A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization’s predefined security policies. It blocks malicious traffic, such as viruses and hackers, to protect internal networks.
Firewalls are fundamental to cybersecurity, providing a barrier between trusted internal networks and untrusted external networks. This glossary will delve into firewalls’ essential terms and concepts, clearly understanding why they are critical for protecting data and systems.
Key Terms and Definitions for Firewall
Understanding firewalls involves familiarity with various terms and concepts that define their functionality and application. This glossary provides detailed explanations of key terms related to firewalls.
Access Control List (ACL)
An ACL is a set of rules used by firewalls to permit or deny network traffic. These lists are essential for defining which users or system processes are granted access to network resources.
Application Layer Firewall
An application layer firewall filters traffic based on specific applications or services, rather than just at the network or transport layer. This provides more granular control over network traffic.
Bastion Host
A bastion host is a server specifically designed and configured to withstand attacks. It typically hosts critical applications and is secured to provide a strong line of defense against threats.
Circuit-Level Gateway
A circuit-level gateway works at the session layer of the OSI model, monitoring TCP handshakes and other network protocol session initiation messages to determine if the session being requested is legitimate.
Deep Packet Inspection (DPI)
DPI is an advanced method of examining and managing network traffic. It inspects the data part (and sometimes the header) of a packet as it passes through a checkpoint, helping to identify, categorize, and block malicious traffic.
Demilitarized Zone (DMZ)
A DMZ is a physical or logical subnetwork that separates an internal local area network (LAN) from other untrusted networks, usually the internet. It provides an additional layer of security by isolating the internal network from external access.
Firewall Policy
A firewall policy is a set of rules and configurations that define how a firewall should handle incoming and outgoing traffic. Effective policies are crucial for maintaining network security and efficiency.
Host-Based Firewall
A host-based firewall is installed on individual servers or devices to protect them from threats. Unlike network firewalls, which protect multiple devices on a network, host-based firewalls focus on securing a single host.
Intrusion Detection System (IDS)
An IDS monitors network traffic for suspicious activity and potential threats. It works alongside firewalls to provide a comprehensive security solution by detecting intrusions and alerting administrators.
Intrusion Prevention System (IPS)
An IPS is similar to an IDS but takes a proactive approach by not only detecting threats but also preventing them from succeeding. It can take automatic action to block or mitigate attacks.
Network Address Translation (NAT)
NAT is a technique used by firewalls to map multiple private IP addresses to a single public IP address or a few addresses. This helps in preserving the limited number of IPv4 addresses and adds a layer of security by hiding internal IP addresses.
Next-Generation Firewall (NGFW)
NGFWs offer more advanced features than traditional firewalls, including DPI, intrusion prevention, and application awareness. They provide a more comprehensive security solution capable of handling modern threats.
Packet Filtering
Packet filtering is a firewall technique that controls access to a network by analyzing incoming and outgoing packets and allowing them to pass or halt based on predetermined rules.
Proxy Firewall
A proxy firewall acts as an intermediary between end users and the websites they visit. It helps in filtering content, logging user activity, and masking user IP addresses for enhanced security.
Stateful Inspection
Stateful inspection, also known as dynamic packet filtering, tracks the state of active connections and makes decisions based on the context of the traffic. This method is more secure than simple packet filtering.
Unified Threat Management (UTM)
UTM refers to a comprehensive security solution that integrates multiple security features, such as firewall, antivirus, intrusion detection, and more, into a single platform, simplifying security management.
Web Application Firewall (WAF)
A WAF protects web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It helps in defending against attacks such as SQL injection and cross-site scripting (XSS).
