects of the rule creation process.

AlgoSec now has cloud products that they are rolling out. This is the next space for which everyone is dedicating more resources. We would like to see them utilize the cloud to help with performance improvement, and with various processes needed on a daily basis. We have two remote agents that help with daily processing and would like to integrate more power from the cloud to be as flexible as possible.