Secure Your Firewall: It's the Front Door, and Attackers Stopped Knocking

by Daniel

Headline 'Your firewall is the front door.' next to a gold door in a brick wall with a violet keyhole and a doormat that reads 'Welcome'. — Nobody ordered the welcome mat, but every botnet on the internet RSVP'd anyway.

Quick question: when did anyone last actually look at your firewall? Not the dashboard with the green checkmarks. The box itself. Its firmware. Who can log into it, and from where.

If the honest answer is "when the IT contractor installed it", congratulations, you're in very large company. Norbert's company, for one. Also, unfortunately, on a lot of attackers' to-do lists.

What is an edge device, anyway?

Edge devices are everything that sits on the line between your network and the internet: firewalls, VPN gateways, routers, load balancers, remote desktop gateways, sometimes that NAS with the oh-so-convenient remote access feature. They are reachable from the internet by design. That's literally the job.

Which is exactly why attackers love them. Own the firewall and you're not standing outside the door. You're standing in the hallway with a key, and the alarm system thinks you're the janitor.

Rule of thumb: the device that's meant to protect you is also the one device every stranger on the internet is allowed to poke.

The numbers: from side door to main entrance

The Verizon Data Breach Investigations Report 2025 (the DBIR, the industry's annual required reading) put it in writing: exploiting vulnerabilities was the way in for 20 percent of breaches, just behind stolen credentials at 22 percent. And among exploited flaws, edge devices and VPNs made up 22 percent. In the report before that? 3 percent.

That's an almost eightfold jump in a single year. Not a trend line. A hockey stick.

It gets worse: only about 54 percent of those edge flaws were fully remediated, with a median of 32 days to patch. Attackers, meanwhile, often need days after disclosure. Sometimes hours.

Edge devices under fire, per the Verizon DBIR 2025: edge devices and VPNs went from 3 percent of exploited flaws in the DBIR 2024 to 22 percent in the DBIR 2025. Only 54 percent of edge flaws were fully remediated. The median time to patch an edge flaw was 32 days. — 32 days: long enough for a vacation, and attackers are spending theirs in your network.

Live this week: two firewalls, one bad Wednesday

In case that sounds like last year's statistics, the past few days served up two textbook examples.

Palo Alto meets PHP2Shell

On October 28, Palo Alto Networks warned that attackers were exploiting the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) against PAN-OS management interfaces exposed to the internet. A suspected China-nexus group reportedly chained this with the Linux privilege escalation bug Fragnesia (CVE-2026-46300) to get root. Palo Alto's first recommendation wasn't some exotic workaround. It was: take the management interface off the internet. Now.

Cisco and the VPN that keeps rebooting itself

Also on October 28, Cisco disclosed an actively exploited flaw in the SSL VPN of Secure Firewall ASA and FTD (CVE-2026-76418, CVSS 8.6). An unauthenticated attacker can force the firewall to reload. No data theft, but picture your VPN dropping every ten minutes on a Monday morning with half the team working from home. Barbara from accounting will find you. And she will not be using her indoor voice.

Why small and mid-sized businesses get hit hardest

In a lot of companies, edge devices are classic set-it-and-forget-it boxes: configured once by a contractor, it works, so nobody touches it again. On top of that:

There's no EDR on a firewall (Endpoint Detection and Response, basically antivirus with a brain). If someone's inside, usually nobody's watching.
Logs often live only on the device itself. Whoever has root gets to tidy up.
Updates mean maintenance windows, maintenance windows mean overtime, and overtime means: maybe next month.
Once a device hits end of life there are no patches at all, but the box keeps humming along like nothing happened.

"It's been fine so far" is not a security strategy. It's a famous last words collection.

How to secure your firewall

1. Inventory: what's actually exposed?

You can't secure what you don't know about. Check from the outside which services your public IP address is offering. Important: scan from genuinely outside your network (a phone hotspot works), and only scan systems you own.

Bash

# Scan from OUTSIDE, not from inside the office LAN.
# Replace 203.0.113.10 with your own public IP.
# Only scan systems you own or are authorized to test!
nmap -Pn -sV -p 22,80,443,4443,8443,10443 203.0.113.10

If an admin login page shows up, you've just found to-do number one.

2. Get the management interface off the internet

Your firewall's admin interface belongs on the internal network or behind a separate management VPN, reachable only from designated admin machines. Not on the open internet. Not with a strong password. Not "just for a minute". This is the one measure that would have made all the difference at Palo Alto this week.

3. Patch on a schedule, not on vibes

Subscribe to your vendor's security advisories and keep an eye on CISA's Known Exploited Vulnerabilities catalog (KEV, the list of flaws confirmed to be exploited in the wild). If your vendor shows up there with a fresh entry, that's not a job for the next maintenance window. That's a job for today.

Bash

# Show the 20 newest KEV entries for common edge vendors
# (requires curl and jq)
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[]
      | select(.vendorProject | test("Palo Alto|Cisco|Fortinet|Ivanti|SonicWall"; "i"))
      | [.dateAdded, .cveID, .vendorProject, .product] | @tsv' \
  | sort -r | head -20

4. MFA on the VPN, done properly

A VPN login with just a username and password in 2026 is about as current as a fax machine with Wi-Fi. Multi-factor authentication won't save you from a bug in the device itself, but it stops stolen credentials (and there are truckloads of those) from walking straight in.

5. Get the logs off the box

Ship your edge devices' logs via syslog to a separate system, ideally one the firewall can't write to after the fact. An attacker with root can do a lot, but they can't quietly wipe their tracks anymore.

6. Put end of life on the calendar

For every edge device, write down when the vendor stops supporting it. An unpatched box on your perimeter isn't a cost saving. It's an invitation with a welcome mat.

What if it's already too late?

If a vendor advisory matches your device and the management interface was exposed, don't just patch and pray. Check the indicators of compromise the vendor published (IoCs, basically the attackers' muddy footprints), rebuild the device if in doubt, and rotate every credential and certificate that passed through it. A patch locks the door. It doesn't evict whoever's already on the couch.

The bottom line

Your firewall isn't a bouncer that handles things on its own. It's the front door, and front doors need a decent lock, regular maintenance and someone who actually checks on them. Do the inventory this week, not next quarter. Turn on MFA. Think purple.