Firewalls, IDS/IPS, and Network Segmentation
Understand firewall types, intrusion detection and prevention systems, and network segmentation strategies with CISA audit evaluation guidance.
Firewalls: Types and Functions
Firewalls are fundamental network security controls that filter traffic between networks based on predefined rules. For CISA candidates, understanding firewall technologies and their limitations is essential for evaluating an organization's network security posture. Auditors must assess firewall configurations, rule management processes, and the overall effectiveness of firewall controls.
Firewall Types
Different firewall technologies provide varying levels of inspection and protection:
- Packet filtering firewalls: Examine packet headers (source/destination IP, port, protocol) and make decisions based on simple rules. Fast but limited in detecting application-layer attacks
- Stateful inspection firewalls: Track the state of network connections and make decisions based on the context of the traffic flow, providing better security than simple packet filtering
- Application-layer firewalls (proxy): Inspect traffic at the application layer, understanding protocols such as HTTP, FTP, and DNS. Can detect and block application-specific attacks
- Next-generation firewalls (NGFW): Combine traditional firewall capabilities with intrusion prevention, application awareness, deep packet inspection, and threat intelligence integration
Firewall Rule Management
Effective firewall rule management is critical for maintaining security. Auditors should evaluate whether rules follow a deny-by-default policy, whether overly broad rules exist (such as "any-any" permits), whether rules are reviewed and cleaned up regularly, and whether changes follow a formal change management process. Rule ordering is also important, as firewalls typically process rules sequentially and apply the first matching rule.
Intrusion Detection and Prevention Systems
IDS vs. IPS
Intrusion Detection Systems (IDS) monitor network traffic or system activity for malicious behavior and generate alerts. Intrusion Prevention Systems (IPS) go further by actively blocking detected threats. Key distinctions include:
- Network-based (NIDS/NIPS): Monitor network traffic at strategic points, analyzing packets for known attack signatures or anomalous behavior
- Host-based (HIDS/HIPS): Monitor activity on individual systems, including file integrity, registry changes, and process behavior
Detection Methods
IDS/IPS systems use two primary detection approaches:
- Signature-based detection: Comparing traffic against a database of known attack patterns. Effective for known threats but unable to detect novel attacks
- Anomaly-based detection: Establishing baseline behavior and alerting on deviations. Can detect unknown threats but may generate more false positives
Network Segmentation
Network segmentation divides the network into isolated segments to limit the blast radius of security incidents and enforce access controls. Effective segmentation strategies include creating separate zones for different trust levels, using VLANs and subnets to isolate systems, implementing micro-segmentation for granular control within data centers, and restricting inter-segment communication to only what is necessary.
Audit Procedures
IS auditors should review firewall rule sets for compliance with security policy, verify that IDS/IPS signatures are current and that alerts are investigated, test segmentation effectiveness by attempting cross-segment access, review logs for evidence of detected and blocked threats, and assess whether security devices are properly positioned within the network architecture. Regular vulnerability assessments and penetration tests should validate the effectiveness of these controls.