Cyber Security and Implementation of Security by Firewalls

This paper discusses the implementation of security by firewalls in cyber security. It explores the dynamics of firewalls and how they protect networks from unauthorized access. The risks and vulnerabilities associated with firewalls are also analyzed, along with countermeasures to mitigate these risks. Different types of firewalls are discussed, including packet-filtered firewalls, next generation firewalls, proxy firewalls, and network address translation firewalls. The effectiveness of these firewalls in providing security is also examined.

Cyber Security

ABSTRACT
Cyber Security is one of the most severe and menacing issue which is associated with
unethical and inappropriate access, as well as usage of one’s data that is stored within the cloud
computing software. Moreover, this act and threat usually arises for personal gains or even for
vendettas. Hence, the paper below discusses the cloud computing security and is divided into
separate tasks to help in getting a better insight within the report.
The first task of the report would be addressing how cloud computing implements cyber
security, for which the dynamics of cloud computing are explored and the requirements of this
task is fulfilled. Furthermore, the second tasks is related to the vulnerabilities and risks
associated in cloud computing. Within this, certain risks and vulnerabilities associated with
firewalls are discussed. In addition to this, the third task the techniques that are used by attackers
to overcome cloud computing technologies are discussed, which explores methods like hacking,
malware and so forth. Moreover, this task also takes into account several countermeasures to
provide better security to cloud computing systems, which explores a better and more effective
functioning of firewalls. The last task of this paper highlights the key features of policy that
would mitigate risks in cloud computing, for which Information Security Policy has been
discussed in detail.

Table of Contents
ABSTRACT....................................................................................................................................2
INTRODUCTION...........................................................................................................................4
TASK 1............................................................................................................................................5
IMPLEMENTATION OF SECURITY BY FIREWALLS.............................................................5
What is firewalls and How firewalls implement cyber security?................................................5
RISKS AND VULNERABILITIES OF FIREWALLS..................................................................8
Risks in firewalls.........................................................................................................................8
Vulnerabilities in firewalls........................................................................................................10
TECHNIQUES AND COUNTERMEASURES...........................................................................11
Techniques used by attackers to overcome cloud computing security......................................11
Countermeasures to the risks.....................................................................................................13
Effectiveness of Both Systems..................................................................................................14
INFORMATION SECURITY POLICY.......................................................................................15
Outlining the key features of a policy that would mitigate or prevent risks to firewalls..........15
CONCLUSION..............................................................................................................................18
REFERENCES..............................................................................................................................19

INTRODUCTION
Cyber security is a very important and Critical area for business is and an organisation
flourishing in the market as cybercrime is regularly increasing and aggressively growing. As
known that technology is a blessing and a curse both for the users because it is basically day to
day part of every individual’s lives but several malicious elements make negative and harmful
use of technology for their personal growth which hinders and harms several businesses and
people(Bada, Sasse and Nurse, 2019). Cyber security refers to the body of technologies
processes and practices designed and created for protecting the networks systems programs
devices and the data from hackers and unauthorised attackers. Cyber security is also defined as
information technology security. Cyber security is very important as the data stored with
government military financial corporate and medical organisations and their computer systems
and other devices is very critical and harmful. The report it is based on a Cybersecurity tool
known as firewalls which is a technology developed and designed for keeping the attackers out
of the systems of the users and provide in security to the data available with the organisations.
The report covers and focuses on several different areas related to Cybersecurity and firewalls. In
the very beginning the focus is on understanding the tool of firewalls which is a software and
hardware developed for protecting the networks from any malicious attacker. Several types of
firewalls which are flourishing in the market are defined and described along with the
implementation of firewalls on cyber security. Moreover, the risks and vulnerabilities associated
with firewalls and its programs are also analysed along with highlighting on different steps to
reduce their impact and mitigate the risk (Sun, Hahn and Liu, 2018). Furthermore Different
techniques which are used by attackers and hackers to overcome the firewall security are
identified and explained. Along with it different countermeasures to these risks and techniques
which can be used by attackers for breaching the firewall security also highlighted along with the
effectiveness of both the attacking techniques and to the countermeasures. At the end several key
features of the policies that would mitigate or prevent the risk two firewalls are described and
mentioned in the report.

TASK 1
IMPLEMENTATION OF SECURITY BY FIREWALLS
What is firewalls and How firewalls implement cyber security?
Firewalls is a system designed preventing and protecting any unauthorised access from a
private network. Firewalls can be implemented in any of the three ways that is hardware and
software also in a combination of both. Firewalls is a software or hardware that prevents any
unethical or unauthorized internet user or attacker from accessing any private networks
connected with internet and more especially keeps safe the intranet networks. There are several
messages which enters and leaves the intranet of a company which is a local Network used by 8
to be connected with all the people associated with the organisation (Xin and et. al., 2018). The
different messages and data which is entering and exiting the internet of the company must pass
through the firewall which take care and examine each single packet of information and
messages. The firewalls block those packets of information or data passes through the intranet,
those who do not meet the specified security criteria by the company. A firewall is considered to
be one of the finest and first line of defence sir in protecting private information messages and
data of companies but it cannot be considered the only such line of protecting data. The firewalls
are generally developed and designed for protecting the network traffic and connection and
therefore do not attempt or make efforts to authenticate individual users while determining who
can access a particular computer for a particular network.
Implementation of firewalls cyber security:
Firewalls carefully analyses all the incoming traffic on a system or on a network based on
pre-established rules filters and security information. The analysis and evaluation of incoming
traffic enables the firewalls to identify the source of the traffic and determine it into a secured or
unsecured source in order to prevent any breaches in the system by unauthorised parties and
attackers(Mosca, 2018). Firewalls work as a guard of traffic at computer system and network at
the entry point of it which are called as ports. These ports are the entry points of a network is the
place where information is exchanged with external devices for example, “source address
172.18.1.1 is allowed to reach the destination 172.18.2.1 over port 22”. The IP addresses of a
computer system and software is considered as a house and the port numbers are considered as
the rooms within the house. In these houses only trusted people that is trusted source addresses

are allowed to enter the house and that is the destination address. Months the trusted source
address is entered in the destination then it’s for the filtered so that the source address is only
allowed to access certain information from certain destination ports depending on the
authenticity and security measures of the port. The owner of the boats are allowed to access all
the sources of different ports while the other parties who are associated with the network and
company are allowed in certain specific sports according to their security measures and traffic
filters (Liu, and et. al., 2018).
As known and discussed that firewalls can be implemented in three manners that is either as a
software or as a hardware and the third option is one of the best option to have both that is to
have a combination of software and hardware firewalls. A software firewall is a program which
is installed on the computer systems and networks of company which regulates all the traffic
through specific port number and applications. On the other hand the hardware firewalls which is
a physical firewall is a piece of equipment that is installed between the networks and gateway of
the company. There are several different types of fire was available in the marketplace which can
be implemented and installed by organisations in their computer Network and systems for
keeping the unauthorised attackers out of their systems allowing company to secure and protect
their personal information and all authenticated data. Several different types of firewalls are as
follows and mentioned below in the next section of the report.
Types of firewalls:
 Packet-filtered firewalls: the packet filter firewalls are the most common type of
firewall which are basically developed for examining the packets and messages entering
the port and prohibit them from passing through if did not matches any established
security rule set. The packet filtering firewall checks the source of the packet and the
prescribed destination with the help of IP addresses (Gratian and et. al., 2018). Once the
packet matches the security rule sets then the packet filter firewalls allows the package to
travel and enter the network as it is trusted to enter otherwise the firewall denies the entry
of packet. Packet-filtered firewalls are basically divided into two categories which are
statefuland stateless. The statefulfirewall remembers all the information about previously
passed packets and considered much more secured and protected. On the other hand the
state less firewalls are entirely opposite and examine the packets independently of one
another and lack the context making them easy targets for the hackers and unauthorised

attackers. The packet filtering firewall are effective as the ultimate Lee provide very basic
protection and can be very limited.
 Next generation firewalls (NGFW)-the next generation firewalls are the results of
updated technology and revolutionary changes taking place in the technical world. The
next generation firewall is basically a combination of traditional firewall technology with
additional functionality according to the updated technologies such as encrypted traffic
inspection intrusion prevention system, antiviruses and many more. the next generation
firewalls are most notably includes deep packet inspection in comparison with other basic
firewalls only look at packet headers. The deep packet inspection examine the data within
the packet itself and assist uses to more effectively identify and categorise the packet so
that it can stop a malicious data to enter the network of the company(Shoemaker, Kohnke
and Sigler, 2018).
 Proxy firewalls- The proxy firewalls certainly filter the network traffic at very beginning
and at the application level. The proxy firewalls act an intermediary between two ends of
the system. The clients or the users or the companies using the proxy firewalls send a
request to the firewall there it is then evaluated and analysed against a set of rules and
then permitted if the packet matches the security traffic blocked by the firewall. The
proxy firewall mostly monitor the traffic for layer 7 that is make deep packet inspection
protocols such as HTTP and FTP make use of both deep packet inspection and state full
to detect malicious traffic and to stop the entry of unprotected and unsecured network in
the systems of users.
 Network address translation firewall (NAT)- The network address translation firewall
allows multiple devices with a sole and an independent network addresses to connect
with the internet using a simple and a single IP address and keeping all the other
individual IP addresses hidden (Hareide and et. al., 2018). This firewall protects all the IP
addresses as the attacker scanning a network for IP addresses cannot capture a specific
detail and which provides a more and higher level of security against any malicious
attacker or hacker to the system. The network address translation firewall are kind of
similar to proxy firewalls but in that act as an intermediary between a group of computers
and outside traffic on the other hand this network address translation firewall allows
multiple devices to connect with the internet within a single IP address.

RISKS AND VULNERABILITIES OF FIREWALLS
Risks in firewalls
Firewalls are a fundamental piece of any organization's cybersecurity engineering. In any
case, firewalls alone ought to never be considered as the whole and sole answer for the
organization's cybersecurity needs. Indeed, they are helpful however there are a couple of issues
with firewalls that can make it a poorly conceived notion to just depend on this one security
apparatus to ensure the business. Here are some issues or risk associated with firewalls
mentioned below:
 Insider Attacks: The perimeter of firewalls is developed for keeping up with the attack
that originate from the outside of the system and network. But the system do not protect
the network is the attack takes means from the inside. Typically the perimeter of firewall
feels and becomes useless when the attackers have already accessed to the system.
Therefore it is considered as the risk of firewall because it is specifically created for
keeping the system safe from the outside and not from the inside (Sabar, Yi and Song,
2018). Still even the attackers originate and reaches the system from the inside of the
networks firewall can still be e off some use and do some good but for that the business
has to have an internal firewalls on the top of their perimeter firewalls. This internal
firewalls helps in dividing the individual assets on the network which increases the
efforts of attackers for moving from one system to another enable in increasing the
breakout time of attackers.
 Missed security patches: if the network firewall software is not managed properly the
issue of security patches arises and it is considered as a risk associated with firewalls
software. Every software program has some vulnerabilities which enhances the power of
attackers and enable them to exploit the system (Khalili, Naghizadeh and Liu, 2018).
When the vendors of firewall software discover these vulnerabilities associated with the
software they usually take measures and create a patch for fixing the problem as soon and
fast as possible. But the existence of a mere patch do not means that it automatically the
applied to the firewall program until then the vulnerability is still there and the attackers
can exploit it. The companies using the firewall software have a solution for this problem
and that is to create and stick to a very appropriate and strict patch management schedule

under which they should check for all and any security updates for the system and make
sure that the supply of those updates are made as soon as possible.
 Configuration mistake:even if a firewall software is placed on the network and all the
vulnerability patches are applied and updated by the organisation on the network there is
still a chance of creation of problem if the configuration settings of firewall software
generate any conflicts. This risk of firewall software can lead two laws of performance on
the net worth of the company and the firewall software out rightly fails to provide
protection to the system and networks. For instance, dynamic routing is a setting in a
firewall software that was long ago deemed as a bad idea because it resulted in a loss of
control on the system that reduces security and protection(Levi, Allouche and
Kontorovich, 2018). But some of the companies ignore it and leave it on which created
vulnerability for then in their firewall protection and caused a configuration mistake
attackers to enter and misuse their systems. Having a poorly configured firewall software
system is basically inviting the attackers and giving them the keys for entering into the
network by making things easier for them and spending time money and lot of efforts on
the security measures.
 A lack of deep packet inspection:A deep packet inspection also known as layer 7
inspection is a very rigorous and strict inspection mode used by next-generation firewalls
to examine and inspect the contents of information for a data packet before approving or
denying that packet passage to or from a system. Every organisation and big user of
firewall software is suggested to undertake the packet inspection in order to be protected
and says against any unethical breach or entrance of third party in their networks. The
organisation or users using in less advanced firewall me simply check the data packets
their point of origin and destination before approving or a request which can be easily
spoofed off by attacker and enable them to track the networks off firewall in a easy way
without making any rigorous efforts. Therefore it is always suggested to organisation and
firewalls users in order to fix this problem is to make use of firewalls software that can
perform deep packet inspection which is rigorous in nature for checking all the data and
information packets for known malware so that the unnecessary package can be rejected
and more importantly the unethical breaches can be ignored with keeping the system and
network safe from any attackers (Porcedda, 2018).

 DDoS attack: The DDoS stands for Distributed Denial of Service and it is one of the
most commonly and frequently used attack strategy by the breachers for entering into the
software and stealing the data. This is the most common and frequently used strategy
because it is highly effective and potential in nature along with it the cost associated with
it in order to execute it is very low. The strategy works appropriately with the goal of
overwhelming the defenders resources and create a shutdown inability to deliver the
services. This is one category of attack which is a protocol attack designed to drain
firewall and load a balancer resource and information to keep them song processing
traffic. Firewalls software can mitigate some types of distributed denial of service attacks
but it is risky because they can still be overloaded by protocol attacks which empowers
the attacker and enable them to breach the network. The strongest part of distributed
denial of service attacks is they are not easy to fix and till date there is no appropriate
solutions for this kind of attack (Kure, Islam and Razzaque, 2018). This is because there
are several attack strategies that can leverage numerous weaknesses and flaws in the
organisations network structures.
Alone, firewalls cannot protect the system from the entry of the dangers and attacks that are
out there considered as drawbacks of enhancement of technology. They can fill in as a basic
piece of a bigger cybersecurity procedure to defend the business and the systems.
Vulnerabilities in firewalls.
 Passwords are set to the default which makes each security issue conceivable, including
responsibility and accountability issues when network issues are occurring.
 Anybody on the Internet can get to Microsoft SQL Server databases facilitated from the
inside which can lead them to inner database, particularly when SQL Server has the
default credentials or very weak passwords.
 Firewall OS programming is obsolete and no longer supported this can encourage
realized events including remote code execution and forswearing of administration
assaults, and probably will not be great in eyes of others if a breach happens and it's made
realized that the framework was obsolete (Lee, 2018).
 Anybody on the Internet can get to the firewall by means of decoded HTTP associations,
as these can be abused or mistreated by an outsider or a third party who is on a similar
system, for example, an open/decoded wireless system.

 Anti-spoofing controls are not empowered on the outside interface which can encourage
denial of administration and related assaults.
 Rules exist without logging which can be particularly dangerous for basic frameworks
and administrations.
 Any protocol and service can interface between inside system networks which can
prompt inner breaks and consistence breach or violation, particularly as it identifies with
PCI DSS cardholder information environments.
 Anybody on the inside system can get to the firewall by means of unencrypted telnet
connections. These associations can be abused and misused by an internal party (or
malware) if ARP harming is enabled by means of an instrument, for example, the free
password recovery program Cain and Abel.
 Any sort of TCP or UDP service can leave the system which can empower the spreading
of malware and spam and lead to worthy use and related arrangement infringement and
breaches (Leszczyna, 2018).
 Rules exist with no documentation can make security the board issues, particularly when
firewall administrators leave the association suddenly.
Certainly, in businesses firewalls can help prevent the results when these vulnerabilities are
abused, for example denial of administration attacks realized by malware diseases and missing
patches, high transfer speed utilization identified with SQL infusion database dumps.
TECHNIQUES AND COUNTERMEASURES
Techniques used by attackers to overcome cloud computing security
Cloud Computing Security ensures that the information available with an individual or an
organisation within their cloud storage remains essentially secured in a way which protects the
privacy and confidential information about individuals and their personal, along with
professional lives.
However, there are various attackers who use different techniques in order to bypass or
overcome this security system and steal the data in an unauthorised and illegal manner.
Therefore, it becomes necessary to highlight and determine several methods and techniques
which are usually used by the same in order to ensure security against such threats. Therefore,
some of these technologies are explored below:

 Service or Account High jacking:One of the most commonly used techniques by
attackers in context of overcoming cloud computing security is the high jacking of
service or a person’s account. It is a state when the attacker could access the login
credentials of a person’s account, which could be obtained by coding, as well as hacking
the server of individuals. Hence, then it leads the attacker easily towards the data
uploaded within the cloud computing of an individual. Furthermore, despite of just
stealing data, they could also plant false evidences against these individuals in a
threatening manner which is a serious violation of a person’s privacy (Liu and et. al.,
2018). Denial-of-Service:Another threatening technique which is used by attackers is the
denial-of-service attacks, which has been evident since the popularity of cloud
computing have been on the initial stage. These are the attacks when the person
authorised for the access of data could not do the same due to blockages of complex
coding planted by attackers. These enhances the encryption level within the cloud
computing software which restricts the user from accessing and even viewing the data,
with possible chances of corruption of the information available within the storage units.
 Malware:This is yet another grave act of security threat which is adopted as a technique
by attackers to overcome the cloud computing security. It is usually associated with
certain codes which are placed within the services performing cloud computing. These
operate within the servers as SaaS. In addition to this, once this malware is planted and
induced within the server, it cloud begins to operate with the same. Therefore, after this
injection of malware, it becomes easier for the attacker to eavesdrop, steal and
manipulate the information stored within the cloud computing system (Boeckl and et. al.,
2019). Social Engineering and Phishing Attacks:Cloud Computing has been a widespread
technology currently which is adopted all over the world. Hence, such widespread
engagement of the system makes it quite vulnerable to attacks, especially towards the
ones which are related to social engineering. Similar to high jacking, it is also linked
with acquisition of various login credentials which are then used by the attackers to
appropriately and effectively access the information on the server from anywhere in the
world. However, this attack is mostly seen in corporate offices where crucial client

information is generally stored, along with essential information about the organisation’s
confidential data.
Countermeasures to the risks
The above information highlights a lot of risks being associated with the attackers and the
variety of attacking techniques that are being used by them. Furthermore, it becomes necessary
to determine and activate various countermeasures which allow individuals and organisations to
safeguard themselves towards the systems and techniques adopted by the organisation. Hence,
some of these countermeasures are explored below: Encryptions and Passwords:One of the most common and essential countermeasures in
regards with safeguarding against the attack within cloud computing is to ensure
protection of data and information through layers of encryptions and passwords. This
could be done by installing systems which provides effective security and complex
coding which is impenetrable by any attacker. Moreover, this could also be
accomplished by individually encrypting several folders, files or pathways which could
only be accessed by authorised individuals only (Collier, 2018). Complex Credentials:Most of the attacks in cloud computing happens due to the fact
that the credentials used by individuals to access the information or log in within their
account are the ones which are very simple and easy to crack with simple coding.
However, of a person chooses multifactor authentication, along with complex
credentials, then it would rather take how very complex coding to suffice the access,
which would not be effectively possible for the attackers and hence, could develop as a
countermeasure for individuals and organisations. Backups and Updates:This method is linked with effective backups, as well as updates
within the software along with the security systems is necessary to ensure that new and
better encryption and security to the data is provided by the individual or organisation.
Within this, the organisation could use professional help towards developing a
customised systems which provide desired and essential protection to the kind of data
which is stored within the cloud computing. Furthermore, this could also be very well
linked with the government authorities that could be tracking the movements within
these systems and could report the authorised individuals immediately if any deviations
or lapses are found during their monitoring.

 Firewalls:This provides a rather effective and strong protection to the data that is
available within the cloud computing software. Within this system, virtual walls are
created which are appropriately subjected towards the protection of the information that
is available beyond these walls. However, this creates certain layers within the systems,
which safeguards the data due and restricts the attackers to breach the same even with
complex codes being subjected by them. However, there are ways through which further
protection could be acquired by the authorised parties. These are related to combining
these firewalls with Randomised Encryption / Decryption Placements which would
enhance the security to VM level, along with ensuring more complexities for attackers to
breach the systems and access the data (Peng and et. al., 2018).
Effectiveness of Both Systems
It is highly imperative that effectiveness of both the systems is highlighted and examined,
which would allow in determining the complexity of attacks against the protection that could
possibly be provided to the individuals and organisation. In terms of the attacks, high jacking is
quite lethal, as it could ensure access of the data in a number of ways without possible indication
until and unless there is actual monitoring of data inventory. Along with this social engineering
and phishing attacks involve complex coding procedures and decryption which enhances the
effectiveness towards accessing the data appropriately. However, out of these attacking
techniques, the most critical one is malware, which holds the capacity of corrupting the data
beyond backup capacities, as well as ensure that the data could be accessed by the attackers
anywhere in the world almost instantly.
In comparison to these attacks, the effectiveness of normal encryption and even up gradation
and complexities of credentials hold limited effectiveness towards holding any attack and
safeguarding the content. The reason for this is because their protection layers are not too deep
and could be penetrated by simple coding (Sherman and et. al., 2018). However, firewalls and
Randomised Encryption .Decryption system is highly effective in holding up each and every
kind of attack planned and placed by attackers. The reason for the same is that it gives the cloud
computing software with A grade security, meaning that it could possibly not be encrypted by
even complex of codes and advanced hacking. Therefore, to safeguard the systems and provide
essential protection to the data and information, it is recommended for the individuals and

companies to use this system within their cloud computing software, amongst other essential
measures.
INFORMATION SECURITY POLICY
Outlining the key features of a policy that would mitigate or prevent risks to firewalls.
Information Security Policy is the policy that helps in managing or mitigating the
constantly evolving risks to firewalls. It is the policy that involves set of rules and also provides
guidance to people who work in IT department or other organisation to manage risks to firewalls
(Fallon, 2017). It ensures that users follow security procedures along with protocols while
implementing actions that add threats to risks on firewall. Working with information security
policy generally ensures that compliances are followed in context to firewalls and risks are
managed as well as mitigated at appropriate duration. There are various elements described in
the policy whose adoption can benefit an user to manage uncertain circumstances to firewall and
mitigate risk on time through adopting authorised methodologies and practices. The policy plays
main role of codifying guiding principles, protecting information assets from hazardous viruses
and serves roadmap to mitigate uncertainties. Effective information security policy defines what
is to be done, when to be done and why to be done for the purpose of preventing firewall risks.
Some of the key features of information security policy are as outlined below:
 Confidentiality: The attribute of policy that protects risks concerned with keeping
information on networks through avoiding involvement of unauthorised person for using
information relation to network technologies. For instance, various types of hackers uses
distinct methodologies to steel information on network system without acknowledging to
the individual that adds wide number of risks to firewall. By using the information
security policy, all the information are kept confidential as the entire data is stored in
folders having passwords that creates difficulties for hackers and this results in mitigating
risks (Fani, Von Solms and Gerber, 2016). Addition to this, information security policy
also plays crucial role in preventing disclosure of information together with unauthentic
usage. It keeps data safe from various risks including theft and others.
 Authentication: Another feature of the policy is providing authentic method for
protecting documents addition to files in network system as well as protect all from
hazardous infection of various viruses resulting in risk. Information security policy

involves numerous types of principles, methods and ideology that are authentic in nature.
For example, one of authentication method is password to the information. In the policy,
various rules are written and one of the rules is to keep information protected and for this
passwords are necessary. The authentication technique provide opportunity to an
individual that they can assign distinct kind of special as well as secret word which is
termed as password to all of the information which has to be protected for risks. At same
time, authentic method also helps in mitigating risks from sharing of knowledge in
network system.
 Risk assessment as well as treatments: It is the section in the Information security
policy that reflects the ways in which risks are assessed along with treated in the firewall.
The policy includes provisions and procedures that assists in identifying essential security
requirements through methodical assessments for mitigating security risks. For example,
there are situation in information system like misbalance in expenditures in controls
against operational damage that likely to occur from failures of security (Goodman,
Straub and Baskerville, 2016). Information security policy includes risk assessments
techniques that guides as well as determines suitable management actions together with
priorities for manage uncertainty related to information risks. along with this, it also
includes some provisions that aid in implementing controls in order to protect systems
against the risks.
 Policy principles: The section of Information security policy defines about system
protection policies. There are certain rules related to servers which runs organisational
networks along with management of business passwords and many more that are clearly
defined. For example, firewall and antivirus policy are key element of the section as these
have huge involvement of risks and uncertainties. By following the policies, it enhanced
huge changes for an user to manage risky situation and also mitigate them for upcoming
durations in order to manage network system properly. Along with this, there is one more
policy that is clean desk policy that provide guidance to an individual to secure the
information systems and manage risks concerned with pop ups of unnecessary hurdles.
 Compliances and responsibilities: As per the section, each individual in the network has
some of other responsibilities and compliances through which working must be
performed for managing risks. For example, ISO is authorised towards restricted network

access. ISO has initiated mechanisms to track compliances as well as produce a report
representing risks that can harm the network system. Moreover, this section of
Information security policy also described about various compliances with which risks to
the firewalls are mitigated or managed on appropriate duration (Li and Xue, 2019). At
same time, it is necessary for all to comply the workings as per the implemented sections
in the information security policy so that uncertain situations are not ignored or neglected
that can harm the firewall. Moreover, complying workings with standards as defined in
the policy aids towards management of risks for existing or upcoming duration.
 Data classification: It is the element that outlines the ways to classify the data and
impose handling regimes to each risk types. Information security policy directs an user
towards succeeding in paying attention to significant information and leave insignificant
information that can cause overburden risks to firewall. With this policy, data is classified
into various criteria that are high risk class, moderate risk class and low risk class. For
example, high risk class includes information having high risk while low risk class
comprises information related to firewall that have low risk involvement. Moreover, the
section helps in paying more focus towards high risk class as it hampers firewall and its
concerned workings. The section pays huge emphasis towards the ways in which risks are
mitigated in the manner that protect the relevance of the information to firewall.
 Data support addition to operations: The section describes about the clauses which
stipulate parameters of general system mechanisms that are responsible to protect
information, data backup and movement of information (Muñoz, 2019). It outlines about
the system that host personal information that is protected against risks through applying
standards and best practices in firewall. Particularly, information security policy outlines
about operations and supports provided by antimalware protection, encryption as well as
firewall for administration of viruses or risks. At same time, it also provide storage media
that mitigate risks of data loss as it directs towards the procedures to be followed for data
backups in order to mitigate loss of scope information that is stored in folder or other
location in the network system.
Information security policy includes all the mentioned features that assists an user to mitigate
risks through following the procedures and elements. Moreover, the policy outlines set of rules
for the purpose of ensuring that networks in information technology structure should

adhereworkings within the domains of data security and risk management. Information Security
Policy also governs protections to data that is major in demand for mitigating risks related with
firewall. The policy ensures firewall from all ends and also mitigates uncertainties in software,
hardware devices, access control, physical parameters and many more. While considering the
provisions of the policy, it delineate about creating remedial actions, processing workings and
ensuring applications of elements to administer any type of risk and managing it promptly. It
preserves integrity, availability together with confidentiality of information within the
information networks. Information security policy also states about mythologies for managing
risks in harsh traffic to firewall.
CONCLUSION
The report above is based on cyber security and the tool known as a firewalls used for
maintaining cyber security. The report concludes that cyber security is becoming one of the most
important and essential concern of organisations and government in the current scenario because
of the increasing Cybercrimes and malicious activities. The tool named as firewalls is developed
and designed with the help of updating technologies that specifically provides protection to the
networks of the users and companies from any malicious hackers and attackers. The firewalls
provides a security system and keeps a strict security check over the entry and exit of any
messages and information from the network along with that denies any unauthorised IP address
to enter the port which is not matching to the security filters and traffic filters.

REFERENCES
Books and Journals
Bada, M., Sasse, A.M. and Nurse, J.R., 2019. Cyber security awareness campaigns: Why do they
fail to change behaviour?. arXiv preprint arXiv:1901.02672.
Boeckl, K. and et. al., 2019. Considerations for managing Internet of Things (IoT) cybersecurity
and privacy risks.US Department of Commerce, National Institute of Standards and
Technology.
Collier, J., 2018. Cyber security assemblages: A framework for understanding the dynamic and
contested nature of security provision. Politics and Governance. 6(2). pp.13-21.
Fallon, M., 2017.Unjustifiable means: The inside story of how the CIA, Pentagon, and US
government conspired to torture. Simon and Schuster.
Fani, N., Von Solms, R. and Gerber, M., 2016, May.Governing information security within the
context of “bring your own device in SMMEs”.In 2016 IST-Africa Week Conference
(pp. 1-11).IEEE.
Goodman, S., Straub, D.W. and Baskerville, R., 2016.Information security: policy, processes,
and practices. Routledge.
Gratian, M. and et. al., 2018.Correlating human traits and cyber security behavior
intentions. computers& security. 73. pp.345-358.
Hareide, O.S. and et. al., 2018.Enhancing navigator competence by demonstrating maritime
cyber security. The Journal of Navigation. 71(5). pp.1025-1039.
Khalili, M.M., Naghizadeh, P. and Liu, M., 2018.Designing cyber insurance policies: The role of
pre-screening and security interdependence. IEEE Transactions on Information Forensics
and Security. 13(9). pp.2226-2239.
Kure, H.I., Islam, S. and Razzaque, M.A., 2018. An integrated cyber security risk management
approach for a cyber-physical system. Applied Sciences. 8(6).p.898.
Lee, J.A., 2018. Hacking into China's Cybersecurity Law. Wake Forest L. Rev..53. p.57.
Leszczyna, R., 2018. A review of standards with cybersecurity requirements for smart
grid. Computers & Security. 77. pp.262-276.
Levi, M., Allouche, Y. and Kontorovich, A., 2018, June.Advanced analytics for connected car
cybersecurity.In 2018 IEEE 87th Vehicular Technology Conference (VTC Spring) (pp. 1-
7).IEEE.
Li, H. and Xue, W., 2019, September.Dimensions and Construction of E-Commerce Network
Security. In 2019 International Conference on Computer Network, Electronic and
Automation (ICCNEA) (pp. 150-154). IEEE.
Liu, L. and et. al., 2018. Detecting and preventing cyber insider threats: A survey. IEEE
Communications Surveys & Tutorials. 20(2).pp.1397-1417.
Liu, X. and et. al., 2018. Trace malicious source to guarantee cyber security for mass monitor
critical infrastructure. Journal of Computer and System Sciences. 98. pp.1-26.
Mosca, M., 2018.Cybersecurity in an era with quantum computers: will we be ready?. IEEE
Security & Privacy. 16(5).pp.38-41.
Muñoz, J. J., 2019. Derecho de dañostecnológicos, ciberseguridad e insurtech.Midac, SL.
Peng, C. and et. al., 2018.Modeling multivariate cybersecurity risks. Journal of Applied
Statistics. 45(15).pp.2718-2740.
Porcedda, M.G., 2018. Patching the patchwork: appraising the EU regulatory framework on
cyber security breaches. Computer law & security review. 34(5). pp.1077-1098.

Sabar, N.R., Yi, X. and Song, A., 2018. A bi-objective hyper-heuristic support vector machines
for big data cyber-security. IEEE Access. 6. pp.10421-10431.
Sherman, A.T. and et. al., 2018.Cybersecurity: Exploring core concepts through six
scenarios. Cryptologia. 42(4). pp.337-377.
Shoemaker, D., Kohnke, A. and Sigler, K., 2018. A guide to the National Initiative for
Cybersecurity Education (NICE) cybersecurity workforce framework (2.0).CRC Press.
Sun, C.C., Hahn, A. and Liu, C.C., 2018. Cyber security of a power grid: State-of-the-
art. International Journal of Electrical Power & Energy Systems. 99. pp.45-56.
Xin, Y. and et. al., 2018.Machine learning and deep learning methods for cybersecurity. IEEE
Access. 6. pp.35365-35381.
Online:
What is Firewalls, 2020.Available Through: <https://www.forcepoint.com/cyber-edu/firewall/>
5 Firewall Threats and Vulnerabilities to Look Out For, 2018.Available Through:
<https://www.compuquip.com/blog/5-firewall-threats-and-vulnerabilities-to-look-out-
for/>
Common Firewalls Threats, 2015.Available Through: <https://www.algosec.com/blog/top-10-
common-firewall-flaws-that-continue-to-surface//>