What you should know about firewalls

Scott Rolf knows trouble when he sees it. An IT director for a law firm near Cleveland, Ohio, Rolf was asked by a friend to check out the new website the friend had put up on a DSL-connected web server.

Rolf did more than just visit his friend's site; he quickly found that the server lacked any sort of firewall protection. It took less than five minutes for Rolf to exploit a well-known Windows NT vulnerability and email to his friend a complete listing of files and directories from the server's hard disk.

"He called me a few minutes later and said 'Holy cow, what do I do?' He was at work and couldn't turn the server off," Rolf laughs. "I think he went out and bought a Linksys firewall box."

As the name implies, a firewall acts as a barrier between your PC and the internet. Firewalls not only prevent unauthorised access to your PC or network, they also hide your internet-connected PC from view.

Firewalls have long been a fixture at large companies, which must secure their networks against determined attackers. But the dangerous surge in email- and web-borne threats, including viruses, worms, hijacks, and increasingly aggressive spyware, means that home PCs require this protection as well.

According to the Internet Storm Center, a typical unprotected PC will come under attack within 20 minutes of being connected to the internet. In less time than it takes most people to shower and get dressed in the morning, your PC will probably attract some form of unwelcome advance.

Johannes Ullrich, chief technology officer at the Internet Storm Center, says the situation is so bad that a newly connected PC won't have time to download all the Windows patches needed to make it secure before malicious software has found and infected it.

The time to attack is even shorter for PCs on high-speed university networks and cable or DSL services. Hackers specifically target these addresses for their high bandwidth and always-on nature. It's a digital catch-22. The better your connection, the bigger your risk.

Alas, it seems that too few people have well-meaning – if over-inquisitive – friends like Rolf. Alan Paller, director of research for The SANS Institute, an organisation dedicated to internet security issues, says most home users don't have any firewall protection in place. That leaves connected PCs exposed to all manner of intrusion and attack.

The good news for cable and DSL customers is that firewalls are cheaper to buy and easier to use than ever. And adoption is picking up, according to forecasts by In-Stat/MDR, a market research firm. Sales of consumer firewalls are expected to quadruple by 2007, in part because firewall functions are being built into all sorts of consumer network gear.

"I don't even think there are any routers that don't have basic firewall protection," says Ullrich.

Firewalls actually come in two distinct flavours: software applications that run in the background, and hardware devices that plug in between your modem and one or more PCs. Both types hide your PC's presence from other systems, prevent unauthorised access from external sources, and keep tabs on network traffic across the firewall.

While software applications can be less expensive – Microsoft has improved the firewall software in Windows XP Service Pack 2, and both ZoneAlarm and Sygate Personal Firewall are free for download – a hardware firewall usually does a better job for broadband users.

"Users really like them because they are simpler to use than software firewalls, and they don't have any [performance] impact on their computer," Ullrich says.

"The other advantage of a hardware firewall is if you happen to install some sort of malware on your system, it cannot take out your firewall. However, malware frequently disables antivirus checkers and software firewalls."

Matt Neely, a computer security expert for a major financial firm, says you can find bare-bones firewall devices for next to nothing. "You can get a decent one on sale for 10 or 20 bucks," says Neely. "They make a great gift. I give them out like candy on the holidays."

Don't make the mistake of buying a firewall and thinking your security problems are solved. Firewalls may be great at stopping unwanted intrusions, but they often do little or nothing to detect virus-laden emails or stop intrusive adware and spyware.

You'll want separate antivirus and spyware checkers to stymie these threats. What's more, hardware firewalls usually won't manage outbound traffic, which means a piece of spyware can freely send data from your PC to a server on the internet.

So what do hardware firewalls do exactly? More than anything, they stymie inquisitive software that pings, sniffs and queries IP addresses in the hopes of finding a wide-open system. To do this, hardware firewalls employ numerous functions. Among them: