Enterprise Storage Forum content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
A firewall is one of the most commonly used cybersecurity solutions to ensure and maintain the security and privacy of internal networks’ applications and databases.
Without understanding what a firewall actually is, determining the type a cybersecurity team needs can be tricky and may leave them with, otherwise avoidable, gaps in security.
Before considering a firewall solution, it’s important to understand the core functionality of a firewall, the different types, how it works, and what types of cyber threats it protects against:
What is a firewall?
A firewall is a computer network security system and an endpoint detection and response (EDR) solution. Its primary task is monitoring and restricting the free trade of traffic between third parties, the public internet and a company’s internal network of devices and applications.
The software sits at the parameter of the network, monitoring and filtering outgoing and incoming network traffic, inspecting data packets and flagging ones that meet the criteria of set security and privacy policies.
First used in the 1980s, firewalls are a staple of cybersecurity solutions that have been protecting commercial, confidential, and personal user data for several decades now.
One way to think about the functionality of a firewall is a metal detector scanning incoming packages to ensure they don’t contain anything harmful, malicious, or otherwise not allowed within the parameters of the secure area. Similarly, it also scans outgoing traffic to ensure no confidential data is sent out without the explicit authorization of the network’s admins.
How do firewalls work?
A firewall belongs to the category of EDR tools. Those are strictly responsible for monitoring a network’s endpoints and access points and do not interfere with the internal work of the network or its devices.
EDR tools vary in how comprehensive they are for data protection. The same applies to firewalls. Some have limited functionality and are able to detect the most obvious and well-known network threats and malware. Others employ a variety of advanced features to boost the level of security they offer, such as machine learning (ML), artificial intelligence (AI), and behavioral analysis.
A firewall puts to use a number of features to scan incoming and outgoing traffic, looking for signs of malicious activity, malware, unauthorized access attempts, or large amounts of data being uploaded without the network admin’s permission.
See more: How Does a Firewall Work? Guide to Understanding Firewalls
Types of firewall software
There are multiple types of firewall solutions that vary in the levels of security they offer, how they operate, and how they interact with edge user devices within the network.
While there is some overlap in offered functionality in most firewall solutions, here are several firewall types and how they work:
Next-generation firewall
Next-generation firewalls (NGFWs) are considered the third generation of firewall technology, with more advanced features than are included with the initial software.
As the name suggests, NGFW is an upgrade to traditional firewalls, combining the basic functionality of network parameter monitoring with advanced network device traffic filtering, deep packet inspection, and an intrusion prevention system (IPS).
A NGFW can be used to optimize the use of the network’s bandwidth capacity and speed, simplify the management of the security infrastructure, and offer multiple layers of protection to filter out as many threats as possible.
Proxy firewall
A proxy firewall, also referred to as an application-level gateway (ALG), is a server firewall program that’s able to understand the type of information being transmitted. An ALG doesn’t only control the general data flow entering and exiting the network. Instead, it takes matters farther and manages how specific applications execute lines of code or files, ensuring no malicious files or code are being run.
An ALG, specifically, monitors TCP handshakes done by applications receiving and sending data to the public internet, filtering commands that adhere to the set network security policy.
Virtual firewall
Virtual firewalls are software-only network security tools. Instead of occupying its own security hardware, a virtual firewall is run entirely on a virtual environment, where it’s able to perform all its duties as a firewall, from monitoring network traffic to scanning and filtering out data packets that don’t match security policies.
Virtual firewalls can be easily extended to the cloud, securing connected data center infrastructure with the same policies and configuration used on the remaining user devices.
Packet filtering firewall
Packet filtering firewalls focus their security efforts on monitoring the inspecting network traffic and data packets. They filter through IP packets, accounting for the source of the traffic and the destination IP address in determining the safety and legitimacy of the traffic. This type is often used alongside activity logging software and a network address translator (NAT).
The main benefit of packet filtering firewalls is that a single security device can be used to filter the traffic for the entirety of the network, making the scanning more efficient and fast without overusing resources or negatively affecting the network’s overall performance.
See more: Different Types of Firewalls
Features of firewalls
Individual features found in every firewall differ depending on the offering and the type and size of the network users are looking to protect. Generally, firewalls are capable of the following:
Access control: Access control allows network admins to control which users and third parties have access to the network’s protected elements. It also lets the team block certain users and applications from accessing the internet partially or fully.
Sandboxing: Firewalls with sandboxing capabilities are able to run code and execute files within an isolated environment to test the safety of the command. Any code or file that shows malicious or suspicious behavior is prevented from proceeding to the actual network.
Logging: Log files collected and kept by the firewall software can be used to audit, verify, and analyze the activity of traffic entering and exiting the network. This feature can be used in cyber-forensics and in optimizing network operations in relation to the firewall.
Bandwidth control: Bandwidth control allows network admins to limit or restrict connections that result in a heavy load on the network. This way, limited bandwidth can be optimized and prioritized for the most important communications.
Intrusion prevention: Through the continuous monitoring of the network, a firewall is able to detect and intercept malicious incidents, collecting information that can be used for further analysis and future security measures.
See more: Why Firewalls are Important for Network Security
Firewall vendors
The global network security firewall market was estimated to be at $4.63 billion in 2021, and it’s expected to reach an estimated value of $15.81 billion by 2027. There are many vendors and firewall offerings that vary in functionality, added features, and effectiveness in detecting and intercepting network threats.
A few of the most prominent firewall vendors in the global market include:
Cisco: Cisco’s ASA solution combines a firewall with antivirus, intrusion prevention, and virtual private network (VPN) capabilities into a single offering. The whole package can be used by organizations and networks as a proactive threat defense solution.
Palo Alto Networks: Palo Alto’s offering is an NGFW that promises complete visibility and control over the network’s elements, from applications and users to content entering and exiting the parameters.
Forcepoint: Forcepoint’s firewall is an NGFW that’s lightweight, enabling users to increase the efficiency of their network’s operations without worrying about malicious attacks or data theft and leaks.
Barracuda Networks: The Barracuda firewall is far-reaching in its capabilities, protecting the network from denial-of-service (DoS) attacks and persistent threats, in addition to intrusions and malware. Additionally, it enables users to regulate web traffic with complete network access control.
Conclusions
Firewall software and hardware are essential for networks that regularly connect to the internet, whether it’s personal devices or a company with many user devices, databases, data centers, servers, and applications communicating with customers online and third-party providers.
Understanding what a firewall is, how it works, along with the different types and features that come with an offering can help an IT team make a decision when it comes to selecting a vendor. Firewalls are only one layer of a network’s security and should be combined and layered with a number of other EDR and network detection and response (NDR) solutions.
