What is a Firewall? Basic technologies to protect corporate network security

What is a Firewall? Basic concepts and roles

Firewall is a security technology that protects the internal network from unauthorized access from the outside.

Simply put, it is like a "gateway" installed between the internal network and the external network (Internet) to monitor and control the entry and exit of communications.

Firewalls operate at the network level (layers 3-4 of the OSI reference model) and filter traffic based on information such as IP addresses and port numbers. This protects the network from unauthorized access and attacks.

Differences Between Firewall and WAF Features of Firewall:

• Operates at the network level (layers 3-4 of the OSI reference model)
• Control traffic based on IP address and port number
• Example: Block connections from specific IPs, only allow communication to specific ports

Features of WAF (Web Application Firewall):

• Operates at the application level (layer 7 of the OSI reference model)
• Detailed analysis of HTTP request content
• Example: Defend against web application-specific attacks such as SQL injection and XSS

This means that while Firewall controls which computers are allowed to access which ports, WAF controls what operations are allowed for web applications.

They are not in conflict but work complementarly as different layers of defense-in-depth.

As I mentioned in the previous article, the following diagram briefly summarizes the roles of Firewall and WAF.

*The composition is just an example.

Types and Characteristics of Firewalls

There are the following main types of firewalls:

1. Packet Filtering Firewall

The most basic type of firewall filters based on packet header information (source/destination IP address, port number, etc.).

• Pros: Fast processing, low resource consumption
• Disadvantage: The content of the communication itself cannot be inspected

2. Stateful Inspection Firewall

Monitor the state of communication (sessions) and allow only established legitimate communications.

• Benefits: Higher security, dynamic port usage
• Disadvantages: Higher processing load than packet filtering type

3. Next-Generation Firewall (NGFW)

In addition to traditional Firewall features, Firewall integrates features such as IPS (Intrusion Prevention System), Application Control, and URL/Content Filtering.

• Benefits: Comprehensive protection, centralized management
• Disadvantages: High implementation and operation costs

4. Cloud Firewall

Firewall services provided in cloud environments, such as AWS Security Groups and Azure Network Security Groups.

• Benefits: Integration with cloud infrastructure, scalability
• Disadvantages: Challenges in linking with on-premises environments

Main Threats Firewalls Defend Against

Firewall protects your network from major threats, including:

1. Unauthorized Access

Block access from unauthorized IP addresses and traffic to unauthorized ports.

2. Port Scanning

Detect and block attackers exploring open ports on target systems.

3. DoS/DDoS attacks

Mitigate attacks that overload systems by flooding them with traffic.

4. Botnet Communication

Blocks communication between malware-infected devices and the C&C server (command and control server).

5. Data Leakage

It monitors suspicious communications from inside to outside and prevents the leakage of sensitive information.

Benefits and Challenges of Firewall Implementation

Pros

1. Establish perimeter defenses: Clearly protect the boundaries of your internal network and the internet
2. Reduce attack surface: Open only the services and ports you need to minimize the attack surface
3. Compliance: Helping to comply with various regulations and security standards
4. Enhanced Visibility: Enabling Monitoring and Analysis of Network Traffic

Challenges

1. Excessive Restriction: Risks of overly strict rules reducing operational efficiency
2. Operational Burden: Requires ongoing work such as rule management and log analysis
3. Bypass Risks: Potential for Firewall Bypass with VPNs and Encrypted Communications
4. Technological Evolution: Continuous Updates Required to Keep Up with New Attack Techniques

Best Practices for Firewall Deployment and Operations

Here are some best practices for effective Firewall operations:

1. Principle of Least Privilege

• By default, reject all communications and allow only necessary communications
• Closed ports and services that are not in use
• Regularly review and delete rules that are no longer needed

2. Defense-in-Depth Approach

• Place firewalls between internal segments as well as boundary firewalls
• Combine with other security measures such as WAF, IPS/IDS
• Endpoint security is also used together

3. Proper Rule Management

• Carefully prioritize rules (be careful not to override certain rules by higher-level rules)
• Add a description to the rule to clarify the purpose and responsibility
• Establish change management processes and record rule changes

4. Continuous Monitoring and Optimization

• Detect security events with regular analysis of logs
• Adjust rules as traffic patterns change
• Regular updates for new threats and vulnerabilities

Streamlining Firewall Operations with SOC Services

Effective operation of a firewall requires expertise and resources. By utilizing SOC (Security Operation Center) services, you can benefit from:

1. 24/365 Monitoring: Real-time security event detection and response
2. Expert Rule Optimization: Balancing Excessive Restrictions and Vulnerabilities
3. Incident Response: Rapid analysis and response when attacks are detected
4. Leverage threat intelligence: Update rules based on the latest attack trends

Summary: Utilizing Firewalls Effectively

Firewalls continue to play an important role as the foundation of network security. However, deployment alone does not provide sufficient protection.

Key points for effective security measures:

1. Position the Firewall as part of your defense-in-depth
2. Set Proper Rules and Continuously Review
3. Early Threat Detection by Monitoring and Analyzing Logs
4. Leverage expertise such as SOC services Colorkrew SecuritySOC service provides support for the introduction and operation of Firewall!

You can also leverage Colorkrew Security's unique knowledge to properly filter Firewall and WAF logs to remove noise, extract, organize, and automate important logs, significantly reducing operational burdens.

If you are an enterprise that is experiencing challenges in implementing Firewall or would like to learn more about SOC services, please contact Colorkrew.