Firewall
A firewall controls network traffic according to rules. An allowed connection replaces neither secure software nor permission checks within the application.
What is a firewall?
A firewall controls network traffic using defined rules. NIST describes devices or programs that control traffic between networks or hosts with different security requirements. The specific checks depend on the product, its position and configuration.
Example: limiting database access
In a fictional design, only the intended application service may reach the database. The team defines the required sources, destinations and connections. Public web access does not mean that the same permission should also apply to the database.
Before changing a rule, the team checks both wanted and unwanted connections. Overly broad rules can open unintended access; overly narrow rules can interrupt necessary functions. Later infrastructure changes must also be considered.
An allowed network connection is not a user permission for projects or records. That decision remains with the application. The firewall does not fix errors in program code either.
Sources
Related terms
- IP addressAn IP address provides addressing on a network. It differs from a domain name and alone says nothing about the application reachable at that address.
- Reverse proxyA reverse proxy accepts requests in front of an application and forwards them. Routing, connection boundaries and forwarded information need clear rules.
- Transport Layer SecurityTLS protects data in transit between its endpoints. Application permissions, stored data and further connections need their own measures.
- Return-PathReturn-Path records the SMTP reverse path in a header. It explains the technical route for error reports, not a person’s identity.
- Envelope-FromEnvelope-From identifies the SMTP sender for transport and error feedback. It must be distinguished from the visible sender address.
- DMARC aggregate reportA DMARC aggregate report summarises a reporting mail system’s domain checks over a period. It helps examine sending sources and misconfigurations.
Articles on this topic
Cloud & Operations with ASES
Hosting, deployment, maintenance and support