Firewalls and Network Filtering
Firewalls enforce which network traffic may cross a boundary, the workhorse control for segmentation and perimeter defense.
Deciding What May Pass
A firewall sits at a network boundary and decides, packet by packet or connection by connection, what traffic to permit and what to drop, according to a rule set. It is the most familiar network security control and the practical mechanism behind segmentation: the boundaries between zones are enforced by firewalls that pass only the traffic those zones legitimately need.
Generations of Firewall
- Packet filters: allow or deny by address, port, and protocol
- Stateful firewalls: track connection state to permit only valid flows
- Application-layer (next-generation) firewalls: inspect the content and application, not just headers
- Industrial protocol firewalls: understand ICS protocols and can filter by function code
Default Deny
A sound firewall policy is default deny: everything is blocked unless explicitly allowed. The alternative, default allow with a list of blocked things, inevitably leaves gaps, because you cannot enumerate every bad thing. Default deny with a minimal allow-list reflects least privilege at the network layer.
Deep Packet Inspection for ICS
Industrial firewalls can inspect ICS protocol content, permitting, for example, read requests to a controller while blocking write commands from a zone that should never issue them. This function-level filtering enforces intent that address-and-port rules cannot express.
Fusion Context
In the Hyperion breeder and burner control networks, firewalls enforce the Purdue-style zone boundaries with default-deny policies, and industrial protocol filtering restricts which commands may cross into safety-relevant segments. Firewalls are one layer among several: they reduce the attack surface but are backstopped by monitoring, host hardening, and the independent safety instrumentation that no firewall rule can be relied upon alone to protect.