Academy
TermDefence

Next-generation firewall

(NGFW)

A firewall that adds application awareness, intrusion prevention and threat intelligence on top of port and address filtering.

Flow

  1. 1Identifies traffic
  2. 2Applies policy
  3. 3Prevents attacks
Related families
—
MITRE ATT&CK
—
Sources
4 sources
01

Overview

NIST defines a firewall as a device or program that controls traffic between networks according to a security policy. NIST CSRC

A next-generation firewall adds application-level inspection and intrusion prevention; it recognises which application the traffic belongs to independently of the port number. NIST CSRC

02

How it works

  1. 1

    Identifies traffic

    The application and user are determined. NIST CSRC

  2. 2

    Applies policy

    Disallowed applications and destinations are blocked. NIST CSRC

  3. 3

    Prevents attacks

    Known attack patterns and malicious addresses are stopped. MITRE ATT&CK

03

How to detect it

  • Connections to known command and control servers or newly registered domains. MITRE ATT&CK
04

What to do

  • Bind outbound traffic to policy as well; inspecting inbound traffic alone is not enough. MITRE ATT&CK
05

Related terms

Terms

URL filteringGateway securityCommand and control server
06

Sources

  1. 1Firewall — glossary definition · NIST CSRC
  2. 2Next generation firewall — glossary definition · NIST CSRC
  3. 3Network Intrusion Prevention (M1031) · MITRE ATT&CK
  4. 4Filter Network Traffic (M1037) · MITRE ATT&CK