Skip to main content

Firewall-The first defense against Malware

 


Firewall forms the first defense against malware attack on a system. It acts as a security guard scrutinizing inbound/outbound traffic from the web.


ACL (Access List)

The earlier adoption to firewall, they resided in the main router. 

We know data passes digitally in the form of individual packets. They contain information such as source/destination address, data type, bandwidth etc.

ACL would compare each packet to a set of predefined rules, mainly in ascending order (rule1, rule 2...).

If a match is found, the connection is allowed, and no further check is done. If no rule is adhered, the packet is discarded. 

But this provided only basic filtering, and ACL did not care about protocol type like http or https. 

Also, once the rules were set, it cannot be redefined. To edit one would be to clear the existing set and start from scratch.


The era begins ...

Present firewall came into existence during the late 80s, and graphical user interface (GUI) in the 90s.  Firewall basic working include

  • Rule settings like ACL for packet tracking. They can be modified, without full erasure
  • Can exist in the client side or the router. 
  • Permission set to who can access which system. For example, a sales team cannot access HR server, but an administrator can access both.
  • Outgoing packets are less filtered compared to inbound ones.

Types

1. Packet Filtering Firewall

Done using a set of rules based on protocols, source/destination address, and ports. If guidelines are met, the packet will be allowed else discarded.

2. Stateful Inspection Firewall

Here the state of the packet is checked, and filtering is done based on that. The states include

  • New: The packet is not yet identified in memory, presumed to be a recent connection.
  • Established: The packet address pre exits and needs less filtering.
  • Related: The packet is new but has a connection to an established one. Caution is exercised.
  • Invalid: Rules don't apply or adhered, and packet is discarded  
      

3. Application Layer Firewall

The reach extends to the application layer and is the most secure. The firewall forms a drawbridge between the internal network and the web. All traffic passes through it whether inbound or outbound. Features include

  • IP address of internal network is concealed from view, like a VPN (Virtual Private Network).
  • Any strike against the rules, and the packet gets discarded immediately. 
  • Keeps a cache of frequently visited websites for faster access. This increases speed and bandwidth.   

They are also commonly known as proxy firewalls.

Other variants include software/hardware firewalls, cloud firewalls (Online) etc.


Limitations

  • The initial setup is expensive specially for hardware firewalls.
  • Even though they can block eaves dropping or certain malwares, firewalls are not a comprehensive security package. The end user needs to install antivirus software for advanced protection.
  • Firewall limits their protection circle to a single network. Multiple connections need more of the same.



Additional Information



 

   

Labels:

Comments

Post a Comment

Popular posts from this blog

Man In The Middle Attack - EavesDropping in the Digital World

    This is a term used to describe a cyber attack where a hacker acts as middleman, during data transfer between user and an application. The app can be a financial or an E commerce website, Software as a Service (SaaS) etc. The hacker can intercept data passed via the browser to the website, and collect sensitive information such as account and credit card details, user login etc. To put it into context, it is like a postman who reads all the letters addressed to you, then reseals the same, on delivery. This way no one suspects a foul play.   Interception This is the first phase of the attack. Here the hacker establishes a connection with the target device whether a PC, Laptop or Smart phone. This is done   through various methods   like   Free WiFi  : Here a WiFi hot spot is set up  which is not password protected. When a user logs in to the network, they are in essence connecting to the hacker's system. Now any data transfer occurs via this co...
Post a Comment
Read more

Internet of Things-Connection Redefined

  Imagine driving home after a long day of work. En route the car instructs the residence to automatically turn on the lights, prepare a hot bath, and download the latest Netflix series. While this may seem like a line from a SciFi script, the future is more realistic than ever. Welcome to the world of IoT or Internet of Things. Though not as popular as its famous counterpart, Artificial Intelligence, its penetration into the consumer market is indeed extensive. What is IoT...... It is the term used to describe a   device, or set of devices which are connected to the internet,   and also communicate with each other. They can share data obtained from various sensors to a central hub, analyze it using  AI, and take appropriate actions. For example, a smart thermostat can read the room temperature, analyze the same, and adjust the heating system without any human intervention. Another example would be a smart camera which provides video footage when a movement is detect...
Post a Comment
Read more

Bluetooth - You are Connected

       We are entering the era of Internet of Things (IoT) devices, where each device connects remotely to one another, and the world wide web. This makes them smart in the way of integration to Artificial Intelligence, Machine learning and Data analysis. There are number of network protocols that facilitate this peer to peer communication be it ZigBee, Matter etc. More on that later.    What is Bluetooth  Invented  in 1994 by Ericsson and widely used, Bluetooth allows for short distance communication, within 10 meter radius. The data speed is between 1 Mbps and 3 Mbps. The bandwidth is in the range of 2.4 GHz to 2.485 GHz.   Frequency Hopping Unfold Spectrum This is the underlying tech used in Bluetooth. Data signals by default have low frequency, and high bandwidth. This makes them prone to distortion, affecting long distance transmission. Also the receiving antennas  have to be large in size which is a limitation for mobile phone...
Post a Comment
Read more