Application vs Ports Based Security

 Next Generation firewall is all about inspecting the payload at Layer 7 or also called application layer. The content payload must be checked in order to fully utilize the privilege of NGFW. So what ultimate is the difference between application layer inspection and port based protection. Let me briefly describe the difference.

Port Based Security 

Port based security or policy will allow anyone who matches TCP port traffic along with source and destination . Providing protection based on port protection is just a legacy way of protecting any application or end host. NGFW is not required to make use of port based security. Protecting based on service will only provide protection till layer 4 and will not be able to see the underlying application which could be tunneled and lead to attack or to unintended destination as well. We will also loose the ability to become more granular. For example  we only want to allow some specific application on port 80 to be allowed and not all the application related to port 80. 

Application Based Security

Application Based Security will leverage the use of Next Generation Firewall and make deep packet inspection in other words will check the bit and bytes of the payload that transverse the firewall. Tunneling traffic making use of Service will not be allowed and will get blocked. For Example if we are using DNS as our application and if someone used port 53 and tries to tunnel the traffic to something else than UDP port 53 than it simply not allow it. This will provide us more granular control . For Example :  Block facebook chat or video but allow facebook application to work.

Application layer protection must be used in conjunction with port based security which will help us in localizing the traffic in layer 4 as well provide deeper layer of inspection for more granular and effective control of end host or an application.