Control versus protection – the role of a firewall

Firewalls have always had a simple purpose; let through specific traffic types, and deny everything else. While this works very well for general network control and security, it can be a positive hindrance for desktop Internet users.

On the other hand, many services, from IM to Skype, use port 80 so you can’t block them by closing their standard ports. Yet many companies still use this form of access control, even though it is an incredibly blunt instrument. Modern firewalls are capable of a much more fine-grained approach to user-level security. And this is where the philosophy and politics of internal network security come into play; should that security be about controlling what users can and cannot do, or should it concentrate on protecting the users as far as possible?

Functions such as TCP stream analysis and deep packet inspection can root out all sorts of threats; viruses, malware, even Web advertising that may lead to a potentially dangerous site. Web site block lists can prevent adult or offensive web sites being accessed. Deploying these functions means that users can be protected from malicious activity while having nearly unrestricted Internet access. As needs become more sophisticated, you can recommend complementary security appliances and network management hardware that automate these approaches.

Traffic denial by type still has its place. SMTP should only exit your network from the mail server, for example. But better, I think, to allow users to use the Internet in a protected manner, than having them try to bypass network security entirely because of frustration.