A firewall is a network control that allows or blocks traffic according to a written policy between different zones of trust.
It decides which conversations may cross a boundary, and it does not replace device hardening, identity, or monitoring of what is allowed through.
How it works
Zones might separate the public internet, a guest network, employee devices, and systems that hold sensitive data.
The policy should say which directions and which services are permitted, and everything else should fail closed or be explicitly reviewed.
A firewall that permits broad access because an application once needed it becomes a corridor rather than a boundary.
Owners review rules, remove expired exceptions, and log denied and allowed traffic that matters, without treating the device as a complete security program.
Concrete examples
- Employee laptops may reach the internet, but they may not open administrative services on servers that hold customer data.
- A guest network can use the web and cannot reach payroll systems at all.
- An expired project rule that allowed a supplier into a database segment is removed at the review date.
Protective measures
- Write the zone policy in plain language, including what is denied by default.
- Require an owner and an expiry for every exception that opens a new path.
- Review firewall rules on a schedule and delete paths that no current system still needs.
- Log the traffic your incident process will actually use, and do not assume the firewall sees activity inside a zone.