What does
a firewall do,
and does my
business still
need one?

Firewalls have been the default cyber security tool for many years. Even today for many companies, their firewall and their endpoint anti-malware remain their primary or only IT security. Despite security tools becoming increasingly sophisticated, firewalls remain popular, with the global firewall market expected to reach $8.6 billion by 2026. Yet small business owners, already facing rising costs amid a global pandemic, may have questions about the value of firewalls as a service. What does a firewall do and is a firewall really necessary? Before answering the crucial question “what is a firewall in a computer network?” it is important to consider the cost of cyber attacks on small businesses.

The FBI's Internet Crime Report notes the cost of cyber crimes reached $4.2 billion in 2020, and while the Small Business Administration (SBA) recognizes cyber attacks "are a growing threat for small businesses," Intrusion, Inc. projects that global cybercrime costs will reach $10.5 trillion annually by 2025.

According to the small business advisory organization SCORE, 71% of cyber attacks occur at businesses with less than 100 employees and the average cyber attack costs a small business an average of $34,604. It takes an average of 191 days for a small business to become aware of a cyber attack, and nearly 60% of companies go out of business within six months of a cyber attack.

The SBA says small businesses are attractive targets because they have information valuable to cyber criminals, without generally having the security infrastructure or access to the required resources of larger businesses. A recent SBA survey found 88% of small business owners felt their business was vulnerable to a cyber attack. Yet many businesses have few, if any, skilled resources, limited knowledge of appropriate tools, minimal time to devote to cyber security, or simply don't know how vulnerable they really are.

So, what does a firewall actually do? The goal of a firewall is to protect your network from unauthorized access. A firewall monitors both incoming and outgoing network traffic, allowing only permitted packets to get through. The firewall helps prevent intruders from accessing your systems when you are online as people with malicious intent can invade your computer to delete or corrupt files on your system, hunt down personal information stored on your computer, or even read your email.

A firewall may be one of the more well-known cyber security tools, but how it works has changed as the technology and the attack vectors has become more sophisticated. This is why it is important to understand not only what a firewall does, but also how a firewall fits in an overall computer network architecture and how a firewall can be a part of a secure access service edge (SASE) solution.

A firewall can be a piece of hardware (often called a security appliance) with specialized software installed on it, or it can be simply an application installed on a system, or it can be a virtualized system deployed in a cloud. Some organizations may find that they need a combination of firewall type services. A hardware firewall is a device that is installed at the edge of a company’s network, acting as a barrier between the organization's internal networks and its internet connections. A software firewall is typically installed on each individual device and can offer protection down to individual applications. A cloud based firewall can allow companies to central the firewall and security functions and reduce overhead.

Within those offerings, these are the most common types of firewalls:

• Packet filtering firewall: This is the oldest, and maybe most basic type of firewall—a first step in protecting users from network threats; it checks data packets based on predefined parameters. These can be difficult to configure and don't provide detailed incident logs about the contents of the packets.
• State-full firewall: This firewall tracks network connections and their attributes, like IP addresses, and it filters incoming and outgoing packets over time, storing and even evaluating cumulative data to improve filtering decisions. The data evaluation process takes context history from previous connections and packets into account rather than solely relying on administrator-defined rules.
• Web application firewall (WAF): This firewall works with web servers hosting websites or applications, and it typically applies a set of rules to HTTP communication that counter the most frequent types of attacks.
• Next-generation firewall: Next-gen firewalls scan packets from applications and add the ability to identify and block malware from getting into the network, something traditional firewalls typically cannot do.

While firewalls in some form or another have been around since the 1990s, firewalls remain a crucial element of modern cyber security. Here are a few reasons why:

• Firewalls can help you stay in charge. Each type of firewall offers control of your own network. You can dictate what websites can be accessed and what should be blocked through their firewall controls. You may even choose to prevent employees from accessing social media sites during the workday.
• Firewalls can save money. Cyber attacks can cost money and could even jeopardize your whole business. Firewalls can block potentially harmful websites from the network and can decrease the risk of malware and ransomware attacks.
• Firewalls are important. Many small businesses have limited resources to spend on cyber security, and even if you have ample resources, a Cybersecurity Workforce Study identified a global cyber workforce shortage of 2.72 million. A firewall needs to be on duty all the time monitoring the network and offering protection for data. It might not replace a security team, but a firewall can help lessen their workload.