Control versus protection – the role of a firewall

Firewalls have always had a simple purpose; let through specific traffic types, and deny everything else. While this works very well for general network control and security, it can be a positive hindrance for desktop Internet users.

On the other hand, many services, from IM to Skype, use port 80 so you can’t block them by closing their standard ports. Yet many companies still use this form of access control, even though it is an incredibly blunt instrument. Modern firewalls are capable of a much more fine-grained approach to user-level security. And this is where the philosophy and politics of internal network security come into play; should that security be about controlling what users can and cannot do, or should it concentrate on protecting the users as far as possible?

Functions such as TCP stream analysis and deep packet inspection can root out all sorts of threats; viruses, malware, even Web advertising that may lead to a potentially dangerous site. Web site block lists can prevent adult or offensive web sites being accessed. Deploying these functions means that users can be protected from malicious activity while having nearly unrestricted Internet access. As needs become more sophisticated, you can recommend complementary security appliances and network management hardware that automate these approaches.

Traffic denial by type still has its place. SMTP should only exit your network from the mail server, for example. But better, I think, to allow users to use the Internet in a protected manner, than having them try to bypass network security entirely because of frustration.

Share |

Download


Subscribe and get the magazine in the post before it's online

Subscribe and get access to all of the back issues

To read a sample eMagazine - March 2010

 
FREE SUBSCRIPTION!
Banner

IT EXPERT TOP TIP

If Autoruns, Processor Explorer, FileMon, RegMon and the other SysInternals tools aren't already in your arsenal, then you need to take a look at the instructions for these invaluable free utilities on the Sysinternals site. If you already know, love and tote them around on a USB stick, memorise http://live.sysinternals.com instead; this hosts the full set of tools as EXEs files, complete with help files, so you can run them from any machine you need to work on without needing to install them or even unpack a ZIP file. read more

TAKE THE POLL

Unified communications

Banner

The #1 Bestseller for Only 77p

RECENT COMMENTS