4.2. Concepts

Types: ● Packet Filtering Firewall – Based on IP/port/protocol

A Packet Filtering Firewall works by examining packets of data in the network. It allows or blocks traffic based on pre-defined rules that consider the source IP address, destination IP address, port number, and protocol type of the packets. If a packet matches the rules, it is allowed through; if it does not, it is blocked.

Imagine a security guard at the entrance of a building who checks guests against a guest list. Only those whose names are on the list (meeting certain criteria) are allowed entry; everyone else is turned away.

● Stateful Firewall – Tracks state of connections

A Stateful Firewall keeps track of the state of active connections and makes decisions based on the context of those connections. Unlike a simple packet filtering firewall, which treats each packet independently, a stateful firewall understands the ongoing communications and can determine if a packet is part of an existing connection.

Think of a conversation between two people. If one person asks a question and the other responds, the responder knows that the second statement is linked to the first due to their ongoing dialogue. A stateful firewall operates similarly, recognizing established connections and allowing traffic to flow freely in that context.

● Application-Layer Firewall (WAF) – Protects web apps (e.g., ModSecurity)

An Application-Layer Firewall, often referred to as a Web Application Firewall (WAF), is specialized in monitoring and filtering HTTP/HTTPS traffic to and from a web application. It is adept at identifying and blocking common web-based threats such as SQL injection, cross-site scripting (XSS), and other application vulnerabilities by analyzing the behavior of web traffic.

Consider a high-tech security system at a museum that not only checks for tickets but also monitors the behavior of visitors to prevent art theft. An Application-Layer Firewall protects web applications in a similar way, actively looking for suspicious activity that could indicate an attack.

Concepts: ● Deep Packet Inspection (DPI)

Deep Packet Inspection is a form of filtering that inspects the data part (the payload) of a packet as it passes through a checkpoint. DPI goes beyond basic packet analysis by examining the contents of the packets, allowing for more granular control over the data and the ability to extract valuable information for security monitoring.

Imagine a postal worker who not only checks whether a package has the correct address but also opens the package to inspect its contents. DPI performs an analogous task in network security by examining the details within the data packets to ensure compliance and detect potential threats.

● Geo-blocking (deny traffic from certain countries)

Geo-blocking is a security measure that blocks user access based on their geographical location. Organizations can configure their firewalls to deny traffic from specific countries or regions known for high levels of cybercrime or unwanted activity, thus preventing potential attacks or data breaches.

It's like a nightclub that only allows entry to patrons from certain neighborhoods. If someone comes from an area with a reputation for trouble, the bouncer might refuse them entry to keep the venue safe. In cybersecurity, geo-blocking serves a similar purpose for networks.

● Logging and automated threat response

Logging involves keeping records of network activity, which is vital for tracking security events and understanding network behavior. Automated threat response leverages these logs alongside predefined actions to swiftly respond to potential security incidents without human intervention, such as blocking an IP address or alerting administrators about suspicious activity.

Imagine a home security system that records all activity and also has the option to automatically lock doors if it detects a potential break-in. In network security, logging and automated responses work together to fortify defenses against threats efficiently.

--