Firewalls and Security

Learning outcomes

  • Explain the purpose of a firewall, and what it does and doesn't protect against
  • Compare types of firewalls, and how they differ across operating systems
  • Explain how the order of rules affects a firewall
  • Compare a deny all policy with allow all, and explain which is safer

Would you like to download my PowerPoint to follow along?

  • What is a firewall?
    • Monitor traffic
    • Ingress and Egress (in and out) traffic can be monitored and controlled
    • A way to separate your network from the WWW (World Wide Web)
  • How are firewalls different on different operating systems?
    • Different Operating Systems use different types of firewalls and have different ways to interact with the firewall
    • Some examples include: UFW (Ubuntu) Firewalld (Red Hat) and Windows Defender Firewall (Microsoft)
  • What kinds of firewalls are there and how do we sort them?
    • Hardware vs Software
    • Stateful vs Stateless
    • Network vs Host
    • Static vs Dynamic
  • Allow all vs deny all
    • Firewalls that work with packets have rules
    • Rules must have a default if no other rules apply
    • Deny All
      • More Secure
      • Needs more work to keep up to date
      • Used in places like governments and secure R&D where security is more needed
    • Allow All
      • Less secure
      • Needs less hands-on watching
      • Used in places where you don't need as much protection such as small businesses
  • What firewalls are NOT good at
    • Any Social Engineering threats
    • If you don't know the issue is coming you can't tell the firewall to protect you from it
    • They are reactive not proactive
  • What firewalls are good protection for
    • Prevents some unauthorized remote access
      • Not all! Scammers can get through on Browsers still
      • Social Engineering and viruses can still give up access
    • Extra layer of protection for legacy systems
    • Can be used to Block access to specific sites from within the network such as social media
    • Can give extra info in logs of ingress/egress on network
  • Ok, but why do I care for security
    • Hardening of the system
      • In security we need to protect systems by knowing where our vulnerabilities are to mitigate them
      • Blue Team
    • Testing limits of the system
      • Pen testing
      • Red Team
  • What do most companies do with firewalls?
    • Layered approach
    • Multiple vendors (Swiss cheese model)
    • DMZ

Suggested Activities and Discussion Topics:

  • In pairs, discuss How could you use a Firewall to prevent a DDOS attack, and what the limitations of your protections might be.
  • Work as a group to come up with 3 Firewall rules for your company including explanations of why those rules are helpful
  • Activity: look at the example firewall rules. Find the problem with the rule order, explain what traffic is actually being allowed, and rewrite the rules in the correct order.
  • Discussion: is "deny by default" always the right choice? Compare a home network, a coffee shop guest network, and a hospital. Who would be affected if the rules were too strict?
  • Activity: log in to your home router and look at its firewall settings. Is the firewall on? Is UPnP turned on? Are there any port forwarding rules you don't recognize? Share what you found (without sharing your passwords or public IP address).

Would you like to see some more classes? Click here