What Does a Firewall Do in Cyber Security?

A firewall in cyber security is the control that decides which network traffic may enter or leave your business network and which traffic gets blocked. Picture your office network on one side and the internet on the other. The firewall sits at the border and checks every connection against a set of rules.

NIST’s glossary defines a firewall as “a gateway that limits access between networks in accordance with local security policy.” Whoever sets up the firewall writes that policy, so a firewall protects you only as well as it has been configured.

The rules work in both directions. The same glossary includes the definition “a system designed to prevent unauthorized accesses to or from a private network.” For example, a firewall can let your team browse the web and send email while refusing connections that start from outside and were never requested.

A firewall can be a physical device or a program running on a computer. NIST recommends that a small business use both, and the next two sections show how each one works.

How a Firewall Decides What Gets In and What Stays Out

Every time something tries to connect to your network, the firewall compares it with its rules. The Cybersecurity and Infrastructure Security Agency (CISA) explains that a firewall can be set to block data from certain network addresses, applications or ports. In plain words, the address is where the traffic comes from, the port is which door on a device it is knocking on, and the application is the program involved.

The log is worth having. NIST’s guide for small businesses recommends turning logging on when the device offers it, because the record gives you evidence when someone needs to investigate an event. A firewall with logging off still filters traffic, but nobody can look back at what it blocked or allowed.

The rules also need attention over time. When an office adds software or devices, a rule written for last year’s setup can leave a gap or block something your team needs. A firewall needs maintenance, and installing it once is not enough.

Hardware Firewall, Software Firewall and Antivirus: What Each One Does

A hardware firewall, which CISA calls a network firewall, is a physical device placed between your computers and the internet. Everything behind it shares its protection. A software firewall runs on a single computer, and most operating systems already include one. CISA’s advice is to make sure it is enabled. Antivirus software is a separate layer that deals with malicious programs, and CISA lists it among the other protective measures to use alongside a firewall.

Note: CISA says firewalls mainly help protect against malicious traffic, not against malicious programs (malware). That is why it recommends using a firewall together with other protections, such as antivirus software.

The software layer also reaches devices the network firewall cannot see once they leave the building. NIST’s small business guide recommends a software firewall on each computer in the business, including smartphones and other networked devices where possible. On a hotel or public network, the firewall on the laptop is what protects it.

Does a Small Business Need a Firewall?

Yes. NIST’s guide to information security for small businesses (NISTIR 7621 Rev. 1, November 2016) recommends running a hardware firewall between your internal network and the internet, plus a software firewall on each computer. The same guide notes that small businesses typically cannot invest in security the way larger ones can, and that many cyber criminals see them as soft targets.

If you are thinking “our router already has a firewall,” you may be right. The NIST guide says the hardware firewall can be a function of a wireless access point or router, including the router your internet provider supplied. What matters is whether that feature is turned on, set up for your office and kept current. The guide also says to change the administrator password when the device is installed and regularly after that, because default passwords are typically known or easily guessed.

You need firewalls on your computers and networks even if you use a cloud service or a virtual private network (VPN). If employees do any work from home, the guide adds that their home networks and systems should have hardware and software firewalls installed, operating and regularly updated.

Among the possible impacts of a security incident, NIST includes decreased productivity, loss of information critical to running the business and loss of business income. A firewall that is configured and maintained is one of the protections NIST recommends for small businesses.

For offices that want more, the same guide mentions an intrusion detection and prevention system (IDPS), which analyzes network traffic at a more detailed level than a basic firewall. It is an addition to a basic hardware firewall.

How to Tell If Your Firewall Is Doing Its Job

You don’t need to be technical to check the basics. These questions work with your current IT provider, your internet provider or any company you are thinking of hiring.

• Find out where your firewall lives: in the router, in a separate device, or both.
• Confirm that it is turned on and ask who wrote its rules.
• Ask whether the default administrator password was changed, and when.
• Check that the built-in firewall is running on each computer.
• Ask whether logging is enabled and who reads the logs.
• Confirm that the device runs an updated version its maker still supports.
• Ask what happens when a rule blocks something your team needs, and who adjusts it.

Write the answers down. They give you something to compare if you are choosing between two providers, and something to hand to a new one if you switch. If nobody can answer these, the firewall is probably not being managed by anyone, and that is worth fixing. This guide is part of the firewall and network security section of our blog.

The Bottom Line: What You Need to Know About Firewalls

• A firewall controls what enters and leaves your network. It checks each connection against rules, so its value depends on how it is set up.
• A firewall does not replace antivirus. CISA says firewalls mainly protect against malicious traffic, not malware, and recommends using them with antivirus software.
• Small businesses need a firewall too. NIST recommends a hardware firewall at the network edge and a software firewall on each computer.
• Your router may already include one. Check that it is on and current, and replace the default administrator password.
• A firewall needs someone looking after it. Rules need updating as the office changes, and logs only help if someone reads them.

Who Looks After Your Firewall?

CFL Technology Source works as the outsourced IT department for small and mid-sized businesses in Orlando and Central Florida, with remote and on-site support, proactive monitoring to prevent problems before they become emergencies, and a fixed monthly fee. Firewall and antivirus are among the protections that can be part of Managed IT Services, when applicable. You can read more on our firewall and network security page, and what managed IT means explains how managed IT works in general.

If you would rather talk it through with someone local, we are glad to help.