There's no scaling a secure firewall

Firewalls are an essential element of network protection, though they're not the whole package. Selecting the most appropriate firewall for a network configuration is only part of the job; you must also configure it correctly and maintain it properly by updating it to reflect newly disclosed vulnerabilities and closing ports against new network threats.The first step is to set a policy for firewall use. The policy you choose is far more important than the brand of firewall, as long as the firewall is sufficiently robust to handle your policy rules and the traffic load.It's critical to specify and maintain an up-to-date policy based on threat levels, including newly discovered or emerging threats, the value of your information and the specific network configuration. Despite the fact that each firewall configuration is specific to your installation, there are some general rules:If the firewall runs on a host operating system, that OS must be hardened as completely as possible, or hackers will simply go around the firewall through known or newly disclosed OS vulnerabilities.The National Institute of Standards and Technology's Special Publication 800-41 recommends the following types of network traffic always should be blocked:There is no such thing as a set-and-forget firewall. New threats emerge all the time, and often the best ? or only ? way to protect a network is to block some specific port until vendors release patches, and you have time to apply them. This is no rare event; it occurs at least every month for many networks.Finally, there must be a fixed schedule for verifying that the firewall is applying the written policy. This should probably be a combination of regularly checking hard-copy printouts of the actual firewall settings against the stated policy and actual testing.No system can be considered secure without periodic real-world tests of firewall policies, in which you attempt to penetrate the firewall, confirming not only that policies are programmed but also that the firewall is able to properly apply them in every instance. This physical test should be made after any vulnerability in the security software is discovered and patched.For any agency permitted to use outside tests, Gibson Research Corp. () makes ShieldsUP, a free firewall-testing program that can run online to test the first 1,056 TCP ports. You might want to bookmark this even if you only use it as a quick reference, because moving the cursor over the map generated by the site produces a quick report on each port's function.ShieldsUP also displays your browser's Web server requests, which may be revealing information you don't want freely disseminated, such as your server's software and version.If nothing else, the GRC site provides a lot of basic security-related information.Many agency installations will need to purchase commercial test software to verify firewall protection. It would be nice if you could simply install a firewall and feel secure. But even properly configured firewalls are far from perfect, especially since they have been found to contain bugs or vulnerabilities. Check Point Software Technologies Ltd. has reported vulnerabilities in its VPN-1 and FireWall-1 products so far this year. All of these vulnerabilities were patched, but the threats were highly critical because most would allow a remote attacker to run arbitrary code.Zone Labs' ZoneAlarm firewall was discovered to have a highly critical vulnerability in February, one that would allow an attacker to bypass the firewall and take control of the network.Every firewall or other security tool is likely to have some hidden vulnerability that will someday surface with greater or lesser impact, so administrators need to monitor new threats not just to operating systems and applications but also to their security software itself.John McCormick is a freelance writer and computer consultant. E-mail him at .