There is an lsass.exe that is a genuine system process, but only if it is the one that resides in the C\Windows\System32 directory.
If the one your firewall picked up is located elsewhere then you may have a virus.
Or, if that spelling is incorrect and the process picked up by your firewall is lsasss.exe, then that could mean a virus.
The guidance at AnswersThatWork here; http://www.answersthatwork.com/Tasklist_pages/tasklist_l.htm may help.
Hello, for some reason my firewall program detected lsass.exe connecting to the internet. I did a whois of the IP and it was from beijing. I did a scan with nod32 and kaspersky and they found nothing. Do you think I have a virus?