What I learned at Tufin’s customer conference (Tufinnovate)

Last week, I attended Tufin’s annual customer conference, Tufinnovate, in Boston. If you don’t know Tufin, the company focuses on network security policy management for enterprise organizations.

Here are a few of my take-aways from the event:

1. It’s all about operational efficiency. Despite industry banter about artificial intelligence (AI) and process automation, many large organizations still rely on people power to get most tasks done. This creates a serious bottleneck when tasks like network provisioning or firewall audits take weeks to accomplish. This is where tools like Tufin come into play. One customer talked about reducing network provisioning time from days to minutes, while another used Tufin as an alternative to hiring three full-time employees. Yes, some cautious organizations continue to slow-roll the transition from humans to machines, but every organization wants to do things better, faster, and cheaper. Tufin and others are at the tip of this spear.
2. Think abstraction layers, connectors, and APIs. I recently wrote about the need for centralized network security policy management for hybrid cloud deployments. This is increasingly where Tufin lives. Vendors that play in this space must become leaders in three areas: Abstraction layers, connectors, and APIs. Abstraction layers provide the ability for centralized command and control over heterogeneous infrastructure and security tools. Connectors give customers fully baked and tested integration to common security technologies, while APIs accelerate development for custom configurations. 
3. Firewall consolidation is well underway. Large organizations tend to have a mixed portfolio of network firewalls from vendors such as Check Point, Cisco, Fortinet, and Palo Alto Networks. This situation is changing, however, as enterprises winnow down to one or two vendors. Oh, and more often than not, they choose vendors that can support their firewall needs in corporate data centers AND pubic cloud services. Tufin customers use its products to manage firewall migration, configure/monitor network segmentation, and audit firewall rule sets.
4. DevOps is attractive but remains immature. Just about every large organization I spoke with was actively embracing a DevOps model, but most were still in the “toe-dipping” stage. How were they proceeding? A few told me that they assigned a security team member to the development team and told them to figure things out. That’s not very sophisticated, but it is a step in the right direction. Ultimately, the goal is to inject security controls within the CI/CD pipeline. Organizations are getting there, albeit slowly. 

Overall, Tufin plays in an area that isn’t always understood, so many organizations don’t assign budget for network security policy management. While I understand where this behavior came from, it seems like a legacy mindset to me. Given where the business and IT are going, organizations with large complex networks, dozens of firewall clusters, and expanding cloud presence really should be looking at products from Tufin and others to improve security efficacy, operational efficiency, and business enablement.

Many thanks to Tufin for hosting me at Tufinnovate.