Abstract
This chapter describes various firewall conventions, and how these technologies operate when deployed on a corporate network. Terms associated with firewalls, as well as related concepts, are also discussed. Highly neglected internal security mechanisms utilizing firewall technologies are presented, including host-based firewalls and the more novel distributed firewall implementation. Finally, a section on how to perform a cost-benefit analysis when deciding which firewall technologies to implement is included. The chapter is designed as an introductory tutorial to the underlying concepts of firewall technologies. This understanding should provide a starting point for both systems support specialists implementing network security and researchers who are interested in firewall technologies.
TopWhat Is A Firewall
The term firewall historically gets its name from the physical concrete barriers running from the basement to the roof in buildings designed to limit the spread of fire and heat from one portion of the building to another (Whitman & Mattord, 2005). This model is mirrored with the concept of a firewall as it pertains to computer networks. Firewalls are typically thought of as devices placed between the internal corporate network and the external Internet designed to keep the “bad guys” and mischievous programs out of the internal network.
Firewalls, in their simplest construct, can be defined as a collection of components placed between two networks of differing security levels (Cheswick & Bellovin, 1994). Firewalls are designed to allow certain information into and out of a group of computers, or possibly a standalone computer, by way of a controlled point of entry (Zalenski, 2002). This controlled point must use some mechanism to keep track of which types of traffic are both allowed to enter as well as leave the network or computer.
Firewall functions. Firewall technologies come in several types which implement varying functionality for protecting internal computer(s) from external threats. These different methods all have their associated advantages and disadvantages relating both to security as well as usability, speed, and manageability. Understanding these concepts can help in the evaluation of the correct firewall technology for a specific application. While the most common application of firewall technology involves leveraging the device to protect the corporate network from the outside Internet, all the underlying functional types described in this section can be used in a large external firewall down to a host-based firewall protecting a single machine.
While the primary objective of all firewalls is the same, the methods used to accomplish these goals may vary. The following is a description of three main categories of firewalls: Packet Filters, Circuit Gateways, and Application Gateways.
Packet Filtering
The first generation of firewall technology involved analyzing packets entering and leaving a network for malicious traffic. This can involve inspecting just certain header values within the packet all the way up to analyzing the actual content of the message being transmitted in the packet payload (Strassberg, Gondek, & Rollie, 2002). One of the original firewall mechanisms, packet filtering is still widely used in many firewall appliances and applications today.
Packet filtering is a broad term which subsumes two separate methodologies: static packet filtering and stateful packet inspection. Although they can operate independently, these methods are traditionally not seen in isolation from each other, so a de facto third category also exists, the hybrid packet filter.
Key Terms in this Chapter
Network Address Translation (NAT): The process of converting internal private addresses to one or more external addresses.
Distributed Firewall: A coordinated, centrally managed, host-based firewall environment for all hosts on the corporate network (Bellovin, 1999).
Packet Filtering: Examining the header and/or data of each a packet against known security vulnerabilities to decide whether or not to pass the packet along the network to the next hop or rejecting the packet.
Stateful Packet Inspection (SPI): A packet filter which keeps track of existing communications and only allows communications between the hosts involved in the current transmission.
Demilitarized Zone (DMZ): A buffer between two networks of differing security levels which usually contains certain services/hosts to which both networks require access.
Application Gateway (Proxy Server): A circuit gateway which adds the functionality for analyzing packets at the application level.
Circuit Gateway: A relay agent which acts as an intermediary between internal and external hosts.
Firewall: A device and/or software designed to protect networks of differing security levels.