The importance of the firewall in companies: the first line of defense

Every day, corporate networks receive thousands of inbound and outbound connections: email, cloud applications, remote devices, external suppliers. Without proper control of that traffic, any company, regardless of size, is exposed to intrusions, data theft and ransomware. Decades after its creation, the firewall remains the most basic and, at the same time, the most critical component of an enterprise cybersecurity strategy.

What is a firewall?

A firewall is a physical, virtual or software-based system that controls network traffic according to a set of security rules. It acts as a filter between networks with different levels of trust: for example, between the company's internal network and the internet. It analyzes every data packet that tries to enter or leave and decides whether to allow, block or log it, based on criteria such as the source and destination IP address, the port, the protocol or, in more advanced models, the content of the application itself.

There are different types: packet-filtering firewalls, stateful inspection firewalls, next-generation firewalls (NGFW) with deep packet inspection and threat detection, and web application firewalls (WAF), designed to protect specific services such as portals or APIs.

What role does it play in a company's security?

The firewall performs several key functions:

• Access control: it defines which traffic can enter or leave, reducing the attack surface exposed to the internet.
• Threat containment: it blocks known malicious connections, port scans and anomalous traffic before they reach internal systems.
• Visibility: it logs network traffic, which is essential for detecting incidents and for compliance audits.
• Policy enforcement point: it translates the organization's security policies (which services are public, which areas are sensitive) into concrete technical rules.

It is not a magic solution, nor does it replace other layers of defense (antivirus, EDR, patch management, staff awareness), but without it those other layers are far more exposed.

The importance of keeping it updated and well configured

A misconfigured or outdated firewall can be as dangerous as having none, and it sometimes creates a false sense of security. Some critical points:

• Firmware and signature updates: NGFWs depend on threat signature databases and inspection engines that must be updated constantly. An outdated firewall does not recognize new attacks.
• Periodic rule review: over time, obsolete, overly permissive or duplicate rules accumulate (“temporary rules” that are never removed). A regular audit prevents ports from being left open unnecessarily.
• Principle of least privilege: each rule should allow only strictly necessary traffic. “Allow all” (any-any) rules are common, high-risk mistakes.
• Log and alert management: logging traffic is useless if nobody reviews the alerts. Integrating the firewall with a SIEM or monitoring system makes it possible to react in time.
• Vulnerability patching: firewalls themselves (especially next-generation ones with management interfaces) have been the target of critical vulnerabilities exploited in the real world. Keeping them patched is as important as patching any other system.

The importance of network segmentation

Segmentation consists of dividing the network into separate zones (for example, user network, servers, IoT, guests, production and test environments) and using the firewall to strictly control the traffic between them. Its benefits are decisive:

• Breach containment: if an attacker compromises a device on the user network, segmentation prevents them from moving laterally toward critical servers or databases.
• Reducing the impact of ransomware: by limiting communication between segments, it becomes harder for malware to spread across the entire organization.
• Regulatory compliance: regulations such as PCI-DSS require isolating environments that process payment card data from the rest of the network.
• Granular control: it allows different policies to be applied according to the criticality of each zone, instead of a single “all or nothing” perimeter.

An increasingly recommended model is microsegmentation, which takes this principle down to the level of individual workloads, especially in virtualized and cloud environments, where the traditional perimeter is no longer enough.

The importance of sending firewall logs to the SOC / SIEM

Having the firewall configured correctly is not enough if its logs stay isolated on the device itself. Centralizing those logs in a SIEM and placing them under the watch of a SOC (in-house or managed) provides benefits that local configuration cannot deliver on its own:

• Event correlation: a SIEM cross-references firewall logs with those from other systems (servers, endpoints, Active Directory, VPN) to detect attack patterns that, seen in isolation, would go unnoticed.
• Real-time detection: the SOC can generate automatic alerts for port scans, brute-force attempts, traffic to known malicious IP addresses or communication with command-and-control (C2) servers.
• Forensic evidence: if an incident occurs, centralized logs make it possible to reconstruct the chain of events (what came in, when, from where and to which system), which is essential for the response and for meeting breach notification obligations.
• Retention and availability: logs stored only on the firewall are usually rotated or overwritten within days. Sending them to the SIEM ensures long-term retention, required by regulations such as PCI-DSS, ISO 27001 or GDPR.
• Reduced mean time to detect (MTTD): without active monitoring, a compromised or misconfigured firewall can go unnoticed for weeks. A SOC that monitors those logs 24/7 drastically reduces that time.
• Tamper protection: if an attacker gains access to the firewall and deletes or alters its local logs to hide their activity, the copy already sent to the SIEM remains intact as evidence.

In practice, this means configuring the firewall to export logs via syslog, proprietary protocols (such as each vendor's own) or agents to the corporate SIEM, and defining specific correlation rules for perimeter and inter-segment traffic.

Recommended best practices

1. Apply the principle of least privilege to all rules.
2. Review and clean up the rule set at least every quarter.
3. Keep firmware, signatures and security patches up to date.
4. Segment the network by function and level of criticality.
5. Enable logging and send the logs to a SIEM/SOC for active 24/7 monitoring.
6. Conduct penetration tests periodically to validate the configuration.
7. Document every rule change and who authorized it.

Conclusion

The firewall is not just another item in the IT inventory: it is the filter that decides, flow by flow, what enters and leaves the corporate network. Its real value depends directly on it being well designed, properly segmented, updated and monitored. A company that invests in firewall technology but neglects its configuration and maintenance is, in practice, leaving the door open.

Frequently asked questions

Keep reading

• What Is SIEM (Security Information and Event Management)?
• What is Zero Trust? The zero trust security model
• What is ransomware, and how can you protect your company?