What Firewalls Can — and Cannot — Accomplish

Firewalls have been born within the Nineteen Nineties, alongside Home windows 95 and Web Explorer. They have been a staple of community safety since, which prompts the query: Are firewalls nonetheless related? The figuring out issue is whether or not firewalls have grown with the adjustments we have seen in know-how or in the event that they’ve simply stayed in keeping with the know-how of the Nineteen Nineties and early 2000s.

How Firewalls Work & How They Do not

Firewalls work totally on the precept of deep packet inspection. Knowledge packets are the models of knowledge that represent any kind of Web visitors, together with Net visitors. They shield networks by checking the payload of each information packet making an attempt to enter or go away a community and blocking any packets that comprise malicious content material. Content material sometimes is outlined as malicious by way of a sequence of fairly advanced insurance policies and guidelines.

At this time, information is sort of at all times encrypted. Encryption ensures that good incoming and outgoing visitors is protected against prying eyes, however, sadly, it additionally hides unhealthy incoming and outgoing visitors. Some firewalls can de-encrypt information packets, verify their payload, after which re-encrypt them, however this course of is computationally intensive and might lavatory down the community considerably. Additionally, this course of shouldn’t be at all times an accessible choice given what number of fashionable safety protocols block the varieties of man-in-the-middle operations required for full-blown SSL inspection.

Leveraging IP Addresses

Certainly, deep packet inspection is turning into an antiquated safety follow, however there are different methods to determine whether or not particular exercise is malicious.

For instance, some organizations blacklist malicious Net domains, then mechanically block visitors from these websites, whereas others use techniques akin to SIEM log evaluation. Nonetheless, these kinds of monitoring and alert methods are reactive: They inform you that you’ve got been attacked, however do not block the malicious visitors that may trigger an assault.

I staunchly imagine in multifaceted safety, with a easy set of three beginning factors:

1. Do not reuse passwords.
2. Usually replace your software program.
3. Use the truest lowest-common-denominator of Web visitors — the IP handle itself — to your benefit, as a key foundational tenet of your cyber safety stack.

It is the third leg of that stool that may assist be sure that your group achieves a proactive posture relating to malicious visitors.

Since all visitors is recognized by a novel IP handle, specializing in IP is a straightforward option to determine and block any packets coming from or going to recognized malicious sources — with out ever needing to verify their contents. It would not matter if the information being transferred is encrypted or not.

Surprisingly to some, firewalls cannot and do not carry out this operate very nicely since you want a really totally different {hardware} and software program structure to realize deep packet inspection versus reaching IP filtering at scale.

Conclusion

Whereas firewalls are a vital software in organizations’ safety arsenals, it is necessary to align safety options with safety threats. As cyberattacks evolve, organizations ought to think about the sorts of instruments that shall be wanted to enhance and shore up firewall safety.