SECURITY in IT SYSTEM

Transcription

1 SECURITY in IT SYSTEM CH6. Network Security Tools 2 (Firewall) Semester 2, ອ.ຈ ໂຕໂມ (TOMO)

2 TODAY S TOPICS 1.Network Address Translation(NAT) 2.ປະເພດຂອງ F/W 3.Network Analyze Tools

3 Network Address Translation (NAT) Port Addres Translation (PAT) convert global IP address private IP address Internet ໃຊ global IP address PAT NAT ROUTER convert global IP address and port number private IP address and port number Private IP Address / / /16 Private Network ໃຊ private IP address Private IP Address / / /16 Private Network ໃຊ private IP address

4 When using the NAT? 1.PC(Inside LAN) Internet When you connect to the Internet from your company s inside PC, For sharing global IP address, the IP masquerade is often used. 2.Internet PC(Inside LAN) When you need a PC of their own receives direct access from the Internet, For sharing global IP address, the Port Fowarding is often used. 3.Internet Server (DMZ) If you want to publish a server built in company, The One-to-one NAT is often used. Internet DMZ 3 NAT 2 1 Inside LAN

5 one-to-one NAT (Full-cone NAT ) Change IP address only Internet NAT Rule WebServer DNSServer DMZ NAT Web Server IP: IP: NAT router DNS Server IP:

6 IP masquerade (Port Address Translation,PAT) Internet Change IP address and Port number PAT Rule : : : : Inside LAN Web Server PAT NAT overload IP: IP: router IP:

7 Port Fowarding Change IP address only Internet NAT Rule WebServer : : DNSServer : :53 Inside LAN Web Server PAT NAT overload IP: IP: router DNS Server IP:

8 ປະເພດຂອງ Firewall Hardware-based Firewalls. ເປ ນທ ສ າງມາພ ອມກ ບເຄ ອງສ ນບ ນແບບ ຫ ອກຊ ໜ ງແມ ນ Hardware firewall Server-based Firewalls. ເປ ນ firewall application ທ ໃຊ ກ ບລະບ ບປະຕ ບ ດການເນ ດເວ (NOS: network operating system)ເຊ ນ: UNIX, Windows or Novell. Integrated Firewalls ເປ ນ firewall ທ ປະກອບກ ບອ ປະກອນຕ າງໆທ ມ function ເປ ນທາງ firewall ເຊ ນ: Router. Personal Firewalls ເປ ນ firewalls ທ ຢ ໃນຄອມພ ວເຕແຕ ລະຊະນ ດໂດຍພ ນຖານແລ ວຈະມການຕ ດຕ ງມາພ ອມກ ບລະບ ບ ປະຕ ບ ດການແລ ວ.

9 Examples of Firewall 1. ƒnetwork Firewall Software beased Firewall Microsoft ISA Server (WindowsServer) IPTABLES, SMOOTHWALL (Linux) Hardware besed Firewall CISCO ASA Juniper SSG 2. Host-besed Firewall (Personal Firewall) WindowsXP Personal FireWall

10

11 SMOOTHWALL Smoothwall is a Linux distribution designed to be used as an open source firewall.

12 Hardware Based Firewall UTM(Unified Threat Management ) Unified threat management (UTM) is a comprehensive solution that has recently emerged in the network security industry, and since 2004 it has gained widespread currency as a primary network gateway defense solution for organizations.in theory, UTM is the evolution of the traditional firewall into an all-inclusive security product able to perform multiple security functions within one single appliance: network firewalling, network intrusion prevention and gateway antivirus (AV), gateway anti-spam, VPN, content filtering, load balancing, data leak prevention and on-appliance reporting. Cisco ASA FireWall Juniper SSG Firewall IPS Anti Virus Anti Spam VPN FireWall + URL filtering Data Leak Prevention

13 Personal FireWall

14 What a personal Firewall can do? Personal Firewall can do Stop hackers from accessing your computer. (Packet Filtering) Protects your personal information. Blocks pop up ads and certain cookies. Determines which programs can access the internet. Personal Firewall cannot do Cannot prevent viruses

15 ການໃຊ ງານຂອງ Firewall Packet Filtering Firewall. ຮ ບຮອງ packet ທ ມການເຄ ອນທ ຜ ານໄປໂດຍມການຕ ງຄ າໃວ ແລ ວໂດຍການພ ຈາລະນາ ຈາກສ ວນໜ ງ ຂອງສ ວນຫ ວ ຂອງ packet ເພ ອມາສ ມທຽບກ ບທ ການ ດໄວ. ທາງານແບບ pattern Matching ຕ ດສ ນວ າຄວນຈະຖ ມ packet ນ ນຫ ຈະຍອມໃຫ ຜ ານ ການທາງານບ ຊ ບຊ ອນສະນ ນຈ ງເໝາະກ ບການທາງານໃນ Router ໃນປະຈ ບ ນ. Stateful Inspection Firewall. ເຮ ດວຽກຄ າຍຄກ ບ Packet Filtering Firewall ແລະເພ ມຄວາມສາມາດໃນການບ ນທ ກຂ ມ ນກ ຽວກ ບຄອນເນ ດຊ ນທ ເກດ ຂ ນລ ງໃນ State Table ກ ອນທ ຈະສ ງເອ າແພ ກເກ ກນ ສ ງຕ ໃຫ ກ ບເລເຢ ອ ນ. ການ ດສະຖານະຕ າງເຊ ນ TCP state ແລະສະຖານະອ ນໆທ ຜ ດ ແລລະບ ບການ ດໄດ. Application Proxy Firewall. ເປ ນ ແອປ ແຄຊ ນໂປ ແກນທ ເຮ ດວຽກຢ ໃນໄຟຟ ທ ຕ ງຢ ລະຫວ າງເນ ດເວສອງເນ ດເວ, ເຮ ດໜ າທ ເພ ມຄວາມປອດໄພຂອງ ລະບ ບເນ ດເວໂດຍການຄວບຄ ມການເຊ ອມຕ ລະຫວ າງເນ ດເວພາຍໃນແລະພາຍນອກ proxy ຈະຊ ວຍຄວາມປອດໄພໄດ ຫ າຍ, ເນ ອງຈາກມການກວດສອບຂ ມ ນໃນລະດ ບຂອງແອປ ແຄຊ ນເລເຢ. ສາມາເພ ມໜ າທ ຢ າງອ ນເຂ າໄປໄດ ສາມາດເກ ບຂ ມ ນໄວ ທ proxy ສາລ ບຂ ມນທ ໃຊ ຫ າຍ. ການໃຊ ງານແບນບ ດມປະສ ດທ ພາບສ ງ ມຄວາມສາມາດໃນການກວດສອບຜ ເຂ າໃຊ (user Authenticate) ມຄວາມສາມາດໃນການກ ນຕອງເນ ອຫາທ ບ ເໝາະສ ມ(content filtering)

16 Network Analyzing Tools Port Scan Packet Caputure Packet Analyze

17 PortScan Tool NMAP( Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon used to discover Host and services on a computer network, thus creating a "map" of the network.

18 ວ ທ ໃຊ NMAP NMAP is used when you want to check the configuration of your FireWall. DMZ Internet Inside LAN Nmap installed PC PortScan Test Do not use for the web site and the Internet FireWall of other companies!!! it is considered a hacker attack!!!

19 Packet Capture & Analyze Tool WireShark ( Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education.

20 ວ ທ ໃຊ WireShark WireShark is used to check the details of the packet at the time of network trouble. WireShark Installed PC PC Port Mirroring Server Switching HUB