Source
Who or what initiates the communication.
NETWORK SECURITY & FIREWALL
Connecting is necessary. Controlling every communication is security.
Corporate networks connect users, applications, branches, data centers, cloud, partners, and the Internet. Every connection the business needs must also have the appropriate context, policy, and protection.
Add Solution designs, implements, and evolves network security architectures by combining next-generation firewalls, segmentation, application control, threat prevention, secure access, and visibility to protect environments without turning security into an obstacle to operations.
USERSAPPSCLOUD
POLICY / IDENTITY
SEGMENTINSPECTPROTECTLOG
ENGENHARIA APLICADA
Controlar comunicações exige contexto, política e visibilidade.
Projetamos firewalls e segmentação a partir dos fluxos necessários, reduzindo exposição sem criar regras que a operação não consegue sustentar.
Arquitetura, execução e operação tratadas como partes da mesma responsabilidade.
SECURITY STARTS WITH COMMUNICATION
Before blocking traffic, we need to understand why it exists.
Source, destination, user, application, service, criticality, need, and risk need to give meaning to the flow.
Identity
User, group, or device when available.
Application
The service actually being used.
Policy
Conditions and controls applied.
Destination
A resource required by the business.
An open port indicates that traffic can pass. A well-built policy explains why it should pass.
NEXT-GENERATION FIREWALL
A firewall is no longer just about source, destination, and port.
Modern capabilities expand context and control. Policy determines how that capability protects the business, without turning the page into a feature catalog.
01Stateful inspectionConnection state and context.
02Application controlApplication visibility and control.
03IPSInspection and prevention based on identified patterns.
04URL filteringPolicies for web categories and destinations.
05Threat protectionComplementary threat protection mechanisms.
06Identity & VPNAccess context and secure connectivity.
SEGMENTATION
Not everything that is connected needs to communicate with everything else.
Users, servers, applications, IoT, OT when applicable, guests, administrative environments, production, development, data center, and cloud may require their own zones and policies.
Segmentation reduces exposure, limits reach, controls flows, increases visibility, and separates trust zones — without eliminating every risk of lateral movement.
A flat network turns connectivity into reach.Corporate Networks Industrial Networks
More rules do not mean more security.
Least privilege, business need, source, destination, service, application, identity, ownership, review, and lifecycle need to justify permissions.
The goal is not to have thousands of rules. It is to be able to justify the ones that exist.
Prevention requires context, updates, and tuning.
Inspection mechanisms can identify certain patterns, exploits, and malicious behaviors. Policies, updates, tuning, and monitoring are necessary; absolute protection does not exist.
The port does not always reveal which application is generating the traffic.
When supported by the platform, application-based visibility can combine user, risk, policy, and context for more consistent controls.
Encryption protects content. It can also reduce visibility.
TLS/SSL inspection needs to balance security, privacy, certificates, compatibility, performance, exceptions, and legal and organizational requirements. Universal decryption is not a strategy.
Creating the tunnel provides connectivity. Controlling what passes through it provides security.
Site-to-site, remote access, IPsec, SSL VPN, or equivalents require authentication, MFA when available, segmentation, and policies aligned with the context.
PAM & Identity SecuritySecurity needs to keep pace with distributed infrastructure.
Headquarters, branches, data centers, cloud, and the Internet combine connectivity and protection in flows that cross different domains.
SD-WAN & ConnectivityThe perimeter does not exist only between the company and the Internet.
When relevant, north-south and east-west flows connect servers, applications, zones, published services, and administrative environments.
Data Center Servers & StorageWhen infrastructure becomes distributed, the perimeter changes as well.
On-premises, cloud, branches, remote users, and published services require consistent segmentation, routing, policies, identity, visibility, and connectivity.
CloudA security appliance can also become a single point of failure.
HA, links, interfaces, upstream, downstream, synchronization when supported, and other dependencies need to be part of the architecture.
Two firewalls create device redundancy. Availability depends on the architecture around them.
The control layer itself needs to be protected.
Administrative interfaces, protocols, services, credentials, MFA when applicable, profiles, logs, updates, and management exposure need to be reviewed.
PAM & Identity SecurityFIREWALL POLICY REVIEW
Should a policy that made sense three years ago still exist today?
Rules, objects, services, NAT, VPNs, interfaces, zones, logs, broad permissions, duplicates, obsolete elements, and documentation make up the assessment.
Discover
Rules, objects, NAT, VPNs, interfaces, and zones.
Analyse
Usage, breadth, duplication, and dependencies.
Classify
Criticality, ownership, and need.
Correct
Reduce exposure and remove obsolete elements.
Validate
Confirm communication and intent.
Document
Document rationales and lifecycle.
Migration is not configuration conversion. It is the preservation of security intent.
Inventory, interfaces, routes, NAT, VPNs, objects, policies, services, dependencies, HA, logging, validation, and rollback guide modernization, replacement, or consolidation.
The syntax may change. The policy's intent must remain understood.
Not every access problem is a firewall problem. Not every firewall problem looks like one.
Logs, sessions, routing, NAT, policies, VPN, DNS, application, and connectivity need to be analyzed as layers.
CLIENT → DNS → ROUTE → POLICY → NAT → SERVICE → APPLICATION
Diagnosis starts with evidence, not by disabling controls.
A policy without visibility is difficult to validate and investigate.
Traffic, threats, VPN, administration, events, and changes can feed monitoring and SIEM when applicable.
SIEM & SOC AI & Observability Command CenterAn IP address can gain user, group, device, and application context.
When supported by the architecture, identity extends policies beyond addresses. Integration is not universal and needs to be validated.
PAM & Identity SecurityZero Trust is not a product installed at the perimeter.
Never trust, always verify, least privilege, identity, context, segmentation, verification, and visibility form an architectural approach. A firewall can be an enforcement mechanism.
The policy needs to keep pace with changes in the environment.
New applications, users, branches, cloud, VPNs, threats, changes, updates, reviews, and monitoring keep controls relevant.
Services & Operations Command CenterADD SOLUTION METHOD
From the need to communicate to continuously relevant control.
More than 15 years of experience connecting infrastructure, networking, security, and critical environments without losing sight of availability and operations.
- 01
Understand
Business, applications, and risks.
- 02
Map
Flows, assets, and dependencies.
- 03
Segment
Define zones and boundaries.
- 04
Define
Build consistent policies.
- 05
Implement
Apply controls.
- 06
Validate
Confirm communication and protection.
- 07
Observe
Monitor events and behavior.
- 08
Review
Eliminate unnecessary rules and exposures.
- 09
Evolve
Adapt security to changes.
TECHNOLOGIES & PRODUCTS
Here, we deliver network security engineering.
Vendors and platforms belong on the Technologies & Products pages. Architecture starts with business flows, risks, and objectives.
Cybersecurity TechnologiesPERGUNTAS FREQUENTES
Decisões importantes sobre Segurança de Redes & Firewall
Respostas objetivas para dúvidas técnicas e operacionais que costumam surgir antes de um projeto.
01Firewall impede todos os ataques?
Não. Firewall é um controle da arquitetura e precisa trabalhar com segmentação, identidade, políticas, atualizações, visibilidade e operação.
02Mais regras significam mais segurança?
Não. Regras amplas, duplicadas, obsoletas ou sem ownership podem aumentar exposição e complexidade operacional.
03VPN representa um acesso Zero Trust?
Não. VPN cria conectividade protegida. Zero Trust é uma abordagem mais ampla baseada em verificação, contexto e least privilege.
04É necessário inspecionar todo tráfego criptografado?
Não. Inspeção precisa considerar privacidade, certificados, compatibilidade, performance, exceções e requisitos legais e organizacionais.
05É possível migrar entre plataformas de firewall?
Sim, após inventário e análise de interfaces, rotas, NAT, VPNs, objetos, políticas, HA, logs, dependências, validação e rollback.
06A Add Solution revisa políticas existentes?
Sim. O assessment pode identificar regras permissivas, duplicidades, objetos obsoletos, regras sem uso quando observáveis e oportunidades de documentação.
FALE COM UM ESPECIALISTA
Vamos conversar sobre Segurança de Redes & Firewall.
Share the context of your environment, the perceived impacts and the results your organization seeks. Add Solution will direct the conversation to the most appropriate experts.
CONTEXTO DA CONVERSASegurança de Redes & FirewallOrigem e interesse são registrados automaticamente no atendimento.