Professional Documents
Culture Documents
Network Security Devices You Need To Know About
Network Security Devices You Need To Know About
Go Up
Netwrix Named a Visionary in the 2023 Gartner® Magic Quadrant™ for Privileged Access Management
×
Search
SysAdmin Magazine
Attack Catalog
Game Zone
Blog
Blog / Infrastructure …
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 1/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Dirk Schrader
Published: January 22, 2019
Updated: September 29, 2023
On top of the many network devices that any enterprise should have today, there are a selection
of network security tools and devices that can help you defend your network. While networking
security tools have traditionally been implemented as on-prem network security hardware or
virtual appliances, in recent years many vendors and business customers have transitioned to
cloud based solutions. While most security solutions are available as proprietary solutions, there
are some open-source options out there. Below is a list of the most common network security
device types that can help you secure your network against the growing threat landscape.
Firewall
Firewalls serve as a primary safeguard security tool for medium or large enterprises. Most people
are familiar with the perimeter firewall that protects the network from the Internet. A firewall can
exist as a distinct system or be integrated into other devices such as routers or servers. Available
in both hardware and software formats, some firewalls are specially designed as appliances to
distinctly separate two networks.
Their primary function is to filter out undesired network traffic, ensuring unwanted intrusions
don’t breach an organization’s systems. The firewall’s behavior is governed by specific policies
based on one of two approaches.
Allow listing: Only the traffic explicitly listed as safe is permitted, while all else is blocked.
Block listing: All traffic is allowed unless it’s specifically marked as harmful.
Firewalls evolved over time and now they are commonly referred to as next-generation firewalls,
the third generation of firewalls. Previous generations can be grouped as packet-filtering firewalls
or stateful packet-filtering firewalls. Variations of firewalls are proxy firewalls and web application
firewalls.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 2/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Source IP Address: This indicates the origin of the packet. Traffic can be permitted or
denied based on this address, enabling the blocking of malicious sources or botnets.
Destination IP Address: This represents the final destination of the packet. While unicast
packets are targeted at individual machines, multicast or broadcast packets aim for multiple
devices. By shaping rules around these addresses, specific devices can be protected from
excessive traffic or unauthorized access.
Protocol Type: Packets carry information about the protocol they’re using within their
headers. This can range from standard data-bearing IP packets to specific ones like ICMP,
ARP, RARP, BOOTP, and DHCP. Rules using this criteria ensures that traffic of certain
protocols can be selectively allowed or blocked.
The main advantage of packet-filtering firewalls is the speed at which the firewall operations are
achieved since most of the work takes place at Layer 3 or below, negating the need for intricate
application-level insight. Typically positioned at the forefront of an organization’s security
infrastructure, these firewalls excel in thwarting denial-of-service (DoS) attacks targeting vital
internal systems.
These are not without limitations, however. Since their operations are restricted to OSI Layer 3 or
below, they can’t scrutinize application-level data, leaving a window open for application-specific
threats to penetrate sensitive internal networks. Their defenses can also be circumvented by
attackers who spoof network IP addresses, given that some legacy or basic firewall models fail to
recognize spoofed IP or ARP addresses. While packet-filtering firewalls offer robust defense
against broad DoS attacks, they may falter against more specialized, targeted threats.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 3/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Stateful inspection techniques employ a dynamic memory that stores the state tables of the
incoming and established connections. Any time an external host requests a connection to your
internal host, the connection parameters are written to the state tables. Basic rules can be set to
block packets with port numbers above 1023 for instance. Stateful firewalls do have their
drawbacks. They are not as flexible or as robust as regular packet-filtering firewalls. Incorporating
a dynamic state table and other features into the firewall makes the architecture more complex,
which directly slows the speed of operation. This appears to users as a decrease in network
performance speed. Furthermore, they can’t fully inspect higher-layer protocols or application
services. In contrast, stateful firewalls offer enhanced security across all network levels, crucial for
connectionless protocols like UDP and ICMP.
Proxy firewall
Proxy firewalls operate at the Application layer of the OSI model and are positioned between a
remote user and a server. They mask the identities of both entities, ensuring that each party only
recognizes the proxy. This setup offers robust protection between public and private networks. By
working at the application level, proxy firewalls can effectively guard sensitive applications. They
support enhanced authentication methods, like passwords and biometrics, bolstering security.
Additionally, users can customize these firewalls to filter specific packets, such as potentially
harmful EXE files. They often include detailed logging to audit server connections. However, the
trade-off for this high-level security is speed and cost due to the extensive data processing at the
application level.
Despite the presence of robust protective measures, network intrusions are bound to occur. An
IDS ensures that such security lapses are instantly communicated to administrators, facilitating
immediate action. Additionally, IDS deployment helps spotlight potential vulnerabilities, offering
insights into areas attackers might exploit. The primary types of intrusion detection systems are:
A proactive IDS investment often translates to reduced costs, especially when compared to the
expenses and legal ramifications following a successful attack.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 5/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
content, it can sometimes indicate malicious or anomalous activity. A NIDS can also log relevant
data that can be used for forensic analysis or as evidence in the event of a security breach.
Signature-Based Detection that identifies malicious activity by looking for specific patterns,
such as byte sequences in network traffic, or known malicious instruction sequences in
malware.
Heuristic-Based Detection that uses algorithms to analyze the traffic’s behavior. It’s
particularly useful for detecting previously unknown threats or new variants of known
threats.
Sandboxing quarantines suspicious files or payloads where they can be executed in a safe
environment to observe their behavior without risking the broader network.
Machine Learning & Artificial Intelligence are used in advanced IPS solutions to better
identify and adapt to evolving threats.
Implementing an IPS on an effective scale can be costly so businesses should carefully assess their
IT risks before investing in one. It is important to have an in-depth understanding before
deploying an IPS to reduce false positives and understand the impact on your workloads. It is
always recommended to run IPS and active response technologies in test mode for a while to
thoroughly understand their behavior.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 6/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
A Wireless Intrusion Prevention and Detection System (WIDPS) is a security solution designed
specifically for wireless networks. It monitors the radio spectrum for the presence of unauthorized
access points (often called rogue APs) and clients and identifies potential attacks or intrusions on
the wireless infrastructure. A WIDPS compares the list of MAC addresses of all connected wireless
access points on a network against the list of authorized ones and alerts an IT staff when a
mismatch is found. Once a threat is detected, the WIDPS can take proactive measures to
neutralize it, either by alerting administrators or by actively blocking or disconnecting the
malicious device. This ensures that the wireless environment remains secure and free from
unauthorized access, safeguarding sensitive data and maintaining network integrity. In addition to
providing a dedicated layer of security for wireless LANS, a WIDPS can be used to monitor network
performance and discover access points with configuration errors. A WIDPS operates at the Data
Link layer level of the OSI model.
Packet filtering
Port Address Translation (PAT)
Network Addres Translation (NAT)
Virtual Private Network (VPN)
URL-blocking
SSL- and SSH verification
Deep Packet Inspection (DPI)
Intrusion Prevention
Reputation-based malware detection
Application awareness
As these feature are interacting with each other, a next-gen firewall is able to block malware
before it even enters the infrastructure. In addition, logs from a 3rd-gen firewall are helpful in
forensic investigations and to detect intrusions.
integrated approach has made UTMs increasingly popular rather than managing multiple
disparate systems. Typical UTM features include:
• Network firewall
• Intrusion detection and prevention
• Gateway anti-virus
• Proxy firewall functionality
• Deep packet analysis
• Web content filtering and proxy
• Data loss prevention (DLP)
• Security event and information management (SIEM)
• Virtual private network (VPN) capabilities
Consolidating all these functionalities into a single unit does have its downsides as it creates a
potential single point of vulnerability and commits all these tools to a sole vendor. Given that
many consider vendor diversification a security best practice, it’s important to weigh the risks
before adopting a UTM system.
Proxy server
Proxy servers act as negotiators for requests from client software seeking resources from other
servers. A client connects to the proxy server and requests some service (for example, a website);
the proxy server evaluates the request and then allows or denies it. Most proxy servers act as
forward proxies and are used to retrieve data on behalf of the clients they serve. If a proxy server
is accessible by any user on the internet, then it is said to be an “open” proxy server. A variation is
the reverse proxy, also known as a “surrogate.” This is an internal-facing server used as a front-
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 8/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
end to control (and protect) access to a server on a private network. The reverse scenario is used
for tasks like load-balancing, authentication, decryption, and caching. Responses from the proxy
server are returned as if they came directly from the original server, so the client has no
knowledge of the original servers. Proxy servers are typically used for traffic filtering (web filters)
and performance improvement (load balancers). Web application firewalls (described earlier) can
be classified as reverse proxy servers.
Web filter
Web filters prevent users’ browsers from loading certain pages of websites that may pose a
potential threat. URL filtering involves blocking websites (or sections of websites) based on the
URL and, restricting access to specified websites or web-based applications. Advanced web filters
can also filter designated search words or web content that may be deemed inappropriate. An
organization may implement a web filter appliance on prem to block malicious internet web sites
of for any device connecting to the Internet. Another approach is to install a client on all
enterprise mobile endpoints that runs in the background that sends the address of the website
being visited to the cloud where the web filter compares it against a maintained list of phishing
and malware sites. If a match is found, a blocking web page appears and encourages the user
cannot continue to the site. Web filter admins can customize the list of blocked sites as needed to
accommodate a user’s legitimate request, although any modifications should be tested first.
Email Filtering
Traditionally known as SPAM filtering, email filtering is critical for any organization as email
remains the primary delivery agent of ransomware and other malware attacks. Conventional
approaches to email filtering used techniques such as signature-based detection, domain and IP
block lists, and content analysis. Such methods are often insufficient today to stop advanced email
attacks. Modern email filtering solutions now incorporate heuristic analysis, machine learning,
and sand boxing. Another technique is Bayesian filtering that analyzes the probability that an
email is spam based on its content and user. Businesses can also apply data loss prevention (DLP)
policies to prevent users from including personal identifiable information (PII) in email. Email
filtering must be on the list of security devices and tools for any organization that utilizes email.
Endpoint Protection
Endpoint Protection used to be known as antivirus software as it specifically targeted the
signatures of known viruses and prevented them from infecting the host device. Antivirus
software has evolved into what is now known as endpoint protection. Think of an endpoint
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 9/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
protection solution as a type of UTM mentioned earlier in the article that consolidates multiple
host-based security functions to protect it. Some sort of endpoint protection is critical for any
computing device that connects to the Internet. At its core, an endpoint solution today detects,
quarantines, and removes various forms of malicious software, including viruses, worms, trojans,
ransomware, and spyware at the host level. Some solutions may also include basic web filtering
and local firewall protection. More advanced solutions may also utilize behavioral analysis that
looks for any unusual behavior of files or processes. To maximize the effectiveness of any
endpoint protection application it is critical that it is updated regularly so that it has the latest
threat defenses.
NDR tools can be used to analyze network traffic in real time. Once a potential threat or
suspicious activity is identified, an alert can be sent to the security team through a visual
dashboard that provides an overview of the detected issue. Beyond just detection, the system
provides detailed forensic tools enabling deep dives into raw data for a comprehensive analysis.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 10/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Some NDRs also come equipped with response functionalities and can isolate a device showing
signs of compromise or block communication with a suspicious IP address.
Advanced NDR solutions often employ machine learning to enhance anomaly detection, which
allows them to become more adaptive and precise as they continue to monitor the network. To
further bolster their detection capabilities, these solutions typically integrate with threat
intelligence feeds. This integration allows for a more effective correlation between network
behavior and known malicious indicators or strategies used by threat actors.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 11/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Conclusion
That is a comprehensive list of most of the cyber security device types that you will find in
networks today. While different members of the cybersecurity community may have different
opinions on them, all perform a critical function. Some of these tools such as firewalls and
endpoint protection can be found in nearly every network today regardless of size. Others, such
as XDR, are only common amongst Fortune 1000 companies. Before implementing any new
security device, always perform an IT security risk assessment to help assess your accepted level
of risk. The lower your risk tolerance, the more security you will need to invest in.
There are many types of network security devices on the market today and each one performs a
different function. Examples include hardware and virtual firewalls, IDS/IPS solutions, web
filtering, email security solutions, proxy servers, endpoint protection, SIEMs, and XDR. All these
security tools collectively play a part in a well-designed multi-layer security strategy.
Most organizations have a firewall appliance that guards the network perimeter. The firewall has
multiple interfaces with each one servicing an isolated zone. The connection to the organization’s
internet router will plug into one interface while their LAN plugs into another. Other interfaces
could connect to other zones that host critical servers or web accessible applications (referred to
as the DMZ). Another example could be a web filter appliance that filters all outgoing web traffic
through it before it gets to the internet router.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 12/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Most home networks need only worry about their endpoint devices so a comprehensive endpoint
protection application should be installed on all desktops, laptops and tablets that connect to the
network. These all-in-one security packages will often include firewall protection and basic web
filtering amongst other security functions.
While there are multiple ways to categorize the various network security components, some of
the more common network security device types include firewalls, access control, intrusion
detection and prevention, filtering solutions and endpoint protection.
Dirk Schrader
Dirk Schrader is a Resident CISO (EMEA) and VP of Security Research at Netwrix. A 25-
year veteran in IT security with certifications as CISSP (ISC²) and CISM (ISACA), he works
to advance cyber resilience as a modern approach to tackling cyber threats. Dirk has
worked on cybersecurity projects around the globe, starting in technical and support
roles at the beginning of his career and then moving into sales, marketing and product
management positions at both large multinational corporations and small startups. He
has published numerous articles about the need to address change and vulnerability
management to achieve cyber resilience.
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 13/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
Show Comments
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 14/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 15/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
FEATURED TAGS
IN THIS ARTICLE
Firewall
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 16/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 17/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 18/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 19/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 20/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 21/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 22/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 23/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 24/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 25/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 26/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 27/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 28/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
About Us
About Netwrix
About Netwrix Blog
Write for Us
Resources
Webinars
Attack Catalog
How-to Guides
eBooks & Guides
SysAdmin Magazine
Cyber Chief Magazine
Research
Solutions
Active Directory Security
Data Access Governance
Data Governance
Ransomware Protection
Privileged Access Management
Compliance solutions
NIST CSF
CMMC
PCI DSS
HIPAA
ISO
GDPR
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 29/30
1/23/24, 10:09 AM Network Security Devices You Need to Know About
https://blog.netwrix.com/2019/01/22/network-security-devices-you-need-to-know-about/ 30/30