A personal firewall complements traditional defenses such as gateway firewalls and anti-virus efforts.
In a world of remote/mobile users and wireless access points, every endpoint PC extends your network perimeter. Obviously, home PCs are targets of worms and hackers, but white-collar criminals also target PCs as the most vulnerable part of the enterprise network. Worst of all, once the perimeter is compromised, these threats quickly spread unchecked throughout the entire network, unless you have the proper protection. Think of the recent rampages of MSBlast or Sasser.
The solution is a personal firewall, which complements traditional defenses such as gateway firewalls and anti-virus efforts. A personal firewall is installed as software on each end-user computer, and it blocks inbound and outbound threats. Personal firewalls can monitor and control not just network-level but also application-level traffic.
Inbound protection
Like a perimeter firewall, a personal firewall can open and close ports. For example, the Sasser worm attempts to connect to endpoint PCs via TCP Port 445. A personal firewall will close that port and prevent the target PC from becoming infected, even if it is running an unpatched, vulnerable operating system.
Gateway firewalls close ports by refusing to transmit inbound TCP packets. Users or administrators can close ports to all traffic or to traffic that matches user-defined conditions – source IP address or domain, for example. In contrast, a personal firewall eliminates the need to program a firewall in the traditional, complex way that depends on such detailed knowledge of ports and protocols. Instead, personal firewalls use an application-centric approach to traffic control, opening and closing ports based upon the applications that users approve.
Additionally, a personal firewall can operate in stealth mode by making the PC invisible to outsiders, offering even more protection. For a closed but unstealthed port, a personal firewall would send a “denied” response to the originator for each refused packet. This lets the initiating computer know that the communication attempt is bug-free because the target PC is refusing the connection. However, attackers can glean information from examining refused packets – operating system, security configuration and, most importantly, that a PC exists at the target IP address. In stealth mode, a PC does not respond to unauthorized packets. The hacker doesn’t even know the PC is there.
Even if a port is open and accepting communication, a personal firewall can filter out malicious connection attempts through stateful packet inspection. By examining each inbound packet to see if it’s in response to an earlier request by the target PC, a personal firewall determines which packets are legitimate communication and which are probes.
Outbound protection
Personal firewalls provide application control by monitoring all applications’ requests to an operating system to communicate to the Internet. The firewall driver associates each application with the traffic it initiates. Then, the firewall allows or denies that traffic according to the rules defined by an end user. This prevents unauthorized applications from successfully making outbound connections to the local network or the Internet. Personal firewalls can catch spyware, Trojan horses and viruses’ SMTP servers the instant they attempt to propagate or “phone home.”
Malware designers compensate for this by spoofing or even hijacking approved programs to facilitate malicious communication. Personal firewalls protect against this via application authentication, checking applications not simply by filename but by MD5 hashes of EXEs, Dynamic Link Libraries and other components. If a program has been altered, it’s not allowed out without user approval.
Personal firewalls also can provide additional protection such as hardened defenses against direct attacks, even during bootup; immediate protection via default settings; automatic network detection with enforcement of appropriate security policy; and a built-in knowledgebase for responding to or remediating security events.
Personal firewalls provide effective front-line defense against human and automated attacks and can prevent the spread of malware within corporations.
Felman is vice president of marketing for Zone Labs. He can be reached at ffelman@zonelabs.com.
