Control versus protection – the role of a firewall

Firewalls have always had a simple purpose; let through specific traffic types, and deny everything else. While this works very well for general network control and security, it can be a positive hindrance for desktop Internet users.

On the other hand, many services, from IM to Skype, use port 80 so you can’t block them by closing their standard ports. Yet many companies still use this form of access control, even though it is an incredibly blunt instrument. Modern firewalls are capable of a much more fine-grained approach to user-level security. And this is where the philosophy and politics of internal network security come into play; should that security be about controlling what users can and cannot do, or should it concentrate on protecting the users as far as possible?

Functions such as TCP stream analysis and deep packet inspection can root out all sorts of threats; viruses, malware, even Web advertising that may lead to a potentially dangerous site. Web site block lists can prevent adult or offensive web sites being accessed. Deploying these functions means that users can be protected from malicious activity while having nearly unrestricted Internet access. As needs become more sophisticated, you can recommend complementary security appliances and network management hardware that automate these approaches.

Traffic denial by type still has its place. SMTP should only exit your network from the mail server, for example. But better, I think, to allow users to use the Internet in a protected manner, than having them try to bypass network security entirely because of frustration.

Share |

Download


Subscribe and get the magazine in the post before it's online

Subscribe and get access to all of the back issues

To read a sample eMagazine - March 2010

 
FREE SUBSCRIPTION!
Banner

IT EXPERT TOP TIP

tools If you're trying to solve connectivity problems at a customer site, you can ask a colleague back at your office to use ping and traceroute to see how the network appears to the outside world; or you can use the tools at http://www.heise-online.co.uk/networks/nettools/ to do it yourself. There are tools for looking up Mac addresses and calculating subnet masks too. If you need a more detailed trace, http://w3dt.net/tools/pathping has a pathping tool.
read more

TAKE THE POLL

Unified communications

Banner

The #1 Bestseller for Only 77p

RECENT COMMENTS