SpartanTec, Inc. Columbia: What is Network Firewall Security

Since nearly three decades, firewalls have been the first line defense for network security. There are many types of firewalls, including software firewalls, next-generation firewalls, traditional firewalls, and hardware firewalls. It can be hard to decide which firewall is right for your business, given the 30 years of technological changes and the many types of firewalls available. The wrong firewall could make you vulnerable to today’s network security threats.

What is a Network firewall?

Network firewalls are devices that sit on the network of a business. It is responsible for preventing traffic, people, or devices from the internet from entering your private network. Next-generation firewalls can be used to block malicious activity and unwelcome traffic from your network.

What Does a Firewall Do to Support Network Security?

The internet connection from your network can be thought of as a bridge. You have cars moving back and forth on this bridge. These cars are traffic on your network. The guard is responsible for approving the cars before they can travel on the bridge. Your firewall is the guard.

The guard examines the traffic on the bridge. It sees a blue car, which represents web traffic. However, it also sees a red vehicle representing email traffic. The guard states that blue cars are allowed and red cars are not. Next comes a purple car, which is SMTP traffic that’s prohibited. The guard replies, “Nope, sorry purple car, you can’t use the bridge.”

This is how traditional firewalls work. Although it’s a good system, there is a major flaw in it that can be exploited in today’s threats landscape. Although the guard let the red car cross the bridge, he didn’t inspect the trunk and saw that there were bad guys hiding in it (representing traffic from an compromised website with malicious payload).

This problem is not present in next-generation firewalls. Before allowing traffic to enter, they inspect the payload. Next-generation firewalls can also inspect traffic from within before allowing it to leave. This is a valuable feature in combating ransomware. A ransomware attack is when a user becomes infected by ransomware and the payload begins to install itself.

Once ransomware has started, it will need an encryption key to encrypt user files and then hold them hostage for ransom. The ransomware requests an encryption key from its command and control server at this point. Next-gen firewall examines the outbound traffic request. It identifies that the ransomware is trying to block a bad site.

The ransomware was detected by the computer’s endpoint protection software. The next-generation firewall detected the ransomware and stopped it from running.

Next-Generation Firewalls and Traditional Firewalls

All firewalls work in a different way. There are generally two types of firewalls available on the market: “traditional firewalls” or “next-gen.”

Based on what type of traffic it is, traditional firewalls block traffic coming in. The traditional firewall blocks traffic based on the type of traffic it is. For example, it blocks Port 80 traffic which is essentially web browsing traffic. It also blocks traffic SMTP which is email traffic. The firewall does not inspect traffic or data within the traffic.

Next-generation firewalls go one step further and can actually monitor traffic and stop malicious payloads.

Hardware Firewall vs Software Firewall

Hardware firewalls, such as the Sophos XG115 have operating systems that can be used with a particular piece of hardware. This ensures the highest level of protection and maximum functionality.

Software firewall is the software equivalent to the hardware firewall operating systems. It allows you run the software firewall on a computer or virtual machine.

If you have a tight budget, the software firewall can be a great solution. The software is often free and you can reuse an old computer to run the firewall software.

Software Firewall: Machine requirements

Two network cards are required to run a software firewall. One must be for outside traffic, and one must be for inside traffic. These should both be connected to your local area network.

Intel or AMD processor
Hard drive space
Firewall Management

The network administrator in an enterprise is usually responsible for firewall management. You may receive reports and notifications via email depending on which firewall you purchased. It is a good idea to also check the firewall management interface.

Network administrators have to manage firewalls every day. This can make it more difficult depending on the number of locations/firewalls. A bank with three branches should have four firewalls. You don’t want to manage each firewall separately.

There are many options available to allow central management of all devices in your security system. These options include notifications, centralized policies and managed security service provider (MSSP) management.

MSSPs offer a complete IT security solution that includes hardware, software and management. Some service providers will even provide an internet connection.