Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
Firewalls
The security desk
An office security desk checks everyone coming in. A basic one just checks you’re heading for a floor that exists. A better one remembers who signed in, so only their visitors are let back out. The best one opens your bag and reads your paperwork.
A firewall enforces a security policy on traffic between networks or zones: it allows what’s permitted and blocks the rest. It’s a key boundary control, but only one layer of defence.
Types
| Type | OSI layer | What it does |
|---|---|---|
| Packet filtering | 3-4 | Checks each packet’s addresses, port and protocol against rules. Fast and simple, but has no memory and can’t see content; vulnerable to spoofing |
| Stateful inspection | 3-4 | Keeps a table of connections, so replies are allowed only for sessions that were legitimately started |
| Circuit-level gateway | 5 | Checks the session handshake, then relays traffic without inspecting it |
| Application-level gateway (proxy) | 7 | Ends the connection and inspects the actual application content. The most secure traditional type, but slower, and needs a proxy per application |
| Next-generation firewall (NGFW) | 3-7 | Stateful inspection plus knowing which application and user is involved, intrusion prevention, and sometimes TLS inspection |
| Web application firewall (WAF) | 7 | Protects web applications from attacks such as SQL injection and cross-site scripting |
| Host-based firewall | Host | Software firewall on an individual server or laptop |
The DMZ
A screened subnet, or DMZ (demilitarised zone), puts public-facing servers in a separate network between an external and an internal firewall. If the web server is hacked, the attacker still faces a second firewall before reaching anything internal. It’s the most secure of the common designs. Putting a public web server on the internal network is wrong.
Older designs you may meet:
- Screened host: a packet-filtering router allows traffic only to one hardened bastion host.
- Dual-homed host: a host with two network cards and routing switched off, so all traffic must go through its proxy services.
Rule sets
- Default deny: anything not explicitly allowed is blocked.
- Order matters: firewalls usually apply the first rule that matches.
- Least privilege: specific sources, destinations and ports, not “any”.
- Regular review to remove unused and too-broad rules, with business owners confirming each is still needed.
- Change management for every rule change.
- Logging of denied and important allowed traffic, sent to a SIEM and reviewed. Logs nobody reads detect nothing.
- Harden the firewall itself: patched, restricted admin access, MFA.
Example. A firewall review finds 1,800 rules. 400 haven’t matched any traffic in a year, and one allows any source to reach the database server on any port, added “temporarily” during a migration three years ago. The findings: no periodic rule review, and weak change control over rules.
What firewalls can’t do
Firewalls don’t protect against:
- attacks that start inside the network
- attacks carried in allowed traffic (such as malware over HTTPS, unless it’s inspected)
- connections that bypass them (rogue wireless, personal hotspots, unauthorised VPNs)
- their own misconfiguration
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most secure traditional firewall type | Application-level gateway (proxy) |
| Firewall type that tracks connections | Stateful inspection |
| Where to place a public web server | In a DMZ (screened subnet) |
| Firewall protecting against SQL injection | Web application firewall |
| Best practice for firewall rules | Default deny; least privilege; periodic review |
| Limitation of firewalls | Don’t stop insider attacks or threats in allowed traffic |
In short
- Packet-filtering firewalls check addresses, ports and protocols (layers 3-4); fast but can't see application content.
- Stateful inspection firewalls track connections, allowing only responses to legitimate sessions.
- Application-level gateways (proxies) inspect traffic at layer 7; most secure of the traditional types but slower.
- Next-generation firewalls combine stateful filtering, application awareness, intrusion prevention and user identity.
- A screened subnet (DMZ) between two firewalls is the most secure common architecture for internet-facing servers.
- Rule sets should default-deny, be ordered correctly, be reviewed regularly, and changes should follow change management.
- Firewalls don't stop attacks from inside, attacks in allowed traffic, or threats that bypass them (such as unmanaged connections).
Exam traps
- A web application firewall protects web applications from attacks such as SQL injection; a network firewall doesn't inspect that deeply.
- The most secure firewall type in the traditional list is the application-level gateway.
- Placing a public web server on the internal network is wrong; it belongs in the DMZ.
- Rules allowing 'any any' or unused rules left in place are common findings.
- Firewall logs that aren't reviewed provide no detection.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The security desk
An office security desk checks everyone coming in. A basic one just checks you're heading for a real floor. A better one remembers who signed in, so only their visitors get back out. The best one opens your bag and reads your paperwork.
Firewalls work at those same levels, enforcing a policy on traffic between networks: allow what's permitted, block the rest.
The DMZ
Rule sets
What firewalls can't do