In this lesson, we're going to discuss Firewalls.
Now, a firewall is a network security device
or software that monitors and controls incoming
and outgoing network traffic based
on predetermined security rules
to protect a network from unauthorized access
and potential threats.
Firewalls can be hardware-based appliances
or specialized software installed on a client or server
to perform this function.
The primary role of a firewall
is going to be to inspect and control traffic,
try and enter or leave a network's boundary.
By placing a firewall in front of a given network segment,
we can create what is known as a Screened Subnet.
Now, a Screened Subnet,
also known as a Dual-homed Host configuration,
plays a crucial role in network security
by acting as a protective barrier
between external untrusted networks,
and internal trusted networks.
Under this setup, a Dual-homed Host
will often be equipped with a packet-filtering firewall
or other security mechanisms
by sitting between these networks.
This effectively helps to screen and filter traffic
as it passes from the untrusted network
to the trusted network,
and it will serve as a buffer
that's going to inspect and control incoming traffic
so that only legitimate
and authorized data flows can make it through
to your internal network,
and everything else will be blocked,
including potential threats
and unauthorized access attempts.
Understanding how to configure
and maintain Screened Subnet
is really essential for network administrators
and security professionals to be able to enhance
the security posture of their networks
and protect the sensitive information
that is contained inside those networks
from an external threat.
Now to create a screened subnet,
you must first install a firewall into your network.
There are many different types of firewalls out there,
including Packet filtering,
Stateful, Proxy, Dynamic packet filtering,
and Kernel proxy firewalls.
Each type of firewall is going to focus on either
a more or less thorough inspection of your network traffic.
As with everything in network security,
there's always going to be a performance trade-off based upon
how deep of an inspection we want to do.
If your firewall does a more in-depth inspection,
that device is actually going to slow down its throughput,
because it's going to take more time
to go through each one of the ACL rules
and inspect each of the packets against those rules.
And in turn, this will negatively affect
our network's efficiency
and increase our network latency.
Now, on the other hand,
if you do a more cursory inspection,
this is actually going to be a faster firewall,
but you're not going to get as good of security.
Now, the most efficient firewalls
in terms of maximizing your throughput
are going to be our Packet Filtering Firewalls.
These firewalls are going to do the minimum level of inspection
because they're only going to inspect the header of the packet
to determine if the traffic is going to be allowed
or denied based upon the IP address
and the port number contained in that packet.
This type of firewall will act very similarly
to a router using an access control list
that's going to be placed between subnets inside
of a given network.
Unfortunately,
these simple firewalls cannot prevent IP spoofing,
packet fragmentation attacks,
or attacks against the TCP handshake itself
because they're limited in their inspection
to the packet header of that traffic.
Since these firewalls operate based on ports
and protocols being used,
they're also known as a Layer 4 firewall
because they operate at Layer 4 of the OSI model.
Now, the next one we have
is what's known as a Stateful Firewall.
A Stateful Firewall is going to be used to track the state
of all the connections and requests
that are going into and out of the network.
So in addition to a simple header inspection
that's being performed by the packet filtering firewall,
a Stateful Firewall will also know
if an outbound request is made from our network.
And then it's going to use that information
to determine if it's going to allow
or accept traffic coming into the network
from a remote host going towards your network.
For example, when you attempt
to visit a website like diontraining.com,
your Stateful Firewall will remember this,
and then it's going to allow the return traffic
from my web server, diontraining.com,
to go back to your host
because it remembers that you asked for the information
that I'm now presenting to you as part of my delivery.
Now, a Proxy Firewall
is our third type we're going to talk about.
And a Proxy Firewall is going to be placed between an internal
or external connection in a network,
and it's going to make connections on behalf
of your other endpoints.
Now, there are two types of Proxy Firewalls.
These are known as a circuit level
or an application level proxy firewall.
Now, a circuit level firewall like a SOCKS firewall
is going to operate at the session layer
or Layer 5 of the OSI model.
An application level proxy, on the other hand,
is going to do a deeper packet inspection
that's going to conduct a different proxy function
for each type of application
at Layer 7 of the OSI model.
For example, an application level proxy can be used to read
and filter HTTP traffic differently
than it would do for FTP traffic
because it uses this deep packet analysis.
Now, a deep packet analysis is going to create
a larger impact to the performance
and efficiency of our firewalls,
and this allows traffic to go through
the network much more slowly.
For this reason, most application level proxies
are going to be best positioned inside of your network
when they're located as closely as possible
to the application server that you're trying to protect.
Another name for an application level proxy
is known as a Layer 7 firewall.
Now, the next type of firewall we need to cover
is known as a Kernel Proxy Firewall.
A Kernel Proxy Firewall
is also known as a Fifth Generation Firewall,
and they're going to be placed between two systems
and create connections on their behalf,
much like the other firewall types we've already discussed.
The main distinction of a Kernel Proxy Firewall
is that it has a minimal impact
to performance on our network,
even while conducting its full inspection of the packet
at every single layer.
These devices should be placed as close as possible
to the system they're trying to protect inside
of the network as well to give you the best
and most efficient usage of them.
Now, because firewalls have become such
an integral security device in our networks,
they're constantly being evolved
to provide us with better features and more security.
There are three such evolutions
that we've seen in recent years,
including things like an NGFW
or Next Generation Firewall,
the UTM, or Unified Threat Management Firewall,
and the WAF, or Web Application Firewall.
All of these are going to focus on adding
and optimizing application
and protocol aware technologies
to provide us with even better levels of security.
Now, the first one we're going to cover here
is a Next-Generation Firewall.
And the Next-Generation Firewall
is going to attempt to overcome the shortcomings
of a traditional Stateful Firewall
by creating firewalls that are application aware.
This means that these firewalls
can distinguish between different types of traffic
that specific applications they're sending into
or out of a given network.
Because of this, these devices can conduct
a single deep packet inspection of the traffic,
and then they can utilize signature-based intrusion
protection measures when they're being installed
as an inline device inside your network configuration.
Additionally, these Next-Generation Firewalls are fast,
and they have little impact to your network's performance.
These devices also have full-stack visibility
over the traffic,
and they can provide more granular control over the traffic
by creating custom signatures inside this firewall.
Next-Generation Firewalls are considered
to be complex devices,
and they have the ability
to integrate with several other security products too.
Unfortunately, this can lead
to our organization becoming reliant
on a single vendor over time
because these different firewalls
are going to be configured to work
with their product lines only.
Now, these firewalls are going to be much more complex
to manage than a single packet-filtering firewall
or a Stateful Firewall would be,
but they do add a lot of security for us as well.
Now, it's important to note
that many organizations have moved
from a Next-Generation Firewall into something known
as a UTM, or Unified Threat Management Firewall.
Now, a Unified Threat Management Firewall
is going to provide us the ability
to conduct numerous security functions
from within a single device or network appliance.
These devices include the functionality
of multiple specialized devices,
including network firewalls,
network intrusion prevention systems,
gateway antivirus and antispam capabilities,
virtual private network concentration,
content filtering, load balancing,
and data loss prevention,
all from within a single network appliance.
These Unified Threat Management devices
have a ton of benefits,
including reducing the number of devices
that technicians need to learn,
operate, and maintain,
and this can overall help to decrease your cost
of providing these protections.
But there are still some drawbacks to using a UTM.
Now, the largest issue with using
a Unified Threat Management device
is that they become a single point of failure
in your network.
If that device fails, for example,
we don't just lose our firewall anymore,
we're now losing our firewall,
our antivirus, our intrusion prevention system,
and all the other things we just mentioned.
All of our security stack can be wrapped up
in this one device, which is great,
but it also means if we lose that device,
we lose our entire security stack.
So our organization needs to consider both the advantages
and disadvantages of using something like
a Unified Threat Management system before deciding
to implement it inside of your network architecture.
Some advantages of using
a Unified Threat Management device
include lower upfront costs,
lower maintenance, and lower power consumption,
because all these functions reside
in a single rack mounted device.
Now, they're also going to be easier to install and configure
because you don't have to deal with multiple devices
that each have a single function,
and instead, they're all integrated into this one device
and this gives us a lot of great benefits.
But the biggest disadvantage here
is that it does create that single point of failure,
and they often lack the detail provided
by more specialized tools,
and their performance can oftentimes not be
as efficient as a single function device might be.
While Unified Threat Management devices work well
for the most part,
they do utilize separate individual engines
for each function that they're trying to perform inside
of their security inspections.
Whereas, when you're using a Next-Generation Firewall,
you're going to be using a single more efficient engine
for a firewall.
But with a UTM,
you're using something where
it's not going to be necessarily as efficient,
but it's good enough to do most of the functions you want.
And so if network speed and efficiency
is going to be your primary concern in your organization,
you're going to want to consider using
a Next-Generation Firewall
over a Unified Threat Management device.
But if your organization does decide
to use a Unified Threat Management device,
you would want to place it between your LAN
and the connection to the Internet,
just as if it was a gateway firewall
as an inline configured device.
Finally, we need to talk about a specialized type
of firewall known as a WAF or Web Application Firewall.
Now, a Web Application Firewall
is going to be focused on the inspection of HTTP traffic,
known as Hypertext Transfer Protocol traffic.
Now, this can be either HTTP or HTTPS traffic depending
on your Web Application Firewall.
Your Web Application Firewall
will utilize specific rule sets
to prevent common attacks against web applications,
including things like cross-site scripting
and SQL Injections.
Web Application Firewalls can also be installed
as separate appliances or as a type of software plugin
on your web server.
This type of firewall can be either installed inline
or out-of-band inside of your network.
If it's going to be placed inline,
the device is going to be placed between your network firewall
and the web servers themself.
By utilizing this inline placement,
these devices can prevent live attacks,
but they're also going to slow down your web traffic,
and sometimes, they'll block legitimate traffic by mistake.
Now, if it's placed in an out-of-band configuration,
it's just going to receive a copy of all the traffic
that was destined for your web server using a mirrored
or SPAN port off of a switch.
This is going to be a very non-intrusive way
to conduct your web application filtering,
but in this configuration,
it cannot block live web traffic
if you're using this configuration.
Instead, it works more like an intrusion detection system
because it sees all the information
and it can then alert on it,
but it can't actually block it if you're not inline.
So as you can see,
there are lots of different choices
when it comes to firewalls
when you're designing the network architecture
for your organization.
You can choose to use Layer 4 firewalls,
Layer 7 firewalls,
Next-Generation Firewalls,
Unified Threat Management systems,
and Web Application Firewalls,
depending on your specific use case.
A Layer 4 firewall is going to operate
at the transport layer
and make filtering decisions based
on the information about port numbers
and protocol data without inspecting the content
of its individual data packets.
A Layer 7 firewall, on the other hand,
is also known as an application proxy
or application firewall,
and it operates at the application layer
and can inspect, filter,
and control traffic based on the content
and characteristics of the data's payload.
A Next-Generation Firewall or NGFW
is an advanced security appliance
that combines traditional firewall capabilities
with additional features like intrusion detection,
application awareness,
and advanced threat protection.
A Unified Threat Management Firewall, on the other hand,
is a fully comprehensive security solution
that integrates multiple security features,
including firewalls, antivirus, intrusion detection,
and content filtering into a single unified platform.
And finally, we have a Web Application Firewall.
A Web Application Firewall
is going to be focused on the the inspection of traffic
at the HTTP or HTTPS levels
to be able to use specific rule sets
to prevent common attacks against your web applications,
including cross-site scripting and SQL Injections.
So remember these different types of firewalls
and what each one is going to be used for,
so you'll be a successful cybersecurity practitioner.