Cyber Security Controls Demystified Part 1 - Network Firewall

In this episode, we break down what a Network Firewall is, how it has evolved over the past three decades and why it continues to serve as one of the most critical pillars of modern cyber security. 

Duration: 00:16:13

Visit https://www.wecyberyou.com for more cyber security education, resources and awareness content like this. 

Thank you for listening. 
WeCyberYou! Team

Transcript

SPEAKER_01 0:00

When you lock a steel vault, you know, you can visibly see the physical protection holding that perimeter.

SPEAKER_00 0:05

Right. You've got the thick concrete walls, the heavy doors.

SPEAKER_01 0:07

Yeah, exactly. There's a tangible line where the safe zone ends and the danger begins. But uh when you plug a surfer cluster into the internet, well, that visible barrier completely vanishes.

SPEAKER_00 0:19

It's just gone.

SPEAKER_01 0:20

You are suddenly operating at the speed of light. You're facing automated threats from every direction all at once. And the only thing standing between your data and, you know, total compromise is this invisible layer of mathematics and logic.

SPEAKER_00 0:35

It's kind of terrifying when you put it like that.

SPEAKER_01 0:37

Right. Well, welcome to the We Cyber You Unlocked podcast. I'm your host, and today's deep dive is an exploration into those digital bulkheads holding the line. We are talking about network firewalls.

SPEAKER_00 0:48

And I'm your resident expert here, and I have to say the stakes with firewalls really cannot be overstated.

SPEAKER_01 0:54

Yeah, for sure.

SPEAKER_00 0:55

I mean, if you deploy a server onto the public internet without proper firewall architectures, it isn't just a matter of if it gets attacked. It's well, it's literally a matter of minutes.

SPEAKER_01 1:05

Just minutes. Wow.

SPEAKER_00 1:06

Oh yeah. Automated scanners will find it, they'll probe it for vulnerabilities, and they'll attempt to deploy ransomware or recruit it into a botnet almost immediately. Firewalls are the ultimate gatekeeper between your trusted internal network and the completely untrusted, you know, chaotic Wild West of the Internet.

SPEAKER_01 1:25

Right. Now, if you are tuning into this deep dive, you probably already know the foundational basics of cybersecurity. Like you know the CIA triad, right?

SPEAKER_00 1:33

Right. Confidentiality, integrity, and availability.

SPEAKER_01 1:36

Exactly. Keeping sensitive things safe, ensuring data isn't secretly modified during transit, and making sure legitimate users can still actually get to their services without being blocked by denial of service traffic.

SPEAKER_00 1:48

We all know firewalls are there to keep unauthorized users out.

SPEAKER_01 1:51

Right. But what we really want to explore today is how modern firewalls actually achieve this at scale. Because whether you're just a curious learner or you're prepping for a big IT meeting, this session will really demystify how these digital bouncers actually work. The technology has evolved way beyond simple port blocking.

SPEAKER_00 2:08

Aaron Powell It really had to evolve because the threats just grew infinitely more sophisticated.

SPEAKER_01 2:13

Aaron Powell Okay, let's unpack this. To understand how they protect us, we first have to understand what exactly they are looking at. So uh let's imagine network data as physical mail.

SPEAKER_00 2:23

Aaron Powell Oh, that's a really good analogy.

SPEAKER_01 2:24

Yeah. So when data travels, it's broken down into thousands of individual envelopes, which we call packets. And the earliest firewalls were basically just like mailroom clerks looking at the outside of those envelopes.

SPEAKER_00 2:35

Aaron Powell Right, the early days of basic packet filtering. Fast but super limited.

SPEAKER_01 2:39

Aaron Powell So the clerk is just checking the return address, the source IP, the destination address, the protocol type, and the port number.

SPEAKER_00 2:46

Aaron Powell And then checking those against a strict rule book. Allow rules versus deny rules.

SPEAKER_01 2:51

Like allowing employees to browse the web via HTTPS, but denying peer-to-peer file sharing.

SPEAKER_00 2:58

Exactly. Or blocking traffic from known malicious countries. The firewall reads the envelope and then decides to allow, deny, inspect, log, or alert.

SPEAKER_01 3:07

But if I'm a hacker, couldn't I just put a fake return address on my envelope? Or disguise my malicious package to look like normal web traffic?

SPEAKER_00 3:16

Yes. And that is exactly what they started doing. Attackers started forging return addresses through IP spoofing.

SPEAKER_01 3:23

Oh, wow.

SPEAKER_00 3:24

Yeah. So that basic mailroom clerk became a massive liability because they were only looking at isolated packets one at a time.

SPEAKER_01 3:30

Aaron Powell So how did the defense architecture adapt to that kind of active deception?

SPEAKER_00 3:35

Aaron Powell Well, the industry realized that treating every packet as an independent event was a losing battle. So they shifted toward stateful inspection.

SPEAKER_01 3:43

Aaron Powell Stateful inspection. Okay, so what does that actually mean?

SPEAKER_00 3:46

Aaron Powell It means that instead of just looking at single packets, stateful firewalls maintain a dynamic memory of active network sessions. They actually monitor the whole conversation.

SPEAKER_01 3:56

Okay, wait. How does a firewall actually track a full conversation between two computers?

SPEAKER_00 4:01

By monitoring the underlying protocols. Specifically the TCP handshake.

SPEAKER_01 4:06

Ah, the transmission control protocol.

SPEAKER_00 4:08

Right. When your computer wants to talk to a web server, it sends a SYN packet to synchronize. The server responds with an S Y N ACK, and then your computer replies with an ACK.

SPEAKER_01 4:16

Like a secret handshake.

SPEAKER_00 4:18

Exactly like that. And a stateful firewall monitors that exact sequence. It writes that session into a state table in its memory.

SPEAKER_01 4:27

So if an external server suddenly tries to send inbound data to your network out of nowhere.

SPEAKER_00 4:32

The firewall checks its state table. And if it sees that no internal device ever initiated a handshake with that specific external IP, it instantly drops the traffic.

SPEAKER_01 4:42

Oh, that's brilliant. It validates the state of the connection itself, not just the static port rules.

SPEAKER_00 4:47

Exactly.

SPEAKER_01 4:47

That makes a ton of sense for blocking unsolicited traffic. But uh what if the handshake is perfectly legitimate?

SPEAKER_00 4:53

What do you mean?

SPEAKER_01 4:54

While say an employee clicks a link in an email and requests a file from an external server, the TCP handshake is valid. The firewall state table sees an established session, but the file being downloaded happens to contain a malicious payload.

SPEAKER_00 5:08

Ah, yeah.

SPEAKER_01 5:08

A stateful firewall only looking at the session state would just, you know, wave that malware right through, wouldn't it?

SPEAKER_00 5:14

It absolutely would. And that is the exact limitation that drove the creation of next generation firewalls or NGFWs.

SPEAKER_01 5:22

Here's where it gets really interesting.

SPEAKER_00 5:24

Because to catch those malicious payloads, the firewall had to go deeper. It couldn't just stay at layer four, it had to move up to layer seven, the application layer, using deep packet inspection or DPI.

SPEAKER_01 5:37

So instead of just looking at the envelope, DPI actually opens the package to look for malware.

SPEAKER_00 5:42

Yes. It reads the letters inside. And what's fascinating here is the sheer computational heavy lifting involved.

SPEAKER_01 5:49

Because packets don't always arrive in perfect order, right?

SPEAKER_00 5:51

Exactly. The firewall intercepts the incoming packets, buffers them in its memory, and actually reassembles the fragmented data stream to recreate the original file or command sequence on the fly. And once it's reassembled, it runs the payload against a massive database of known malware signatures, vulnerability exploits, and heuristic models. Right. In the old days, you might just block port 443 to stop encrypted web traffic, but today basically everything runs over port 443.

SPEAKER_01 6:24

Right. Attackers realized years ago that if they tunnel their command and control communications over standard HTTP or HTTPS ports, legacy firewalls will just let it pass.

SPEAKER_00 6:34

Exactly. But DPI counters this by enabling application control. The NGFW analyzes the traffic patterns and the payload structure to identify the specific application generating the traffic. It completely ignores what port it claims to be using.

SPEAKER_01 6:49

So you can enforce incredibly granular policies like you could tell the firewall uh uh allow users to access the corporate instance of Microsoft Teams, but explicitly block them from using TikTok.

SPEAKER_00 7:01

Yes. Regardless of how those apps try to route their traffic, it gives administrators surgical control over cloud applications and social media platforms.

SPEAKER_01 7:09

Aaron Powell But I have to push back on the mechanics of deep packet inspection here for a second, because there is a glaring cryptographic issue. Oh yeah, most of the internet is encrypted now with TLS. When I connect to a secure service, my data is mathematically scrambled from my laptop all the way to the destination server. How does a firewall inspect an encrypted package? It can't just crack modern encryption algorithms on the fly.

SPEAKER_00 7:31

You're absolutely right. It cannot break the encryption. And attackers leverage this constantly, hiding their malware inside encrypted tunnels, knowing the firewall is blind to it.

SPEAKER_01 7:41

So how do we fix that?

SPEAKER_00 7:43

To solve this, enterprise firewalls perform SSL and TLS inspection by acting as an authorized man in the middle.

SPEAKER_01 7:50

Wait, if a firewall intercepts my secure connection to my bank and tries to present a different certificate, my web browser is going to throw a massive red security warning screen.

SPEAKER_00 8:01

It would.

SPEAKER_01 8:01

Yeah, because the browser's fundamental job is to verify the identity of the server. That breaks the whole trust model of the internet.

SPEAKER_00 8:09

It would break the trust model on a personal device. But in a corporate environment, the IT department manages the endpoints.

SPEAKER_01 8:15

Oh, I see where this is going.

SPEAKER_00 8:17

Yeah, they install a custom enterprise root certificate authority onto your company laptop. And because your operating system is explicitly programmed to trust this internal certificate, the firewall can seamlessly intercept your outbound request.

SPEAKER_01 8:29

So the firewall establishes its own secure connection with the external bank server and then establishes a separate secure connection back to my laptop.

SPEAKER_00 8:38

Exactly.

SPEAKER_01 8:39

And it signs that connection with that internal corporate certificate my computer already trusts.

SPEAKER_00 8:44

Yes. And while it's doing that, the modern firewall temporarily decrypts the traffic in its memory, inspects a plaintext payload for malware, and if it's safe, seamlessly re-encrypts it and sends it along.

SPEAKER_01 8:56

All of this happens in milliseconds. I can imagine.

SPEAKER_00 9:04

So modern enterprise firewalls rely on specialized hardware.

SPEAKER_01 9:07

Yeah.

SPEAKER_00 9:08

Custom physical microchips designed specifically for cryptographic offloading.

SPEAKER_01 9:12

That is wild. Okay, so we have this incredibly robust perimeter defense, right? Deep packet inspection, custom silicon for decryption, application control.

SPEAKER_00 9:20

So very strong front door.

SPEAKER_01 9:22

But even with the best front door security, what happens if an attacker sneaks in through a side window?

SPEAKER_00 9:27

That's a great question.

SPEAKER_01 9:29

Because assuming the perimeter is impenetrable is a very dangerous game. What if there's an infected smart TV in a conference room? Or a vendor plugs a compromised laptop directly into the internal network?

SPEAKER_00 9:41

Aaron Powell Right. The assumption that the internal network is a safe, trusted zone is completely obsolete. In the past, organizations just focused on data moving in and out of the building.

SPEAKER_01 9:51

North-south traffic.

SPEAKER_00 9:52

Exactly. But today, the focus is heavily on east-west traffic. Data moving laterally from server to server within the network itself. And this requires network segmentation.

SPEAKER_01 10:04

This is where I love the analogy of a submarine.

SPEAKER_00 10:06

Oh yeah.

SPEAKER_01 10:06

If you are in a submarine and the outer hole is breached, you know, you don't want the entire ship to fill with water. So you seal the internal bulkheads. Right. You compartmentalize the damage. One flooded compartment doesn't sink the entire ship.

SPEAKER_00 10:18

Aaron Powell And we apply that exact philosophy through micro-segmentation. You deploy internal firewalls to separate the guest Wi-Fi from the administration network or the student network from the financial systems.

SPEAKER_01 10:29

So if an attacker manages to compromise a vulnerable web server, they can't simply pivot laterally and scan the rest of the network. The bulkhead stops them. Right. Let's break down how an IPS actually detects an exploit. The sources mention buffer overflows and SQL injections. How does the firewall spot those in real time?

SPEAKER_00 11:04

Well, a buffer overflow is when an attacker intentionally sends more data to an application than its memory buffer is designed to handle.

SPEAKER_01 11:11

Aaron Powell Trying to overwrite adjacent memory with malicious code, right?

SPEAKER_00 11:14

Exactly. The IPS monitors the traffic stream, and if it detects an abnormally large payload targeting a known vulnerable service, it drops the packets instantly.

SPEAKER_01 11:22

Aaron Powell And for in SQL injection, that's when an attacker tries to trick a database into revealing information by like entering database commands into a standard web login form.

SPEAKER_00 11:30

Right. The IPS engine contains thousands of syntax rules. It recognizes the malformed SQL syntax attempting to bypass the web front end and terminates the session before the database even sees it.

SPEAKER_01 11:41

It also works in the opposite direction to prevent data from leaving, right? With data loss prevention?

SPEAKER_00 11:46

Yes. DLP is a critical internal bulkhead. Organizations use DLP to stop intellectual property or credit card info from being exfiltrated out to the web. The firewall scans outbound traffic for specific data patterns and blocks it if it sees, say, a huge file of social security numbers leaving the network.

SPEAKER_01 12:05

Okay, but let's look at the current reality of how businesses operate today. We've secured the perimeter in the interior, but the physical perimeter doesn't really exist for many organizations anymore.

SPEAKER_00 12:15

No, it doesn't.

SPEAKER_01 12:15

The workloads are hosted in the cloud, utilizing dynamic Kubernetes clusters, and the workforce is completely remote working from coffee shops. So where does the firewall sit when there is no centralized physical choke point?

SPEAKER_00 12:27

The architecture had to undergo a massive paradigm shift. We saw the widespread adoption of Secure Access Service Edge, or SASE. Right. With Vanis, the firewall functionality is delivered entirely from the cloud.

SPEAKER_01 12:39

Meaning no matter where the employee is physically located, their internet traffic routes through the cloud-based firewall for deep packet inspection before it ever reaches its destination.

SPEAKER_00 12:48

Yes. And this cloud-centric approach ties directly into zero trust security. The old model assumed internal users were trusted. Under zero trust, the new mantra is never trust, always verify.

SPEAKER_01 13:01

Okay, let's unpack this. In a dynamic cloud environment where IP addresses are constantly changing, how does a firewall actually enforce zero trust?

SPEAKER_00 13:10

It evaluates the user's cryptographic identity, the specific device they are using, and the real-time security posture of that device. Every access request is independently authenticated based on context.

SPEAKER_01 13:21

So if I try to access a sensitive database from my corporate laptop and my antivirus is up to date, it lets me in.

SPEAKER_00 13:27

But if you use those same valid credentials from an unmanaged personal tablet on public Wi-Fi halfway across the world, the firewall's policy engine detects the anomaly. It either denies access or demands multifactor authentication.

SPEAKER_01 13:39

Wow. So what does this all mean? If we have deep packet inspection, micro-segmentation, and zero trust, are we completely bulletproof?

SPEAKER_00 13:48

I wish we were, but no. The brutal reality is that firewalls are essential, but they cannot stop the human element.

SPEAKER_01 13:55

Right, they can't stop human psychology.

SPEAKER_00 13:56

Exactly. A next generation firewall won't protect against social engineering or an employee falling for a phishing scam. If an attacker manages to steal a valid session cookie from a user's browser, they can bypass the initial authentication entirely.

SPEAKER_01 14:12

And if a cloud architect misconfigures a storage bucket to be publicly accessible, the firewall just sees authorized public web traffic. It doesn't know the data was supposed to be confidential.

SPEAKER_00 14:22

Which is why firewalls are just one piece of a puzzle. They must be tightly integrated with multi-factor authentication and continuous security awareness training. The technology enforces the policy, but humans define the policy.

SPEAKER_01 14:34

Which underscores why understanding the underlying mechanics of these systems is so vital for anyone working in tech today. Firewalls have evolved from basic port blockers into incredibly intelligent security platforms that provide global coverage, threat prevention, and complex access control.

SPEAKER_00 14:52

They truly are an indispensable part of modern architecture.

SPEAKER_01 14:55

Thank you for joining us for this deep dive into the mechanics of network firewalls. We always appreciate you spending time with us on the WeCyberU unlocked podcast to explore the real technical realities beneath the surface. Please take a second to follow the channel and visit WeCyberEU.com for more deep dives and exclusive cybersecurity content.

SPEAKER_00 15:16

But uh before we wrap up, I do want to leave you with a final thought on where this technology is heading next.

SPEAKER_01 15:20

Oh, please do.

SPEAKER_00 15:21

The sources note that firewalls are evolving toward AI-driven threat detection and behavioral analytics.

SPEAKER_01 15:26

Aaron Powell Meaning the system learns your specific patterns, like tracking your typical connection times or the volume of data you usually download.

SPEAKER_00 15:34

Aaron Powell Exactly. Establishing what is normal versus suspicious for every individual user. So if tomorrow's firewalls are constantly using AI to analyze our minute-to-minute behavior in the office, where exactly do we draw the line between necessary corporate security and total behavioral surveillance in the workplace?

SPEAKER_01 15:52

Wow. That is a complex balance between network visibility and individual privacy. The digital bouncer isn't just checking your credentials at the door anymore, it is scrutinizing every single move you make inside the building.

SPEAKER_00 16:04

Definitely something to ponder.

SPEAKER_01 16:06

Absolutely. Something for you to think about until next time. Keep your network secure, keep your bulkhead sealed, and we will see you on the next deep dive.