Firewall

I'm Phoneboy, and this is season eight, episode twelve.

On this episode, we'll talk about the release of Check Point Firewall R82.20, a new critical security advisory, OpenAI and safety, Anthropic Risk Report, Coast Niche, AI agents, finding and exploiting CI/CD flaws.

Well, let's dive in.

[paper rustling] All right, so the latest release of the Check Point Firewall has dropped, R82.20. Now, this includes the AI network firewall features we did a tech talk on back in August, which I'll link in the show notes.

And as for other new features, some of them were covered in another tech talk we did that's also linked in the show notes.

Now, uh, now that it's out, I'll...

Um, feature is disabled by default, though.

Just be aware.

so good.

And AWS Firewall's fine.

It's solidly fine.

Have you seen in real life folks using AWS Firewall yet? Or have you seen them mostly pipe it through a third party firewall like Apollo?

Very good question.

And in fact, that reminds me of a story also, right? We were trying to build this whole networking stack for a POC environment for the same customer.

And they mentioned, let's first prove it in the sandbox environment.

Our code is working, everything is working, and then let's do it for the production.

so good.

And AWS Firewall's fine.

It's solidly fine.

Have you seen in real life folks using AWS Firewall yet? Or have you seen them mostly pipe it through a third party firewall like Apollo?

Very good question.

And in fact, that reminds me of a story also, right? We were trying to build this whole networking stack for a POC environment for the same customer.

And they mentioned, let's first prove it in the sandbox environment.

Our code is working, everything is working, and then let's do it for the production.

Can you design for centralized inspection instead of bolting a firewall onto every VPC? Do you understand the trade-off between IP-based and domain-based filtering? And do you have a rollout process that doesn't nuke production traffic on day one? Anyone can say, "Add a firewall." Fewer people can explain why it goes in one place and how you prove it's safe before you flip it to blocking mode.

Start with the mental model.

In a multi-VPC setup, you do not want AWS Network Firewall deployed separately in every spoke VPC.

That's operationally painful, it's expensive, and every team ends up writing slightly different rules.

The standard pattern is a centralized inspection VPC sitting between your spoke VPCs and the internet, usually paired with AWS Transit Gateway.

Stateful rules track connections and can inspect protocol details.

And this is where domain filtering comes in.

AWS Network Firewall supports domain-based stateful rules using the home net and TLS SNI, the server name indication field.

He currently serves as a risk manager for a Fortune 50 financial institution and has spent years helping organizations improve cyber resilience, AI governance, and regulatory compliance.

He's also an author and co-host of The Other Side of the Firewall, where he shines a spotlight on people shaping the future of cybersecurity.

So Ryan, welcome to the show.

Honor to have you here.