Firewall Management: The Expert Guide

Modern organizations are more connected than ever. Private networks, systems, and devices form an integral part of any functional business or company. Firewalls are a key line of defense against malicious attacks, helping to keep these networks safe and secure. Firewalls also form an important part of cybersecurity and data protection compliance. Whether through traditional firewalls or ‘next generation’ products, firewalls are a mainstay of an organization’s cybersecurity defenses. Firewall management is vital to maintaining a secure network, mitigating the risks from cyber threats.

An organization will likely have an array of different systems, devices, and related firewalls across its network. The individual firewalls may have hundreds of different rules in play and will need to be regularly monitored and updated. As a result, firewall management can often seem complex. This guide aims to simplify the topic of firewall management, highlighting best practice processes and procedures for organizations of all sizes.

Click on the following to find out more about firewall management

What is firewall management?

Firewall management is the process of configuring and monitoring a firewall to maintain a secure network. Firewalls are an integral part of protecting private networks in both a personal and business setting.

An organization may have many different firewalls protecting its devices and network as standard. Management of these firewalls means setting rules and policies, tracking changes, and monitoring compliance logs. It also includes the monitoring of user access to firewall settings. The configuration ensures the firewall functions securely and efficiently.

Any size organization which has a private network will utilize a firewall to protect their systems. This could be a large contractor subject to Cybersecurity Maturity Model Certification (CMMC) or a small office-based network. Firewalls are an important aspect of cybersecurity, so form a key area of IT security policies. The final responsibility for firewall management is held by those leading the organization’s IT security or compliance efforts.

Networks and firewalls can be complex, but even the simplest of firewalls will need to be set up and monitored correctly. To ensure a secure network, firewall policies must be set and updated regularly. Rules must be tested and audited to avoid rule conflict or vulnerabilities. Firewall software will also require ongoing maintenance and management, including the updating and patching of software and the logging of changes to policies or rules. This will include monitoring rules and configurations, analyzing logs and alerts, and actively monitoring compliance.

What are the three main types of firewalls?

To understand the tasks needed to manage firewalls, organizations should first understand the different available firewall options. Organizations utilize a range of different firewall types to protect their networks. The different types of firewalls will have a shared goal: protect the network and infrastructure from malicious external traffic. However, each type will vary in the process of achieving this aim.

These firewalls can be in the form of software or hardware, and increasingly are cloud-based. There are three common types of firewalls in use by organizations, each with a different way of functioning. Each firewall type has its benefits and drawbacks when protecting a private network. Individual types also vary in terms of complexity and security. The three main types of firewall are:

1. Proxy firewalls

A proxy firewall acts as a sort of ‘go-between’, preventing a direct connection between a device and network. A device will first connect to the proxy, and then the proxy will make the relevant connection to the network destination. Because it prevents a direct connection, it is one of the most secure types of firewall.

This type of firewall can be on a proxy device or can be cloud-based. A proxy server will act as a bottleneck for requests, so will often cache commonly requested content and keep logs. However, as the gateway for numerous devices, the speed of connection can sometimes be an issue.

2. Traditional firewalls

Stateful and stateless inspection firewalls are both often described as ‘traditional firewalls’. These firewalls control and filter the flow of network traffic based on pre-set conditions such as source, destination, or port address. These firewalls will allow only trusted traffic to enter and leave a network.

Rules can be created and enforced on specific traffic flows, and traffic with suspicious sources can be barred. These types of firewalls are common in out-of-the-box solutions and products.

Older traditional firewalls tend to offer stateless inspection, which identifies and checks traffic based on static criteria. Newer traditional firewalls offer ‘stateful’ inspection, which allows firewalls to gauge the state or context of connections and traffic.

3. Next generation firewalls

As the name suggests, next generation firewalls (NGFW) are more advanced versions of traditional firewalls. Many next generation firewalls have the added ability to filter traffic based on applications. This helps organizations protect against more advanced threats. They can also act as an anti-virus, blocking specific malware from accessing networks. These systems combine traditional firewalls with an intrusion detection system, which actively monitors the network for malicious activity.

Next generation firewalls may also be updated in line with up-to-date cybersecurity threats, helping to identify and mitigate emerging risks. For this reason, next generation firewalls offer high levels of security to organizations when implemented.

Why firewall management matters

Firewalls are vital in protecting networks from serious cyber threats including malicious data breaches and viruses. Firewalls protect individual devices and the wider network from cybersecurity incidents. A well-managed firewall will perform efficiently and safely, lowering the chance of cyberattacks within the organization.

Firewall vulnerabilities are a key avenue for serious cybersecurity incidents. Old or conflicting firewall rules and policies can be leveraged for access. A properly managed firewall will help to highlight and mitigate these pitfalls. Documentation and analysis form key parts of the management process. Analysis of firewall logs and records helps to identify and react to any network threats or unauthorized changes to settings.

Firewall configurations are key aspects of industry cybersecurity standards too. Regulations and standards like the Payment Card Industry Data Security Standard (PCI DSS) have firewall configuration as a core component of compliance.

How do you manage firewall rules?

To connect to a network, traffic will need to meet certain criteria set by firewall rules. These rules are a core way firewalls block or allow traffic, so oversight of the process is important. There can be hundreds of different rules within a firewall, so management can often become complex.

All rules should be clearly documented so that any conflicting rules can be highlighted and fixed. If clear policies and procedures are in place around firewall rules, the chance of conflicting configurations or settings is reduced.

Five tips for managing firewall rules:

Standardize the rule naming conventions for added clarity
Order rules as a logical hierarchy, from global rules down to specific users
Regularly audit rules for vulnerabilities, conflicts, or unused rules
Clearly mark temporary rules to help ensure timely deletion
Start by denying all access, before permitting specific access through rules.

Management of firewall rules should be limited to network or system administrators and managers dealing with IT security. Limited access will lower the risk of a malicious attack or improper access. This approach also helps lower the risk of conflicting rules or mistakes in firewall configuration.

An audit of firewall rules should be performed regularly to review any vulnerabilities that could be used within a cyberattack. New rules may have been added in haste or old ones may have become obsolete. In both circumstances, a process should be in place to review and fix these vulnerabilities.

Who should manage the firewall?

Firewall management should be the duty of the team or department in charge of the IT security policy. A firewall is integral to protecting an organization’s networks and systems, so access to management of rules and policies should be limited. Ideally, access should only be given to IT security specialists within the organization.

Overall responsibility should sit with the executive in charge of the IT security policy. Certain industries or organizations will require compliance with information security regulations such as the Federal Information Security Management Act (FISMA).

In this case, the firewall should also be scrutinized by the employee responsible for compliance. Regular audits and records of firewall changes should be reviewed at this level.

1. Block all access by default

When configuring a firewall, it’s important to start by blocking access to the network from all traffic. Rules and policies can then be introduced to highlight the traffic that is permitted to connect to the network.

Blocking all devices and traffic by default lowers the risk of a data breach, as only trusted traffic is given access. Any rules which give access to traffic should be tightly controlled, with close parameters. This will lower the risk of unauthorized traffic entering or leaving the network.

2. Regularly audit firewall rules and policies

Regularly audit rules and settings to remove any unused, old rules, as well as any that conflict. Old or unused rules can be exploited to gain access to the network, heightening the chance of cyberattacks. By highlighting and updating old rules, firewalls can become more efficient as well as more secure.

Because a firewall may have hundreds of different rules, sometimes new rules may conflict with an existing one. Conflicting rules may mean the firewall isn’t functioning as intended, causing unforeseen vulnerabilities. By auditing firewalls, these conflicting rules can be resolved and replaced.

A good source of information will be the firewall logs. Changes, access, and events should be recorded within the log, which help the process of improving firewall rules.

3. Keep the firewall up-to-date

Firewall software should be kept up-to-date so any vulnerabilities highlighted by the vendor can be fixed. The latest version will ensure the firewall will be as efficient and secure as possible. Where possible, any software updates or patches should be automated.

4. Keep track of authorized users

Firewall management is an important responsibility, and there’s a severe risk in allowing too many users access to firewall settings. Those with access should be senior network administrators, and all changes to configuration should be monitored.

Users should have varying degrees of access on a case-by-case basis. User access should be logged and audited regularly, and only be granted if there is a business need. Control of authorized users limits the risk of accidental or malicious changes to settings and configurations.

5. Document all firewall changes

Changes to firewall rules should be well documented within the organization so any damaging changes can be reversed. If rules are documented, it lessens the risk of conflicting rules causing unforeseen access issues in the network.

A clear process for recording and approving changes to firewall rules should be set as part of the management system. Documentation should record the business requirements for any change, and the context for the decision. New rules can be assessed for their business needs and risk levels.

Documentation and logs should be centralized in the organization so that records are accessible. A centralized approach will help with strategic decision-making.

Resources