Installation guide

4
INTRODUCTION
About this tutorial
The information in this tutorial has been put together by the General Practice Computing Group (GPCG)
with additional input provided by the Broadband for Health section of the Australian Department of Health
and Ageing and State-based officers of the Australian Divisions of General Practice.
It is a reference for practice managers, IT service providers and GPs to help you:
• understand more about firewalls and why we need them.
• select, install, configure and maintain the firewall best suited to your medical practice.
While this tutorial can enhance awareness about firewalls and the need for them, you will still require the
appropriate technical expertise to follow through and properly protect your computer system.
What is a firewall?
A firewall is a system designed to prevent unauthorised access to or from a private network (e.g. between
your practice network and the Internet). Firewalls can be implemented in both hardware and software, or a
combination of the two. All messages entering or leaving the private network must pass through the firewall,
which examines each message and blocks those that do not meet the specified security criteria.
There are several types of firewall techniques:
• Packet filter – a packet filter examines each packet (message) entering or leaving the
network and accepts or rejects it based on the packet type or source/destination address,
according to user-defined rules. Packet filtering is fairly effective and transparent to users,
but it is difficult to configure. In addition, it is susceptible to IP spoofing, i.e. using a legitimate
IP address or packet to gain unauthorised access to a computer.
• Stateful inspection – a stateful inspector monitors the state of network connections that
pass through the firewall. It inspects incoming and outgoing packets to determine if they
correspond to an authorised connection.
• Application proxy – an application proxy only permits packets related to specific
applications to pass through the firewall. For example, SMTP packets for email and HTTP
for web browsing. This is very effective, but can reduce the computer’s performance.
In practice, many firewalls use two or all of these techniques.
Why do you need them?
It’s the law
Australian privacy legislation requires medical practices take reasonable steps to protect confidential
patient data. If your practice computer system/s connects to the Internet, the GPCG recommends you
protect that connection with a properly configured firewall.