The case for not only IP-based security in your firewall

Sanjay Seth, Cybersecurity Consultant, P J Networks Pvt Ltd

The clock says 10:30 AM, the third cup of coffee is brewing, and I’m looking at the screen and remembering how many times I’ve seen companies put all their eggs in one basket, in a black box that trusts source IP addresses as if they were the holy grail of security. Listen, the reality is this: if you’re just relying on IP-based security, great, except it’s like locking the door of your house and leaving all the windows wide open. Been there, done that. Back in the early 2000s, right around the time when I got bitten by worms like Slammer—yes, the infamous Slammer worm that took advantage of SQL Server vulnerabilities and zipped through the network faster than the muni bus I lamentably ever so patiently waited for back in the day when I was a network admin—I learned pretty fast IP-based filtering just wasn’t cutting it.

Fast forward to now: running my own security outfit, helping some serious players — three banks recently upgrade to Zero Trust architectures. I have witnessed firewalls so tightly nailed down as to rival Fort Knox, who still got their asses handed over, because their model of security was a relic of the 90s. So let me explain for you – why do you HAVE to go past IP-based firewalls and what are you supposed to do instead.

Your Firewall’s Achilles Heel: How Spoofing Impacts Your Network

All the way back to the olden days of filtering based on static IPs? It seemed like a no-brainer to set up firewall rules to allow traffic only from “trusted” IP addresses—and hey, it worked well enough (/s). But the internet doesn’t give a damn about your tidy rule lists. IP spoofing, man — it’s the classic hacker’s trick of pretending to be someone else by faking an IP address. When I was in charge of voice and data multiplexers over PSTN lines, trust relationships were simpler because physical boundaries were important. Now? Not so much.

Spoofing allows attackers to sidestep IP filters with chilling ease—they inject packets that appear bona fide but aren’t. Papering over this reality is just that — imagine if you had a guest list that ID-based filtering matched against, but the IDs were just cheap fakes anyone could print. The good from the bad used to be about IP, and now? Attackers can reroute, chain-hop, use botnets globally to work around your firewall rules.

The Slammer worm incident? An early wake-up call. The malware spread rapidly because the defense was based on IP:port blocking. The lesson: relying on IP alone is a path to ruin.

In Order to Survive, Know Order To Survive

And listen, Zero Trust is not a buzzword, its a peace of mind solution. And I just assisted three mega-banks deploying Zero Trust (and that still has me buzzing — right after coming back from DefCon and geeking out at the hardware hacking village). So here’s what Zero Trust will mean for your firewall:

• Never trust, always verify. Every single packet needs to be inspected by the firewall, regardless of source IP.
• Segmentation: Build micro-perimeters within your network that prevent lateral movement.
• Context is king: User identity, device health, behavior analytics—not just where the traffic says it’s coming from.

This trust no longer exists because traffic traverses no longer “trusted” IP ranges; every access request is authenticated and validated.

It’s similar to cooking a soup—you don’t add all your ingredients recklessly and then pray that they combine well. You taste, adjust and test often. The same goes for Zero Trust: continuous verification, adaptive enforcement, and no free passes.

The banks I collaborated with replaced legacy perimeter firewalls with next-gen firewalls capable of identity and context-aware policies. You can’t do a firmware upgrade and claim Zero Trust—you need architectural changes.

Identity-Based Rules: IP Is Simply Not Who You Are

If your firewall is still like, “Allow this IP, block that IP,” you’re missing a massive chunk of the puzzle. Identity-based rules have a very different perspective. Rather than check where a connection is coming from, they query: who wants to connect, what rights do they have?

Identity is the new IP in 2024.

• Link firewall rules to user and device identities and thus make stolen credentials or IP spoofing risk much lower.
• User permissions evolve as users do—there is no static, stale lists.
• Integration with Active Directory, LDAP, or cloud based identity providers become very important.

I’ve worked in environments where identity-based policies thwarted a breach that could’ve been initiated from a compromised internal IP address. In the latter case, if the infiltrated user lacked access rights, the attack simply peters out.

Lawmakers even beginning to embrace regulations requiring identity-aware solutions—IP, after all, is just a layer two construct, easily spoofed or routed around.

MFA: The BFF (Best Friend Forever) of Your Firewall

All right, I have to rant here—password policies that require complex changes every 30 days? Ugh. I feel your pain. But hear me out:

Impulse MFA is the most understated bedrock of firewall security and Zero Trust. No firewall rules are worth anything if bad actors can simply guess or leak passwords.

• MFA provides a second level of defense — something you have (phone app, hardware token).
• Unless there’s a vulnerability in what you’re scanning, or you’ve misconfigured something else like your identity-based firewall policies, there’s practically no way for attackers to get through.
• Allows tighter session controls — tokens that never expire, logins approved in context.

For one of my financial services clients, I recently implemented MFA. Days later, they blocked three phishing attacks that would have resulted in full compromise.

No MFA? May as well leave the door open and a neon sign reading “Welcome Hackers” flashing outside.

Stop-Level Threat Intelligence: Firewalls Must Think Like Hackers

Static rules are dead. The threat landscape changes by the hour. I recall dealing with incident responses when outdated blocklists or IP filters failed to catch a new botnet attack.

Today’s firewalls need:

• Dynamic resolution of requested domains to aggregate threat intelligence feeds.
• Connectivity with security orchestration tools for automated response.
• Dynamic on-the-fly policy adjustments in response to threats or detected anomalies

And do not automatically believe vendors waving “AI-powered” around like a magic wand without results. I’m still skeptical. Tools are not magic bullet, even AI and ML. At the core, there’s still a need for human expertise, the good old-fashioned vigilance, and a design of the system that allows adaptation.

It’s a kitchen sink of attacks and I’m still being educated that attackers are always ahead of any security product—take the recent DefCon workshop on hardware hacking vulnerabilities. Dynamic intelligence allows your firewall, if not one step ahead, at least to get out of the way of your defenders.

For the time being: What to do now

• Avoid blind faith in IP addresses They’re easy to spoof.
• Adopt a Zero Trust mindset. Be sure, segment smart
• Shift to identity-based access policies. It stays the hand of the requiring regulated them, meaning to be limited by who, general, because — but not by much — not where.
• Enable MFA everywhere. No excuses — this is the easiest win.
• Dynamic threat intelligence with real-time updates and automation.

Takeaway: IP Is Not the End of the World.

Here’s a bit of advice I’ve given clients countless times—firewalls that use only IP-based security are like trying to get around with an old paper map, while everyone else is using real-time GPS. Yes, you could end up doing this eventually. But you’ll take wrong turns, spend time on the road, and sometimes drive into trouble no one anticipated.

I’m not a huge fan of hype, but the world of security requires that you grow up from being just an IP filter. My journey from the early days of PSTN networks, fighting worms like Slammer, through to today’s Zero Trust frameworks has one universal message: do not trust anyone based on the IP alone.

Your firewall is the front line of your network, but that line needs hands, eyes, and brains—identity, MFA, dynamic intelligence—not just gatekeeping by IP.

Feeling stuck? That’s where P J Networks comes in. We don’t patch old holes. We construct tailored modern defenses, anticipating the patterns in today’s threat landscape.

Go ahead and brew that fourth cup of coffee and get to re-evaluating your firewall strategy.

—Sanjay Seth, still caffeinated, still wanting to help keep you safe.