Who Needs a Firewall?

To determine whether your organization needs a firewall for Internetsecurity, you must first assess the risks of your Internet connections. The fourmost common types of Internet connectivity in organizations are

Although all these connections represent a potential security hazard, themost risky are those that use TCP/IP as the end-to-end transport mechanism. Thisrisk results from TCP/IP transport mechanisms supporting a range of services,including services that hackers use. Full-time leased lines and dial-up PPPconnections use such TCP/IP connections. UUCP and online service providerconnections are generally safer because they use specialized transport protocolsfor part of the connection. Such specialized transport protocols usually supportonly the intended application and so limit the number of attacks possible overthe connection.

Note that individual accounts with online services can sometimes use TCP/IPas the end-to-end transport mechanism. If your organization uses such accountsfor Internet access, you can expose your internal network to significantthreats, even if your service provider implements security measures (e.g., afirewall between the service's system and the Internet). If online serviceprovider accounts or dial-up PPP accounts are starting to appear in yourorganization, the time has probably come to move to a dedicated Internetconnection that you can protect with a firewall.

Some ISPs provide a firewall service, which may be a cost-effective optionfor small companies. However, operating your own firewall lets you more easilymeet users' Internet-access needs so they won't be tempted to secretly installdangerous dial-up accounts. Any organization that's large enough to have aninternal IS staff and must provide Internet access beyond simple email needs afull, dedicated Internet connection that an onsite firewall controls. Inaddition, any organization that must tightly control access to or fromparticular departments or provide a dedicated network connection to an externalorganization over the Internet needs a firewall.