Why do I need a Firewall?

The definition of a Firewall

The meaning of the word “firewall” translates to “a wall or partition designed to inhibit or prevent the spread of fire”. In the case of cybersecurity, it stops the fire from coming into the network. A firewall can be either software or hardware-based and is generally implemented at the perimeter or entry/exit points of a network. Traditionally, its sole purpose was to prevent unauthorised access to networks and systems but as technology has progressed, so have firewalls.

Why do I need a Firewall, and what does a Firewall do?

A firewall is a critical part of your networks security system. Its purpose is to monitor, protect and detect all traffic in and out of your network. Think of it like a door-man to a venue. It checks and only allows people in that are permitted. Similarly, a firewall prevents all traffic regardless of origin and only lets network traffic that an allowed rule.

How does a Firewall work?

Firewalls can be either software or hardware and essentially work as filters on all traffic, inbound and outbound. The Firewall will actively scan network traffic (packets) based on source, destination, port and content. Should any of these criteria be suspect or not permissible, then actions will be taking to stop it from continuing. With newer security technologies, traffic can be checked for code and compared against known vulnerabilities and addressed as needed. There are several ways firewalls that firewalls can police network traffic. These methods often include

Packet Filtering: The internet works on network communication, and protocols do this. At a fundamental level, these protocols have packets that contain information. A firewall will check all of these packets and ensure they are permitted to continue through the Firewall. It does this by comparing it against a defined filter and also a database of known cyber threats.

Stateful Packet Inspection: This filtering mechanism opens every packet that passes through the firewall network interface, checks it based on several criteria, and then takes the appropriate action. This capability has allowed for a large increase in successful active threat detection and allows for collaboration with cyber threats discovered with other vendors

Proxy Service: This capability essentially acts as an intermediary to carry and receive traffic forward. It ensures that the traffic cannot connect directly to the destination and so provides an extra layer of protection. It has its limitation in that it’s often limited to web browsing protocols.

How does a Firewall protect my network?

A firewall inspects every packet of traffic (TCP/IP) destined to and from your network. It performs various analysis based on its source, destination and port. It will then compare that against a set of rules defined in its rule base, and if it is allowed, the traffic will be let through. If, on the other hand, it is not permissible, then the Firewall will drop the packets, and all network communications will cease for that traffic.

So, how does a Firewall protect me against cyber threats?

Having protective filters and inspection technology in place around your networks, servers, and devices ensures that you have a robust intrusion detection and response capability.

Security and cyber threats are ever-evolving, and the need for a robust firewall solution within your network is a must. A firewall will protect you against several attack mechanisms, including;

Viruses: Are what they say. Small programs replicate and breed across networks and need very little to spread and cause security issues. The threats they pose can vary depending on their payload and the subsequent damage caused, but some examples include; erasing data, deleting files, encrypting system folders, sending data from the device to a remote location, etc. Whilst many firewalls have antivirus capability, they are often complemented with an endpoint security solution.

Spam: Spam is often deemed harmless but can be the first phase of an exploratory cyber-attack. Spam often will contain links to external websites, which then dupe the user in to provide credentials. From there, the next phases of the attack continue. Firewalls can reduce Spam by referring to a filter and database for known threats, so when it arrives and when it is clicked, a block will be implemented. Your company must provide its users with Cybersecurity awareness training to spot such instances of Spam.

Remote Connection Attempts: Remote login attempts across firewalls are widespread, and you can assume that would-be hackers will try this multiple times per day. They will scan your network and IP addresses to see what is open and then make connection attempts. Ensuring you have a robust access policy is very important. Employing MFA and Whitelisting and active monitoring and alerting capability will go along way in addressing the threat.

Denial of Service: It is probably one of the most common types of cyberattacks. A denial of service (DOS attack) floods the device with lots of traffic, which then causes the Firewall or Server to malfunction or slow down. The majority of next-generation firewalls have a way to address such attacks, including banning the IP address or re-routing the traffic to another location.

Backdoors: Practically every application, service or device will have had one form of vulnerability. It is up to the vendor of the service to ensure they deliver updates to address these issues. However, these are often missed or take too long to release, so hackers focus on exploiting these vulnerabilities. A Firewall will have the capabilities to address these backdoors using application control or traffic filtering,

Malicious Macros: Macros are less of an issue now, but they can still cause havoc if let through; by launching malware payloads. Their goal is to start processes that they can cause unwanted activity. They can delete files, start operations, send out emails, crash the operating system etc.

Geographic Location Blocking: The ability to block traffic from a specific location can be a powerful capability. Firewalls can protect against any access based on countries, so if you know your business will not operate in a particular region that is a known threat, then this capability must be considered.

What are the benefits of a Firewall?

Firewalls are an essential component of an overall Cybersecurity tool-set. They play a crucial part in managing and monitoring threats that will keep your systems and data secure. Let us now summarise some of these benefits

Prevents Hacking: Cyber threats are ever-increasing across the world, and hackers are looking for any opportunity to exploit them. Using a Firewall in your cybersecurity arsenal makes it that much harder for them to succeed, and so its use is classed as essential.

Stop Virus and Malware Attacks: Recent events have shown us that a business can be shut down within days once it suffers from a virus or malware attack. Having a Firewall that can monitor, manage and deter these attacks will provide that extra layer of security that is needed.

Privacy Protection: A Firewall will help keep your data and assets safe from cyber attacks and cyber threats. Nobody likes their data to be stolen, and unfortunately, when this does occur, there are significant privacy issues that arise.

Monitoring and Alerting: The ability to monitor and alert on threats and activity is key to understanding what is happening across your networks. Leveraging this capability will help your cyber team understand, detect and prevent attacks but reacting based on live events.

Teck Genius have extensive experience in network protection and firewall technologies. Being vendor agnostic, we can help implement, manage and support the right solution for your needs. For a no-obligation chat, please contact us here.