أمن الشبكات والجدر النارية

Firewall sizing is the most common specification error in this field. Vendor throughput figures are typically quoted with inspection features disabled; enabling application awareness, intrusion prevention and TLS decryption can reduce usable throughput by a large factor. A unit chosen on its headline number and then configured properly becomes the bottleneck on the connection it was bought to protect.

The second issue is that a perimeter firewall only inspects traffic crossing the perimeter. Traffic between a compromised laptop and a file server never touches it, which is why internal segmentation with policy between zones does more for containment than a larger perimeter device.

For a building full of connected equipment this is the central point. Cameras and door controllers are appliances that are rarely patched and often ship with weak defaults; keeping them in their own segment, able to reach only their recorder and their controller, converts a whole-network compromise into a contained one.