Introduction
Firewalls play a crucial role in cyber security, acting as the first line of defence against unauthorised access. Whether your organisation is pursuing Cyber Essentials, Cyber Essentials Plus, or just looking to be secure, a suitably configured firewalls is a fundamental requirement. In this article, we explain why firewalls are so important, make consideration and provide key notes, we also present an example scenario to help with the explanation of the Cyber Essentials requirements.
Why Firewalls Are Important
A firewall is a security barrier that monitors and controls incoming and outgoing network traffic based on predefined rules. It helps prevent cyber threats, unauthorised access, and data breaches. Without a firewall, your network and/or devices are exposed to various cyber risks, including malware infections, hacking attempts, and unauthorised access.
Firewalls are especially important for:
- Protecting sensitive business data
- Preventing unauthorised access from the internet
- Blocking malicious traffic
- Enhancing regulatory, compliance and security posture
What Firewalls Cover in Cyber Essentials
To meet Cyber Essentials certification requirements, organisations must ensure:
- Default passwords are changed to secure access
- Internet access to administrative interfaces are prevented unless there’s a documented business need with suitable protection (such as multi-factor authentication)
- Only necessary ports are open, again with a documented business need
- All other inbound connections are blocked, including unauthenticated connections
- Unnecessary firewall rules are removed or disabled quickly, to reduce exposure
Considerations and Key Notes
When reviewing firewalls for your organisation, please consider:
- The network boundaries – office, cloud, and/or work at home environment
- The type of firewalls in use – hardware and/or software firewalls
- Who manages the firewalls – your organisation or other parties
- Whether there’s a business need to access internal services
Key Notes
- Home broadband ISP devices are out of scope for Cyber Essentials
- Best practice cyber security requires two types of firewall are used for protection. One at the entrance or boundary to the network and another on each computer
- In-built (vendor provided) software firewalls are suitable for Cyber Essentials – no need to purchase a software firewall unless there’s a business need (Microsoft Defender, Mac OS firewall and default Linux firewalls are all acceptable for Cyber Essentials)
Example Scenario
Organisation ABC has an office environment using a firewall provided by the organisation
- For Organisation ABC, a hardware firewall is protecting the office network (boundary)
- Ensure technical controls are in place for the hardware firewall – change any default password, prevent administrative access from the internet / ensure inbound ports are blocked (unless there’s a documented business need and suitable controls are in place)
- Document a way to change the password – use this in the event that the password may be compromised
- For best practice ensure software firewalls are also in use for each computer
Tips and Recommendations
- Make it clear that you have considered each of your environments when completing the Cyber Essentials question set
- Make reference to hardware and software firewalls (assuming software firewalls are being relied upon in some way) on the Cyber Essentials question set
- If a third party is responsible for your firewall, ensure that third party manages password control and detail how you confirm the requirements are being met in the question set
- Always change any default password and then change again if a compromise is suspected, or if someone leaves the organisation with knowledge of that password
- Really consider whether administration is required via the internet – if it is ensure this is documented as a business need and ensure technical controls are in place such as multi-factor authentication with a minimum of 8 character passwords, or a minimum of 12 characters if multi-factor authentication is not possible to setup
- If inbound rules are setup to allow access to internal services, ensure this is documented as a business need, that firewall rules are reviewed regularly and disabled when not in use / not required
For more detailed guidance, visit the IASME knowledge hub for Cyber Essentials and review the ‘About Firewalls’ section.
How We Help
At RB Consultancy Ltd, we support organisations in implementing firewall security that meets Cyber Essentials and Cyber Essentials Plus requirements:
- Explain the difference between hardware and software firewalls
- Help determine how they should be relied upon for your environment
- Explain why the Cyber Essentials questions are being asked and how they intend to protect organisations in different ways
- Ensure the firewalls to align with Cyber Essentials guidelines
Conclusion
Firewalls are a critical component of cyber security and Cyber Essentials certification, helping to protect your business from cyber threats. Misconfigurations, outdated rules, and poor administrative practices can leave your organisation vulnerable. By implementing best practices and ensuring compliance with Cyber Essentials technical controls, organisations can significantly reduce their cyber risk. If you need assistance with firewall configuration, or Cyber Essentials / Cyber Essentials Plus certification, please contact us for support.
Written by Remo Belisari, Managing Director of RB Consultancy Ltd, an experienced cyber security professional cyber advisor. Remo holds certifications relating to CISSP, ISSAP, ISO 27001, Cyber Essentials, IASME Cyber Assurance, and has many years experience in IT and cyber security. Remo has a history of supporting organisations from all over the world – including a Fortune 500 in USA and over 100 organisations across the UK. The views expressed in this blog are those of the author and do not necessarily reflect the views of RB Consultancy Ltd, its clients, partners, or affiliated organisations. The content is intended for general information only and should not be taken as legal advice.
