Firewall types: packet filter, stateful, proxy and WAF explained

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A company installs an appliance at headquarters that inspects employees' outbound browsing, including encrypted sessions, and blocks links to malicious websites before they reach laptops. Which of the following has the company installed?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: A is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   The answerA.Secure web gatewayNIST SP 800-215 describes a secure web gateway as 'fundamentally a web filter that protects outbound user traffic through HTTP or HTTPS inspection', protecting endpoints from links to malicious or malware-infected websites.Your answerB.Intrusion detection systemAn intrusion detection system watches traffic and raises alerts. It does not act as a web filter that blocks requests before they reach the user.Your answerC.Network access controlNetwork access control checks devices and users before letting them onto the network. Once a laptop is connected, it does not inspect or block the sites the user visits.Your answerD.Web application firewallA web application firewall sits in front of the company's own web applications and filters inbound requests to them. SP 800-215 notes that secure web gateways are not a replacement for WAFs, because the two protect different directions.

   Show the full explanation and doc quotes

   Inspecting and filtering outbound browsing is its job.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-215.pdf

2. A company installs a second firewall of the same model at the same point in its network, with identical external and internal connections, so either one can take over if the other goes offline. Which of the following is the company implementing?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: C is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   Your answerA.Load balancingLoad balancing spreads traffic across several devices to share the work. The design here is about one firewall taking over when the other stops.Your answerB.Platform diversityPlatform diversity means using different vendors or products so a single flaw cannot defeat both. Both firewalls here are the same model.The answerC.High availabilityNIST SP 800-41r1 describes high-availability firewalls as deployed in pairs at the same spot in the topology with the same external and internal connections, so one can take over if the other fails or is taken offline for maintenance.Your answerD.Defense in depthDefense in depth places different controls one behind another, so an attacker must pass each. Two identical firewalls side by side at one point add no extra layer.

   Show the full explanation and doc quotes

   That is the arrangement the company built.

   Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf

3. A company protects its internal network with an outer and an inner firewall, both running the same vendor's software. It wants an exploit that defeats the outer firewall to be less likely to defeat the inner one. Which of the following best achieves this?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: D is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   Your answerA.Defense in depthThe two firewalls already form layered defenses. While both run the same software, one exploit can pass both layers, so more of the same depth does not change that.Your answerB.High availabilityHigh availability keeps a firewall service running if a unit fails. A high-availability pair runs the same software, so the same exploit would work on it.Your answerC.Least privilegeLeast privilege limits the rights of users and processes. It does not make a firewall software exploit less likely to work on a second firewall.The answerD.Platform diversityNIST SP 800-53 Rev. 5 control SC-29 (Heterogeneity) says a diverse set of information technologies reduces the likelihood that the means adversaries use to compromise one system component will be effective against other components, increasing the adversary's work factor.

   Show the full explanation and doc quotes

   Running the inner firewall on a different vendor's platform means an exploit for the outer firewall's software is unlikely to work on the inner one.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf