3.2 Secure enterprise infrastructure
📘CompTIA Security+ (SY0-701)
Firewalls: Overview
A firewall is a security device (hardware or software) that monitors and controls network traffic based on pre-set rules. Its main purpose is to block unauthorized access while allowing legitimate communication. Firewalls are a core part of enterprise network security.
Firewalls can operate at different layers of the network and come in different types, each designed for specific security needs.
1. WAF – Web Application Firewall
- Purpose: Protects web applications specifically, rather than the network as a whole.
- How it works: WAF monitors HTTP/HTTPS traffic and filters out malicious requests targeting web apps.
- Focus: Application layer attacks (Layer 7 of the OSI model).
- Common threats WAF protects against:
- SQL Injection
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Example in an IT environment:
A company runs a web-based customer portal. A WAF will inspect all incoming requests to ensure hackers cannot inject malicious scripts or steal user data.
Key Exam Point: WAF is application-focused, usually at Layer 7, and protects web apps from attacks.
2. UTM – Unified Threat Management
- Purpose: Combines multiple security functions into a single device or solution.
- Functions may include:
- Firewall
- Antivirus/Anti-malware
- Intrusion Detection/Prevention System (IDS/IPS)
- VPN (Virtual Private Network) support
- Content filtering
- Advantages:
- Simplifies security management by centralizing controls.
- Cost-effective for small to medium-sized businesses.
- Limitations:
- Can be slower because it handles multiple functions in one device.
- May not scale well for large enterprise networks.
Example in an IT environment:
A small business deploys a UTM device at the network perimeter to block malware, control employee internet usage, and secure remote access—all from one device.
Key Exam Point: UTM is multi-functional and combines several security tools in a single platform.
3. NGFW – Next-Generation Firewall
- Purpose: Advanced firewall that includes traditional firewall capabilities plus additional security features.
- Key features:
- Deep packet inspection (DPI)
- Application awareness (can block or allow traffic by application type)
- Integrated intrusion prevention
- SSL/TLS inspection
- User identity awareness (can create rules based on users, not just IPs)
- Difference from traditional firewall: Traditional firewalls mostly filter traffic by IP addresses, ports, and protocols. NGFWs understand applications and users, not just ports.
Example in an IT environment:
An enterprise uses an NGFW to allow employees to access approved cloud applications (like Office 365) while blocking unauthorized apps like peer-to-peer file sharing.
Key Exam Point: NGFW = traditional firewall + application awareness + advanced security features.
4. Layer 4 vs Layer 7 Firewalls
Firewalls can operate at different OSI layers, which determines what they inspect:
Layer 4 – Transport Layer Firewall
- Works with TCP/UDP ports and IP addresses.
- Decides to allow or block traffic based on:
- Source/Destination IP
- Source/Destination Port
- Protocol (TCP, UDP, ICMP)
- Example: Allow HTTPS (port 443) but block FTP (port 21).
- Pros: Faster because it inspects only headers, not content.
- Cons: Cannot understand the actual application content.
Layer 7 – Application Layer Firewall
- Inspects application data in addition to headers.
- Can make decisions based on:
- URL, HTTP method, payload
- Application-specific behaviors
- Example: Block requests that contain SQL injection code in a web form.
- Pros: Very precise, protects against application attacks.
- Cons: Slower, requires more processing power.
Key Exam Point:
- Layer 4: Fast, works at transport layer (ports & IPs)
- Layer 7: Detailed inspection, works at application layer, blocks sophisticated attacks.
Summary Table for Exam
| Firewall Type | Layer | Key Feature | Example Use |
|---|---|---|---|
| WAF | 7 | Protects web apps from attacks | Blocking SQL Injection in web portal |
| UTM | 4-7 | All-in-one security device | Small business perimeter security |
| NGFW | 4-7 | Application awareness, deep inspection | Enterprise cloud app security |
| Layer 4 FW | 4 | Filters by IP & port | Block FTP, allow HTTPS |
| Layer 7 FW | 7 | Inspects application data | Detect and block malicious web requests |
Exam Tips
- Remember WAF is only for web applications.
- NGFW > traditional firewall, includes app awareness.
- UTM = multi-function firewall for smaller environments.
- Layer 4 vs Layer 7: Know the difference in speed and depth of inspection.
