CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention - - PowerPoint PPT Presentation
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
l however it creates a threat
l can be a single computer system or a set of two or more systems working together
l single choke point to impose security and auditing l insulates the internal systems from external networks
design goals
the firewall
defined by the local security policy will be allowed to pass
penetration
techniques used by firewalls to control access and enforce the site’s security policy are:
capabilities:
security events
Internet functions that are not security related
limitations:
firewall
threats
accessed from outside the organization
may be infected outside the corporate network then used internally
– typically a list of rules based on matches in the IP or TCP header – forwards or discards the packet based on rules match
– discard - prohibit unless expressly permitted
– forward - permit unless expressly prohibited
filtering rules are based on information contained in a network packet
– simplicity – typically transparent to users and are very fast
– cannot prevent attacks that employ application specific vulnerabilities or functions – limited logging functionality – do not support advanced user authentication – vulnerable to attacks on TCP/IP protocol bugs – improper configuration can lead to breaches
tightens rules for TCP traffic by creating a directory of outbound TCP connections
currently established connection
traffic to high numbered ports
the profile of one of the entries in this directory
reviews packet information but also records information about TCP connections
numbers to prevent attacks that depend on the sequence number
like FTP, IM and SIPS commands
user on an inner host and one on an outside host
without examining contents
connections will be allowed
level gateway outbound
l SOCKS v5 defined in RFC1928 l designed to provide a framework for client-server applications in TCP/UDP domains to conveniently and securely use the services of a network firewall l client application contacts SOCKS server, authenticates, sends relay request
establishes or denies the connection
SOCKS- ified client applications
l system identified as a critical strong point in the network’s security
l runs secure O/S, only essential services l may require user authentication to access proxy or host l each proxy can restrict features, hosts accessed l each proxy is small, simple, checked for security l each proxy is independent, non-privileged l limited disk use, hence read-only code
advantages:
environment
l controls traffic between a personal computer or workstation and the Internet or enterprise network l for both home or corporate use l typically is a software module on a personal computer l can be housed in a router that connects all of the home computers to a DSL, cable modem, or other Internet interface l typically much less complex than server-based or stand-alone firewalls l primary role is to deny unauthorized remote access l may also monitor outgoing traffic to detect and block worms and malware activity
software on servers
host-resident firewall
with stateless or full packet filtering
screening router
external router
single bastion inline
where externally visible servers are placed
single bastion T
double bastion inline
bastion firewall
double bastion T
distributed firewall configuration
l identifies attacks using both signature and anomaly detection techniques
in packets, looking for patterns that have been identified as malicious
malware
l can be tailored to the specific platform l can also use a sandbox approach to monitor behavior
l enables Snort to function as an intrusion prevention capability l includes a replace option which allows the Snort user to modify packets rather than drop them
l useful for a honeypot implementation l attackers see the failure but can’t figure
Snort rejects a packet based on the
defined in the rule and logs the result
packet is rejected and result is logged and an error message is returned
packet is rejected but not logged
Security ¡ Appliance ¡ Attack ¡ Protections ¡ Summary ¡-‑ ¡ Transport ¡Level ¡ Examples ¡ ¡
Sidewinder ¡G2 ¡ Security ¡Appliance ¡ Attack ¡Protections ¡ Summary ¡-‑ ¡ Application ¡Level ¡ Examples ¡(page ¡1 ¡of ¡2) ¡ ¡
l firewall location and configurations l DMZ networks l virtual private networks l distributed firewalls l intrusion prevention systems (IPS) l host-based IPS (HIPS) l network-based IPS (NIPS) l Snort Inline l UTM products
l need for l characteristics of l techniques l capabilities/limitations
l types of firewalls l packet filtering firewall l stateful inspection firewalls l application proxy firewall l circuit level proxy firewall l bastion host l host-based firewall l personal firewall