# Firewall Best Practices for Securing Smart Healthcare Environment: A Review
## 3 Firewalls Types for Smart Healthcare Environment
### Web Application Firewall (WAF)  
The web application firewall (WAF) is a security solution at the application layer of the OSI model. This firewall was developed specifically for web security and plays a crucial role in securing the standard infrastructures, such as web servers and web applications, session handling and cookies, and other components typically part of a web application, also providing log monitoring tools and other security methods, such as URL encryption. Among all countermeasures, WAF has been able to take against most common attacks generally involving the web application layer, we can find logging secure checks, Secure Socket Layer (SSL) enforces encryption, data validation against buffer overflow, and many others, such as SQL, LDAP, XML, code injection cross-site scripting and tracing, HTTP request smuggling, and the aforementioned cookie protection [40; 41]. In recent years, with the growing importance of cloud networks, the web application firewall has been extended to the cloud-based WAF, preserving characteristics, but with an elastic, scalable, and pay-as-you-go fashion. All of these favorable aspects are balanced by some risks requiring more complicated troubleshooting (e.g., when occurring false-positive events) [42]. Bothcause negative business impacts and cost opportunity disadvantages. Because of the importance of securing the web and the internet in cloud-based networks, in this section, we will discuss more in detail WAF firewalls and security practices, according to the environment where WAF is typically deployed. WAF essentially acts in synergy with other firewall software in the following five modes, according to the security policy applied to the architecture deployed [43]:  
* Layer 2 bridge: in this mode, the WAF uses SSL decryption, and then is able to set a direct block of illegitimate packets through the WAF device. This allows global good performances, but despite these advantages, WAF cannot decrypt traffic with Diffie-Hellman techniques.
* Reverse Proxy: layer 2 bridge and reverse proxy mode are very similar to each other (Figure 6). However, in this mode, the WAF has its IP address and can decrypt, monitor, and check all web traffic. The WAF operates as a device between the firewall and the webserver.
* Embedded WAF: in this scenario, the WAF operates as an independent application (Figure 7a), working as software within the webserver perimeter.
* Out-of-band: unlike reverse proxy, in this mode, WAF is not running in the infrastructure.
* Internet hosted and cloud: it acts as a software, in the service delivery model, software as a service (SaaS) in the Cloud. WAF works in reverse proxy mode, with the DNS pointing directly to the cloud provider (Figure 7b). However, every policy should be checked and reviewed separately as the WAF is external to the corporate environment [44].  
Figure 6: Reverse proxy and layer 2 bridge topology.  
Figure 7: (**a**) Embedded web application firewall (WAF) topology, (**b**) internet hosted and cloud WAF topology.  
This later classification makes it possible to distinguish these firewalls, which are intended for standard environments, from others that handle additional services capable to integrate cloud platforms. For example, next-generation firewalls offer advanced attack detection and removal features for cloud environments where there are generally more advanced categories and a vast set of attacks. Although this separation, some traditional firewall types, such as stateful inspection firewalls, may also operate in cloud environments since stateful inspection enablement is generally still preferred today and this separation is not necessarily intended for the targeted environments, but essentially due to topology constraints [45; 46].