Next-Generation Firewalls and IPS Explained

Next-Generation Firewalls (NGFW) and Intrusion Prevention Systems (IPS) are security appliances. Both are upgraded versions of their predecessors. They provide the features their predecessors lack. This tutorial compares both with their predecessors, lists their differences, and explains their roles and functions in computer networks.

Intrusion Prevention System (IPS)?

An intrusion prevention system (IPS) is a security appliance. It operates in the middle of the data flow. It detects threats, removes malicious content before it reaches other security devices, terminates suspicious connections, and sends alerts to administrators. It is the predecessor of intrusion detection systems (IDSs). IDSs have threat detection and reporting functions. They detect and report threats to administrators. However, they lack a threat prevention system. This system is added in IPS. IPS includes all the features and functions of IDS, as well as a threat prevention system. It was developed and released in the mid-2000s as a stand-alone device. Later, it was integrated into Next-Generation Firewalls and unified threat management (UTM) solutions.

Features of IPS

• It reduces workloads from other security appliances. It allows them to focus on blocking more complex threats.
• It implements network security policies by preventing users from performing unauthorized actions.
• It effectively detects vulnerability exploits and blocks attackers from utilizing them until a security patch is applied.

IPS threat detection methods

IPS uses the following threat detection methods.

• Signature-based detection
• Anomaly-based detection
• Policy-based detection
• Reputation-based detection

Signature-based detection

A threat or malware includes a uniquely identifiable pattern or sequence of code, called an attack signature. An attack signature is a unique characteristic of a specific threat. IPS maintains a database of attack signatures. When a threat or malware is discovered, its signature is added to the attack signature database. IPS compares all data packets with its database. If a packet matches any signature stored in the database, it drops the packet, terminates the connection, and sends an alarm to administrators.

Policy-based detection

This method requires administrators to configure security policies based on their requirements and network infrastructure. IPS monitors network traffic based on configured policies. If it detects an action that violates a security policy (such as a user opening an unallowed port or sending or accessing more network traffic than the defined limits), it takes the defined action.

Anomaly-based detection

It uses artificial intelligence and machine learning methods to build a baseline model of normal network activity from the configured security policies. It randomly compares network traffic with the baseline model. If traffic activity falls outside the baseline performance parameters, it takes action.

Reputation-based detection

Many organizations and security agencies maintain and share databases of IP addresses and domains that are associated with malicious or suspicious activity. IPS utilizes these databases to flag and block potentially harmful traffic. For example, it can use them to identify a denial-of-service (DDoS) attack.

IPS threat prevention techniques

When an IPS detects a threat, it takes the following actions.

It removes malicious content. Based on configuration, it may allow the remaining traffic or drop the entire data stream containing the malicious content. For example, if an email attachment contains harmful content, depending on the configuration, it can either drop the email or deliver it while discarding the attachment.

Depending on the configuration, it can send notifications to other security devices to take appropriate actions, such as updating the attack signature database and changing firewall rules to keep hackers out of the network.

It can terminate the session and block all actions that violate the security policies. For example, if a user sends data to a remote host not listed in the security policies, the connection is terminated, and all further user activity is blocked.

Next-generation firewall (NGFW)

A next-generation firewall (NGFW) is also a security appliance. It is an upgraded version of a traditional firewall. Traditional firewalls filter traffic based on ports and IP addresses. However, they do not filter application data. NGFW offers all features and functions of traditional firewalls. In addition, it filters application data and offers an integrated intrusion prevention system. It checks network traffic at the application level to prevent misuse of legitimate applications.

How does an NGFW work?

Traditional firewalls operate at the Data Link, Network, and Transport layers. They compare the hardware (MAC) address, software (IP) address, and port numbers of source and destination devices against the defined security policies. They can filter who can access what. You can use them to configure which hosts and services are allowed or denied on the network. However, you cannot use them to check the data allowed hosts exchange.

Let us take an example. You configure a firewall to allow certain hosts, identified by their IP addresses, to access a web server. When a host initiates a connection, the firewall checks its IP address. If the host is on the allowed list, the connection is allowed. If not, it blocks the connection. If you need more granular control, you can configure the firewall to allow access only on the port running the web server. After that, allowed hosts can access only the web service running on the server.

Since a traditional firewall does not work above the Transport layer, it cannot see what data the allowed hosts exchange. In this example, it cannot check the data the web server and an allowed host exchange. Furthermore, devices in modern networks exchange data in encrypted format. Traditional firewalls cannot read the encrypted data stored in packets.

Traditional firewalls check only headers. They do not inspect the payload. Hackers can use this behavior to bypass traditional firewalls. They can hide malware in encrypted data and send it to the web server from an allowed host. Since the firewall sees data packets originating from an allowed host, it allows them to reach the web server.

The NGFW fills this security gap. It checks each packet’s header and payload. It inspects the payload for attack signatures and other potential threats. It compares each packet’s contents with an attack signature database. It uses IPS to provide this functionality. IPS is integrated into NGFW. Traditional firewalls use packet filtering, whereas NGFW uses deep packet inspection.

Packet filtering

In packet filtering, the firewall inspects the source and destination IP addresses, ports, and protocols associated with each packet. It checks each packet’s origin and destination, as well as the path it takes to reach the destination.

Deep packet inspection (DPI)

In Deep packet inspection, the firewall inspects the source and destination IP addresses, ports, and protocols associated with each packet, and checks each packet’s origin and destination, the path it takes to reach the destination, and its contents.

Differences between a traditional firewall and a next-generation firewall

Conclusion

Traditional firewalls use ports and addresses to filter network traffic. They do not see and inspect the data stored inside the packets. Due to this limitation, allowed devices can bypass a traditional firewall and send malware to a target device by hiding it in encrypted data. Next-generation firewalls fill this security gap. They include IPS, which filters application data for malware and suspicious code. In this tutorial, I explained both next-generation firewalls and IPS.