of 33 /33
CSCE 201 CSCE 201 Network Security Network Security Firewalls Firewalls Fall 2015 Fall 2015

CSCE 201 Network Security Firewalls Fall 2015. CSCE 201 - Farkas2 Traffic Control – Firewall Brick wall placed between apartments to prevent the spread

Embed Size (px)

DESCRIPTION

CSCE Farkas3 Firewall security wall between private (protected) network and outside word Private Network External Network Firewall

Text of CSCE 201 Network Security Firewalls Fall 2015. CSCE 201 - Farkas2 Traffic Control – Firewall Brick...

CSCE 201 Network Security Firewalls Fall 2015 CSCE Farkas2 Traffic Control Firewall Brick wall placed between apartments to prevent the spread of fire from one apartment to the next Single, narrow checkpoint placed between two or more networks where security and audit can be imposed on traffic which passes through it CSCE Farkas3 Firewall security wall between private (protected) network and outside word Private Network External Network Firewall CSCE Farkas4 Firewall Objectives Keep intruders, malicious code and unwanted traffic or information out Keep proprietary and sensitive information in Private Network External Network Proprietary data External attacks CSCE Farkas5 Without firewalls, nodes: Are exposed to insecure services Are exposed to probes and attacks from outside Can be defenseless against new attacks Network security totally relies on host security and all hosts must communicate to achieve high level of security almost impossible CSCE Farkas6 Network Address Translation (NAT) Organization uses private IP addresses on its network increase address space Send packet to Internet: convert private IP address to globally assigned IP address Receive packer from Internet: globally assigned IP addresses converted to private IP addresses Firewalls may Establish connections on behalf of the client Support NAT CSCE Farkas7 Common firewall features Routing information about the private network can't be observed from outside traceroute and ping -o can't `see' internal hosts Users wishing to log on to an internal host must first log onto a firewall machine (or else start `behind' the firewall). CSCE Farkas8 Trade-Off between accessibility and Security Accessibility Security Service Access Policy CSCE Farkas9 Firewall Advantages Protection for vulnerable services Controlled access to site systems Concentrated security Enhanced Privacy Logging and statistics on network use, misuse Policy enforcement CSCE Farkas10 Controlled Access A site could prevent outside access to its hosts except for special cases (e.g., mail server). Do not give access to a host that does not require access. Some hosts can be reached from outside, some can not. Some hosts can reach outside, some can not. CSCE Farkas11 Concentrated Security Firewall less expensive than securing all hosts All or most modified software and additional security software on firewall only (no need to distribute on many hosts) Other network security (e.g., Kerberos) involves modification at each host system. CSCE Farkas12 Enhanced Privacy Even innocuous information may contain clues that can be used by attackers E.g., finger: information about the last login time, whenwas read, etc. Infer: how often the system is used, active users, whether system can be attacked without drawing attention CSCE Farkas13 Logging and Statistics on Network Use, Misuse If all access to and from the Internet passes through the firewall, the firewall can theoretically log accesses and provide statistics about system usage Alarm can be added to indicate suspicious activity, probes and attacks double duty as IDS on smaller networks CSCE Farkas14 Policy enforcement Means for implementing and enforcing a network access policy Access control for users and services Cant replace a good education/awareness program, however: Knowledgeable users could tunnel traffic to bypass policy enforcement on a firewall CSCE Farkas15 Firewall Disadvantages Restricted access to desirable services Large potential for back doors No protection from insider attacks No protection against data-driven attacks Cannot protect against newly discovered attacks policy/situation dependent Large learning curve CSCE Farkas16 Firewall Components Firewall Administrator Firewall policy Packet filters transparent does not change traffic, only passes it Proxies Active Intercepts traffic and acts as an intermediary CSCE Farkas17 Firewall Administrator Knowledge of underpinnings of network protocols (ex. TCP/IP, ICMP) Knowledge of workings of applications that run over the lower level protocols Knowledge of interaction between firewall implementation and traffic Vendor specific knowledge CSCE Farkas18 Firewall Policy High-level policy: service access policy Low-level policy: firewall design policy Firewall policy should be flexible! CSCE Farkas19 Service Access Policy Part of the Network Security Policy Defines: TCP/IP protocols Services that are allowed or denied Service usage Exception handling CSCE Farkas20 Service Access Policy Goal: Keep outsiders out Must be realistic and reflect required security level Full security v.s. full accessibility CSCE Farkas21 Firewall Design Policy Refinement of service access policy for specific firewall configuration Defines: How the firewall achieves the service access policy Unique to a firewall configuration Difficult! CSCE Farkas22 Firewall Design Policy Approaches: Open system: Permit any service unless explicitly denied (maximal accessibility) Closed system: Deny any service unless explicitly permitted (maximal security) CSCE Farkas23 Simple Packet Filters Applies a set of rules to each incoming IP packet to decide whether it should be forwarded or discarded. Header information is used for filtering ( e.g, Protocol number, source and destination IP, source and destination port numbers, etc.) Stateless: each IP packet is examined isolated from what has happened in the past. Often implemented by a router (screening router). CSCE Farkas24 Simple Packet Filter Placing a simple router (or similar hardware) between internal network and outside Allow/prohibit packets from certain services Private Network Packet Filter Packet Filter Outside Packet-level rules CSCE Farkas25 Simple Packet Filters Advantages: Does not change the traffic flow or characteristics passes it through or doesnt Simple Cheap Flexible: filtering is based on current rules CSCE Farkas26 Simple Packet Filters Disadvantages: Direct communication between multiple hosts and internal network Unsophisticated (protects against simple attacks) Calibrating rule set may be tricky Limited auditing Single point of failure CSCE Farkas27 Stateful Packet Filters Called Stateful Inspection or Dynamic Packet Filtering Checkpoint patented this technology in 1997 Maintains a history of previously seen packets to make better decisions about current and future packets CSCE Farkas28 Proxy Firewalls Bastion Host View Private Network Outside Private Network Outside Proxy Server Reality CSCE Farkas29 Proxy Firewalls Application Gateways Works at the application layer must understand and implement application protocol Called Application-level gateway or proxy server Circuit-Level Gateway Works at the transport layer E.g., SOCKS CSCE Farkas30 Application Gateways Interconnects one network to another for a specific application Understands and implements application protocol Good for higher-level restrictions Client Server Application Gateway CSCE Farkas31 Application Gateways Advantages: by permitting application traffic directly to internal hosts Information hiding: names of internal systems are not known to outside systems Can limit capabilities within an application Robust authentication and logging: application traffic can be pre- authenticated before reaching host and can be logged Cost effective: third-party software and hardware for authentication and logging only on gateway Less-complex filtering rules for packet filtering routers: need to check only destination Most secure CSCE Farkas32 Application Gateways Disadvantages: Keeping up with new applications Need to know all aspects of protocols May need to modify application client/protocols CSCE Farkas33 Firewall Evaluation Level of protection on the private network ? Prevented attacks Missed attacks Amount of damage to the network How well the firewall is protected? Possibility of compromise Detection of the compromise Effect of compromise on the protected network Ease of use Efficiency, scalability, redundancy Expense