Firewall Design Principles in Network Security

What does a firewall do? A firewall is a system engineered to prevent unwanted data from coming into or exiting a private network. You can use either hardware or software to implement a firewall, as well as a combination of the two. In a business setting, an organization may have an intranet that they protect using a network firewall. The goal is to keep unauthorized users from penetrating the intranet and therefore gaining access to sensitive data and systems.

How does a firewall work? To provide network security, a firewall setup has to have the following attributes:

1. All data moving into and out of the organization's network has to pass through the firewall.
2. Local security policies decide which kinds of traffic are allowed to pass through the firewall. You can use multiple kinds of firewalls to enable a variety of security policies.
3. The firewall cannot be vulnerable to penetration, so you have to use a reliable provider with a strong reputation for having dependable products.

There are several basic factors to consider in firewall design. Giving appropriate forethought to these factors can prevent many firewall design issues. The following firewall design principles can ensure you have the most secure defense system:

1. Pinpoint the kinds of security controls your organization needs. This will involve checking the security requirements as outlined by upper management, evaluating the current security posture, and deciding how firewalls can address any concerns.
2. Outline your security policy. If your security policies are well-defined, they will include access policies, network resources, and the appropriate authorization controls.
3. Choose your firewall philosophy. This process centers around the identification of applications, resources, and services that you want to protect. All firewall design principles in cybersecurity hinge on these decisions.
4. Choose the kinds of communications that will be allowed. This one involves deciding which people, devices, and applications will be allowed to use your network and access your organization’s web services.
5. Choose where the firewalls will be deployed. Figuring out the locations of your firewall should be done strategically. They should be specifically focused on safeguarding the communications and systems you identified in the previous steps. For example, you can use a packet filter firewall at the edge of your network or a proxy firewall between your internal network and your web server.

To ensure adequate protection for your network and devices, it is best to take a systematic approach. Some primary concerns should be the control and visibility of applications, preventing threats, ensuring high throughput, and focusing on protecting devices from remote users. Here is a more detailed description of each element:

1. Control and visibility of applications. Consider which applications you want people within your network to be able to access as well as the visibility you need to achieve. For example, there may be some applications, such as Facebook, that may be more of a distraction than an asset. You can control access to these applications, as well as which elements of the applications users gain access to. For instance, you can prevent users from using all facets of Facebook except messaging. You can also specify which kinds of usage you need to establish visibility into. This gives you the ability to see what your users are doing while connected to your network.
2. Preventing threats. A next-generation firewall (NGFW) not only controls which applications are being used, but it can also scan applications to ensure they do not present a threat. Depending on how you configure the firewall, you can also use it to reduce the amount of bandwidth specific applications use.
3. Adequate throughput. Applying filters and processing information can significantly limit throughput. If you opt for an NGFW, choose one that gives you at least one full gigabit of throughput, which is enough for most organizations to run necessary applications and processes.
4. Focus on devices. Focusing on devices instead of IP addresses is often a better way of protecting your network. This is because a malicious user can use a device with an IP address that has been approved but still infect your network with malware. You can use a next-generation firewall that can help you search for a device using a username. In this way, you can stop a malicious user, find the device, and prevent it from accessing the network.
5. Beware of remote users. Whether your organization uses remote employees who work from home or a co-working space, if they connect insecurely, they can present a significant threat. A next-generation firewall can identify safe users. You can also use a firewall to set up a virtual private network (VPN), which creates a secure tunnel through which remote users can access your network. This way, even if they use less secure, public networks, their communications are encrypted, protecting both you and them.

There are several basic factors to consider in firewall design. Giving appropriate forethought to these factors can prevent many firewall design issues. The following firewall design principles can ensure you have the most secure defense system:

1. Pinpoint the kinds of security controls your organization needs. This will involve checking the security requirements as outlined by upper management, evaluating the current security posture, and deciding how firewalls can address any concerns.
2. Outline your security policy. If your security policies are well-defined, they will include access policies, network resources, and the appropriate authorization controls.
3. Choose your firewall philosophy. This process centers around the identification of applications, resources, and services that you want to protect. All firewall design principles in cybersecurity hinge on these decisions.
4. Choose the kinds of communications that will be allowed. This one involves deciding which people, devices, and applications will be allowed to use your network and access your organization’s web services.
5. Choose where the firewalls will be deployed. Figuring out the locations of your firewall should be done strategically. They should be specifically focused on safeguarding the communications and systems you identified in the previous steps. For example, you can use a packet filter firewall at the edge of your network or a proxy firewall between your internal network and your web server.

With a FortiGate Next-generation firewall (NGFW), you gain full control over what users and devices are allowed to access, thanks to integration with FortiOS. The FortiGate NGFW also provides faster processing because it features dedicated security processing units whose sole job is to protect your network. 

You also get the most recent threat intel powered by FortiGuard, ensuring you are shielded from a wide range of new and old threats. Machine learning capabilities enable the FortiGate NGFW to detect threats based on their behavior, not just their signatures, giving it the ability to stop zero-day attacks.

Firewalls are designed to protect your network from threats, as well as prevent malicious actors from using resources inside your network to launch attacks.

While there are a number of techniques, there are four primary approaches: service control, direction control, user control, and behavior control.

Firewall design is the process of deciding which digital assets and resources you need to protect, what your available firewalls are capable of, and how to position and configure them. The design process also includes ensuring you have adequate throughput so core business processes are not interrupted by your firewall.