 | Internet FirewallsYour protective barrier online. |
Once, the term firewall was used to describe a type of barrier used in construction. As the name implies, the firewall would prevent fires from spreading from one part of the completed building to other parts. Automobiles have firewalls between the passenger compartment and the engine to keep out heat, noise, and - you guessed it - fire.
The more common use of the term today refers to software and hardware that screens incoming and outgoing packets from computers. Many home users have firewall software running on their computer, preventing the downloading of viruses and the uploading of sensitive information. Businesses and schools may use a firewall for these purposes and also to limit the types of activities that users may do online. The firewall does not necessarily have to be installed as a program on the machine benefiting from it. Most routers today have built-in firewalls, and even ISP's can firewall your internet connection remotely (Because all the information passed between your computer and the internet goes through your ISP). Firewalls are not only used to protect computers from the ravages of the internet. On local networks, firewalls can protect individual machines from potentially 'infected' computers on the same network.
The firewall is basically a filter that searches all packets passing through it for specific content, with it then blocks, logs, or both. For home users with DSL or 'always-on' connections, and businesses with many employees and other users, a firewall is critical in protecting the computers on the network. Without a firewall, hackers or others with malicious intent would have access to the files on the computers. They may read these files or place files or their own, ofter viruses or spyware. They may even use the 'infected' computer to send spam, create DOS attacks, or other harmful activities. Machines so 'infected' are called zombies, and are quite common on computers running Microsoft Windows without their owners even being aware of it.
Computers running Microsoft Windows operating systems are especially vulnerable to infection, and therefore need a firewall, for several reasons that are often compounded. For one, Windows includes the Internet Explorer web browser and uses it as the default. This browser has many documented exploits and many more that are yet undocumented. These exploits can remain unfixed for many months before Microsoft releases a patch. In certain cases, the exploits are never patched, or the patches create new exploits. This is true of many of Microsoft's products, not only Internet Explorer. Outlook, for example, has similar flaws. As both programs mature, new bugs are added, not eliminated. The other main reason that Windows is susceptible to viruses is there the OS allows programs to install software without the user knowing. This 'feature' is meant to ease the installation of complex software that may consist of many parts, such as Photoshop or Office. It also enables malicious programs and web pages to install viruses, spyware, and other unwanted programs. Users who are very concerned about their online safety are encouraged to use an operating system that does not employ these 'features'. Such 'alternative operating systems' include Macintosh OS X and Linux. At the very least, Internet Explorer and Outlook should be avoided at all costs. Alternative web browsers include Firefox and Opera. Alternative email clients include Thunderbird and The Bat. The use of a firewall (and anti-virus software) is mandatory for Windows computers.
While the actual operation of a firewall is often complex and composed of many steps, the basic result is filtration of network traffic. Each packet passing through the firewall is scanned, and if it triggers no filters, then it is passed through unchanged. If it does meet the requirements to trigger a filter, then it is either discarded, logged, or both. Discarded packets are not passed through. They may be replaced with packets that signal to other machines or programs that a packet has been discarded, and why. In some very complex firewalls, then discarded packets are not erased, rather, they are quarantined. This allows inspection of the packets and further action can be taken. Logging means that the firewall write to a file the details of the packet, including where it came from, where it was going, and what triggers it tripped. Logs can be reviewed and analyzed, and action can be taken based upon their content.
As with all things, firewalls are not perfect. They sometimes miss 'bad' packets, and more commonly, sometimes 'trap' good packets. Through analysis of quarantined packets and firewall logs, the filters are constantly being refined and updated. Many times the computer user updates the filters to his preference, other times a 'firewall update' is downloaded in much the same way that anti-virus or anti-spam software is updated. Even in the case of automatic updates, it is good practice for the user to check the logs. The automatic updates are very general in nature, and each user has his own needs. For instance, users of bit-torrent or other p2p (peer to peer) file sharing software often need to open ports that are usually closed by default in the firewall.
As computer security is based upon layers of protection, a firewall alone is often not enough to protect computers online. Anti-virus software (and in the case of Windows computers: anti-spyware software) should be installed, functioning, and updated often. Secure programs with minimal exploits should be used, and software of questionable origin should be avoided. The computer's operating system should be updated regularly as well, and overall smart online behaviour should be practiced.