Choke and screen firewall: the modern day concentric castle

Security experts often use terms of warfare to describe Internet security. Some of the terms come from the castle building era. Castle design evolved over time to incorporate multiple lines of defenses to defeat attacks and resist sieges. These principles are included in Internet security under the rubric

Defenses in Depth

Castles protected people, their property and possessions against attacks from rival lords and invading armies. Initially, castle fortifications consisted of a single line of defense. An earthwork called a motte protected a keep. The motte surrounded the area to be defended and was frequently located on a hilltop.	Photo by jayneandd
Durham County Council	The Motte The motte is similar to the field fortifications a Roman legion built around each encampment during a campaign. Legionnaires would dig a ditch  around their camp and pile the dirt behind the trench. This effectively doubled the height of the wall. Mottes were in many cases much larger and wider. The ditch was also often dug deeper and wider than a Romain camp entrenchment.
Castle designers were engineers. Like modern engineers, they learned from failures as often as successes. As siege tactics improved and the motte became too regularly breached, engineers determined that multiple lines of defense would offer more protection than any single wall, no matter how formidable that wall might be. They added a wall within the outer wall.	HistoryOnTheNet.com
Wikipedia	Concentric Castles Concentric castles relied on the outer wall to blunt the bulk of the attack. The inner wall was used to bolster the defenses of the outer wall and to defend against any attackers who managed to penetrate the outer wall. Checkpoints at gateways were used at both walls to permit access to residents and visitors and deny access to intruders.

Firewall Evolution

The early evolution of firewalls tracks closely with castle defenses. Initially, a single perimeter defense, the Internet firewall, protected an enterprise’s clients and servers against network attacks. This arrangement proved effective while organizations hosted applications primarily or exclusively for users behind the Internet firewall.

As Internet presence became a business imperative, organizations had to find ways to separate applications intended for internal users from external visitors or customers. Look carefully at concentric wall design and you can see that firewalls could be similarly deployed. An outer, Internet firewall would blunt or screen attack traffic and serve as a checkpoint to allow traffic to public facing applications intended for external visitors. These applications would be situated behind the Internet firewall. An inner firewall would serve as a choke point to ensure that no traffic intended for public facing applications gained access to the organization’s internal (private) applications and hosts.

Screen and Choke Firewall

The screen and choke firewall arrangement, like its concentric castle predecessor, proved effective. Evolving business needs (intranets, Wikis, secure application access), technology (WLANs) and attack targets (client as well as web applications and services) have forced us to think beyond the original deployment, the choke and screen firewall arrangement is remains popular. Today, web application firewalls (WAPs), firewall load balancers (FWLBs), and interdepartmental firewalls serve as the screening firewall in many screen and choke deployments.