WatchGuard FireCloud Total Access

The short version

Most companies let employees work from home through a VPN: a login page on the office firewall that anyone on the internet can find and attack. FireCloud Total Access replaces it. Employees still reach the files and applications they need, but there's no remote-access door on your network for an attacker to find, scan, or break into.

What's wrong with a traditional VPN

• It's always on the internet. A VPN has to listen on an open port so employees can reach it, which means attackers can reach it too. Automated scanners find these login pages within minutes.
• VPN devices are a top target. Over the last few years, VPN appliances from nearly every major vendor have had serious security flaws that attackers exploited, often before a patch was available.
• One password opens everything. Once someone is connected, they're usually on the whole office network. A single stolen password or infected laptop can reach every server, which is how ransomware spreads.
• It's slow and clunky. Traffic squeezes through one box at the office, and users have to remember to connect.

How FireCloud works

1. A small connector at your office, built into your WatchGuard Firebox or run as a small virtual machine, connects out to WatchGuard's cloud. Nothing on the internet connects in, so there is no port open to attack.
2. Employees install the WatchGuard Connection Manager on their Windows or Mac computer and sign in with their company login and multi-factor authentication.
3. WatchGuard's cloud checks who they are and the health of their device, then connects them through an encrypted tunnel to only the applications they're allowed to use: the file server, the accounting system, a specific remote desktop. Everything else on the network stays invisible to them.
4. Access is checked for the whole session, not just at sign-in, so a stolen session or a device that falls out of compliance can be cut off.

Why it's better

• No open ports. Your internal applications aren't exposed to the internet, so there's nothing for attackers to scan or exploit.
• Least privilege. People get the specific applications their job needs, not the whole network, so one compromised account can't wander.
• Web protection everywhere. Remote users' internet traffic is filtered for malware, phishing, and malicious websites, at home or at a coffee shop, the same as in the office.
• No new hardware. If you already have a WatchGuard Firebox managed in WatchGuard Cloud, it can serve as the connector.
• One place to manage it. Users, access rules, and reports live in WatchGuard Cloud, so we can add or remove someone's access in minutes.

Is it right for you?

If your staff connect to the office with a VPN, or you've been putting off remote access because of the risk, FireCloud is worth a look. We'll review what your people need to reach, set up the connector and access rules, and retire the old VPN so its port can be closed for good.