Do You Really Need FireWall-1?

Whether or not you really need FireWall-1 might seem like a strange question to ask in a book about FireWall-1. One of the important points I make in this book is that FireWall-1 is simply a tool used to enforce a security policy. In some cases, using this tool may be overkill. In other cases, this tool is just one of many that are used.

Let's look at a one- or two-person site. In this case, whether or not to use a firewall depends on what the network connection is and what needs to be protected. If the connection is an analog dial-up connection to the Internet that does not stay up a majority of the time, a firewall may not be entirely necessary. If the connection is something more permanent, like a leased line, Digital Subscriber Line (DSL), or cable modem, or if what goes on at this site is highly sensitive or valuable , a firewall may be necessary. If the people who occupy this site are technically savvy, perhaps they will set up their external router with an access list, set up a multihomed host using a BSD or Linux-based operating system, use one of the many consumer-grade firewall devices on the market, or install personal firewall software on the computers. Depending on what the site's needs are, these solutions may be sufficient.

Now let's look at a slightly larger site, say, one that employs 25 to 50 people. This type of site is likely to have some sort of permanent Internet connection. It may even have an externally accessible server or two like a mail server and a Web server. Again, as mentioned previously, this type of site could probably get away with setting up a multihomed host using a BSD or Linux-based operating system running their built-in filtering mechanisms, or an access list on a router. Perhaps the site also needs to allow one or two people access to the internal network from home. At this point, a few "holes" would be added to the firewall. At a later time, a few other people might want to use some sort of specialized application through the firewall and a few more holes would get added. Pretty soon, the firewall starts to look like Swiss cheese.

Now let's talk about a large corporate site with thousands of people. A site like this could use a firewall or two. One obvious place to put a firewall would be at the external connection to the world, but firewalls could also be used internally to protect certain sensitive departments like human resources, research and development, or accounting. And perhaps this corporate site is also responsible for some smaller remote offices. These remote offices likely need secure access into the internal network at the corporate site. Also, the corporate site might like to be able to manage the security policy for the remote sites. And, of course, there are those who want to work from home or who need secure access to the corporate network from the Internet.

People tend to think of security needs in terms of the size of the network involved. The preceding examples are typical of what I have experienced in the real world. What type of firewall you require, if any at all, really comes down to your specific needs or the needs of an organization. A one- or two-person site might be developing source code that could potentially be worth millions of dollars; thus network security becomes important. Another example might be a university network with thousands of students, where an open environment is far more important than a secure environment ”although you can bet that certain parts of the network, like admissions and finance, require very tight security. The main question you have to ask when considering a firewall is, "What is at stake if an unauthorized person gains access to my network?"

FireWall-1 is an appropriate solution for networks of all shapes and sizes. This is because FireWall-1 is one of the few firewalls that can grow with your needs. In a network with few needs, FireWall-1 can start out as a simple Internet firewall. As your needs change, you can easily add firewalls and still be able to easily keep track of and manage your corporate-wide security policy. As your network grows, you can readily upgrade or change the platform on which FireWall-1 is installed and add functionality, such as a VPN, quite easily. Because FireWall-1 works the same on all supported platforms, you will not have to spend a significant amount of time reconfiguring or relearning the product. Adding new functionality is usually as simple as adding a new license string and modifying your configuration to support the new feature. With the added functionality of INSPECT, you can program FireWall-1 to securely support just about any service.

With the help of this book, you will be able to effectively use FireWall-1 in just about any network environment in which you work.