Firewalls and why they’re a key part of network security.
Firewalls remain a core part of modern enterprise security. This article explains how firewalls have evolved from simple packet filters to Next-Generation Firewalls (NGFWs), and highlights the main settings needed to meet NCSC Cyber Essentials and ISO 27001 standards.
For a long time, a firewall was simply a dedicated hardware device placed at the edge of an office network. It checked all incoming and outgoing traffic and blocked unauthorised connections using strict port and IP rules.
Today, the traditional network perimeter no longer exists. With the rise of hybrid work, cloud services like AWS, Microsoft Azure, and Google Cloud, more use of SaaS, and distributed branch offices, company assets are no longer protected by a single boundary.
Firewalls are still a key part of modern cyber security. Standards like the UK NCSC Cyber Essentials, ISO 27001, and the NCSC Cyber Assessment Framework (CAF) require them. Today’s firewalls are smart, software-based tools that control data flows, check encrypted traffic, and help stop threats from moving across networks.
Defining a Firewall: The Technical Bit
A firewall is a network security device or software that monitors and filters both incoming and outgoing network traffic based on the organisation’s security policies.
It acts as a barrier between a trusted internal network and an untrusted one, like the public internet. Its main job is to let legitimate business traffic through while blocking unauthorised access, malware, and scanning attempts.
Today, firewalls can’t just be set up and forgotten. They need regular audits, ongoing rule management, frequent firmware updates, and strict control over any changes.
The Evolution: From Stateless Packet Filters to NGFWs
Firewall technology has gone through several stages to keep up with more advanced cyber threats:
1. Packet-Filtering Firewalls (Stateless)
The first firewalls worked at the Network and Transport layers. They checked each data packet against set rules, such as source and destination IP addresses, packet type, and port number. These firewalls were simple and fast, but they couldn’t tell if a packet was part of a real, ongoing communication.
2. Stateful Inspection Firewalls
Stateful inspection was a big step forward. It tracked active sessions, so the firewall could automatically allow return traffic from approved outbound requests by monitoring the full context of a communication, such as the three-way TCP handshake. It blocked unsolicited inbound attempts that tried to mimic valid connections.
3. Gateways at the application level (proxy firewalls)
A proxy firewall works at the Application layer. It intercepts traffic between external networks and internal services. Instead of allowing direct connections, it terminates the incoming session, examines application-specific commands (like HTTP, FTP, or DNS), and creates a new connection to the internal destination only if it is safe.
4. Next-Generation Firewalls (NGFW)
Most modern enterprises use Next-Generation Firewalls. These combine traditional stateful filtering with advanced threat-prevention features, such as:
- Deep Packet Inspection (DPI) checks the actual data inside packets, not just the protocol headers.
- Integrated Intrusion Prevention Systems (IPS) detect and block exploit signatures, brute-force attacks, and port scans in real time.
- Application awareness means identifying and managing traffic from specific applications. For example, it can distinguish normal web browsing from unauthorised uploads to cloud storage over HTTPS port 443.
- Encrypted traffic inspection (using TLS/SSL decryption) involves decrypting, checking, and then re-encrypting sessions to find malware hidden in normal HTTPS traffic.
Network Firewalls vs Host-Based Firewalls: The Layered Defence
Relying on just one boundary device is a common weakness found in technical audits. To build strong security, organisations need to use a layered approach.
| Dimension | Network-Based Firewall | Host-Based Firewall |
|
Deployment Location
|
Hardware appliance or virtual gateway at network junctions / VPCs. | Software agent running locally on endpoints (laptops, servers, VMs). |
|
Primary Scope
|
Controls traffic entering or exiting entire subnets or network zones. | Controls incoming and outgoing traffic exclusively for that single host. |
|
Use Case
|
Boundary defence, multi-cloud transit routing, micro-segmentation. | Protecting remote worker devices outside the office; stopping lateral movement. |
|
Management
|
Centralised network management console / infrastructure-as-code. | Centralised Mobile Device Management (MDM) / Group Policy (GPO). |
Common Firewall Misconfigurations Identified in CREST Assessments
During penetration tests and external attack surface audits, technical teams often find firewall settings that weaken otherwise secure environments:
- Leaving administrative ports exposed: Allowing direct public internet access to Remote Desktop or SSH without an encrypted VPN gateway that uses multi-factor authentication.
- Unpatched gateway firmware: When critical vulnerabilities in boundary firewalls and VPN concentrators are not fixed within 14 days, attackers can use them to get into the network.
- Accumulation of outdated rules: Keeping old temporary firewall rules, such as those created for finished contractor projects, can leave permanent unauthorised access paths into internal systems.
Frequently Asked Questions (FAQ)
Can a firewall block all kinds of cyber-attacks?
Certainly not. No, a firewall can’t block every type of cyber-attack. It filters network traffic but can’t stop threats that get past network boundaries. For example, it won’t stop an employee from entering their password on a fake phishing site, or prevent insider threats or malicious files run from a USB drive. Firewalls should be used along with strong identity management (like MFA), endpoint detection and response (EDR), and user awareness training.
A firewall filters data as it moves across network boundaries, using rules based on IP addresses, ports, protocols, and application behaviour. Antivirus and endpoint security software work directly on the device to scan for, detect, and remove malicious files, scripts, or memory-based attacks already on the system.
What is it about Cyber Essentials that causes it to place such an emphasis on firewalls?
Firewalls are the first control in the NCSC Cyber Essentials framework. When boundary and host firewalls are set up properly, they block automated scanning tools and brute-force bots from finding vulnerable services on the public internet. The NCSC considers strong firewalling the basic defence against opportunistic attacks.
What exactly is a Web Application Firewall (WAF) and in what way does it differ from an NGFW?
An NGFW protects the perimeters and subnets of an enterprise network from Layer 3 to Layer 7. A Web Application Firewall (WAF) works specifically at Layer 7 to protect web applications and APIs. The WAF inspects HTTP/HTTPS traffic to block application-layer attacks like SQL Injection (SQLi), Cross-Site Scripting (XSS), and automated bot scraping, as listed in the OWASP Top 10.
How frequently should firewall rules be audited?
In high-assurance frameworks, formally review firewall rules at least every six months and after any major network changes. Redundant rules allow outdated permissions for third-party systems.
A firewall is only as reliable as its rules, settings, and management. Organisations can make sure their network controls stand up to modern threats by using strong boundary designs and independent technical testing.
High-Assurance Network Security & Auditing
Cyber Security Specialists provides accredited technical consulting, CREST penetration testing, and compliance gap analysis to help UK businesses check and strengthen their network perimeters:
- CREST-accredited penetration testing means simulating real attackers inside internal networks, across multi-cloud perimeters, and at external gateways.
- Cyber Essentials and Plus Certification provide a quick technical audit to check firewall settings, secure configurations, and patching service levels.
- Firewall rule base reviews: thorough checks of firewall settings to remove outdated permissions, improve security, and ensure compliance.
- External Attack Surface Management (EASM): ongoing real-time scans to find open ports, misconfigured gateways, and unpatched vulnerabilities (CVEs).
To arrange a firewall rule-base audit, commission an external penetration test, or discuss technical compliance, contact the specialist team directly:
Telephone: 0161 706 0244
Email: info@cybersecurityspecialists.co.uk
Related Pages
