What is a Firewall?
A firewall is a network security device that separates an internal, trusted computer network from untrusted external networks like the internet and monitors and regulates data traffic based on preset rules. Firewalls are either hardware devices or software applications and are paramount in protecting networks from unauthorized access, malware, and other threats. They may be in-house, hosted in a private (virtual) or public cloud, or delivered as software-as-a-service.
Firewalls are built around granular analysis of inbound and outbound data on a packet-by-packet basis. Each packet contains data that includes information about the destination, source, and other characteristics of a network connection. Firewalls can analyze these headers and decide to allow, block, or drop packets based on pre-set security rules.
Each network has a set of rules, called Access Control Lists (ACLs), that are nested together and form a firewall policy. When a packet enters or exits a computer, the firewall evaluates it against the ACLs to determine its status (i.e., allowing, blocking, or dropping). Firewalls are able to evaluate packets in sequence and apply the appropriate action without further evaluations.
Firewalls have come a long way since their first generation in the late 1980’s when virus attacks on stand-alone PC’s drove the need for anti-virus software and early firewalls that used packet filtering. These early tools examined the headers of data packets at a network layer (OSI Layer 3) and inspected them for parameters such as source and destination IP addresses, ports, and communication protocols. The second generation introduced in the 1990’s was stateful inspection, which analyzed a packet on a more macro level by pulling in previous connections and device information into a state table.