INTERNET SECURITY FUNDAMENTALS: FIREWALL

WHAT IS A FIREWALL?

Firewall, firewall, firewall or firewall - all these words mean the same thing: a kind of barrier that protects the entire network or parts of it from the transmission of malicious packets and intrusion by hackers. A firewall is installed at the junction of two networks, usually between the world wide web and the corporate network. There are also so-called client firewalls that are installed on the end user's computer and only protect it. Firewalls can be used both as hardware solutions and as software. The firewall scans all incoming and outgoing traffic according to certain previously configured criteria. If the transmitted data meets these criteria, the firewall will let it through. If they do not match, it blocks. The transmitted data is filtered based on the following criteria: what is a firewall

Address filtering: the source and destination (source and destination) addresses and port numbers are checked

Protocol filtering: the type of network traffic is checked, for example, HTTP or FTP

The attributes and status of the data packets being sent are also checked.

However, the firewall does not provide automatic network protection. The effectiveness of its application directly depends on how the firewall is configured.

FIREWALL CONFIGURATION

There is no single answer to the question of how to properly configure your firewall. The required settings depend on many factors and may require changes, for example, when new applications, devices or users are added, when access rights change in connection with the tasks and roles in the business, when cloud technologies and mobile devices begin to apply.

Firewalls are needed not only to protect stationary information technologies. They are also important for controlling applications on the web, in the clouds or on mobile devices. Regular checks and adjustments of firewall settings are necessary not only because the IT landscape is constantly changing, but also due to the constant change and complication of cyber threats. Once established, filtering rules can significantly differ from the actual need for protection without timely checking and adjusting the settings, which allows fraudsters to gain access to confidential information. How often the firewall settings need to be checked depends on the level of risk and changes in the existing IT infrastructure.

Also, remember that it is important to not only keep the configuration up to date, but also to protect the firewall logging. This means that the protocols should be encrypted and verified using a double-check principle, and the logging data should be stored as carefully as possible.

METHODS FOR USING A FIREWALL

Firewalls can be used in a variety of ways. The simplest is a packet filtering router. The router configures various packet filters that control data transmission based on the source and destination addresses and port numbers. Typically, conventional IP routers work with this method. Since this is a fairly simple procedure, the cost of such a firewall will be low. However, using this method alone does not provide sufficient protection. Even a simple spoof of an IP address will be enough to gain unauthorized access.

If you connect a firewall system between two packet filtering routers, this method will be called "bastion node". The outside router is responsible for filtering IP traffic between the bastion host and the Internet, while the inside router only allows IP traffic between the inside network and the bastion host. This method of protection is very effective, but also quite costly, since in addition to two routers, a firewall system is also required. In addition, setting up such a system can be quite complex. A well-managed and effective solution is found by many companies to use a firewall server because it includes the following features:

internal and external firewall,

bastion knot,

web application server.

The Firewall Server is a complete solution that includes everything you need for related Internet services. The more filtering and access control methods you use, the more security you can achieve.

HACKER ATTACKS ON FIREWALL

Hacking is the most common attack scenario: a hacker gets into someone else's computer and thus can track and modify user data, identifiers and files. Hacks often go unnoticed. Attackers manage to get into someone else's computer without leaving a trace.

The second common scenario is to disable certain services so that other users cannot use a particular computer or port. This form of electronic sabotage can corrupt data as well as damage your device. Most attacks of this kind are carried out by overloading: A fraudster overloads the system or network, for example, with a stream of network requests, messages or other processes, as a result of which the user cannot operate efficiently. An attacker could also disable, replace, or redirect some services. Unfortunately, quite often usernames, passwords and IDs are transmitted unencrypted in plain text, so they can be easily eavesdropped on the network. This is also used by scammers to steal information.

Network technologies such as Ethernet or Token Ring can intercept all network traffic on a local network. As in the case of hacking, scammers almost never leave a trace here, so data theft is rarely detected.