The gatekeeper at the door, the firewall

Guarding the doors

In the previous area we saw traffic come and go through doors, that is ports.
A computer has several such doors.
A door for the web, a door for mail, one per purpose.
Leaving every door wide open is convenient, sure.
But anyone can come in through any door.
So you post a guard in front of the doors.
A guard who looks at each piece of traffic
and decides whether to pass it or block it.
This guard is exactly the firewall.
What comes in and what goes out both pass through its hands.

Tap to send the incoming traffic. The firewall guard stops and inspects it.

When we sent the traffic, it did not go straight in.
The firewall stood in the middle and stopped it.
This is the guard's first job.
Not just passing it through, but first stopping it to inspect.
If everything were let in without inspection,
there would be no point in having a guard.
But what does the guard look at
to decide whether to pass it or block it?
Surely not on a whim with no standard.
Next we look at that standard, that is the rules.

Allow and block, set by rules

The guard holds a list of rules in hand.
A rule sets, per door, whether it is allow or block.
For instance, decide to keep the door for the web open
and to keep an unused door shut.
When traffic arrives, the guard sees which door it comes to,
and if that door's rule is allow, lets it pass.
If it is block, it is stopped on the spot.
Who the source or destination is can also be checked.
It sounds hard, but the core is simple.
Pairing doors with rules to split passing from blocking.

Tap allow or block per door to set the rule. Traffic passes or is blocked as you set it.

Setting a rule per door, the result was clear.
A door set to allow let the traffic pass through,
and a door set to block stopped the traffic.
Even the same traffic, depending on which door and what rule,
met a different fate.
This is the basic way a firewall works.
But one thing is missing.
When new traffic arrives that no rule mentions,
what should the guard do?
Next we look at that default stance.

The default is to block the unknown

Say unfamiliar traffic arrives that no rule covers.
The guard has two possible stances.
One is to let it in first and block it if it seems suspicious.
One is to block it first and let in only what is permitted.
The safe side is the second.
Let through only what is explicitly allowed,
and block anything unknown without exception.
This is called default deny.
A door you forgot to write is effectively shut automatically,
so the worry of a door left open by mistake shrinks.

Tap to switch the default stance. With default deny, any unfamiliar traffic not on the allow list is blocked.

Switching the default stance, the difference was big.
With default allow, unfamiliar traffic slipped in too.
Switching to default deny,
only what was on the allow list passed,
and all the rest was blocked.
Forgotten doors and traffic you never thought of
are shut automatically, that is the power of default deny.
The basic skill of safety is exactly this.
When in doubt, block first.
So is opening fewer doors safer? Next we look.

The fewer open doors, the safer

The surface visible from outside is called the attack surface.
Each open door is a point that can be reached from outside.
The more doors open, the more places that can be reached.
So the more open doors, the wider the attack surface.
Conversely, keep only the doors you truly need and shut the rest,
and the surface reachable from outside narrows.
There is no reason to keep a door open that you never use.
In practice, just shutting unused doors
cuts exposure greatly.
A small surface is also easier to defend.

Tap an open door to shut it. Compare how the attack surface bar shrinks as fewer doors stay open.

Each time we shut a door, the attack surface bar got shorter.
With many doors open the exposure was wide,
and leaving only the doors truly needed cut it sharply.
This is what reducing the attack surface means.
Use the firewall to shut unused doors
and make the surface reachable from outside small.
Of course, shut the needed doors too and the work stops,
so doors you must use should stay open.
The key is balance.
Open what you use, shut what you do not.

Let's wrap up

Gathered on one line, it is this.
A firewall is a gatekeeper that inspects passing traffic by rules.
Traffic comes and goes through doors, that is ports,
and the firewall sets per door whether to allow or block.
The default is to block the unknown, that is default deny.
Only the allowed passes and the rest is blocked automatically.
The fewer open doors, the narrower the attack surface, so it is safer.
So open only the doors truly needed and keep the rest shut.
Gatekeeper, default deny, and a small attack surface.
These are the three key points of the firewall.

Tap the key points in order to review. (guard the doors -> allow and block rules -> default deny -> reduce the attack surface)

Now you know what a firewall does.
It guards the doors for coming and going, inspects by rules,
blocks the unknown, and shuts unused doors, a gatekeeper.
A firewall inspects traffic, but it does not read every detail
of the content to declare for certain who someone is.
So another safeguard is needed,
one that confirms the other side really is who they claim.
In an earlier lesson you briefly heard the word authentication.
Next, let's look at that authentication in more detail
and see together how to confirm who someone is.