Control versus protection – the role of a firewall

Firewalls have always had a simple purpose; let through specific traffic types, and deny everything else. While this works very well for general network control and security, it can be a positive hindrance for desktop Internet users.

On the other hand, many services, from IM to Skype, use port 80 so you can’t block them by closing their standard ports. Yet many companies still use this form of access control, even though it is an incredibly blunt instrument. Modern firewalls are capable of a much more fine-grained approach to user-level security. And this is where the philosophy and politics of internal network security come into play; should that security be about controlling what users can and cannot do, or should it concentrate on protecting the users as far as possible?

Functions such as TCP stream analysis and deep packet inspection can root out all sorts of threats; viruses, malware, even Web advertising that may lead to a potentially dangerous site. Web site block lists can prevent adult or offensive web sites being accessed. Deploying these functions means that users can be protected from malicious activity while having nearly unrestricted Internet access. As needs become more sophisticated, you can recommend complementary security appliances and network management hardware that automate these approaches.

Traffic denial by type still has its place. SMTP should only exit your network from the mail server, for example. But better, I think, to allow users to use the Internet in a protected manner, than having them try to bypass network security entirely because of frustration.

Share |

Download


Subscribe and get the magazine in the post before it's online

Subscribe and get access to all of the back issues

To read a sample eMagazine - March 2010

 
FREE SUBSCRIPTION!
Banner

IT EXPERT TOP TIP

There are plenty of technical discussion sites on the Web, but if you're looking for a community where you have a chance to meet other experts and network in person, check out the list of UK technical user groups at http://www.ukusergroups.co.uk/. The new Active Directory User Group (http://adug.co.uk/) is kicking off with a meeting at Microsoft's London office in October, the Windows Server Team (http://winserverteam.org.uk/Default.aspx) is planning meetings in January and Vista Squad
(http://vistasquad.co.uk/), the Microsoft Messaging and Mobility Group (http://www.mmmug.co.uk) and Windows Management User Group (http://wmug.co.uk) are running regular meetings too. read more

TAKE THE POLL

Unified communications

Banner

The #1 Bestseller for Only 77p

RECENT COMMENTS