Introduction of Firewall in Computer Network

A firewall is a network security device, either hardware or software-based, which monitors all incoming and outgoing traffic and based on a defined set of security rules it accepts, rejects or drops that specific traffic. Accept : allow the traffic Reject : block the traffic but reply with an “unreachable error” Drop : block the traffic with no reply A firewall establishes a barrier between secured internal networks and outside untrusted network, such as the Internet.

History and Need for Firewall

Before Firewalls, network security was performed by Access Control Lists (ACLs) residing on routers. ACLs are rules that determine whether network access should be granted or denied to specific IP address. But ACLs cannot determine the nature of the packet it is blocking. Also, ACL alone does not have the capacity to keep threats out of the network. Hence, the Firewall was introduced. Connectivity to the Internet is no longer optional for organizations. However, accessing the Internet provides benefits to the organization; it also enables the outside world to interact with the internal network of the organization. This creates a threat to the organization. In order to secure the internal network from unauthorized traffic, we need a Firewall.

How does Firewall work?

Firewall match the network traffic against the rule set defined in its table. Once the rule is matched, associate action is applied to the network traffic. For example, Rules are defined as any employee from HR department cannot access the data from code server and at the same time another rule is defined like system administrator can access the data from both HR and technical department. Rules can be defined on the firewall based on the necessity and security policies of the organization. From the perspective of a server, network traffic can be either outgoing or incoming. Firewall maintains a distinct set of rules for both the cases. Mostly the outgoing traffic, originated from the server itself, allowed to pass. Still, setting a rule on outgoing traffic is always better in order to achieve more security and prevent unwanted communication. Incoming traffic is treated differently. Most traffic which reaches on the firewall is one of these three major Transport Layer protocols- TCP, UDP or ICMP. All these types have a source address and destination address. Also, TCP and UDP have port numbers. ICMP uses type code instead of port number which identifies purpose of that packet. Default policy: It is very difficult to explicitly cover every possible rule on the firewall. For this reason, the firewall must always have a default policy. Default policy only consists of action (accept, reject or drop). Suppose no rule is defined about SSH connection to the server on the firewall. So, it will follow the default policy. If default policy on the firewall is set to accept, then any computer outside of your office can establish an SSH connection to the server. Therefore, setting default policy as drop (or reject) is always a good practice.

How does Firewall work?

Generation of Firewall

Firewalls can be categorized based on their generation.

1. First Generation- Packet Filtering Firewall:  

   Packet filtering firewall is used to control network access by monitoring outgoing and incoming packets and allowing them to pass or stop based on source and destination IP address, protocols, and ports. It analyses traffic at the transport protocol layer (but mainly uses first 3 layers). Packet firewalls treat each packet in isolation. They have no ability to tell whether a packet is part of an existing stream of traffic. Only It can allow or deny the packets based on unique packet headers. Packet filtering firewall maintains a filtering table that decides whether the packet will be forwarded or discarded. From the given filtering table, the packets will be filtered according to the following rules:

1. Incoming packets from network 192.168.21.0 are blocked.
2. Incoming packets destined for the internal TELNET server (port 23) are blocked.
3. Incoming packets destined for host 192.168.21.3 are blocked.
4. All well-known services to the network 192.168.21.0 are allowed.

5. Second Generation- Stateful Inspection Firewall: 

   Stateful firewalls (performs Stateful Packet Inspection) are able to determine the connection state of packet, unlike Packet filtering firewall, which makes it more efficient. It keeps track of the state of networks connection travelling across it, such as TCP streams. So the filtering decisions would not only be based on defined rules, but also on packet’s history in the state table.

6. Third Generation- Application Layer Firewall : 

   Application layer firewall can inspect and filter the packets on any OSI layer, up to the application layer. It has the ability to block specific content, also recognize when certain application and protocols (like HTTP, FTP) are being misused. In other words, Application layer firewalls are hosts that run proxy servers. A proxy firewall prevents the direct connection between either side of the firewall, each packet has to pass through the proxy. It can allow or block the traffic based on predefined rules. Note: Application layer firewalls can also be used as Network Address Translator(NAT).

7. Next Generation Firewalls (NGFW): 

   Next Generation Firewalls are being deployed these days to stop modern security breaches like advance malware attacks and application-layer attacks. NGFW consists of Deep Packet Inspection, Application Inspection, SSL/SSH inspection and many functionalities to protect the network from these modern threats.

What is Magic Firewall?

“Magic Firewall” is a term used to describe a security feature provided by the web hosting and security company Cloudflare. It is a cloud-based firewall that provides protection against a wide range of security threats, including DDoS attacks, SQL injections, cross-site scripting (XSS), and other types of attacks that target web applications.

The Magic Firewall works by analyzing traffic to a website and using a set of predefined rules to identify and block malicious traffic. The rules are based on threat intelligence from a variety of sources, including the company’s own threat intelligence network, and can be customized by website owners to meet their specific security needs.

The Magic Firewall is considered “magic” because it is designed to work seamlessly and invisibly to website visitors, without any noticeable impact on website performance. It is also easy to set up and manage, and can be accessed through Cloudflare’s web-based control panel.

Overall, the Magic Firewall is a powerful security tool that provides website owners with an additional layer of protection against a variety of security threats.

What is Firewall UTM

Types of Firewall

Firewalls are generally of two types: Host-based and Network-based.

1. Host- based Firewalls : Host-based firewall is installed on each network node which controls each incoming and outgoing packet. It is a software application or suite of applications, comes as a part of the operating system. Host-based firewalls are needed because network firewalls cannot provide protection inside a trusted network. Host firewall protects each host from attacks and unauthorized access.
2. Network-based Firewalls : Network firewall function on network level. In other words, these firewalls filter all incoming and outgoing traffic across the network. It protects the internal network by filtering the traffic using rules defined on the firewall. A Network firewall might have two or more network interface cards (NICs). A network-based firewall is usually a dedicated system with proprietary software installed.

Advantages of using Firewall

1. Protection from unauthorized access: Firewalls can be set up to restrict incoming traffic from particular IP addresses or networks, preventing hackers or other malicious actors from easily accessing a network or system. Protection from unwanted access.
2. Prevention of malware and other threats: Malware and other threat prevention: Firewalls can be set up to block traffic linked to known malware or other security concerns, assisting in the defense against these kinds of attacks.
3. Control of network access: By limiting access to specified individuals or groups for particular servers or applications, firewalls can be used to restrict access to particular network resources or services.
4. Monitoring of network activity: Firewalls can be set up to record and keep track of all network activity. This information is essential for identifying and looking into security problems and other kinds of shady behavior.
5. Regulation compliance: Many industries are bound by rules that demand the usage of firewalls or other security measures. Organizations can comply with these rules and prevent any fines or penalties by using a firewall.
6. Network segmentation: By using firewalls to split up a bigger network into smaller subnets, the attack surface is reduced and the security level is raised.

Disadvantages of using Firewall

1. Complexity: Setting up and keeping up a firewall can be time-consuming and difficult, especially for bigger networks or companies with a wide variety of users and devices.
2. Limited Visibility: Firewalls may not be able to identify or stop security risks that operate at other levels, such as the application or endpoint level, because they can only observe and manage traffic at the network level.
3. False sense of security: Some businesses may place an excessive amount of reliance on their firewall and disregard other crucial security measures like endpoint security or intrusion detection systems.
4. Limited adaptability: Because firewalls are frequently rule-based, they might not be able to respond to fresh security threats.
5. Performance impact: Network performance can be significantly impacted by firewalls, particularly if they are set up to analyze or manage a lot of traffic.
6. Limited scalability: Because firewalls are only able to secure one network, businesses that have several networks must deploy many firewalls, which can be expensive.
7. Limited VPN support: Some firewalls might not allow complex VPN features like split tunneling, which could restrict the experience of a remote worker.
8. Cost: Purchasing many devices or add-on features for a firewall system can be expensive, especially for businesses.

Real-Time Applications of Firewall

1. Corporate networks: Many businesses employ firewalls to guard against unwanted access and other security risks on their corporate networks. These firewalls can be set up to only permit authorized users to access particular resources or services and to prevent traffic from particular IP addresses or networks.
2. Government organizations: Government organizations frequently employ firewalls to safeguard sensitive data and to adhere to rules like HIPAA or PCI-DSS. They might make use of cutting-edge firewalls like Next-generation firewalls (NGFW), which can detect and stop intrusions as well as manage access to particular data and apps.
3. Service providers: Firewalls are used by service providers to safeguard their networks and the data of their clients, including ISPs, cloud service providers, and hosting firms. They might make use of firewalls that accommodate enormous volumes of traffic and support advanced features such as VPN and load balancing.
4. Small enterprises: Small firms may use firewalls to separate their internal networks, restrict access to specific resources or applications, and defend their networks from external threats.
5. Networks at home: To guard against unwanted access and other security risks, many home users employ firewalls. A firewall that many routers have built in can be set up to block incoming traffic and restrict access to the network.
6. Industrial Control Systems (ICS): Firewalls are used to safeguard industrial control systems against illegal access and cyberattacks in many vital infrastructures, including power plants, water treatment facilities, and transportation systems.

Introduction of Firewall Computer Network,How Firewall Works Introduction of Firewall in Computer Network, A firewall is a network security device,hardware or software-based, it monitors all incoming & outgoing traffic

More about Firewalls

1. Difference between Traditional Firewall and Next Generation Firewall
2. Difference between Hardware Firewall and Software Firewall
3. Types of Network Firewall
4. Basic Network Attacks in Computer Network
5. Introduction of MAC Address in Computer Network
6. Zone-based firewall
7. Firewall methodologies
8. Zone-based firewall Configuration
9. How to setup firewall in Linux?
10. Packet Filter Firewall and Application Level Gateway

For more details, Please visit Firewall Firm

Are Startups or Small Enterprises Vulnerable to Hacking? Let’s see how we can help them…

The first half of 2017 saw ransomware attacks on a scale never seen before, with the spread the WannaCry ransomware-worm in May, followed by the outbreak of the self-spreading Petya ransomware in June. Year 2017 and 2018 has seen some bigtime identity theft like Facebook Security Breach Exposes Accounts of 87 Million Users and Equifax’s Identity Theft exposes 143 million U.S. consumers’ Social Security Numbers, dates of birth, and other sensitive personal information. The most recent revelation from Marriott is that as many as 500 million customer data has been hacked from the customer database of Starwood Hotels. Customers’ credit card information, name, mailing address, phone number, email address, passport number, date of birth, gender, etc. are part of the compromised data.

Last year’s NotPetya malware attack provided clear examples of how falling victim to cybercriminals can cost businesses dearly, with Reckitt Benckiser, FedEx and Maersk among those facing losses of hundreds of millions due to the impact of system downtime. For example, Maersk had to reinstall 4,000 servers, 45,000 PCs, and 2,500 applications, with the need to do so impacting on the shipping firm’s ability to do business.

Global businesses are losing the equivalent of nearly one percent of global GDP (Gross Domestic Product) a year to cybercrime, and it is impacting job creation, innovation and economic growth. So says a report from cybersecurity firm McAfee and the Center for Strategic and International Studies (CSIS), which estimates that cybercrime cost the global economy nearly $600 billion a year in 2017 — up from a 2014 study which put the figure at $445bn.

The Asia Pacific region alone has lost $171 billion to cybercrime in 2017. No digital form of financial instruments are opaque from cyber-attacks, even the much touted peer-to-peer BlockChain based NEM cryptocurrencies – Tokyo-based cryptocurrency exchange Coincheck, where almost 58 billion yen of NEM coins were stolen. That wasn’t the first of its kind, but it was certainly one of the biggest thefts to have occurred.

These cyber-attacks and security breaches are no longer script-kiddies or youngsters sitting in their basements and attacking your IT systems, but it is an organized professional service known as Cybercrime-as-a-Service. It is becoming more mature; it’s now serious, organized crime that are using these services. Some reports say that “no single cybercriminal organization can specialize in every form of attack or nefarious activity, so there’s an increasing market for hiring of skills or purchasing of toolsets to help facilitate criminal activity — be they online, physical or both. When they require something outside their own area of competency, they need only to find someone offering the appropriate tool or service in the digital underground; they can simply buy access to what they need. They run these operations secretly with no-mercy.”

The above were the stories of some of the Global Fortune 500 corporations. It won’t be difficult to imagine the state of SMEs. Some study says that most small businesses are incredibly vulnerable to a cyber-attacks. They fall into preys of all sorts of ways the bad guys can get log-in credentials and other critical data from your business – hackers can send you a fake phishing email that looks legitimate (for example, the hackers will incorporate some personal info that they easily find on social media) or have you click on an innocuous link that is in fact infected with malware, or covertly install key-logging software on your computer that allows them to see what you type, and worse. Logging on to a spoofed site give the hackers everything he needed to potentially compromise the business.

As the cyber-attacks impact economic growth, it is becoming a big headache for the entrepreneurs. Instead of focusing on the business and taking it to new heights, now they will have to deal with this and making them less competitive. Some of them have started taking cyber security seriously. They hire third-party vendors to handle security. Many of them do not have that kind of resources and most of them do not know from where to star. If they can do something to prevent cybercrime from happening in the first place, that is going to be a win for them. So, what can they do minimally?

1. Get Security Training for your staff: They need to know what a phishing scam is, what to look for and what your cybersecurity protocols are.
2. Use a Firewall & Virtual Private Network (VPN) in order to hide IP addresses and encrypt internet connections.
3. Implement some sort of Identity & Access Management to manage who can access to your business critical IT systems, when can access them and from where can access them. Also, implement Password Management for the users.
4. Enable two-factor authentication: This means that after you login to a site/IT System, you receive either an email or a text with a code (aka One-Time Password i.e. the second authentication). You enter that code to get in. Cyber-criminals will find it difficult to crack that to use.
5. Install Cyber Security Software Suite: Some of the choices include Sophos, McAfee, Symantec, Bitdefender, and Trend Micro. The average cost is about $50 per user a year.
6. Need a good teammate or a consultant who knows information security: Beyond implementing the hardware and software tools for security and getting help from the experts of these software/hardware vendors, the options include hiring a techie expert or using a third party vendor.

Once you have taken these steps, you and your employees will have some celebrations!