The firewall has been part of the network security landscape for decades, but what it does today is not at all the same as what it did when it was first conceptualized. Early firewalls were designed for a world with explicit perimeter boundaries, where traffic moves between a trusted internal network and an untrusted external world in fairly predictable ways. That world is gone, replaced by cloud applications, remote workforces, and the encrypted traffic that accounts for the vast majority of what traverses modern-day networks.
Most explanations of what is a firewall in cybersecurity still lean on the original packet-filtering definition, even though the role has expanded well past that to meet threats and architectures that didn’t exist when firewalls were first introduced.
The Original Firewall Model Always Was Going to be Overstretched
Firewalls from the past were built on a deceptively simplified notion – that traffic moving across a network border could be categorized based solely on source and destination addresses, ports, and protocols and that there is an obvious line dividing what was safe within the perimeter of a network and what wasn’t. That worked well enough when virtually every app and every data set were hosted on servers that a given organization directly controlled.
In most modern environments, this assumption is no longer true. Today, applications run in public cloud platforms, in software-as-a-service providers, and on-premises systems at the same time — and frequently without a single convergence point where all traffic logically assembles. The network perimeter that traditional firewalls were designed to defend has effectively disappeared for many organizations, as employees have begun connecting from home networks, coffee shops, and mobile devices.
This shift is part of why a TLS encryption protocol specification like the one published by the IETF matters so directly to firewall design. As encryption became the default for web traffic, firewalls that could only inspect packet headers lost visibility into what was happening inside that traffic, a blind spot that traditional packet filtering was never built to address.
The Rise of Encrypted Traffic and What It Means for the Firewall
One of the most notable trends driving firewall design has been the move to encrypted-by-default traffic. A firewall that sees only headers is essentially blind to large portions of network traffic, especially as attackers nowadays shift malicious payloads into encrypted connections for the very same reason: traditional inspection tools cannot see inside encrypted flows.
The logical “cover your butt” mechanisms that modern firewalls use to fill this gap is called decryption and re-inspection, where the firewall will terminate an encrypted connection then inspect traffic for potential threats in a decrypted state before encrypting again and forwarding it along. This gets back the visibility but imposes a genuine performance penalty – large-scale plaintext decryption and re-encryption require substantially more processing power than header inspection ever did.
Since this tradeoff is significant, organizations must be judicious about determining which traffic truly needs to be fully decrypted versus that can be assessed via other channels like encrypted pattern behavioral analysis without full decryption.
Core Capability: Application Awareness
Modern firewalls have also gone far beyond just allowing or blocking traffic based on port numbers and deciding whether to even let packets continue through an encryption tunnel. Application-aware rather than port-based firewalls enable a firewall to determine which application is generating traffic regardless of the port it runs on [In fact many apps now run over standard web ports, something older rules would have considered allowed].
Because of this, and as a result of attackers learning how to mask malicious traffic by routing it over ports often permitted rather than relying on unusual ports, older firewalls would flag automatically. An application-aware firewall can identify traffic masquerading as regular browsing as something else, based on patterns in the traffic itself rather than just the port number.
Application awareness thus also enables far more granular policy enforcement than earlier generations have. This enables organizations to allow certain applications, while blocking others that use the same port and protocol, a granularity that firewalls operating only at network and transport layers can not provide.
Firewalls in a Zero Trust Architecture
Perhaps the most significant conceptual shift in modern firewall deployment is how firewalls fit into a zero trust security framework rather than standing alone as the primary defense. Zero trust assumes no user, device, or network segment should be trusted by default, regardless of whether it sits inside or outside the traditional perimeter, which fundamentally changes how firewalls get deployed.
In this model, firewalls have been deployed not only at the network perimeter but between internal segments as well, with all traffic treated as if it was from the public internet (the so-called zero trust model). Well, this is because most breaches are now opportunistic, whereby an attacker has already gained entry and they are just working laterally towards systems that hold a higher value.
Firewalls that operate on zero trust are increasingly focused not only on network-level traffic but also on identity and context. A request from a known device with a validated identity may be handled differently from the same request originating from an unrecognized source — even if both are on the same network.
Cloud and Distributed Deployment Models
This kind of scaling was necessitated by the fact that modern firewalls have had to adapt to environments where the hardware appliance can not be deployed at any single, physical location. Cloud-native deployments operate as software in the cloud infrastructure, driving elasticity with the workloads they protect rather than being an immovable bottleneck at a single chokepoint.
There are real-world implications for organizations in the way they think about firewall sizing and placement. Conversely, cloud-based deployments can meet fluctuations in demand by scaling up or down w/real utilization and become a consistent deployment across clouds and on-premises environments backed by an identical policy framework instead of provisioning one large appliance sized for peak traffic at a single location.
Further, as organizing principles shifted to distributed deployment, it meant every firewall must increasingly coordinate with other firewalls instead of simply checking points one-by-one. Policies that successfully translate if traffic passes through a firewall region in the cloud, or branch office or datacenter are essential to ensuring a consistent security posture across a hybrid environment.
What Hasn’t Changed About Firewalls
Even with all that evolution, some things still do not change. At its heart, however, a firewall is still just a piece of software or hardware making allow-or-deny decisions on network traffic based on a policy. Now, sure the input has become much more complicated, but the basic function of comparing traffic against rules and taking action hasn’t gone away.
But firewalls are still only one slice of a multi-pronged security approach, not a magic bullet on their own. The most sophisticated modern firewall in the world cannot substitute for endpoint defenses, security awareness training or any of the other layers that constitute a responsible defense. Many organizations treat a deployment of a sophisticated firewall as enough, on its own, to keep out the bad guys, but they are all too often surprised when an aggressor with real determination uncovers loopholes in their defenses.
Frequently Asked Questions
Is a firewall still necessary for organizations when most of their traffic is encrypted?
Yes. In an encrypted-by-default world, modern firewalls are more relevant (not less so) because many new architectures designed to deal with such situations rely on dedicated decryption and inspection capabilities.
Do I still need firewalls when adopting zero trust?
No, firewalls are still a critical enforcement point within a zero trust architecture, though instead of the primary perimeter defense, their role is changed to one of multiple layers that continuously assess trust.
Are the same protections offered by your appliance firewall available in a purely cloud-based option?
Yes, when properly configured. Much like hardware appliances, cloud-native firewalls can apply the same policies and inspection capabilities, only they usually scale dynamically with demand.
