What Is a Firewall in Simple Terms
The word “firewall” came into the field of computer networks from fire fighting. It means a fire-resistant wall of a building that prevents flames from spreading to neighboring parts of walls and houses.
Imagine a large office with an internal network. There are dozens of computers, servers, and routers. Personal data, critical company information, or corporate secrets are stored there. Everything can fall into the hands of an intruder.
To prevent this from happening, one requires comprehensive protection. One of its components is a firewall. Like a meticulous gatekeeper, it examines everyone’s credentials as well as what the visitors bring outside.
Let’s look at several types of firewalls to understand their key features.
Hardware with protection software installed. You can buy such an appliance and configure it for your purpose. Hardware firewalls are more powerful and much more expensive than software firewalls. However, there is no consensus on how much more reliable they are.
Software that can be installed on a real or virtual appliance. All network traffic will flow through the firewall into the corporate network. The simplest example of this type is the standard firewall built into Windows.
How it works
A firewall can be a separate program, an expensive piece of hardware, or even a feature integrated into an antivirus. To understand how it functions, let's take a look at these two types of firewalls: Stateful and Stateless.
Note: A firewall can be either stateful or stateless, but never both.
|Analysing the data in a flow using the full context of the traffic. Operating according to multiple prescribed algorithms.||Analysing the data in isolation and strictly adhering to simple sets of ACL rules. Making decisions based on the source and destination.|
Storing the state of legitimate connections and verifying what’s inside the data packets: characteristics and communication channels.
Evaluating packets by following strict rules. They are considered “safe” and allowed through if complying with these rules. When they don’t, the packet is considered “malicious” and gets blocked.
|For medium and large projects, that have large outbound traffic and a budget to implement such a solution.||For smaller projects, that face fewer threats and have a limited budget.|
Why Do We Need a Firewall?
A firewall can protect your network at different levels. It depends on the specific goal: traffic scrubbing, malware protection, unauthorized access, or cyberattacks.
Here are some examples
1. Prevention of unauthorized access.
The regional company Bergerton PLC has a branch in Los Angeles. They are constantly exchanging data. The IP address of the head office and the branch office are known. One day, someone sends a request for downloading the customer database from an unknown IP address disguised as an LA branch office. The firewall automatically checks the access settings. If it does not find a match with new address, it blocks access. All data stays safe.
2. Data transfer restriction.
Justin K. Edwards, head of the department, has downloaded a game to the corporate computer to have some fun. But a virus lurks in the installation file. If Justin’s computer does not have a program that reports the malicious nature of the downloaded file, the virus will try to collect the confidential data and send them “outside”. In this situation, a firewall is of great help. It detects suspicious activity and an unfamiliar IP. Data transfer gets blocked, and the information stays inside the company.
3. Protection of an internal network from cyberattacks.
The eyewear store has its online work space at work.domain.com. Without this platform, managers can’t process orders, get documents, or find information about items. If it faces a DDoS attack, and there is no protection, managers will simply fail to log into the system. In this case, a properly configured firewall can be a tool that prevents disruptions in corporate operations.
Does a Firewall Protect Against DDoS Attacks?
Users often associate the concept of a “firewall” with comprehensive protection. However, having a firewall does not really guarantee protection against DDoS, because in addition to traffic processing policy, specialized settings and multiple layers of filters are required. Moreover, irregular updates make firewalls become vulnerable — hackers are constantly improving their skills and developing new methods of malicious impact.
Therefore, for genuinely comprehensive protection, it is recommended to implement additional solutions.
Protection against DDoS attacks means traffic scrubbing at Layers 3, 4 and 7 of the OSI Model. Web traffic processing and scrubbing are most often based on the Reverse Proxy technology.
When suspecting an attack, the system deals with each incoming packet separately, without blocking all traffic from the IP address. If an attack occurs from compromised home routers, legitimate users of the routers will be able to access the protected resources.
There is one more tool with a rather sophisticated configuration designed for protecting Web applications — the Web Application Firewall. The WAF features consider the specifics of the application to be protected. It analyzes web pages and blocks SQL injections, XSS scripts and other threats from the OWASP list. Such threats are much more demanding to implement as compared to DDoS attacks. So this type of firewall also requires advanced technical skills for deployment and maintenance.
The picture shows that WAF is not the primary protection. It is a multifunctional enhancement that can be used in addition to an anti-DDoS solution at L7.
We have noticed that sometimes in requests for protection services, WAF occurs more often than protection against DDoS attacks. Perhaps it is because some people think WAF is a service that includes absolutely everything. It is important to avoid considering WAF as a panacea and distinguish it from other protection services.
“Who Needs a Firewall” Checklist
We have already established that WAF does not stand separate from the L7 protection. To decide whether your project needs additional protection components, please refer to the checklist below.
WAF is a good choice for you if
- there is an understanding of the features of the web application (social network, game, educational resource or other online service);
- you need an additional set of sophisticated options for protection against complex types of attacks (OWASP TOP 10);
- you have enough technical skills to configure it yourself, or the resources to hire an experienced technician.
Important Things to Keep In Mind
Website protection at the Layer 7 is the base. It ensures that your web asset has high loading speed and fault tolerance. The system detects suspicious activity and blocks malicious traffic. Website protection is already a reliable cyber security tool. Requiring additional modifications and financial costs always depends on the specific challenges of the application.
Your project will be sustainable on any scale with the properly chosen protection. Remember the goals it is supposed to achieve, and test solutions with easy-to-understand features.