What are the emerging trends and challenges in firewall security?

From a strictly pro-cloud perspective, the main advantage of cloud-based firewalls is the increased scalability and flexibility. Cloud-based firewalls make it much easier to manage multiple networks and devices, as they can be configured quickly and easily. Another benefit is that they provide a higher level of security as they are hosted in secure data centers and are regularly updated with the latest patches and security measures. Additionally, they can be used to detect and block potential threats, such as malicious traffic, before they enter the network.

I would say zero trust has moved past "emerging" and is thankfully becoming "established". Regardless of your company size, zero trust represents one of the most versatile forms of protection, and should be on the to-do list of all companies. In a previous life I was in marketing for a cybersecurity company. I had the privilege of watching how quickly and effectively zero trust could be used in all types of network, from local to remote. From laptop to life support machine. Zero trust is one of the most flexible, frictionless, and intelligent forms of protection and has no limitations. With incredible leaps in AI and ML, I see zero trust absolutely becoming the most significant form of cybersecurity.

Zero Trust Architecture (ZTA) is a cybersecurity framework that was developed in 2010 by Forrester Research and codified in the US government by Executive Order (EO) 14028. The goal of ZTA is to create a secure network environment where all users, devices, networks, and applications are considered untrusted unless proven otherwise. The framework is based on two principles: least privilege access and continuous verification. The former means that users and devices should only have access to the data and resources they need, while the latter ensures that users and devices are constantly being verified by the system in order to maintain a secure network environment.

AI and ML can be used to enhance firewalls by improving their accuracy in detecting and blocking malicious traffic and anomalous behavior. AI and ML can also be used to identify new threats more quickly and accurately, as well as to automate firewall rules and configuration tasks. Additionally, AI-enabled firewalls can provide useful context-based insights into network behavior to help security professionals respond to threats more effectively = faster and more accurate decision-making, improved automation, better customer service, improved security, reduced costs, etc....

Effective AI-powered firewalls will require integration with identity management systems, governance policies, expert reporting and analysis tools and more. There will be plenty of room for humans to tune their configuration. Bad actors will soon be (likely are already) using AI to penetrate networks and systems... without AI on the defending side as well, organizations will struggle. The challenge, as with all security, will be trust. If you apply zero trust to your AI firewall, it's going to need to overcome a high bar to convince CISOs and their teams that the AI is better than well-trained humans at securing their organizations.

Firewall access policies themselves need to be audited regularly as well. Many compliance standards require that access must have business justification and authorized by management. This is based on the concept of "deny everything that is not explicitly allowed". Most modern firewalls allow "notes" or "comments" on a per-rule basis. I highly recommend putting the ticket number in this field that shows WHY the rule was needed, WHO authorized the rule, WHO configured and applied the rule, and WHEN it was applied. Auditors like to see this level of self-documenting process.

Firewalls should be only managed by trained admins, and all configurations should be documented, business justified, validated, and regularly reviewed if any changes are still required to be in use.

I disagree. Working in cybersecurity requires prioritizing and applying resources to the right parts of your environment to control your greatest risks. Focusing on creating "firewall training" for users doesn't seem like a great use of those resources. Training users on higher-priority security topics (like how multifactor authentication protects their user identities or how to avoid social engineering/phishing) should take priority. Your administrators/engineers, on the other hand, need to understand what firewalls you are using, how they are configured, and what they are meant to protect. But not necessarily your users.

Effective cybersecurity is proactive. In today's world, firewalls should be effortless and require no training for staff or users.

Regardless of the firewall technology being deployed, without proper governance in place it will eventually become a nightmare and a less efficient, if not vulnerable, control to rely on. A proper intake process to create rules must be in place, which including vetting and documentation of the business case, assessment of the request by network security team (e.g. "allow all" is a "no no"), and clear identification of the owner. Without that it will be virtually impossible to manage it overtime, specially in complex organizations. Technology will definetely helps, but it is just part of the puzzle.

Firewalls have one job, but hold several roles. These roles are determined by where they reside physically, where they reside in the network, what layer of the OSI model they operate on, etc... There are competing philosophies regarding firewall roles. I subscribe to the philosophy that you should try to limit the number of roles any specific firewall (or redundancy) has. While this will simplify each individual firewall configuration, it may be at the cost of needing additional firewalls. Personally I prefer more numerous, simple configurations over fewer complex (and sometimes confusing and contradictory) configurations.