Secure Firewall Best Practices

Each of the entry point from the internet to the internal (private) network must be protected securely by a firewall. A Secure firewall should be able to control the flow of traffic between protected and un-trusted networks. All connections between protected and un-trusted networks must be forced to pass through a single concentrated checkpoint which will control, authenticate, filter and log all traffic according to the policies set. See also definition about firewall.

Each organization should deploy a secure firewall in each of the internet entry point to the private network. The following standards are defined to provide a baseline for establishment and standardizations of the firewall security based on the best practice approach.

Firewall Topology

To ensure a secure firewall in protecting against any types of network security attacks, the use of suitable firewall, firewall topology, and security policy is critical. To provide a security boundary if needed, network segmentation must be created by means of DMZ (demilitarize zone). The minimum requirements regarding the firewall standards as follows:

• Must use a suitable for all external connections to the internet
• Segmentation and protection with a firewall is needed for networks with differing security requirements.
• To provide public resources, a DMZ is a mandatory. All public resources must not be placed on internal networks
• For multiple security segmentations, multiple DMZs must be deployed.
• Labeling to physical firewall must be provided appropriately and physical firewall must be placed in a secure location.
• Configuration for all external facing firewall must be “deny all” traffic unless explicitly permitted.

Default Firewall Configurations

Firewalls that face the external internet must be configured by default to deny all traffic not specifically permitted by the firewall security policy to ensure maximum security. The following list the requirements for default firewall connections:

• All external facing firewall must be configured with DENY all traffic unless explicitly permitted. This is to ensure that all un-trusted traffic is automatically denied from entering the private network.
• All perimeter routers (external router in front of a firewall) shall be configured to provide basic packet filtering using extended access-lists to provide a front-line defense mechanism against Internet based attacks.
• All traffic must be individually allowed / permitted based on traffic classification parameters including Application type (protocol and port), direction (source /destination), Action (Permit or Deny), Authentication requirements, Virus Scanning (Content Filtering), and Logging Level.
• Internal components (such as inside private IP address and DNS) must not be exposed in the external firewalls. Network Address Translation (NAT) must be used to hide private network.
• External facing firewalls must be configured for anti-spoofing (IP masquerading) to defend against common IP based security attacks.
• Only trained and security conscious personnel should managed secure firewall.

Firewall Access Privileges

Only authorized security personnel who are proficient in managing the firewall system should have the privileges to modify the firewall configuration. All firewall configuration changes must have a roll-back strategy in place. As a best practice, there should be two administrators who are proficient in managing and maintaining the firewall that should have firewall access privileges. A standard operating procedure must be developed for managing the firewalls.

Configuration management of any firewall is critical in maintaining security of the firewall system. A configuration change made by any unauthorized or untrained personnel would most likely result in a security hole in the firewall system.

Reference: www.sans.org

See also:

• Internet security download – free trial
• Introducing WS2000 wireless firewall
• Urgency of business firewall for small to medium business
• IP address design – private and public
• Understanding firewall port and protocols