Firewall guidelines
Firewalls safeguard your IT network from illegal or inappropriate access which may harm your systems and critical data. However, Firewalls are not the end-all, be-all solution to information security.
They are, however, a necessary component of an effective information security infrastructure. The following list is a set of best practices, in no particular order, that you should consider to ensure that your firewall is configured for optimal performance and effectiveness.
- Deny all traffic by default, and only enable those services that are needed.
- Do not rely on packet filtering alone. Use stateful inspection and application proxies if possible.
- Ensure that you're filtering or disabling all unnecessary ports and common vulnerable ports
- If a malicious user can obtain physical access to the firewall, anything can happen. Ensure that physical access to the firewall is controlled.
- Keep your firewall configuration as simple as possible, and eliminate unneeded or redundant rules to ensure that the firewall is configured to support your specific needs.
- Run the firewall on a hardened and routinely patched operating system. An insecure and non-hardened operating system can render the firewall completely useless.
- If possible, use a firewall in conjunction with a router when connecting to the Internet to help prevent denial-of-service attacks and successful penetrations.
- Patch the firewall's operating system and application software with the latest code on a regular basis. However, make sure you test these updates in a controlled, non-production environment whenever possible.
- Use firewalls internally to segment networks and permit access control based upon business needs.
- Enable firewall logging and alerting if possible.
- Regularly monitor the firewall logs. Treat the logs as business records and include them in your data retention policy.
- Note any firewall log entries that don't look right, and investigate them immediately.
- Periodically backup the firewall logs (preferably onto write-once media such as CD-R) and store for future reference and/or legal protection in the case of an intrusion that must be investigated.
- Consider outsourcing your firewall management to leverage the managed security service providers' aggregation of expertise, network trending analysis and intelligence, and to save time and money.
- Perform vulnerability assessments on your firewall on an ongoing basis to test for known software flaws and weaknesses. New exploits are continuously discovered and must be tested for on a consistent basis. In addition, the slightest firewall system or rule set modifications can completely change the firewall's security capabilities. Perform these tests on every interface of the firewall in all directions. Also, perform these tests with and without the firewall rules enabled to determine how vulnerable you will be when the firewall is not functioning properly.
- Remember that firewalls won't prevent attacks that originate from inside your network. An acceptable usage policy, personal firewalls/intrusion-prevention software, network monitoring, content filtering and access controls on all hosts can help lower these risks.
 articles |
 news |
 PAYG |
 callback |
 contact |
 quote |