Archived from Sun's Dot-Com Builder Web Site
This content is archived from Sun's Dot-Com Builder Web Site.
These are the Best Practices > How To's archives.
Some of these pages may contain links that are no longer available.
If you see these, you can report it through the Suggestions link
and we will remove the link and leave the name (for reference).
Considerations for Building a Transparent Firewall Complex October 31, 2000
by James Mendelsohn
Virtually every business developing Internet operations needs a transparent firewall complex--an unobtrusive means of restricting access to a private network from unwanted intrusions via the Internet. The firewall must monitor activity such as e-commerce and
restrict remote use of an enterprise network. Invisible to users--hence transparent--a firewall complex protects a network from such dangers as hacking, denial-of-service attacks, and theft of proprietary information.
An effective firewall complex allows a business to protect itself yet remain open enough to do business. But the threats coming over the Internet are quite sophisticated, and the number and kinds of firewall technologies have mushroomed. Therefore, determining what
kind of a firewall complex to build has become more difficult. In this article we divide the process of building a complex into three stages.
Assessing your business needs
Identifying kinds of firewalls
Choosing a firewall complex
First Stage: Assessing What Kind of Business You Do and Evaluating Your
Security Policy
Assessing Your Business
When choosing a firewall complex, begin with the largest issues of business and security policy. There is no single, comprehensive firewall complex solution. One size does not fit all. First and foremost, the firewall complex you choose depends upon the kind of business you have.
How much do you use the Internet for e-commerce? for m-commerce? To what extent should customers have access to your network and how often?
How much do you use the Internet to connect remote or mobile employees with your network? With each other?
How large is your network? How much information does it exchange via the Internet?
Answering these questions should help you determine what access your firewall complex will need to limit and what it will need to
allow.
Evaluating Your Security Policy
At the same time, the firewall complex you choose should reflect your comprehensive security policy and plan. The firewall is one
part of a larger effort to secure your enterprise network. Choosing your firewall complex comes after you address these related
issues:
What additional network security components do you have, such as intrusion
detection and anti-virus software? (A firewall is a controlled gateway. It can't stop
attacks from malicious insiders, nor take the place of education and security policies
and procedures.)
Where are you most vulnerable?
What are your most valuable assets?
What access needs the most restriction from both outsiders and employees
(such as databases containing proprietary information and financial records)?
You might consider hiring a security consultant to help you develop a comprehensive security policy, to assess your vulnerabilities, and to evaluate the firewall products available for the complex you build. All these factors will depend on both your budget and the in-house technology resources you have to create a security policy.
Second Stage: Understanding the Components and Features of a Firewall Complex
A firewall complex should
support your home network;
extend your network to remote devices such as
laptops,
mobile phones,
home desktops,
branch networks of your business.
The firewall complex is a number of components devoted to a single goal: to secure a network by controlling access to all entry and exit points.
Striking a Balance Between Speed and Security
Your choice of firewall components will likely depend upon striking a balance between
how much you need to restrict access;
how much speed and convenience you need to encourage commerce and the exchange of information.
Identifying Kinds of Home Network Firewalls
You'll need to decide between four kinds of firewalls or a combination of two of them. They vary in their ability to restrict access and to facilitate the flow of information between your network and the Internet. One of them, the circuit level gateway, isn't transparent to users inside your network. The kinds of firewalls are as follows:
Filtering Firewalls: Made up of routers and packet filtering rules, they grant or deny access from a specific external address and port to a specific address inside the network according to the rules a business establishes on the routers. Sometimes referred to as
screening routers, filtering firewalls route information between networks quickly. In general, they are
fast
inexpensive
transparent
easily implemented (because most networks already have routers)
On the other hand, filtering gateways
are the least secure form of firewall;
make a network vulnerable to attack at the network address to which access has been granted;
risk a network being fooled by someone spoofing a seemingly acceptable address if the host address cannot authenticate an address very well;
do not enable a network to build in powerful user authentication ability;
make it difficult to keep good logs and can be unaware of attacks and unable to recover well from them;
are notoriously difficult to adjust to the preferences an administrator desires.
