Q20Information System Security

A Firewall is an absolute mandatory architectural chokepoint between a secure internal corporate network and the chaotic, malicious public internet. Its mathematical function is to violently inspect all inbound and outbound traffic, applying rigid Access Control Lists (ACLs) to either drop or permit packets.

A. Packet Filtering Firewall

• Mechanism: The most primitive architecture. It operates purely at the Network and Transport layers (OSI Layers 3 & 4). It mathematically examines the raw headers of every IP packet (Source/Destination IP, Source/Destination Port, TCP/UDP protocol).
• Merit: Explosively fast processing speed.
• Demerit: Absolutely zero intelligence. It is "Stateless." It has no mathematical memory of previous packets. If it allows Port 80 (HTTP) traffic, a hacker can violently inject malicious SQL code through Port 80, and the firewall will blindly allow it because it does not inspect the payload.

B. Stateful Inspection Firewall

• Mechanism: A highly intelligent architecture. It mathematically tracks the entire TCP Connection State (SYN, SYN-ACK, ESTABLISHED). It maintains a massive dynamic State Table in RAM.
• Merit: If an internal computer requests a webpage, the firewall dynamically opens a temporary return port. If an external hacker attempts to violently blast unrequested packets into that port, the firewall checks the State Table, realizes no internal computer requested this connection, and instantly drops the packets.

C. Application-Level Gateway (Proxy Firewall)

• Mechanism: Operates at the absolute top of the OSI model (Layer 7). It completely breaks the TCP connection. The client talks to the Proxy, and the Proxy talks to the Server. It violently tears apart the actual HTTP payload, searching for viruses or prohibited commands.
• Merit: Absolute maximum security.
• Demerit: Horrific performance bottleneck due to massive CPU overhead.

A. Screened Host Architecture

A primitive setup using a single packet-filtering router facing the internet, combined with a highly secure Bastion Host on the internal network. All internet traffic is mathematically forced to pass exclusively through the Bastion Host. If the Bastion Host is compromised, the entire internal network is destroyed.

B. Screened Subnet Architecture (The DMZ)

The absolute enterprise standard. It utilizes TWO completely independent firewalls to mathematically create an isolated middle network called the Demilitarized Zone (DMZ).

• The Outer Firewall: Faces the internet. It strictly allows public traffic ONLY into the DMZ, where the Web Servers and Email Servers reside.
• The Inner Firewall: Faces the internal corporate network. It violently blocks all traffic from the internet and strictly limits traffic from the DMZ. If a hacker mathematically compromises the Web Server in the DMZ, they are STILL trapped by the Inner Firewall, completely protecting the highly classified internal Database servers.