Internal Network Security test
The Internal Network Firewall (INFW) is specifically aimed at protecting your internal networks through a combination of network segmentation, data loss prevention and traffic inspection. Both SME and large enterprises should use INFW solutions are part of a wider network security strategy.
Why use an Internal Network Firewall (INFW)?
The most common location for a firewall is at the network-edge or perimeter. Perimeter firewalls deployed in this manner are designed to secure traffic to and from the internet (i.e. north-to-south traffic). However, while these perimeter devices may identify external threats passing through your perimeter firewalls, their positioning in the network means they are unable to identify or block viruses, hackers and similar threats moving laterally throughout your network (i.e. East-to-West). This lateral traffic could be data flows between your departmental networks, between your dev and live environments, or across your WAN from other offices.
This is where the internal network firewall has a key role. The Internal Network Firewall (INFW) securely segments your network whilst simultaneously screening for unusual traffic, indications of compromise and other anomalous behaviour.
Internal Network Firewalls (INFW) are also described as Internal Segmentation Firewalls (ISFW).
External vs Internal Traffic
Gartner’s traffic patterns assessment suggests a significant amount of traffic is still not regularly screened against an intrusion prevention system and other related security checks are missed.
In most IT or hosted environments, the traffic patterns can broadly be described as:
- North to South – Traffic going from the LAN to the Interent, and vice-versa.
- East to West – Traffic internal to the organisation, routing server-to-server, server-to-client or client-to-client but not leaving the organisation. This can be between IP subnets or routed VLAN interfaces (typical in many enterprises with L3 switches).
The exact ratio of north to south and east to west will vary from business to business and it will depend on the exact IT environment. Figures from Gartner suggest 77% of traffic is East to West, whilst 17% is North to South (The remaining 6% is between sites).
How to deploy an INFW?
MTG has worked in a variety of network environments and in all cases will recommend the most appropriate solution based on your security needs.
There are generally three methods to deploy an internal network firewall:
- VLAN Separation. For organisations using VLANs, they may use L3 VLAN interfaces or inter-vlan routing to enable traffic flows between L2 Ethernet networks. The INFW can be added to the existing Ethernet environment as a high speed trunk interface, managing the routing between L2 VLANs. The Ethernet switch then reverts to being a L2 switch.
- Interface Separation. In this scenario, individual Ethernet ports of the firewall are patched into the various switches or VLAN access ports.
- Transparent Mode. In transparent mode, the INFW serves as a transparent L2 bridge, invisible to the network. Bridge mode is useful when you want to protect or monitor a discreet network segment.
Internal Network Firewall – Use Cases
If your business is looking to enhance its internal network security, there are a number of key use-cases or scenarios where the internal network firewall is a great fit:
In many organisations the WAN component, linking other offices or suppliers, is treated as an internal network and therefore is not subject to the same perimeter security checks. In a large organisation, a malware outbreak can propagate across the WAN or provide a method for attackers to infiltrate other sites. The INFW can implement a network security policy on your WAN links.
Defending key network assets
In many businesses there may be a particular department or network segment that holds particularly sensitive of valuable data assets. In these scenarios, the INFW should be considered to further protect these network assets with the added functionality of an Intrusion Prevention System (IPS) and advanced firewalling features.
Department or functional separation
The INFW can be placed to provide secure segmentation between functional departments (i.e. Accounts, IT, R&D). MTG can work with you to identify typical inter-departmental traffic flows before implementing a baseline policy to secure intra-organisation traffic.
It is common for links to suppliers to pass through the perimeter security however in many cases this is not feasible. An INFW firewall can be deployed to provide a secure gateway between your business and your suppliers.
The INFW firewalls have the same rich feature-set that our managed firewalls have. Internal Network Firewalls can also be managed 24x7x365 by our security operations team.