WHAT ARE FIOREWALLS?

Firewalls are network devices that help enforce an organization’s security
policy. Since their development, various methods have been used to
implement firewalls. These methods filter network traffic at one or more
of the seven layers of the ISO network model, most commonly at the
application, transport, network, and data-link levels. Newer methods,
which have not yet been widely adopted, include protocol normalization
and distributed firewalls.
Firewalls involve more than the technology required to implement
them. Specifying a set of filtering rules, known as a policy, is typically
complicated and error prone. High-level languages have been developed
to simplify the task of correctly defining a firewall’s policy. Once a policy
has been specified, testing is required to determine if the firewall correctly
implements it.
Because some data must be able to pass in and out of a firewall for
the protected network to be useful, not all attacks can be stopped by
firewalls. Some emerging technologies, such as virtual private networks
(VPNs) and peer-to-peer networking, pose new challenges to existing
firewall technology.

TYPES OF FIREWALLS

• Packet-filtering firewalls
• Circuit-level gateways
• Stateful inspection firewalls
• Application-level gateways (a.k.a. proxy firewalls)
• Next-gen firewalls
• Software firewalls
• Hardware firewalls
• Cloud firewalls

Note: The last three bullets list methods of delivering firewall functionality, rather than being types of firewall architectures in and of themselves.

How do these firewalls work? And, which ones are the best for your business’ cybersecurity needs?

Here are a few brief explainers:

Packet-Filtering Firewalls

As the most “basic” and oldest type of firewall architecture, packet-filtering firewalls basically create a checkpoint at a traffic router or switch. The firewall performs a simple check of the data packets coming through the router—inspecting information such as the destination and origination IP address, packet type, port number, and other surface-level information without opening up the packet to inspect its contents.

If the information packet doesn’t pass the inspection, it is dropped.

The good thing about these firewalls is that they aren’t very resource-intensive. This means they don’t have a huge impact on system performance and are relatively simple. However, they’re also relatively easy to bypass compared to firewalls with more robust inspection capabilities.

Circuit-Level Gateways

As another simplistic firewall type that is meant to quickly and easily approve or deny traffic without consuming significant computing resources, circuit-level gateways work by verifying the transmission control protocol (TCP) handshake. This TCP handshake check is designed to make sure that the session the packet is from is legitimate.

While extremely resource-efficient, these firewalls do not check the packet itself. So, if a packet held malware, but had the right TCP handshake, it would pass right through. This is why circuit-level gateways are not enough to protect your business by themselves.

Stateful Inspection Firewalls

These firewalls combine both packet inspection technology and TCP handshake verification to create a level of protection greater than either of the previous two architectures could provide alone.

However, these firewalls do put more of a strain on computing resources as well. This may slow down the transfer of legitimate packets compared to the other solutions.

Proxy Firewalls (Application-Level Gateways/Cloud Firewalls)

Proxy firewalls operate at the application layer to filter incoming traffic between your network and the traffic source—hence, the name “application-level gateway.” These firewalls are delivered via a cloud-based solution or another proxy device. Rather than letting traffic connect directly, the proxy firewall first establishes a connection to the source of the traffic and inspects the incoming data packet.

This check is similar to the stateful inspection firewall in that it looks at both the packet and at the TCP handshake protocol. However, proxy firewalls may also perform deep-layer packet inspections, checking the actual contents of the information packet to verify that it contains no malware.

Once the check is complete, and the packet is approved to connect to the destination, the proxy sends it off. This creates an extra layer of separation between the “client” (the system where the packet originated) and the individual devices on your network—obscuring them to create additional anonymity and protection for your network.

If there’s one drawback to proxy firewalls, it’s that they can create significant slowdown because of the extra steps in the data packet transferal process.

Next-Generation Firewalls

Many of the most recently-released firewall products are being touted as “next-generation” architectures. However, there is not as much consensus on what makes a firewall truly next-gen.

Some common features of next-generation firewall architectures include deep-packet inspection (checking the actual contents of the data packet), TCP handshake checks, and surface-level packet inspection. Next-generation firewalls may include other technologies as well, such as intrusion prevention systems (IPSs) that work to automatically stop attacks against your network.

The issue is that there is no one definition of a next-generation firewall, so it’s important to verify what specific capabilities such firewalls have before investing in one.

Software Firewalls

Software firewalls include any type of firewall that is installed on a local device rather than a separate piece of hardware (or a cloud server). The big benefit of a software firewall is that it’s highly useful for creating defense in depth by isolating individual network endpoints from one another.

However, maintaining individual software firewalls on different devices can be difficult and time-consuming. Furthermore, not every device on a network may be compatible with a single software firewall, which may mean having to use several different software firewalls to cover every asset.

Hardware Firewalls

Hardware firewalls use a physical appliance that acts in a manner similar to a traffic router to intercept data packets and traffic requests before they’re connected to the network’s servers. Physical appliance-based firewalls like this excel at perimeter security by making sure malicious traffic from outside the network is intercepted before the company’s network endpoints are exposed to risk.

The major weakness of a hardware-based firewall, however, is that it is often easy for insider attacks to bypass them. Also, the actual capabilities of a hardware firewall may vary depending on the manufacturer—some may have a more limited capacity to handle simultaneous connections than others, for example.

Cloud Firewalls

Whenever a cloud solution is used to deliver a firewall, it can be called a cloud firewall, or firewall-as-a-service (FaaS). Cloud firewalls are considered synonymous with proxy firewalls by many, since a cloud server is often used in a proxy firewall setup (though the proxy doesn’t necessarily have to be on the cloud, it frequently is).

The big benefit of having cloud-based firewalls is that they are very easy to scale with your organization. As your needs grow, you can add additional capacity to the cloud server to filter larger traffic loads. Cloud firewalls, like hardware firewalls, excel at perimeter security.

The firewall is at the boundary between the two networks.

All traffic between the two networks must pass through the firewall.

The firewall has a mechanism to allow some traffic to pass while
blocking other traffic (often called filtering). The rules describing
what traffic is allowed make up the firewall’s policy.
Additional desirable criteria include:

Resistance to security compromise.

Auditing and accounting capabilities.

Resource monitoring.

No user accounts or direct user access.

Strong authentication for proxies (e.g., smart cards rather than
simple passwords).

Fail-safety: If it fails, the protected system is still secure because
no traffic is allowed to pass through the firewall.
The fact that a firewall is at the boundary between two networks has
also led to them being called “perimeter security” —
Firewalls function by filtering traffic at one or more (today, normally
multiple) layers in the network protocol stack. These layers are described
using the ISO seven-layer model for networking
A firewall is at the perimeter of an organization’s network. The inside
network may be as simple as a few machines or may consist of several divisions
located in geographically distant locations connected by telecommunication lines.
Outside
network
Inside
network Firewall

The Need for Firewalls
In the early years, the Internet supported a small community of users who
valued openness for sharing and collaboration. This view was challenged
by the Morris worm . However, even without the Morris worm, the
end of the open, trusting community would have come soon through
growth and diversification. Examples of successful or attempted intrusions
around the same time include Clifford Stoll’s discovery of German spies
tampering with his system and Bill Cheswick’s “Evening with Berferd”
ISO Layer Internet Example
Application File Transfer Protocol (FTP) and Telnet
Presentation Common Object Request Broker Architecture (CORBA)
Session No directly corresponding protocol
Transport Transmission Control Protocol (TCP) and User Datagram
Protocol (UDP)
Network Internet Protocol (IP)
Data link Ethernet or Asynchronous Transfer Mode (ATM)
Physical Twisted pair or fiber-optic cable
Network Firewalls
in which he set up a simple electronic “jail” for an attacker. In this
jail, the attacker was unable to affect the real system but was left with
the impression that he or she had successfully broken in. Cheswick was
able to observe everything the attacker did, learning from these actions
and alerting system administrators of the networks from which the attacks
were originating. Such incidents clearly signaled the end of an open and
benign Internet. In 1992, Steve Bellovin described a collection of attacks
that he had noticed while monitoring the AT&T firewall and the networks
around it. The result was clear — there were many untrustworthy and
even malicious users on the Internet.
When networks are connected together, different levels of trust often
exist on the different sides of the connection. “Trust” in this sense means
that an organization believes that both the software and the users on its
computers are not malicious. Firewalls enforce trust boundaries, which
are imposed for several reasons:
Security problems in operating systems: Operating systems have a
history of insecure configurations. For example, Windows 95
and Windows 98 were widely distributed with file sharing
enabled by default; many viruses exploited this vulnerability (for
example, see Reference 16 and Reference 17). A second example
is Red Hat Linux version 6.2 and version 7.0, which wer e
vulnerable to three remote exploits when the operating system
was installed using default options [18]. It is an ongoing and
expensive process to secure every user’s machine, and many
organizations consciously decide not to secure the machines
inside their firewall. If a machine on the inside is ever compromised, the remaining machines also are likely vulnerable
a situation that has been described as “a sort of crunchy shell
around a soft, chewy center”
Preventing access to information: National firewalls attempt to limit
the activities of their users on the Internet, for example, China
[49]. A similar idea in the United States is the Children’s Internet
Protection Act (CHIPA), which mandates that certain information
be filtered. This law requires that schools and libraries that
receive federal funding block certain classes of Web content.
Preventing information leaks: Because all traffic leaving a network
must pass through the firewall, it can be used to reduce information leaks
The key criterion for success for the digital corporate
gateways is preventing an unauthorized or unnoticed
leak of data to the outside.

Enforcing policy: Firewalls are one part of an overall security policy;
they enforce the rules about which network traffic is allowed
to enter or leave a network. These policies control the use of
certain applications, restrict which remote machines may be
contacted, or limit the bandwidth.
Auditing: If a security breach (which does not include the firewall)
occurs, audit trails can be used to help determine what happened. Audit trails have also been used to monitor employees,
e.g., for using office network resources for nonwork purposes.
Using a personal firewall, individuals can protect a single machine
connected to the Internet. Rather than trying to secure the underlying
operating system, these firewalls simply prevent some types of communication. Such firewalls are often used in homes and on laptops when
they are outside their normal firewall. In this case, the trust boundary is
the network interface of the machine.
Organizations often use firewalls to prevent a compromised machine
inside from attacking machines outside. In this case, the firewall protects
the organization from possible liability because of propagating an attack

Drop your comment below.