Types of firewall
Network firewalls protect the connection between the company and the internet and between internal zones. Next generation firewalls (NGFW) add application awareness, user identification and intrusion prevention. Host firewalls, built into Windows and macOS, protect each device. Cloud environments use security groups and cloud firewalls. A WAF is a specialised type that protects web applications.
Rules are what matter
The principle is default deny: block everything and allow only the traffic that is needed. Over time, rule sets accumulate exceptions, temporary openings that were never closed and rules nobody remembers. Periodic rule reviews, documented business justifications and removal of unused rules keep the firewall effective.
A target in itself
Firewalls and VPN appliances face the internet, and vulnerabilities in their management interfaces have been exploited in many attacks. Keep management access off the internet, apply patches quickly and send firewall logs to a SIEM.
Where it shows up in compliance
ISO 27001 covers networks security and the security of network services (Annex A 8.20 and 8.21). The ENS, PCI DSS and most cyber insurance questionnaires ask about perimeter protection and rule reviews. Firewalls are also the main tool for network segmentation.
