Why Do People Disable Their Firewalls?
Since they’re so vital, it can be difficult to understand why some network admins are turning off their firewalls.
#1: Troubleshooting Network Issues
Network issues are often only discovered after flows of data have already been prevented or started throwing errors up. Furthermore, because firewalls are an integral part of most networks, these misconfigured transfers can be blocked in response – and can run the gamut of symptoms.
Network and firewall configuration issues can manifest in frustrating, variable errors and failure patterns.
Plus, firewalls occasionally get in the way of diagnosing network issues. Pinging is a common diagnostic tool that allows an admin to assess whether a connection is functional and how good the connection is. But, many firewalls disable pinging by default, as this can be a tool used by an attacker when attempting lateral movement.
While log-based diagnosis is the best route, some network admins temporarily disable the firewall to test underlying connections – some firewalls support this by allowing rules on specific sites or network zones to be temporarily disabled.
#2: Firewall Firmware Updates
When firewall firmware is updated, older or more standalone solutions are essentially disabled while rebooting. Because it’s inherently risky, these update periods are kept as short as possible, and limited to time periods that don’t see much network traffic.
More modern setups rely on a high availability cluster, which applies each update to a secondary, or standby, firewall, before then being applied to the primary firewall at a later time.
This removes the disablement period, and ensures continuous protection.
#3: Host Firewall Clashing with Network Firewall
Firewalls come in lots of different flavors, but one of the most common distinctions is between network firewalls and host-based firewalls.
- The network firewall is deployed on an internal network, and monitors all packets that are sent into and out of it.
- Host-based firewalls are deployed on individual devices and monitor the traffic being sent and received by the specific endpoint.
Since they monitor network security from different perspectives, it’s common for enterprises to use both.
But, this also essentially doubles the maintenance expectations made on security personnel, as each requires continual updating – otherwise network changes and new apps can fall foul of a firewall’s rules. Unfortunately, admin teams that struggle to maintain this setup may be tempted to disable the host-based firewalls.
#4: Compromised Administrative-Level Account
The worst-case scenario for a firewall being disabled: an attacker or piece of malware is aiming to exfiltrate data or communicate with its command and control servers.
Host-based firewalls can prevent this, making disablement a core goal of most attacks.
What Happens If You Disable a Firewall?
Put simply, disabling a firewall allows all packets through to the underlying server.
The ramifications of this significantly compromises an organization’s security – and is why this guide doesn’t cover how to turn off a firewall.
Users Can Access Anything on the Web
Firewalls are one way that organizations keep users’ browsing habits and website access safe.
Firewalls are particularly important in education and office settings. They prevent users from accessing inappropriate content and devices from communicating with high-risk websites. Disabling this opens up the risk of malware-loaded sites deploying active strains on users’ devices.
Non-Users Can Exfiltrate Files or Change Settings
In other setups, firewalls enforce the way that data access is limited to users’ defined roles and requirements.
Without this in place, not only can any user access any internal data, but even personnel from outside an organization can access and exfiltrate it. This includes:
- High-sensitivity customer data
- Intellectual property
- Employee details
Malware May Be Allowed to Spread
If host-based firewalls are disabled while network-level firewalls are maintained, it creates a perimeter.
The outward-facing edge of each network may be assessing connections to the public Internet, but not all devices remain on this internal network at all times. For instance, employees may bring devices home, or their own mobiles and laptops into the office. Without a host-based firewall, each device that leaves the site or connects to third-party apps can become an attack vector, including:
- USBs
- Emails
- Coworking apps
This is because a network-level firewall, when monitoring external connections, views any internal device or data flow as trusted. If a single device is compromised by malware, it can result in widespread attack propagation.
Feedback