Firewalls are essential security elements in any network. However, as with all aspects of network security, deploying firewalls is a complicated task. Many factors need to be considered, chief among them is cost and function. A dilemma faces all firewall administrators: what is the proper balance between firewall security and network usability. In other works, how can one make the network secure as possible with a firewall while maintaining ease of use and maintaining appropriate speed of the connections for the users? There is no one or easy answer to this question. Each network and organization is unique. I believe that fact is the key to a good answer. Since each organization has unique objectives and goals the firewall must protect those security elements that achieve those objectives and goals. To some extent, firewalls must be customized to meet the needs of the organization. I have read about the trade-offs of an out-of-the-box firewall versus a firewall that is built from scratch to meet the requirements of a particular network’s security. A do-it-yourself firewall has the advantage of being highly customized to the needs of the organization and an out-of-the-box firewall generally is more expensive. Does that make a do-it-yourself firewall the better choice? I think not. It seems to me that a pre-built firewall has one overriding advantage when compared to a do-it-yourself unit: documentation and support. What if the builder of that do-it-yourself firewall didn’t document how he or she built it? Worse, what if there was no documentation about how to program it and the builder died in a car accident? How much would the do-it-yourself solution cost then? The solution I advocate goes to the very heart of usability. Security personnel must have the documentation and support for the firewall to use it effectively so that network users can easily and effectively use the network. Next, I would suggest a simple, but comprehensive, rule set for the firewall. I believe in KISS – Keep it Simple: Security. Everything begins with a written security policy. As a subset of that written security policy is the written firewall security policy. The firewall security policy should be designed with the specific objectives and goals of the organization in mind. The rules should address those issues (all the issues necessary to keep the network secure), but no more. That way, the rules will not be so over burdensome as to be a hindrance to the sale of goods or services or the normal operation of users on the network. Clearly, the selection of the right firewall is a daunting task of paramount importance. There isn’t one right choice of a firewall. A firewall must be chosen by considering the totality of the circumstances. Organizations come in all different sizes and budgets. A specific firewall policy for one organization might be perfect, but be completely inadequate for another. It all comes down to the needs of a particular organization and the money it has to spend. The objectives and goals of the organization determine the correct choice.
Balancing usability and security - Firewall discussion. (2013). Retrieved from Symantic.