Firewalls, next-generation firewalls, IDS and IPS

What a firewall is

A firewall monitors traffic entering and leaving a network and allows or blocks it according to security rules. It forms a barrier between trusted internal networks and untrusted outside networks such as the internet, and has been the first line of defence for decades. A firewall can be hardware, software or both. Every firewall should:

• resist attacks against itself;
• be the only path between the networks it separates;
• enforce the organisation's access-control policy.

Types of firewall

Next-generation firewalls (NGFW)

A next-generation firewall combines stateful inspection with much deeper awareness:

• identifies and controls individual applications and behaviours inside them;
• filters web use by site reputation and category;
• applies policy by user, device, role and application, not just IP address;
• includes NAT, VPN and an integrated intrusion prevention system;
• receives live threat intelligence to block new attacks quickly.

Intrusion Detection System (IDS)

An IDS looks for attacks and reports them. It sits out of band: it receives a copy of traffic from a switch SPAN port or a network TAP, so it doesn't slow the network. It works passively and only alerts administrators; it can't stop an attack by itself.

Intrusion Prevention System (IPS)

An IPS sits inline, usually right behind the firewall, so every packet passes through it. It analyses layer 3 and 4 traffic (and often application content) and can act immediately:

• alert the administrator;
• drop malicious packets;
• block traffic from the attacking address;
• reset the connection.

Because it is inline, an IPS can stop even single-packet attacks, but a poorly tuned IPS can also block legitimate traffic, so rules need testing.

Real-world example: an IPS in front of a hospital web server

A regional hospital publishes an appointment booking site from a server in its DMZ, behind a next-generation firewall with IPS (intrusion prevention) turned on. One evening the IPS logged and blocked a burst of requests matching a signature for a newly published vulnerability in the web framework the site used. The server had not yet been patched, because the fix had been released only two days earlier.

The security team saw the blocked events in the morning, confirmed that no request had reached the application, and fast-tracked the patch that afternoon. The firewall rules themselves were correct, since web traffic to the booking site had to be allowed; it was the IPS layer that inspected the content of that allowed traffic and stopped the attack. The team also set up an alert so that high-severity IPS blocks reach the on-call engineer straight away.