—
For decades, the mental model for network architecture was really only this: create a nice, impermeable wall around the network, trust all inside, and stick a firewall at one or two spots where traffic crossed that wall. That model made sense when the majority of employees sat in a single home office and most applications lived in a single data center. That was arguably less sensible when you could get away with one big peach, but now it’s downright ludicrous. One enterprise can cover many cloud providers, a workforce that spans the globe, and dozens of interconnected systems not designed to think in terms of a single perimeter, so this won’t fly at all.
The basics about what a firewall actually does, how it works, and where it belongs across a modern distributed network are covered in firewall in enterprise network architecture, laying the groundwork towards understanding how firewalls fit into this more complicated picture.
From Single Gatekeeper to Distributed Control
Previously, the perimeter model relied on a single point of control, which is highly problematic. As a result, if that outer firewall held the network was presumed secure; and in failing, any attacker past that point would have freer movement once inside. A modern enterprise architecture will distribute that control across multiple tiers rather than centralizing it at a single focal point; for increasingly complex networks, though, firewalls should not only be positioned at the network edge but also between internal segments, around certain applications and on the outer perimeter of any given cloud environment.
And, of course, this change was liberating not so much a matter of choosing to do so as it was necessity. As soon as an attacker gets past the outer perimeter, a flat unsegmented internal network provides the lateral movement that security teams can only hope to identify through scrutinization of everything that takes place within it. The placement of layered firewalls is meant only to interrupt that flow, not to assume that the outer wall will just last for all eternity.
A breakdown of precisely this challenge, stopping lateral motion between networks, clearly outlines the argument: networks without inner security and robust perimeter safety grant hackers open reign once they go beyond that boundary; The guidance also suggests segmenting a network by both function and sensitivity, with unique firewall protections between each segment, so that one compromise does not immediately provide access to everything else.
Which has direct implications at how enterprises architect today. A finance stack, a customer database, and an overall employee workstation network Myers argues can likely distract one flat section with free access to the next. Firewalls at these internal boundary stop that separation; they convert what otherwise might be a giant blast radius into several smaller, contained ones.
Hybrid and multicloud firewalls
Yet enterprise architecture lives increasingly off-prem, and firewall placement had to chase workloads into the cloud. So, cloud-native and cloud-delivered firewalls now reside at the interface of virtual networks, individual cloud accounts and specific application tiers, applying the same segmentation logic we used to only apply to physical data center architecture. This matters as a compromised cloud workload can be a launch point for lateral movement just like an on-premises server, and treating the Cloud environment as somehow “exempt” from internal segmentation creates exactly the gaping hole that attackers look to exploit.
Maintaining consistency across these environments is emerging as the harder architecture problems enterprises face. If you have a firewall policy that is strictly enforced on-premises but only loosely applied to a fresh cloud account, then the whole premise of layered approach fails as an attacker will see how far they can go based on the weakest link in that chain.
Standards That Shape Architectural Decisions
It is important to remember that enterprise network design does not occur in a vacuum but instead takes much of its clues from existing standards, particularly common best practices for how the deployment of secure networks should be done. The international standards on network security, including the network security standard for architecture, provide guidance on planning and designing secure network architectures, including how organizations should identify and analyze risk before determining where controls like firewalls fit within that design.
These standards are more than just compliance checkboxes. Provide architecture teams with a common, battle-tested vocabulary to justify design decisions internally, which is often the hardest part of the technical implementation. Forcing justification of a certain segment reaching its own firewall boundary is easier if that justification springs from an established framework than the opinion from one team.
Balancing Security With Operational Complexity
Each layer of firewall you add generates a little more operational overhead: More policies to manage, more chances for a misconfiguration to glance through, and more sources of friction between your business traffic when crossing those firewalls. Enterprise architects also have to consider this cost against the security benefit, and the balance will largely depend on what is being protected. Some company segments do not need as stringent of a firewall check as the most sensitive data repositories within the organization.
Modern enterprise architecture often approaches segmentation in a risk-based manner rather than a uniform one hence this. The segments that include the highest-value assets are locked down as tightly as possible, and areas where risk is lower can settle for somewhat lighter restrictions to ensure the entire system functions well without sacrificing protection of its most critical components.
Frequently Asked Questions
Is internal segmentation today a replacement of the strong network perimeter?
No. This is because perimeter defense and internal segmentation target different time frames of an attack. A good perimeter lessens the likelihood of an initial intrusion while internal segmentation reduces damage in case that perimeter is ever broken.
What should be the number of firewall boundaries for an enterprise network?
This quite varies depending on the size of an organization and the privacy of the data. There isn’t a single number; the right way to do it is to translate segmentation into real risk instead of trying to apply a one-size-fits-all template.
Is the firewall architecture needed on cloud environments different from that for on-premises networks?
The high level principles are the same, but the implementation is different. And while segmenting based on risk stays the same, Cloud environments are more likely to use cloud-native or cloud-delivered firewall services versus physical appliances.
—
