How Does Firewall Protection Work?
Since the key mechanism of any firewall is in its establishment and execution of firewall rules, it’s worth breaking the tool down into its core components.
Proxy Service
Preventing direct connections between verified safe devices and the open Internet is key to establishing a safe network. To achieve this, many enterprises today install firewalls as a proxy service.
This routes all requests via the firewall.
As it acts as an intermediary, its protective scope is able to be universally applied to all internal devices.
Packet Filtering
Within networks, data is organized into packets.
Thanks to the aforementioned proxy setup, these data packets travel first to the firewall, where they’re examined against the firewall’s ‘allow’ list. This consists of information that can identify malicious data. If the data packet matches the parameters of a defined threat, the packet is dropped..
Rule Examination
Once the data packet reaches the firewall, it’s evaluated against its established rules. Each rule outlines a specific criterion of allowed data, and if the packet doesn’t comply, it’s discarded. These rules allow for in-depth customization across different networks and organizations.
One of the most popular rule types is access control rules – these define which traffic is allowed past. The access control rules are based on pieces of data that are contained within data packets:
(since they’re all easily accessible data points that allow suspicious activity to be pinpointed and prevented.)
Decision Execution
This is the mechanism through which the firewall acts on a rule: according to the rule, the packet either gets passed to the requested server, or discarded if it fails.
Logging
As the firewall continuously compares packets against its associated rulesets, every allow or deny decision is recorded in its own log file. These are a veritable goldmine of security data that ideally would be used within your enterprise’s wider security ecosystem.
After all, no single security tool is a silver bullet, and other tools like Security Information Event Management (SIEM) software can combine firewall logs with other security data to assess its health.
4 Firewall Protection Best Practices
Firewalls are potent security tools, but knowing how to apply and maintain their rulesets is key to their potential.
#1: Harden and Configure your Firewall
The process of hardening and securing firewalls begins long before deployment into a network. You’ll need to have a pretty good understanding of precisely which devices are verifiably secure, and essential.
This makes a network diagram of your infrastructure essential for gaining an understanding of your network’s structure, as it provides a visual representation of the connections between various components.
With this in hand, it’s possible to design a hardened firewall.
To start, it’s important to ensure that only authorized administrators can access it. This starts with keeping the firewall updated with the latest firmware to protect against known vulnerabilities. Before deploying a firewall into production, it should be properly configured to align with security best practices.
There’s a lot of overlap with traditional security management:
- Default accounts and passwords must be disabled or changed to prevent unauthorized access attempts
- Administrator accounts should be safeguarded with strong unique passwords to further enhance security
- Shared user accounts should be avoided.
If multiple administrators need access, it is better to create separate accounts with restricted privileges tailored to each administrator’s specific responsibilities.
This approach minimizes risk and ensures accountability.
#2: Regularly Update Firewall Rules
A good foundation of rules is vital for any firewall: this is why most firewall providers include an inbuilt, universally-applicable ruleset upon implementation.
However, don’t underestimate the impact of fine-tuning these rules for your own applications and architecture.
This should be done under the scope of your network diagram: prioritize the highest-risk applications and users, and from there begin to build out the firewall ruleset. Keep in mind that most firewalls will cycle through custom rules first, before going on to the preset rules afterward.
Once your rules are set up, monitor their efficacy and keep an eye on how tight they are: overly permissive access control lists are hugely risky, while too-tight restrictions can leave users locked out of necessary resources.
#3: Rely on Stateful Inspection
Check Point first developed stateful inspection in the late 90s, and it refers to a firewall that can zoom out from individual packets to assess the wider context.
Stateful inspection monitors communication packets over time, analyzing both incoming and outgoing traffic. It tracks outgoing packets that request specific types of responses and allows incoming packets to pass through if they match the expected reply.
This type of firewall keeps an eye on all active sessions and validates every packet, though the exact method depends on the firewall technology and the communication protocol in use.
#4: Use Logs for Alert Mechanisms
Logs are vital pieces of data that create a path of all outbound and inbound traffic. This offers invaluable insights into the:
- Patterns of traffic
- Anomalies in source and destination IP addresses
- Potential vulnerabilities.
This data can then feed into future ruleset adaptations. Logs only mean anything if they’re actionable. Hooking your firewall logs up to an analysis engine allows for strange patterns of behavior to be spotted, while real-time alerts also help ensure swift action is taken.
Go One Step Further with Check Point’s Next Generation Firewall
Traditional firewalls focus solely on basic traffic filtering while NGFWs combine standard firewall capabilities with features like:
- Application control
- Intrusion prevention systems (IPS)
- Advanced threat protection
Check Point’s NGFW utilizes real-time threat intelligence powered by Check Point ThreatCloud, enabling the identification and mitigation of emerging cyber threats. Plus, it supports deep packet inspection, which examines data beyond the header level to detect hidden malware or unauthorized activity.
These are all key components to an NGFW – for a deeper dive into the topic, see our NGFW buyer’s guide. One of the standout features of Check Point’s NGFW is its ability to control applications based on user identity and group roles.
Explore this deep access management with a demo to see how Quantum can keep your environment safe.
Feedback