Firewalls filter traffic using rules or filters. All firewalls, of whatever type—static packet filtering, stateful inspection, application proxy, circuit proxy, or content filtering—use rules to filter traffic. Rules are instructions that evaluate and take action on traffic traversing the network.

Firewall rules are used to control what traffic enters or leaves a secured network area. Depending on where the firewall is positioned, this mechanism can protect the private network from the public Internet or filter traffic between internal subnets or departments. The security administrator or the dedicated firewall administrator configures firewall rules in accordance with the organization’s security policy.

Generally, two main philosophies or security stances govern the use of rules: default deny or default allow. Default deny is also known as deny by default or deny all. Default allow is also known as allow by default or allow all. These two rules define the foundation for rules governing traffic crossing the firewall.

A default-deny stance assumes that all traffic is potentially malicious—or at least unwanted or unauthorized. Thus, everything is prohibited by default. Then, as benign, desired, and authorized traffic is identified, an exception rule grants it access to the network. This is known as deny by default/allow by exception. This method of rule creation allows security administrators to focus on what is wanted or needed, rather than watching out for all possible forms of unwanted or malicious activity. This is the whitelist-like action in a firewall whereby only those exceptions you define are allowed through.

A default-allow stance assumes that most traffic is benign. Thus, everything is allowed by default. Then, as malicious, unwanted, or unauthorized traffic is identified, an exception rule blocks it. This is known as allow by default/deny by exception. This method of rule creation forces the security administrator to be on constant watch for new and different forms of unwanted, unauthorized, and malicious activity. This is the blacklist-like action in a firewall, whereby everything is permitted with a few noted exceptions.

Most security experts agree that deny by default/allow by exception is the more secure stance to adopt. This stance automatically prevents most malicious communications by default, while the opposite allow-by-default stance allows most malicious communications by default. In most situations, fewer exceptions are required for a default-deny solution than for a default-allow system.

Most firewalls, both hardware and software varieties, usually come preconfigured with rules above and beyond the default rule. Firewalls are normally factory-configured in a deny-by-default stance with some common exception rules thrown in for end user/customer convenience (FIGURE 8-1). Often, these rules allow the most common forms of communication to occur across a new firewall without requiring you to configure the firewall fully upon initial installation. Some of the more common factory default rules allow for web, email, instant messaging, and file transfer through common Internet services on default ports.

Although this can be a convenience, it is never in your best interest to rely upon a third party’s assumptions about your environment or guesses as to what types of traffic you do or do not want to cross your firewalled boundaries. Always take the time to review any factory-installed rules before deploying the firewall in the production environment. Delete or disable any rule that you do not need or want. With regard to any rules that you do want or need, you should double-check to make sure the rules are in line with your security policy. If you need rules that are not present by default, add each carefully and double-check your work as you go.

Your organization will need to decide which firewall rules to define; this is an essential part of its security policy. If the appropriate sections of the organization’s security policy related to firewalls do not predefine which rules to implement on a new firewall, perform the following procedure:

1. Inventory all essential business processes and communications that will cross the firewall/checkpoint.
2. Determine the protocols, ports, and Internet Protocol (IP) addresses of valid traffic for both internal and external hosts.
3. Write out the rules or use a firewall rule designer/simulator.
4. Test the rules in a safe, nonproduction environment.
5. Obtain written approval for the rule sets from a change approval board or administration.
6. Document the rules into a security policy procedure amendment and submit the amendment to the security policy management team or administrator for inclusion in the official document.

Ultimately, this is the basic process for creating any new element of security. The goal is to have a written security policy for every security component. If there is no current policy or procedure defining the steps to take for the deployment of a new security element, then you must write, test, and get approval for a new policy or procedure. Once a procedure exists, use it to judge successful deployment.

The exact rules to add to a new firewall depend upon the business processes that are unique to every organization. However, some common types of rules are found on most firewalls. These include:

• Access to insecure Internet websites (HTTP)
• Access to secure Internet websites (HTTP over SSL or TLS)
• Access to other Internet website protocols (SQL, Java, and so on)
• Inbound Internet email
• Outbound Internet email

If other Internet services are essential to a business task, rules allowing or enabling such communications would be needed. Try to keep the number of rules to a minimum. Grant access only to traffic that is essential. Each rule added to a firewall increases its attack surface—and therefore its security vulnerability.