Firewall

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

Firewalls are fundamental security controls that act as barriers between trusted and untrusted networks.

Types of firewalls: - Packet Filtering: Examines packet headers (IP, port) - Stateful Inspection: Tracks connection state - Application Layer (WAF): Inspects application-level traffic - Next-Generation (NGFW): Combines multiple functions

Deployment models: - Network firewalls (perimeter) - Host-based firewalls (on device) - Cloud firewalls (AWS Security Groups, Azure NSGs) - Web Application Firewalls (WAF)

Key firewall principles: - Default deny (block all, allow specific) - Least privilege for network access - Regular rule review and cleanup - Logging and monitoring enabled

Why It Matters

Firewalls remain the foundational network security control, but in cloud environments, traditional perimeter firewalls are replaced by security groups, network ACLs, and cloud-native firewalls. Misconfigured firewall rules—particularly overly permissive inbound rules—are a leading cause of cloud breaches. Regular firewall rule reviews and a default-deny posture are essential for maintaining a secure network boundary.

Key Points

First line of defense for network security

Implements default deny policy

Cloud security groups are modern firewalls

WAFs protect web applications specifically

Rules should be regularly reviewed

Applicable Compliance Frameworks

SOC 2 ISO 27001 PCI DSS HIPAA

Related Terms

Network Segmentation

Network segmentation divides a network into smaller subnetworks, isolating systems and limiting lateral movement if an attacker compromises one segment.

Web Application Firewall (WAF)

A WAF is a security solution that monitors, filters, and blocks HTTP traffic to and from a web application based on a set of rules to protect against web attacks.

Zero Trust

Zero Trust is a security model that requires strict identity verification for every person and device, regardless of network location.

Frequently Asked Questions

Is a firewall enough for security?

No. Firewalls are essential but just one layer. Defense in depth requires multiple controls including EDR, IAM, and encryption.

What is the difference between a firewall and a WAF?

Traditional firewalls inspect network-level traffic (IP/port). WAFs specifically protect web applications by inspecting HTTP requests for attacks like SQL injection.