Firewall Appliances, Part 1

When it comes to network security, the firewall is your primary line of defense. Firewalls have undergone a major transition in the past few years. The first firewalls were simple, stateful packet-filtering hardware devices that provided security at the OSI model's network layer. This approach worked because in the mid- to late 1990s, most attacks took place in the network layer. In the 21st century, however, types of attacks have expanded to include sophisticated application-layer attacks. Why the transition from network- to application-layer attacks? As the famous bank robber Willie Sutton said, "Because that's where the money is."

While "script kiddies" and "click kiddies" entertained themselves with network-layer Denial of Service (DoS) attacks, more savvy hackers realized that compromising network services lets them steal and destroy data with nary a trace. They don't do it "just for fun," either—there's money to be made by stealing and destroying your data, then reselling it to the fastest or highest bidder, which might include the company from which the data was stolen. Consequently, the standards for network-level security have changed. Now, all network perimeters require both stateful packet and application-layer inspection. Packet inspection alone can't provide what we consider a due-diligence effort at providing adequate network-level security. (For more information about OSI model layers, see "Network Port Fundamentals, Part 1," page 5.) . . .