Networking Standard

A stateful inspection firewall is the de facto standard for network protection at this time. Installing less is not a wise move without good reason (e.g., a requirement for the fastest possible data transfer while maintaining some protection for the internal network).

Performance and Protection

The balance of performance versus protection between a packet filter and an application proxy is excellent. Since stateful inspection is the current standard, most vendors support this type of firewall and offer it in many levels of data transfer rates and cost. Cons There are very few reasons not to use a stateful inspection firewall; however, there are a few possible considerations.

Lower Data Transfer Rates Than a Packet Filter

As stated above, there is performance degradation over a packet filter.Tables are maintained and logic is used to parse the access lists, costing memory and processor power. Lack of Fine Control Fine control of application proxies is lost in favor of better performance. Stateful inspection firewall software is written to be generic (i.e., usable in nearly any environment), whereas application proxies are specific and therefore provide fine control for the specific applications.

Deciding on a Firewall Introduction

Choosing a firewall solution involves many factors, some that can be controlled (e.g., features and cost) and others that cannot be controlled (e.g., overall network structure, history, and politics).This article presents the benefits and the drawbacks of various firewalls.The final decision of what will work best in your environment rests on your shoulders and on those who control the budget.

Appliance/Hardware Solution

Considered the most secure approach, a network appliance is a highly specialized device that is placed on the network between a hostile environment and a safe environment. A “hostile” environment could mean the Internet with access open to anyone; the network containing the user base vs. the network containing servers, which should have limited access; or dividing the network into segments of varying security or access, where some areas have less access due to the sensitive data stored there. Compliance with various laws is particularly important for government and private agencies when choosing between firewall types. Such laws include the Federal Information Processing Standards (FIPS) (www.itl.nist.gov/fipspubs) and the Health Insurance Portability and Accountability Act (HIPAA) (www.hhs.gov/ocr/hipaa) in the US, and the Canadian Security of Information Act (SOIA) (www.tbssct. gc.ca/pubs-pol/gospubs/tbm-12a/sia-lpi1-e.asp#effe).These laws require that certain standards be met, including hardware firewall standards. If you fall under one of these laws, you may not have the option of a software firewall.

Hardware

With a hardware-based solution, you have a network appliance whose sole purpose is to provide a firewall that will pass packets in and out quickly, while inspecting them based on a defined security policy.A network device’s hardware provides the single function of packet filtration and/or inspection. In its simplest form, a network router configured as a packet filter is a hardwarebased firewall. In its most complex form, it is an application proxy on specialized hardware protecting a specific application package.

Packet Filter Warning!

Do not depend on packet-filtering routers for your firewall needs; these attacks can go straight through a packet filter (e.g., the Microsoft Structured Query Language (SQL) server has an exploit that can be compromised using the well known SQL port 1433). Blocking all other ports to the SQL server so that users can query the database decreases the attack surface, and won’t protect you against an attack to that port. Using an application proxy allows you to analyze the packets and reduce the possibility that a malicious packet will traverse the firewall and compromise your server. The operating system (OS) and inspection software are sometimes modified for a particular hardware. It is rare for network hardware to be sold without an integrated OS; however, that OS may not be unique to the hardware. Linux, UNIX, and Windows are often the base OS. Even with this, the OS is usually hardened against network attacks and/or stripped down to provide a specific set of functions. It is difficult to add third-party products or change the basic functionality of a hardware-based firewall. Consider the security implications of changing the functionality of a well-designed and hardened OS.Teams of dedicated people have worked to design hardware and software to use together for the greatest functionality and security.You don’t have to worry about how the OS functions; just plug it in, define the rule sets, and go.Your sole responsibility concerning the OS and filtering software is maintaining up-to-date patches.