Firewall

What it means

A firewall filters network traffic against rules: what may come in, what may go out, and between which points. It can be a device at the network edge, a function in the router, or software on a server or a laptop.

The base rule is deny everything and permit only what is needed. The opposite setup - permit everything and block exceptions - is more convenient and is the commonest reason a service ends up needlessly exposed.

A firewall protects the network the company runs itself. When accounting, mail and documents live in the cloud, the company firewall does not protect them: the provider secures the infrastructure, and what remains on the company’s side is mainly managing accounts and sign-in. The perimeter worth guarding moves from the office to the user’s identity.

How it works in practice

In a small company the firewall mostly concerns remote access to the accounting server or to on-premise storage. Rather than opening ports to the internet, it is safer to connect over a VPN and permit access only from it.

Rules are documented and reviewed from time to time, otherwise exceptions pile up for people and services that no longer exist. Blocked attempts belong in the log so someone can see what is happening.

For a webshop or web application on hosting, a web application firewall is used as well; it filters requests to the site itself and catches typical attacks on forms and logins. It is usually part of the provider’s service and only needs switching on and configuring, with the rules reviewed after every major change to the site.

What to watch out for

A firewall does not stop phishing, a stolen password or a malicious attachment - the attack arrives through a permitted channel. So it comes with access control, patching, and verification by a penetration test.

The company does not manage an employee’s home network when working from home. A laptop with access to payroll and the books is protected there only by its own software firewall and updates. If the user turns them off because something did not work, the company learns of it only after an incident, and then also has to deal with reporting a personal data breach.