Does a firewall protect against application attacks?

Does a firewall protect against application attacks?

I have a stateful inspection firewall protecting our network. There are some "one-to-one" NAT settings, so we can send and receive e-mail. Are we still vulnerable to application attacks (like the Windows OS vulnerabilities) if we have a firewall? Is there something else we can do to protect ourselves?

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Firewalls do not stop everything. There are some Windows vulnerabilities that can be exploited by malicious Web sites. If a user visits that site, they are "had." Since your firewall probably allows users to surf the Internet and allows Internet responses to come back through, those attacks sail right through the firewall. Other exploits come in via e-mail, typically in attachments that users open without thinking about where they came from.

Some things you can do are:

  • Ensure that your firewall settings are correct. The default settings are typically not what you need.
  • Consider disabling Active-X and Java in your browsers. While this can stop some malicious sites from attacking, it can also limit your functionality. Perhaps you can add sites that you need to use Active-X or Java to your Trusted Sites Zone (in Internet Explorer you can put sites into different zones) and allow the use of those tools in the Trusted Sites Zone, but not the generic Internet Zone.
  • Limit what types of attachments are allowed to pass through your firewall.
  • Have antivirus software both on the desktops and the e-mail server, and ensure that they are updated regularly.
  • Monitor the Web sites of all your software vendors and ensure that your patches are kept up to date.
  • Continue to read SearchSecurity.com and other security sites to be among the first to learn of new exploits and how to prevent them.
    For more info on this topic, visit these SearchSecurity.com resources:
  • Best Web Links: Infrastructure and network security
  • Featured Topic: Firewall evolution

    This was first published in December 2003