What are firewalls?
A firewall is a essential component of information security which is used to protect a network or computer system from external threats such as cyber attacks, malware, viruses, unauthorized access attempts, and other types of intrusions.
What does a firewall do?
Monitors and controls incoming and outgoing network traffic, using a set of rules that allow or disallow events, up to and including blocking dangerous or unwanted transmissions. The rules that define how the system should behave are based on IP addresses, ports, protocols or applications. Network administrators configure security rules according to the needs of the organization.
Responsibilities and the need for a firewall
- Configuration: Network administrators are responsible for proper configuration. This includes defining the security rules that determine what types of traffic are allowed or blocked through the system.
- Monitoring: Administrators constantly monitor network traffic through the firewall for anomalies or suspicious activity. This may include analysis of system security logs to detect potential threats.
- Updates and patches: It is important to keep the system updated with the latest security patches to protect it from known vulnerabilities. Administrators should ensure that firmware or software is always up-to-date.
- Regular security audits: Administrators can conduct periodic security audits to evaluate the effectiveness of the firewall and make any improvements.
- Response to threats: If a threat or attempted breach is detected, administrators should take immediate steps to mitigate the threat. This may include blocking suspicious IP addresses or changing firewall rules.
- Security policies: Administrators work with other stakeholders within the organization to develop and implement security policies consistent with system use. These policies may define specific rules on permitted or prohibited traffic.
- Training and outreach: Network administrators provide training and awareness to organization staff to ensure that users understand security policies and help maintain a secure environment.
- Monitoring emerging threats: Administrators keep abreast of emerging cyber threats and update system rules and security policies accordingly.
Where to place a firewall?
These systems should usually be placed between an internal network and an external network. They can also be used internally to separate internal networks or network segments for security reasons. Common locations where they are installed include:
- Perimeter Firewall: This is the type that lies between an organization's internal network and the Internet. Its main task is to filter incoming and outgoing traffic, allowing only authorized traffic to pass through it. It can be configured to block certain types of traffic, such as unnecessary ports or known threats.
- Internal Network Firewall (Internal Firewall): This type of system is placed within the organization's network, often between different network zones. Its goal is to control and monitor traffic within the network to prevent insider threats from spreading or to restrict access to certain resources.
- Firewall on the device (Firewall Host): This type is installed on a specific device, such as a computer or server. It protects the device from unauthorized access or attacks from the network or the Internet. Hosts can be configured to control incoming and outgoing connections for specific applications.
- Application Firewall (Application Firewall): This type of system operates at a higher level than the network protocol, often at the application level. It is designed to protect specific applications or services from threats, such as SQL injection or cross-site scripting (XSS) attacks.
- Cloud-based firewall: In an era increasingly based on cloud services, cloud-based systems offer protection for an organization's cloud resources and services. They can be used to control access to cloud services such as web servers, applications, and data stored in the cloud.
- Operating system firewall: Modern operating systems often include built-in systems that can be configured to control traffic in and out of the device.
The choice of where to place the systems depends on the specific security needs of the organization and its network architecture. Typically, a combination of these systems can be used to provide a comprehensive defense against a wide range of cyber threats.
Remember!
Firewalls are an important component of the network security, but they should not be the only security measure taken. Other measures such as theantivirus, encryption, authentications and security procedures are also critical.
IT 
EN 