UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING PATHWAYS TRIMESTER ONE EXAMINATION 2013/14 INTERNET SECURITY MODULE NO: CST3104

Transcription

1 CRT 07 UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING PATHWAYS TRIMESTER ONE EXAMINATION 2013/14 INTERNET SECURITY MODULE NO: CST3104 Date: Friday 20 th December 2013 Time: (2 hours) INSTRUCTIONS TO CANDIDATES: There are SIX questions on this paper. Answer FOUR questions. All questions carry equal marks.

2 QUESTION 1 Page 2 of 7 modprobe ip_conntrack iptables -P INPUT ACCEPT iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A FORWARD -i p2p1 -o p8p1 -s /24 -p tcp --dport 80 -j ACCEPT iptables -A FORWARD -i p8p1 -o p2p1 -d /24 -p tcp --sport 80 -j ACCEPT iptables -A FORWARD -i eth1 -o p8p1 -s /24 -j ACCEPT iptables -A FORWARD -i p8p1 -o eth1 -p tcp --dport 80 -j ACCEPT iptables -t nat -A PREROUTING -i p8p1 -p tcp --dport 80 -j DNAT --to-destination :80 iptables -t nat -A POSTROUTING -o p8p1 -s /24 -j SNAT --to-source echo 1 > /proc/sys/net/ipv4/ip_forward 1a/ Using the iptables rules and topology diagram above, provide a detailed analysis of each of the rules shown in the context of the traversal of a packet through the firewall discussing the appropriate tables and chains in each of the rules. (25 marks)

3 Page 3 of 7 QUESTION 2 2a/ The very nature of a TCP as a connection oriented protocol means that the status of communication sessions can be solidly tracked. Discuss each of the states of the TCP connection. You may use diagrams to assist your explanations (14 marks) 2b/ Outline the concept of stateful filtering (stateful inspection) and explain why configuring stateful filtering can reduce the number of ports open to attack. (5 marks) 2c/ What is a DMZ network and what would it typically contain? (6 marks) QUESTION 3 3a/ You have a web server located within your DMZ and you are getting reports that it is not responding to request for pages. You undertake some network investigation and observe that you are currently under attack using a technique called synflooding. Discuss the nature of a synflood attack and provide details of how this kind of attack can be mitigated. (13 Marks) 3b/ Outline the difference between packet filtering at layers 3 & 4 and layer 7 in terms of the part of the packet used and from this explain why filtering at layers 3 & 4 is faster than filtering at layer 7. Then give examples of filtering that can be achieved at layer 7. (12 marks)

4 QUESTION 4 4a/ Page 4 of 7 In the above diagram the DMZ network has address /24. and the Internal network has the address /24. The address of the firewall s external interface is The Web server in the DMZ on and is accessible to clients on the Internet. A network analyzer is monitoring all the interfaces on the firewall FW. State why NAT is necessary in this situation and identify the type of NAT which would be used. Then fill in the table below to show source and destination IP addresses and port numbers of the incoming and outgoing packets associated with a connection from a host with IP address on the Internet to the Web server in the DMZ as seen by the network analyzer. (You should choose representative values for the client source port numbers.) (15 marks) Question 4 continued over the page

5 Page 5 of 7 Question 4 continued For Incoming Packets entering the firewall Destination IP Address Destination Port No. Source IP Address Source Port No. For Incoming Packets leaving the firewall Destination IP Address Destination Port No. Source IP Address Source Port No. For Outgoing Packets entering the firewall Source IP Address Source Port No. Destination IP Address Destination Port No. For Outgoing Packets leaving the firewall Source IP Address Source Port No. Destination IP Address Destination Port No. 4b/ Your outside interface obtains it s IP address dynamically from your ISP via DHCP which can make Source NAT problematic. Identify the technique used in these circumstances and discuss what the main disadvantage of this technique. Furthermore provide an appropriate iptables rule would be required in order for our internal hosts to connect to servers on the outside of the firewall. (10 marks)

6 Page 6 of 7 QUESTION 5 5a/ Discuss the various methods of connecting and IDS device into the network highlighting the benefits and any disadvantages of each of the connection methods. (9 marks) 5b/ A company with a national reputation wants to employ an Intrusion Detection Systems (IDS) to detect malicious activity on the DMZ and is particularly concerned that they may be vulnerable to 'Zero Day' attacks. Explain briefly what is meant by a 'Zero day attack' then outline the main methods used by Network Intrusion Detection Systems giving their relative advantages and shortcomings in this context and hence identifying which of these would be appropriate for the company. (9 marks) 5c/ A computer security consultant visiting the company in 5a makes a recommendation that the company employ a Host IDS on each critical server in the DMZ. Explain what you think his justification would be for this. ( 7 marks)

7 Page 7 of 7 QUESTION 6 6a/ Outline the concept of the porous perimeter in the context of network security then explain why a layered approach to security is used to address this problem. Give examples of the types of security appliances or security software you would employ to protect a network and indicate on a diagram where these would be located. (18 marks) 6b/ Highlight processes involved in a Smurf attack and why, under some circumstances, even a well protected network can be vulnerable to this type of attack (7 marks) END OF QUESTIONS