Firewalls are those fundamental safeguards that control all incoming and outgoing network traffic based on an organization’s specific security policies. The experts over at Hillstone Networks tell us that properly configuring firewalls is essential when it comes to strengthening protection against cyber threats. But while default settings may well provide basic filtering, more thoughtful customization is needed to properly optimize security.
Selecting the Right Firewall for Your Needs
As there are so many firewall platforms available today, you need to carefully evaluate which one suits your environment. Consider factors like:
- Throughput speeds to support network requirements.
- Features like application-awareness, intrusion prevention, and sandboxing.
- Scalability to accommodate future growth.
- Management interface usability.
- Integrations with other security controls.
- Support services from the vendor.
It is possible to deploy multiple firewalls of different types for layered security. For example, a perimeter firewall can filter external traffic, while internal ones compartmentalize more sensitive systems. You should carefully assess your network architecture and traffic flows to figure out how many firewalls are required as well as where you should place these for optimal protection.
Segmenting the Network with Zones and VLANs
Once the firewall platform(s) has been selected, one of the first steps is segmenting the network into zones and virtual LANs (VLANs). This helps to partition systems and data flows based on factors like function, sensitivity, and access requirements.
For instance, you might create separate zones and VLANs for corporate computers, IoT devices, guest Wi-Fi, application servers, databases, and DMZ systems. Granular segmentation helps to reduce the impact of breaches by isolating threats. Take time to map out a zone model that aligns with your business needs and security priorities.
Implementing a Ruleset for Traffic Filtering
The core functionality of any firewall is its ruleset, which allows or blocks packets based on protocol, IP address, port, and other attributes. Default policies typically block all incoming and allow all outgoing traffic.
Build upon these with additional rules to filter traffic according to your segmented zones and VLANs. For example, block Internet access for database servers, or forbid lateral movement between employee and guest networks. Carefully audit access requirements between zones to craft targeted rules.
Order matters when configuring rules, so place high-priority policies like explicit denials above more permissive rules. Audit and optimize your ruleset regularly as needs evolve. Maintain detailed documentation on your rules to streamline future troubleshooting and modifications.
Enforcing Secure Protocols
Firewalls can force network traffic to use secure protocols and encryption standards. For example, rules can require HTTPS over unencrypted HTTP, or mandate FTP sessions employ SSH encryption wrappers.
Disable outdated and insecure protocols like Telnet and SSL 3.0. Block risky protocols like peer-to-peer file transfers that attackers can leverage. Prioritize modern versions like TLS 1.3. Keep abreast of emerging protocols and industry best practices to evolve your policies.
Integrating with Other Defenses
Your firewalls should work in conjunction with other security controls like SIEM (security information and event management), endpoint protection, and email filtering.
Enable logging integrations to send firewall activity data to your SIEM for consolidated monitoring and analysis. Coordinate policy configurations across platforms to close gaps. Cross-reference event logs from various systems to gain visibility into issues that span controls.
Performing Regular Maintenance and Tuning
Firewall security improves over time as you refine policies based on monitoring and evolving needs.
Review configurations regularly and remove unneeded complexity that can introduce risks. Update to the latest firmware and patches to remediate vulnerabilities.
Monitor traffic flows and event logs to identify weak spots, then tweak rules to resolve issues. For example, you may whitelist certain connections that generate false positives.
Continually tuning and maintaining firewalls as part of an integrated security strategy means you can maximize their effectiveness as a critical first line of cyber defense. Keep detailed records of changes to efficiently manage rulesets at scale across multiple firewalls.