Unit
- Definition: A firewall is a network security device that monitors incoming and outgoing traffic based on an organization's previously established security policies. It acts as a barrier between a trusted internal network and untrusted external networks such as the internet.
- Primary function: Firewalls filter traffic using rule sets that specify permitted or denied actions based on criteria like source and destination IP addresses, port numbers, and protocol types. This filtering prevents unauthorized access while allowing legitimate communication.
- Types of firewalls: Packet filtering firewalls inspect packet headers; stateful firewalls track connection states; application-layer firewalls analyze content; next-generation firewalls combine deep packet inspection with intrusion prevention and application awareness.
- Placement in network: Firewalls are typically deployed at network perimeters (edge), between internal segments (internal), and in front of specific servers (host-based). Placement affects the security posture and performance of the network.
- Logical components: A firewall consists of network interfaces (ingress/egress), a rule base, a state table (for stateful models), and a management interface. The control plane handles policy decisions; the data plane processes traffic.
- Trust models: The default-deny principle means all traffic is blocked unless explicitly allowed. This contrasts with default-permit, which is rarely used due to security risks. Proper trust zoning reduces attack surface.
- Hardware vs. software firewalls: Hardware firewalls are dedicated appliances, offering high throughput and reliability. Software firewalls run on general-purpose servers or within virtualized environments, providing flexibility at lower cost.
- Common use cases: Protecting corporate networks from internet threats, isolating sensitive data (e.g., financial systems), enabling remote access through VPN gateways, and segmenting cloud environments.
- Key metrics: Firewall performance is measured by throughput (bits per second), concurrent connections, new connections per second, and latency. Oversubscription can degrade security if the firewall becomes a bottleneck.
- Demilitarized zone (DMZ): A DMZ is a screened subnet that sits between the internal network and the internet, hosting public facing services like web servers and email gateways. Firewalls on both sides of the DMZ enforce separate rule sets, isolating external services from internal assets and limiting exposure in case of a breach.
- Logging and monitoring: Firewalls generate logs for allowed and denied traffic, including timestamps, source and destination addresses, ports, and actions taken. Centralized logging with a SIEM system enables real time alerting for anomalies, rule violations, and attempted intrusions, which is critical for incident response and compliance audits.
- Rule management best practices: Maintain a change control process for all rule modifications, with documentation of business justification and expected impact. Schedule regular rule reviews to remove stale or unused entries, reduce complexity, and ensure that the rule base aligns with current security policies. Automated tools can help detect shadow rules and rule conflicts.
Security Consideration
HIGH RISK
Vulnerability: Misconfiguration of implicit deny rules
Mitigation: Always place an explicit deny-all rule at the bottom of the rule base. Test with traffic generators to confirm that only approved flows pass. Regular audits of rule effectiveness are essential.
Reference: NIST SP 800-41 Rev. 1
Quick Revision
- A firewall filters traffic based on security policies, acting as a barrier between trusted and untrusted networks.
- Types include packet filtering, stateful, application-layer, and next-generation firewalls.
- Placement at the perimeter, internal segments, or host level determines security boundaries.
- The default-deny principle is fundamental; always use an explicit deny rule as a safety net.