Each of our depots has a small firewall, and each firewall has two parts that are paid for separately. The hardware routes traffic and never expires. The subscription provides web filtering, intrusion signatures and malware scanning, and it runs for a fixed term from the date each box was bought.
In August, during an unrelated fault, an engineer noticed that the firewall at one of our northern depots had not downloaded a signature update since March. Its subscription had ended. The box had carried on routing traffic perfectly, with nothing filtered and nothing inspected, and it had raised no alert, because from the device's point of view nothing had gone wrong. It had simply stopped doing half of its job.
We checked the rest. Fourteen of our thirty eight firewalls were running without a current subscription, some for over a year. The renewal dates were spread across every month of the calendar, because the boxes had been bought one site at a time as depots opened. Renewal notices went to the email address of whoever had placed each original order, and four of those people had left.
Our monitoring asked the question it had been built to ask: is the firewall up? It had been up throughout. The protection we thought we had at those sites was a line in a contract that had quietly reached its end date, and a device that was still running gave us every reason to believe otherwise.
All subscriptions are now co-termed to a single renewal date in April, which cost about six thousand pounds in pro rata charges and removed thirty seven separate renewals from the year. The renewal sits in the budget as one line with one owner. Every firewall reports the age of its signatures to our monitoring, and anything more than three days old is an alert, whatever the reason. Licence status is held against each device in our asset register, and the supplier's portal sends notices to a team mailbox instead of to a person.
A firewall without its subscription does not fail. It keeps working, and that is what made the gap so easy to miss.
We had been measuring whether our security equipment was running. What we needed to know was whether it was still doing the thing we had bought it for.
– Serguey Shinder
Top comments (0)