Next-generation Firewall

We’ve all heard about firewalls. They’ve been around for quite some time, but the threats become more advanced every day, and security needs to become much more advanced to stop the most sophisticated threats. A next-generation firewall is a type of security that keeps track of the network traffic and implements specific security rules to block any potentially hazardous traffic. NGFW is much more evolved than the traditional firewall and has many more capabilities. NGFW will do everything the conventional firewall would do but much better, and it comes with additional features.

Let’s use an airport as an example to make things much more straightforward. Security is essential at the airport, just like on the Internet. Imagine that there is one security checkpoint where someone checks if your passport is valid and if you are the person you say you are. After the first checkpoint, there is a second one where they look for a little less apparent threats, like whether you are on the no-fly list or not. The purpose of the first checkpoint is to scan for evident threats, and the purpose of the second one is to check for the less obvious ones that the first security checkpoint missed.

In this case, the first checkpoint would be the traditional firewall. It blocks data or lets it through by checking whether it is coming from a network that is known to be legitimate or not. This firewall does the job, but it can only stop some of the threats you can encounter daily. That’s where the NGFM comes in because this firewall plays the role of the second security checkpoint. It will inspect the data a little deeper to check whether the data is legitimate and if it’s not, it will block it. The typical firewall couldn’t find these advanced threats, but the NGFW is equipped with advanced features that can scan threats on a deeper level.

What features come with an NGFW?

Next-generation firewalls can do everything the traditional firewalls can. Here’s the list of capabilities:

• Stateful inspection: A firewall looks at packets in context to ensure they are part of a network connection that is legitimate.
• Packet filtering: The firewall inspects each packet of data, and if it turns out to be dangerous or unexpected, it will block it. We’ll talk more about packet filtering later.
• VPN awareness: Firewalls are capable of identifying encrypted VPN traffic and allowing it to pass through.

NGFW also comes with a few capabilities that older firewalls don’t have. New-generation firewalls use deep packet inspection (DPI) on top of packet filtering. A global research and advisory firm named Gartner claims that an NGFW also includes the following:

• Intrusion prevention
• Application awareness and control
• Threat intelligence
• Techniques that will address evolving security threats
• Certain ways of upgrading to add future information feeds

Before we explain what these capabilities are, we have a few more things to cover.

Unlike traditional firewalls, Next-generation firewalls can process internet traffic at a couple of layers in the OSI model, not just the network layer and the transport layer. This sophisticated firewall can look at the HTTP traffic layer and see which applications are currently in for. This step is more important than you can imagine because layer 7(HTTP traffic layer) is often used for attacks in order to attack a system successfully. That said, the layer used the most for cyber attacks is not protected by the traditional firewall.

Packet filtering

All the data you can find on the Internet is broken down into much smaller parts called packets. These packets actually contain what we consider content that enters a network. The job of the firewall is to inspect them and see if they have some malicious content. If the firewall detects something that could harm the system, it will block it; otherwise, it will let it through. Every firewall comes with the capability of filtering packets.

The way packet filtering works is that it inspects the destination and the source of IP addresses, protocols, and ports connected with each packet. Let’s simplify it; every packet needs to be checked where it comes from, where it plans to go, and how it will get there. Based on this assessment, firewalls will make a decision on whether they will allow or block certain packets.

Let’s look at one example. If a system has some vulnerabilities associated with the RDP (Remote Desktop Protocol), attackers will try to exploit them by sending specifically constructed packets to harm the system. These packets will go to port 3389. The firewall is put in place because it can check the legitimacy of the packet, see where it is going, and block everything directed at that porn. The firewall will only make an exception if the packets are coming from already approved IP addresses. This means that the source and destination of IP addresses need to be expected.

DPI (Deep Packet Inspection)

Even though packet filtering does a pretty neat job, NGFWs comes with an improved packet inspection named DPI (Deep Packet Inspection). This includes inspecting every packet to see the destination and source of IP addresses, ports, and so on, just like packet filtering. All this information is kept in layers 3 and 4.

On top of the already mentioned inspection, DPI will inspect the body of every packet, not just the header. The body of each packet will be scanned for malicious content and other potential threats. There’s a list with already known malicious attacks, and DPI will compare every packet to it in order to see whether the content is safe or not.

Application awareness and control

NGFWs check where the packet is headed; if it’s directed to an application where it shouldn’t be, the packet will be blocked. This is done by analyzing layer 7, which is the application layer. As we’ve mentioned earlier, standard firewalls don’t have this capability because they can only analyze layers 3 and 4.

Thanks to application awareness, administrators will be able to block any application that could possibly be considered risky. If we look at what Gartner said, both intrusion prevention and this capability are a part of DPI.

Intrusion prevention

This capability analyzes all incoming traffic before it identifies already known threats and potential threats, and in the end, it blocks those threats if needed. This feature can also be called an IPS (intrusion prevention system). Next-generation firewalls include IPS as part of their DPI capabilities, as we’ve mentioned earlier.

IPS actually uses several methods in order to detect threats, among which are the following:

• Statistical anomaly detection: Traffic will be scanned to detect any unusual changes in usual behavior
• Signature detection: Information will be scanned within all incoming packets and compared to known threats
• Stateful protocol analysis detection: This is pretty similar to the first method (statistical anomaly detection), but it focuses on network protocols which will later be compared to typical protocol usage

Threat Intelligence

Threat intelligence is gathered information about potential cyber-attacks. These cyber-attacks are getting more and more sophisticated every day, and that is the reason why threat intelligence is crucial. All future attacks can be compared to already known signatures to stop the attacks from happening.

Threat intelligence can also detect IP addresses from which most attacks occur. Threat intelligence will gather all the latest bad IP addresses, and the Next-generation firewall will be able to block them based on that information.

Are NGWFs software or hardware-based?

Some of the NGFWs can be installed as hardware. They are meant to defend private networks inside a company, for instance. Next-generation firewalls also come as software. NGWFs can also be deployed as a cloud service. These firewalls are named FWaaS (firewall-as-a-service), which is an essential part of SASE (secure access service edge).

Should you invest in NGWF?

Cyber threats are getting increasingly severe every day, and you should do everything you can to protect your system from getting breached. Traditional firewalls can do a lot of work for you and your company, but they can’t compete with today’s sophisticated attacks. Even though they can scan packets of data, they reach a certain point and can’t stop some cyber attacks entirely. There may be a time when you will need some additional security because that attack may be the one that changes the course of your entire company. It’s better to be safe than sorry.

We’ve discussed all the advantages of the Next-generation firewall, and we at TechProComp would like to help you secure your system as much as possible. With the increased sophisticated cyber attacks, we would like to provide you with the best firewall on the market so you won’t have to worry about getting malicious content inside your servers. If you have some additional questions about the NGFW, feel free to contact our support team, which is available 24/7, and they will provide you with all the answers you need as soon as possible.