Firewalls vs Data Diodes vs Unidirectional Security Gateways

What Are Firewalls?
Firewalls are network security devices and software that monitor and control incoming and outgoing traffic based on predefined security rules. They act as a barrier between trusted and untrusted networks, allowing or blocking traffic based on rules that an admin user has set.

How Do Firewalls Work?
Firewalls can either be set to block certain traffic and allow everything else, or to allow only certain traffic, and block everything else. The latter is generally the most secure option, but there is an ongoing delicate dance between securing the network, while keeping it functional and useful for everyone that is using it. Each company and every department will have a different risk profile and therefore will also have a different set of security requirements. Nothing worse than Sales being blocked from viewing a potential customer’s website because their security profile doesn’t match the requirements set by the finance department. Unplugging the firewall and not letting any traffic go through would also be secure, but the lack of functionality is the reason we don’t do that.

Firewalls inspect data packets traversing the network to decide if it should be allowed or if it should be blocked. There are a few common techniques firewalls use to filter traffic:

Packet Filtering: Examining packet headers, such as IP addresses and ports, to enforce security the rules that have been set by the admin. This approach provides a basic level of protection by blocking unauthorized packets. Pretty much any firewall solution offers this level of protection.

Stateful Packet Inspection: Tracks the state of active connections and determines if incoming packets are part of an established session. This method is more sophisticated than simple packet filtering, offering better security against spoofing or unexpected traffic. This is a fairly advanced method of packet filtering and firewalls that offer stateful inspection typically costs more. Stateful packet inspecting also eats up more network resources and can disrupt the speed of the network’s communication. And worst of all, stateful inspection can lead to unexpected disconnections and “half-open” connections if one side remains idle for too long.

Application Layer Filtering: Analyzes packet data at the application layer (Layer 7 of the OSI Model) to detect and block malicious activity, such as SQL injection or unauthorized file transfers. This type of filtering has grown crucial for modern threats targeting specific applications, and other advanced threats. Filtering the application layer is fairly resource intensive because of the deep packet inspections and payload analysis, and may result in poorer latency compared to simpler firewalls. There is also a good degree of added complexity when setting up these kinds of firewalls, especially in a large and dynamic environment.

Firewall Advantages

Versatility: Firewalls can handle complex traffic scenarios, including bidirectional communication, making them suitable for a wide range of network activity.

Scalability: Firewalls can be deployed in a wide range of setups, from small office networks to large and expansive enterprise systems.

Granular Control: Admins can create highly detailed security policies to regulate very specific traffic types, applications, and users.

Low Upfront Costs: Firewall hardware costs much less to buy than data diodes and unidirectional security gateways. However, the staff resources required to setup and manage the firewall makes this cost advantage negligible to all except the smallest operations.

Firewall Limitations

Misconfigurations and Vulnerabilities: Firewalls rely on having the correct configuration and the latest updates. Misconfigured rules and unpatched vulnerabilities can expose the networks to threats. There are cyberattackers that specifically seek out these kinds of misconfigurations and unpatched updates because they are familiar with how to find them, and know how to exploit them.

Continuous Management: Regular updates, log monitoring, and policy reviews are needed to maintain effective firewall security, which can demand significant resources. Without an ongoing maintenance effort, the firewall security posture will degrade to dangerous levels within just a few months.

Susceptibility to Insider Threats: Since firewalls primarily guard external perimeters, malicious activity originating from within the trusted network can easily bypass them. Since firewalls are poised to protect against outside threats, once someone is already “inside” the network, the firewall doesn’t take on any roles to stop them.