In the fourth part of this series on information security Stewart Twynham of Bawden Quinn reveals everything you ever wanted to know about firewalls, but were afraid to ask.
A few words of caution
A little knowledge is a dangerous thing
In the fourth part of this series on information security Stewart Twynham of Bawden Quinn reveals everything you ever wanted to know about firewalls, but were afraid to ask.
A few words of caution
A little knowledge is a dangerous thing'and no more so than when it comes to choosing, installing and managing firewalls which control the flow of data between networks. Firewalls are designed to prevent malicious disclosure, alteration or destruction of information. They are a necessary component of ANY connection to the Internet. After all, when you connect to the Internet, the whole of the Internet also happens to be connected to you'
Firewalls are the first, and one of the most important parts of a balanced security policy. When properly configured, they protect against hackers and worms, but they probably won't protect against viruses, or malicious/incompetent users. This is because they operate at what's known as the network layer'controlling how computers talk to one another, not what they actually say.
By design, firewalls DO NOT protect against:
- Any communications which don't actually pass through them. For example, a laptop could dial up to the internet independently and bypass the firewall, putting the whole network at risk.
- Anything hidden inside legitimate communications. For example, a virus can be hidden inside an email, or a worm might use an exploit inside a legitimate networking protocol.
Firewalls range in complexity: the simplest are to information security what a 10-year-old copy of Quicken is to the accounting profession. The more sophisticated products are like a modern financials package'they can do some really clever things, but you have to know what you're doing when you set them up.In the coming weeks, we will discuss:
- Anti-Virus protection, its limitations, and dealing with Spam
- Good housekeeping, backup and physical security
- Training, acceptable use policies and legislation
- ISPs, Domains, Web design and Hosting
- The impact of new technology'VPNs, WiFi, Broadband, et al
In order to assess and compare firewalls objectively, we've created something called the 6Ms. You may find them useful, since they outline what matters most when installing and using a firewall:
- Manager - Somebody, somewhere, must have overall charge of the firewall. Their responsibility is to ensure the settings and configuration actually reflect security policy, and that the firewall is maintained, monitored, tested and supported on an ongoing basis. Numerous firewalls end up being shoved into cupboards where no-one has a clue about them'how they're configured, or even if they are doing the job that everyone thinks they are. That's usually when we discover that they are not'
- Make - It is important to understand that the make of the firewall, the technology used, etc will have a significant bearing on the level of security. No technology is foolproof, but many of the low-cost devices on the market are so weak that they are best avoided. Well-known brands from leading security manufacturers are more secure, and are generally better supported.
- Methodology - Firewalls need configuration. A firewall without proper configuration is like a security guard who doesn't know what he or she is supposed to be guarding. The risks, the needs of the business, policies, processes and procedures need to be translated into a set of coherent firewall 'rules' that dovetail with the operation of the business.
- Measurement - No-one installs a car alarm or house alarm without testing it. Yet many firewall installations are not properly tested'the most they will get is a simple 'port scan', which doesn't actually reflect a real attempt to break-in. Recently, we tested six 'professionally installed' firewalls, and broke into all six in just 10 minutes'discovering over 100 configuration errors in the final analysis. This also demonstrates the importance of choosing properly trained and qualified installers.
- Monitoring - Businesses often connect their alarm systems to monitoring systems, so when the alarm is set off by a burglar at 3am in the morning, they and the police can be alerted. Yet firewall logs are often not checked from one month to the next'even though they are protecting the very same assets. The chances are, attempted break-ins to your premises are rare, but if you've read our previous articles, you'll know that attempts to break into your network happen every three minutes.
- Maintenance - A firewall is no different to any other piece of computer equipment. It requires regular updating and patching, and when it goes wrong, it needs repair or replacement. Firewalls usually represent a single point of failure for most companies. Surviving without Internet access while a replacement device is found and correctly reconfigured could be a costly business. The alternative is to try to do without the firewall for an afternoon, whereupon the company soon discovers a far worse fate awaits them'
The technologies used within modern firewalls vary widely, and some are far less effective than others. The more popular types are:
- NAT (Network Address Translation). NAT has nothing to do with security par se but instead allows many computers to share a single address on the Internet. A side effect of NAT 'hides' the internal computer network from the outside world, but in actual fact devices which rely solely on NAT are remarkably easy to defeat, pr