Firewall
Definition
A firewall is a security control that monitors and filters network traffic between systems, networks, and the internet based on defined rules. It helps reduce unauthorized access, limit exposure to malicious activity, and enforce network segmentation by allowing approved connections and blocking unwanted or risky traffic. Firewalls can be deployed at different layers, including network perimeter firewalls that control traffic between networks, host-based firewalls that protect individual endpoints and servers, and cloud-native firewalls that apply policy to virtual networks and workloads. In the context of CyberSecure Canada, firewalls support baseline cybersecurity practices by providing network boundary protection and controlled connectivity for business systems. Effective firewall use includes maintaining an approved rule set aligned to business needs, applying least privilege (deny-by-default and only permitting required ports, protocols, sources, and destinations), documenting and approving changes, and enabling logging to support monitoring, incident investigation, and compliance evidence. A well-managed firewall program also includes periodic rule reviews to remove unused or overly permissive rules, segmentation to isolate critical assets, and alerting on suspicious or policy-violating traffic. Comparable expectations for network boundary protection and traffic filtering also appear in widely used security frameworks such as NIST SP 800-41, NIST SP 800-53 (e.g., SC-7), ISO/IEC 27001 Annex A, and the CIS Critical Security Controls. While a firewall is not a complete security solution by itself, it is a foundational control that complements identity, endpoint protection, vulnerability management, and security monitoring.
Real-World Examples
Startup: Cloud network firewall for a web app
A startup restricts inbound traffic to HTTPS only, blocks all admin ports from the internet, and allows database access only from the application subnet.
SMB: Segmentation between corporate and production
An SMB separates office devices from production systems and permits only required service-to-service traffic, reducing blast radius if a workstation is compromised.
Enterprise: Rule governance and audit evidence
An enterprise requires change tickets and approvals for firewall rule updates, performs quarterly rule recertification, and retains logs to support investigations and audits.
A firewall inspects network traffic and applies rules to allow or block connections based on criteria like IPs, ports, protocols, users, or applications.
A router primarily forwards traffic between networks, while a firewall enforces security policy by filtering, restricting, and logging traffic according to rules.
Network firewalls protect network boundaries, host-based firewalls protect individual devices, and cloud firewalls apply policy to virtual networks and workloads.
An NGFW typically adds application-aware controls, deeper inspection, and threat-prevention features beyond basic port/protocol filtering, depending on configuration.
Start with deny-by-default, then permit only required traffic with tight scopes (source, destination, port, protocol), document the purpose, and review regularly.
Many organizations review rules at least quarterly or after major changes, focusing on removing unused rules and tightening overly broad access based on risk.
Collect allow/deny events, rule hits, admin changes, and alerts with timestamps, sources/destinations, ports/protocols, and sufficient context for correlation.
Retention depends on regulatory and business needs, but should be long enough to support investigations and audits, with secure storage and access controls.
A WAF protects web applications by filtering HTTP/S requests, while a network firewall controls broader network connections across ports, protocols, and segments.
Common evidence includes documented firewall policies, approved rule sets, change records, periodic rule review results, and log samples showing monitoring and alerts.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-26 | WatchDog Security GRC Wiki Team | Initial publication |
