A number of management decisions need to be made prior to the installation of a firewall or any other Internet security mechanisms. Security resource, policy, and architecture issues must be considered or the firewall can become a mirage, providing the impression more than the reality of securing information. It is not only outside unauthorized individuals and competitors who need to be kept from your organization's sensitive information. Departmental information should be protected from internal employees who are not authorized to access that information. In order to guard against all types of computer crimes and abuses, one major bank has decided that firewalls are needed internally between its many networks as well as between those internal networks and the Internet.
Firewalls have to support and be supported by other information security program activities.
If there is a lack of coordination between Internet security and other information security, authorized users can commit unauthorized acts and undercut the security decisions which the firewall supposedly provides. What are the best filter and access decisions. Determine what Internet services will be allowed and establish a policy backed up with technical decisions to deny all services except for those specifically permitted. Provide sufficient flexibility so that when and if an exception is required, that exception can be provided in a secure and monitored fashion. What employees will have what access levels and how will these decisions be kept up to date as employees change work assignments or departments will be security-related questions which managers can answer.