heart of all firewalls is a packet filtering or screening mechanism, based on an interpretation of packet type. The simple firewall cannot check the application level, but identifies IP, TCP, UDP and ICMP. The filtering is controlled by a table. By reading the TCP header, especially the TCP port, it is also possible to determine the type of application. Port 80 in the header means web traffic. Thus the firewall can for example decide that web traffic can pass whereas FTP traffic is blocked. The firewall translates the IP addresses by means of network address translation (NAT). With NAT the internal IP addresses in a LAN or Intranet are not visible from the out- side. This increases the security for the enterprise and reduces the necessary number of IP addresses. 6.9.2 TERMINOLOGY FOR PROTECTED AREAS Protected Network (Inside) All internal systems are placed on the protected network and cannot be reached from any external source. However, this is no reason to reduce the level of system security used internally. If an attacker gets inside, we must also have good host security. High Risk Area - Demilitarized Zone (DMZ) It is common to connect a screened subnet to the firewall. To this subnet, often called a demilitarized zone, public servers such as web servers can be located. Such servers are thus available to the outside and therefore possible targets for attacks. Only computers with a strategic function in the company should be on the DMZ segment. Thorough logging should be applied to all DMZ systems. The log files should be transferred in a secure manner to the inside network for analysis and storage. Alarms should be triggered if an attempted attack occurs. Bastion Host A bastion host is a computer that is continuously monitored, logged and upgraded, and which serves the purpose of being the point of entry to all traffic from outside to inside networks. Proxy Firewall A more advanced firewall is the proxy firewall. It can perform virus control of documents, traffic logging to track intrusions, blocking of JAVA/