In 2024, France’s ANSSI cybersecurity agency observed an increase in attacks exploiting vulnerabilities in equipment exposed online, including firewalls and VPN gateways used to secure remote access to information systems. Several thousand devices were compromised in France, and dozens of incidents linked to these flaws were dealt with, demonstrating the attackers’ interest in these strategic targets.
Cyberattacks are evolving and diversifying, with attackers’ strategies no longer limited to corporate information systems. And their sights are set on cybersecurity solutions themselves, with direct attempts against firewalls and other protective equipment. As illustrated by the recent large-scale attacks using millions of IP addresses against network devices, cybercriminals are looking to exploit the slightest loophole to bypass or neutralise the defences in place.
A necessary security by design approach
With cyber-threats targeting businesses and security vendors alike, a firewall’s robustness is no longer limited to its ability to filter traffic. It is based on an architecture designed to resist exploitation attempts, protection against brute force or denial-of-service attacks, and the ability to detect and counter intrusions that target its own defence mechanisms. This approach is part of “security by design”, incorporating protection against known and emerging threats from the earliest design stage.
The importance of qualifications
But how can you be sure that a firewall is truly robust? Companies and organisations must rely on benchmarks established by independent agencies. In Europe, several reference bodies define strict criteria for assessing the robustness of cybersecurity solutions: ANSSI in France, BSI in Germany and CCN-CERT in Spain. This first level of requirements is backed up by an audit of firewall solutions, carried out by independent, impartial assessment centres. These qualifications certify that a firewall has undergone rigorous testing and meets the most stringent security requirements. They guarantee not only the reliability of the product, but also its ability to provide long-term protection for critical infrastructures against attacks of increasing sophistication.
These certifications go beyond a simple technical assessment of the product: they also examine the development environment and the practices put in place by the publisher to ensure an optimum level of security. Transparency about vulnerabilities discovered, the ability to provide regular corrective patches and the ability to listen to customer feedback are essential criteria for guaranteeing effective protection in the face of constantly evolving cyber-threats.
In an environment where cyberattacks are increasing in number and complexity, choosing a robust cybersecurity solution is no longer a simple precaution: it’s a necessity. Choosing a solution that’s qualified by an independent agency provides the assurance that the security target meets your organisation’s practical needs, while offering a framework of trust that is essential for protecting information systems.”
