The restrictions will be set based on classification of the users. Authorization Clarification of the users and the establishment of levels of trust for those users is the next step. For instance, in our example we trust all users of our internal network, so we will require no authorization or authentication for our LAN users to go outbound. On the other hand, we have different levels of trust for people trying to access our network from the Internet. Create a list of inbound users of the system and organize them into common groupings.
Some companies choose to break down classifications even further.
For instance, the Employees group might contain other subgroups, like the Developers group, the Support group, and the Documentation group. This allows for finer granularity of access control, which will be discussed later. We can now make a matrix of inbound access and services, as shown in Figure 2. The inbound matrix illustrates at a glance which services are allowed or disabled for each group of users. Each of these questions, once answered, will help define the security requirements for the firewall.