CIS 4361: Applied Security Lab 4

Transcription

1 CIS 4361: Applied Security Lab 4 Network Security Tools and Technology: Host-based Firewall/IDS using ZoneAlarm Instructions: The Lab 4 Write-up (template for answering lab questions -.doc) can be found on the course website under the Assignment s section. Save Lab 4 write-up results using following format: Team#_Lab4.doc where the # is the number of your team Lab Write-up s must be uploaded to Blackboard in the Assignment s folder where the laboratory assignment description is located. ALL resources used to complete this assignment must be referenced and sited, this includes, books, articles, websites, etc.) Lab submissions must be typed using the Lab 4 Write-up template! Only submit ONE Lab Write-up per team Goal: In this lab you will learn how to: Use a host-based firewall/ids to detect system-level attacks. Background: A simple definition of firewall is a method and/or software or hardware that regulates the level of trust between two networks using hardware, software, or both in combination. Normally, one of these networks is a trusted network such as a corporate LAN, while the other is considered to be untrusted, such as the Internet. There are four primary categories that firewalls fall into: Packet filtering A packet-filtering firewall examines the header of each packet and decides whether to let the packet continue or not based upon a defined set of rules such as source/destination IP address, source/destination port, protocol involved, and so on. Stateful packet inspection A stateful packet firewall takes packet filtering up a notch. SPI firewalls keep a running log of the actions particular packets bring about, where they go, and so on. This allows the current status quo to be monitored for adnormalities, whether it involves a sequence of events or possibly Application-layer data that performs some forbidden action. Application-level proxies A application-level proxy actually serves as a buffer of sorts between incoming data and the system it is trying to acess. These firewalls run a portion of the Application-layer code that is coming in and determine whether its behavior is acceptable before letting it pass. However, this type of firewall does incorporate some additional overhead. Circuit-level proxies A circuit-level proxy performs most of the functions of SPI firewalls and application-level proxies, making them the most versatile of the firewall technologies being created today. Two types of firewalls are often employed on a network network-based or host-based. Networkbased firewalls are the most common, sitting between two entire networks and monitoring the incoming and outgoing traffic. A host-based firewall, on the other hand, views the host (e.g., your desktop computer or an individual server) as one network and the LAN as the other. Host-based firewalls are also commonly referred to as personal firewalls. Procedure:

2 This lab will walk through some common configuration and attack detection and blocking with the trial version of ZoneAlarm. 1. Click to install the executable file entitled: zapsetup_50_590_015.exe. When the initial installation windows open, click Next. 2. You are presented with the User Information window. 3. Enter the required information in the text boxes on the form, and then make sure that the check boxes at the bottom of the page are unchecked. Click Next to proceed. You see the software s License Agreement. Check the check box at the bottom of the page, and then click Install. 4. The installation runs, and you are presented with a User survey window. Fill in the necessary information, and then click Finish. A dialog box asks if you would like to start ZoneAlarm. Click Yes. 5. The first dialog box asks which version you want. For this lab, you are installing and running the 15-day trial of ZoneAlarm Pro, so click the link you see under Option 2. The Configuration Wizard opens. Click Next. 6. You will be asked whether you wish to anonymously share your setting. 7. Click the No, thanks option, and then click Next. 8. Next, you need to configure the Program AlertAdvisor. To do this, click the Manual button, and click Next. The Privacy Control dialog box appears offering various options controlling pop-ups and other cookies. For this lab, leave both the Privacy Control and Cache Cleaner check boxes blank, and click Next. 9. The final setup page appears. Click Done. 10. When the install is finished, click Ok to restart your computer. When your machine starts up, you may be prompted for a license key, in which case leave the license key blank and accept the trial version. You are prompted to go through a tutorial, and it is recommended that you take the time to do so. ZoneAlarm then detects your network settings. 11. After reviewing the detected settings, click Next, and you are asked whether you trust the network the ZoneAlarm has detected. For this lab, select the second option you DO NOT trust the network. 12. You are now prompted to give this network a name. Enter LAB_3 in the field, click Next. You will see the summary screen. Click Finish. 13. Click Finish to complete the setup. Now the ZoneAlarm overview console appears.

3 **From time to time, ZoneAlarm alerts you that some sort of program or service is trying to access resources on your system. An example is shown in Figure 1.** Figure 1: ZoneAlarm Alert Window ZoneAlarm typically has recommended settings for the common ports and services active on networks. For this lab, accept the recommendations for any of these that appear while you are going through the lab, and each time, be sure to check the Remember this setting option. 14. Click the Firewall tab on the left side. There are three tabs along top of the screen labeled Main, Zones, and Expert. Click the Main tab if necessary, and you see two slider controls that define the level of security for both Trusted and Internet Zones. Based on the default settings, the Internet Zone is set to High, and the Trusted Zone is set to Medium. You can define custom settings by clicking the Custom buttons. Click Custom next to the Internet Zone setting. You should see a dialog box like that in Figure 2. Figure 2: Custom Firewall Settings for the Internet Zone A.) What filtering rules are currently selected for High security settings for Internet Zone? B.) What filtering rules are currently selected for Medium security settings for Internet Zone?

4 15. Do not change any of these settings for this lab. Click Cancel. Now, click the middle tab, Zones. Here you can see the lab network you have defined as an Untrusted network (which ZoneAlarm defines as the Internet zone). 16. Click the Program Control tab on the left side. This is where you can define the level of access and permission that system services and applications have. Click the Programs tab in the middle along the top ZoneAlarm, as shown in Figure 3. Figure 3: ZoneAlarm Program Console 17. You can also add programs manually. Add a program manually by clicking the Add Button. 18. Manually Add Microsoft Office Word, if not listed. Hint: File located in the Office11 folder. Program entitled WINWORD. Once you have manually added Microsoft Office Word, highlight the MICROSOFT WORD program listed, and click the Options button in the lower-right corner of the screen. You see a dialog box like the one shown in Figure 4. Figure 4: Program Options Screen

5 C.) Is the program you selected allowed to access the Internet? D.) Is this program automatically set up with protection? Are its components authenticated? 19. When you are finished looking at the program options, click Cancel and then click the Components tab. You are shown the individual operating system and application components detected by ZoneAlarm. Typically, when an application tries to perform an action, ZoneAlarm verifies that the component is doing something within its normal scope of operation. 20. Click the button labeled Alerts & Logs along the left side of the window. 21. Set Alert Events Shown to High, make sure Event Logging is Turned On, and then set Program Logging to High. Click the Advanced button. You will see the screen shown in Figure 5, allowing you to make many granular changes to the types of alerts and logs that are managed by ZoneAlarm, as well as define the normal rotation of logs and how they are displayed in the System Tray (optional). E.) What Events are configured to generate an alert and/or are logged due to blocked traffic? 22. To perform a simple test of ZoneAlarm s filtering capabilities, open a command prompt by clicking Start, and Run, and then type cmd. Press Enter. F.) What is the command that you should type at the command prompt to find your IP address? 23. Type the following command that follows using your own system IP address. ping <Your IP address>

6 **ZoneAlarm detects a new program (ping) trying to access system resources, and alerts you.** 24. Make sure that the Remember this setting check box is unchecked, then click Allow. 25. Repeat the ping command at the command prompt. You are presented with a Repeat Program alert much like the one you just saw. This time, click Deny. G.) What do you see in your command window? 26. This was a straightforward example used to illustrate the basic principles of the program. In reality, the network environment is usually more chaotic. For example, had an NMAP port scan or LANGuard port scanner been running against your system, many alerts would have been generated. ZoneAlarm has a vast number of configuration options that can be set; you can block Web content, attachment types, viruses, and so on. To get an idea of the level of granularity that can be achieved with ZoneAlarm, click the Firewall tab on the menu along the left side of the console. Select the Expert tab, and then click Add. The Add Rule dialog box opens as shown in Figure 5. Here you can either allow or deny access to specific source address(es), destination address(es), and protocols. You can even designate the time for access or denial to be enacted. Figure 5: ZoneAlarm Custom Rule configuration H.) In what ways does ZoneAlarm perform as an intrusion detection system? I.) In what ways is it more like a firewall?

7 BONUS (+5): Add a simple rule that will block (transfer protocol type) from the following Blackholed IP address: J.) What are the values that you defined in your Add Rule dialog box? Rank: Name: Comments: State: Action: Track: Source: Destination: Protocol: Time: