Welcome back,
and in this video, I want to talk in general
about application layer firewalls,
also known as layer seven firewalls,
named after the layer of the OSI model that they operate at.
Now, I want to keep this video pretty generic
and talk about how AWS implement this
within their product set in a separate video,
so let's just jump in and get started.
Now before I talk about the high-level architecture
and features of layer seven firewalls,
let's quickly refresh our knowledge
of layer three, four, and five.
So we start with a layer three and four firewall,
which is helping to secure the Catagram application.
Now, this is accessed by millions of people globally
because it's that amazing.
Now because this is layer three and four,
the firewall sees packets, and segments,
IP addresses, and ports.
It sees two flows of communications:
requests from the laptop to the server,
and then responses from the server back to the laptop.
Because this firewall is limited
to layer three and four only,
these are viewed as separate and unrelated.
You need to think of these as different streams of data,
request and response, even though they're part
of the same communication from a human perspective.
Now if we enhance the firewall,
this time adding session capability,
then the same communication between the laptop and server
can be viewed as one.
The firewall understands that the request and the response
are part of the same session,
and this small difference both reduces the admin overhead,
so one rule instead of two,
but this also lets you implement more contextual security,
where you can think of response traffic
in the context that it's response to an original request
and treat that differently than traffic
in the same direction, which is not a response.
Now this next point is really important.
In both cases, these firewalls don't understand anything
above the layer at which they operate.
The top firewall operates at layer three and four,
so it understands layers one, two, three, and four.
The bottom firewall does this, plus layer five.
Now what this means is that both of them
can see IP addresses, ports, flags,
and the bottom one can do all of this,
and additionally, it can understand sessions.
Neither of them though can understand the data
which flows over the top of this.
They have no visibility into layer seven.
For example, HTTP.
So they can't see headers or any of the other data
that's been transferred over HTTP.
To them, the layer seven stuff is opaque.
A cat image is the same as a dog image,
is the same as some malware,
and this is a significant limitation
and it exposes the things that we're protecting
to a wide range of attacks.
Now layer seven firewalls fix many of these limitations,
so let's take a look at how.
Let's consider the same architecture
where we have a client on the left
and then a server or application on the right
that we're trying to protect.
In the middle we have a layer seven firewall,
and so that you'll remember it's a layer seven firewall,
let's add a robot, a smart robot.
With this firewall, we still have the same flow of packets
and segments, and a layer seven firewall can understand all
of the lower layers, but it adds additional capabilities.
Let's consider this example where the Catagram application
is connected using a HTTPS connection,
so encrypted HTTP, and HTTP is the layer seven protocol.
The first important thing to realize
is that layer seven firewalls understand
various layer seven protocols,
and the example we are stepping through is HTTP.
So they understand how that protocol transfers data,
its architecture, headers, data, hosts,
all of the things which happen at layer seven or below.
It also means that it can identify normal
or abnormal elements of a layer seven connection,
which means it can protect
against various protocol-specific attacks or weaknesses.
In this example, so a HTTPS connection
to the Catagram server,
the HTTPS connection would be terminated
on the layer seven firewall.
So while the client thinks that it's connecting
to the server, the HTTPS tunnel would be stripped away,
leaving just HTTP, which it could analyze
as it transits through the firewall.
So a new HTTPS connection will be created
between the layer seven firewall and the backend server.
So from the server and client perspective,
this process is occurring transparently.
The crucial part of this
is that between the original HTTPS connection
and the new HTTPS connection, the layer seven firewall sees
an unencrypted HTTP connection.
So this is plain text, and because the firewall
understands the layer seven protocol,
it can see and understand everything
about this protocol stream.
Data at layer seven can be inspected,
blocked, replaced, or tagged.
And this might be protecting against adult content, spam,
off-topic content, or even malware.
So in this example, you might be looking
to protect the integrity of the Catagram application.
You'll logically allow cat pictures,
but might be less okay with doggos.
You might draw a line and not allow other animals.
Sheep, for example, might be considered spam.
Maybe you're pretty open and inclusive
and only block truly dangerous content,
such as malware and other exploits.
Because you can see and understand one
or more application protocols, you can be very granular
in how you allow or block content.
You can even replace content.
So if adult images flow through, these can be replaced
with a nice kitten picture or other baby animals.
You can even block specific applications,
such as Facebook, and even block the flow
of business data leaving the organization
on to services such as Dropbox.
The key thing to understand is that a layer seven firewall
keeps all of the layer three, four, and five features,
but can react to layer seven elements.
This includes things like DNS names which are used,
the rate of flow, so how many connections per second,
you can even react to content or headers,
whatever elements are contained
in that specific layer seven protocol,
which the firewall understands.
Now some layer seven firewalls only understand HTTP,
some understand SMTP,
which is the protocol used for email delivery.
The limit is only based
on what the firewall software supports.
Now that's everything that I wanted to cover
at a high level.
Coming up in future videos,
I'm going to be covering how AWS implements
layer seven firewall capability into its product set.
For now though, this high-level understanding
is what I wanted to help with in this video.
So go ahead and complete the video.
Thanks for watching.
And when you're ready, I'll look forward
to you joining me in the next.