Firewall

To get into an apartment complex, you have to go through the guard booth at the main gate. The guard checks whether the car belongs to a registered resident. If an unfamiliar car shows up, the guard asks why it's visiting, and only then raises the barrier. The same kind of entry control happens in real time in the network world we use every day.

Every little piece of information traveling between the internet and your computer or phone is called a packet (a small bundle of data sent across a network). A firewall stands right between the internet and your device, acting as a digital guard booth that carefully checks the source and destination addresses of each packet.

When you visit a website yourself, you made the request first, so the rules allow the reply data to come back in. The firewall isn't judging whether that site is safe, though. But if a strange outside computer with no known origin tries to sneak into your device, the firewall drops the barrier right away and shuts it out.

A firewall can pick out suspicious traffic from a huge flow of data because of a carefully written guest list. In IT, this list is called a firewall rule set, or a security policy.

These rules spell out exactly which IP addresses (unique numbers for devices connected to a network) are allowed in, and which port numbers (dedicated doorways that programs on a computer use to communicate) stay open. The firewall compares all passing data against the rules and lets through only data that was approved in advance.

If a hacker tries to break in through some random door that is firmly locked, the firewall cuts the connection immediately. It doesn't only watch for break-ins from outside, either. If malicious software hiding on your computer tries to sneak out passwords or personal information, the right rules can block the exit route. One catch: personal firewalls usually allow outgoing traffic by default. If malware disguises itself as ordinary web traffic, a firewall alone has a hard time stopping it.

To be a bit more precise, turning on a firewall doesn't mean you're perfectly protected from every digital threat. That's because a basic firewall mostly checks the address information written on the outside of the data envelope.

Think of a letter. Just because the return address on the envelope looks fine doesn't mean what's inside is guaranteed to be safe. Malicious scripts disguised as ordinary internet traffic, or harmful files attached to emails, are hard to catch with a simple address check.

That's why today we build layered defenses using several tools together. Next-generation firewalls have deep packet inspection (DPI), which opens up the data to look at what's inside. An intrusion detection system (IDS) spots attacks and sounds the alarm, while an intrusion prevention system (IPS) actively stops them. Attacks aimed at website servers are handled by a separate web application firewall (WAF). Harmful files like email attachments are caught by security software such as antivirus programs or by email security solutions. Even if the firewall guards the sturdy outer walls and the front gate, you still need dedicated security software and the latest updates to carefully check what's inside your device.