There's no scaling a secure firewall

The lowdown

What is it? A firewall is nothing more or less than a filter that attempts to block data streams you don't want to enter or leave your network. They accomplish this in several ways, including blocking all traffic over some ports. A firewall also can restrict traffic according to originating IP addresses or by constantly monitoring the stream of data and trying to determine which traffic is legitimate and which may be malicious.

Do I need it? If you have a computer with a static IP address, definitely yes. Sooner or later, someone will try to penetrate your system, probably within minutes of connecting to the Internet. Any telecommuter probably also needs one, especially if he or she has a cable modem or two-way satellite connection. Mobile workers need one if they are using IEEE 802.11x wireless connections.

When don't I need one? About the only people who don't need firewalls are those with standalone PCs without a modem. In many instances, enterprise network managers or even those managing smaller networks will want to place firewalls between each pair of networks even if they just interconnect and are not linked to the public Web.

Must-know info? Probably the most critical point to remember is that a firewall doesn't offer perfect protection. There are hacker tools designed to bring them down or sneak past them, and firewalls are seldom effective at blocking outgoing traffic generated by malware. Also, there are many instances where widely deployed firewall software has been found to have vulnerabilities that can be exploited by hackers.

Firewalls are an essential element of network protection, though they're not the whole package. Selecting the most appropriate firewall for a network configuration is only part of the job; you must also configure it correctly and maintain it properly by updating it to reflect newly disclosed vulnerabilities and closing ports against new network threats.

The first step is to set a policy for firewall use. The policy you choose is far more important than the brand of firewall, as long as the firewall is sufficiently robust to handle your policy rules and the traffic load.

It's critical to specify and maintain an up-to-date policy based on threat levels, including newly discovered or emerging threats, the value of your information and the specific network configuration. Despite the fact that each firewall configuration is specific to your installation, there are some general rules:
  • Block all inbound traffic that isn't permitted. This is more difficult than allowing everything in and then filtering out what shouldn't get through, but it is by far the more effective strategy.

  • Block any unnecessary protocols.

  • Block e-mail attachments that may contain an executable function.

  • Blocking or filtering inbound traffic to the known vulnerable ports should be the baseline configuration for protecting a network. It will block a high percentage of attacks, but it is only the beginning.

If the firewall runs on a host operating system, that OS must be hardened as completely as possible, or hackers will simply go around the firewall through known or newly disclosed OS vulnerabilities.

The National Institute of Standards and Technology's Special Publication 800-41 recommends the following types of network traffic always should be blocked:
  • Inbound traffic from a nonauthenticated source system with a destination address of the firewall system itself

  • Inbound traffic with a source address indicating that the packet originated on a network behind the firewall

  • Inbound traffic from a system using a source address that falls within the address ranges set aside in RFC 1918 as reserved for private networks

  • Inbound traffic from a nonauthenticated source system containing Simple Network Management Protocol traffic

  • Inbound traffic containing IP Source Routing information

  • Inbound or outbound network traffic containing a source or destination address of 127.0.0.1 (localhost)

  • Inbound or outbound network traffic containing a source or destination address of 0.0.0.0

  • Inbound or outbound traffic containing directed broadcast addresses.

There is no such thing as a set-and-forget firewall. New threats emerge all the time, and often the best ? or only ? way to protect a network is to block some specific port until vendors release patches, and you have time to apply them. This is no rare event; it occurs at least every month for many networks.

Finally, there must be a fixed schedule for verifying that the firewall is applying the written policy. This should probably be a combination of regularly checking hard-copy printouts of the actual firewall settings against the stated policy and actual testing.

No system can be considered secure without periodic real-world tests of firewall policies, in which you attempt to penetrate the firewall, confirming not only that policies are programmed but also that the firewall is able to properly apply them in every instance. This physical test should be made after any vulnerability in the security software is discovered and patched.

For any agency permitted to use outside tests, Gibson Research Corp. (www.grc.com) makes ShieldsUP, a free firewall-testing program that can run online to test the first 1,056 TCP ports. You might want to bookmark this even if you only use it as a quick reference, because moving the cursor over the map generated by the site produces a quick report on each port's function.

ShieldsUP also displays your browser's Web server requests, which may be revealing information you don't want freely disseminated, such as your server's software and version.

If nothing else, the GRC site provides a lot of basic security-related information.

Many agency installations will need to purchase commercial test software to verify firewall protection. It would be nice if you could simply install a firewall and feel secure. But even properly configured firewalls are far from perfect, especially since they have been found to contain bugs or vulnerabilities.

Check Point Software Technologies Ltd. has reported vulnerabilities in its VPN-1 and FireWall-1 products so far this year. All of these vulnerabilities were patched, but the threats were highly critical because most would allow a remote attacker to run arbitrary code.

Zone Labs' ZoneAlarm firewall was discovered to have a highly critical vulnerability in February, one that would allow an attacker to bypass the firewall and take control of the network.

Every firewall or other security tool is likely to have some hidden vulnerability that will someday surface with greater or lesser impact, so administrators need to monitor new threats not just to operating systems and applications but also to their security software itself.

John McCormick is a freelance writer and computer consultant. E-mail him at powerusr@yahoo.com.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here
close

Trending

  • Dive into our Contract Award database

    In an exclusive for WT Insider members, we are collecting all of the contract awards we cover into a database that you can sort by contractor, agency, value and other parameters. You can also download it into a spreadsheet. Our databases track awards back to 2013. Read More

  • Navigating the trends and issues of 2016 Nick Wakeman

    In our latest WT Insider Report, we pull together our best advice, insights and reporting on the trends and issues that will shape the market in 2016 and beyond. Read More

contracts DB

Washington Technology Daily

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.