Firewalls are the guardian of your network, effectively blocking unnecessary ports and potentially harmful IP addresses. With a list of ports or IP addresses to keep an eye on, your firewalls will make sure you never have to go through the discomfort of coming across those on the hit list.
Consider your firewall as a proactive measure that ensures only authorized traffic is allowed, thereby maintaining a secure environment. However, even the best ones have off days, and sometimes firewalls can be breached or overwhelmed, allowing wrong traffic to slip through.
Here are two cases where firewall breaches led to costly fallouts for organizations.
1. Equifax data breach (2017)
Who are the victims?
The private records of 148 million Americans, 15.2 million British citizens and nearly 19,000 Canadian citizens were compromised.
What was stolen?
Social security numbers, birth dates, addresses, credit card numbers, and driving license numbers.
2. Marriott International data breach:
Who are the victims?
Around 500 million customers are said to be compromised mainly from the United States, Canada, and the United Kingdom.
What was stolen?
Names, mailing addresses, phone numbers, email addresses, and birth dates, passport numbers (for some guests), and reservation details.
How can attackers overwhelm a network with traffic?
Attackers bombard the network with so much traffic that it gets knackered and breaks down, causing chaos. These attacks can be detected based on unusual spikes or patterns in network traffic.
Different ways of overwhelming a network with traffic:
1. Distributed denial of service (DDoS) attacks
Attackers use botnets to overwhelm targets with excessive traffic. The distributed nature of botnet attacks makes it difficult for firewalls to distinguish legitimate traffic from malicious traffic without impacting legitimate users.
2. Traffic amplification
Attackers exploit certain protocols to send a small request that gets blown up into a huge response, flooding the target.
The flood of amplified responses can overwhelm firewalls before they can make sense of it all.
3. Application layer attacks
Instead of going after the network, attackers focus on overwhelming specific applications with malicious requests. These requests look legit and can sneak past traditional firewalls.
4. TCP SYN flooding
Attackers flood a target with connection requests that never complete, tying up the server’s resources. Firewalls can struggle to spot and stop this kind of attack because it looks similar to normal connection attempts.
5. Slowloris attacks
This deceitful technique involves sending partial requests to keep connections open and wear down server resources over time.
Slowloris attacks can slip under the radar because they don’t create a lot of traffic. They keep connections open with minimal data, exhausting server resources without high traffic, making detection by traditional firewalls challenging.
Tips to enhance firewall security:
1. Keep your firewall updated: Ensure that your firewalls are updated on a timely basis and software patches are done.
2. Use antivirus protection: Firewall, though it has the best intentions, doesn’t guarantee full protection. They are not designed to combat malware by themselves. It’s best to empower them with a security solution specifically designed to detect and remove these threats.
3. Limit accessible ports and hosts: Set your firewall to default connection denial for inbound traffic, and restrict inbound and outbound connections to a strict whitelist of trusted IP addresses.
4. Set up solid firewall rules: Create your firewalls to control how many connections each IP can have at once and set some limits on connection attempts. This helps keep things in check.
5. Check your logs regularly: Keep an eye on your firewall and server logs. Look for any strange connection patterns, like a bunch of connections from one IP or connections that hang around for too long.
6. Use load balancers and reverse proxies: These tools can help manage connections more efficiently. They spread the load, limit how many times each client can try to connect, and can even handle slow connections better.
7. Reduce keep-alive connection times: Cutting down on how long keep-alive connections last can help clear out those excessive connections, making sure legit users don’t feel the pinch. This way, your network stays smooth and fast for everyone.
