How Computer Security Works; October 1998; Scientific American Magazine; by Cheswick, Bellovin; 4 Page(s)

Computer networks will always be vulnerable to attack. As long as companies use the Internet--for transferring files, sending e-mail, downloading programs and so on--there will always be the chance that some malicious outsider will find a way to wreak havoc with their computer systems. But there are ways to make a network much more resistant to attack. The first line of defense is the firewall, a software program that acts as a gatekeeper between the Internet and a company¿s "intranet"--the network of computers used by the company¿s employees.

The two most common kinds of firewalls are packet filters and application-level firewalls. A packet filter, which typically runs on a machine called a router, examines the source address and destination address of every packet of data going in or out of the company¿s network. The filter can block packets from certain addresses from entering the network--and prevent other packets from leaving. An application- level firewall examines the content of the Internet traffic as well as the addresses; it is slower than a packet filter, but it allows the company to implement a more detailed security policy.