From Network Security To Content Filtering
|
|
- David Lester Green
- 8 years ago
- Views:
Transcription
1 Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals or the threats to which we are subjected, but in the approach itself that must be adopted to secure a network connection. Around year 2000 a robust stateful firewall working at layer 4 (in ISO/OSI parlance) was considered a good defense in most situations. Indeed by selecting the TCP/IP addresses, ports (i.e. services) and the direction of the connections (that is of the first packet requesting the service) it was possible to prevent most attacks and reduce quite considerably the risks of unwanted network connections. To be effective this approach required that: 1. TCP/IP ports identified clearly the protocols and the kind of data which is transported through them; 2. it was possible to trust IP addresses to identify the source/destination of the network traffic to distinguish the trusted peers from the untrusted or the unknown. Stateful firewall are still today, and will be in the future, a fundamental building block of network security, very little can be done without them. But today their efficacy is very limited and this has come about in part thanks to their success. Indeed the diffusion of stateful firewalls in public and private companies in the first years of 2000 has forced application developers to find way to pass through them. Very often it happened to install in a company a new application and to discover that it required a modification of the ruleset of the firewall to be able to send or receive communications through it. But the modification of the ruleset of the firewall often requires management approval, security checks of the application itself etcetera. From the application point of view, in many situations it is easier if there is not the need to modify the security rules or to add new security rules, but it is sufficient just to apply security rules already in place. Since access to web browsing in internet is usually allowed through firewalls, almost all
2 Computer Fraud & Security, May 2007 page 2/10 applications today offer the possibility to tunnel their communication as if it was web traffic: some applications just use port 80, the port reserved web servers (httpd), other really tunnel their data communication in the http protocol and appear as if it was a browser connecting to a web server. If most network traffic uses the web ports and looks like web traffic, a layer 4 stateful firewall which filters traffic based only on TCP/IP addresses and ports has very little possibility to enforce the company security policies. Moreover, if a few years ago authentication by IP addresses could have been acceptable for very low security services, today is totally unacceptable: with the extensive deployment of Network Access Translation (NAT), Virtual Private Networks (VPN) and tunnels, the presence of anonymizing services and unfortunately also of viruses, worms, zombie PCs etc. it is impossible to trust the origin of a connection only based on its source IP address. At the same time the security of applications has improved greatly: default password have almost disappeared, trivial bugs due to bad coding practices have mostly been corrected etc., so being able to contact an application via network is today not sufficient to have access to it. Today attacks must be done at the application level: a layer 4 stateful firewall does not analyze the contents of the packets so has no way of protecting from application level attacks. The problem of filtering traffic at layer 7 So the fact that layer 4 stateful firewall are very good in doing their job has, together with the evolution of network security, forced an epic change in the way data is transmitted in TCP/IP networks. We cannot rely on the ports used by an application to understand which kind of data is transmitted since typically port 80 is used for almost anything. So we have to look at the actual contents of each TCP/IP packet (this is usually called layer 7 filtering), but how can we do this? There are various issues at hand among which the most important are: 1. Speed: to check the port number of each packet is fast, to analyze all data transported by a packet is a very big job which can impact adversely on the speed of communication, the work load on firewalls and security devices etc.
3 Computer Fraud & Security, May 2007 page 3/10 2. Protocol Analysis: it is possible to limit the analysis to verify that the data transported is formatted according to the application protocol that is allowed, typically http: this will prevent applications just to use port 80 to communicate (and, as we have seen, this can be a problem) but will not protect against attacks to applications which use the http protocol to communicate. 3. Content Filtering: full content analysis seems to be the real security solution, but it is almost impossible to implement. Indeed if almost any kind of traffic can be tunneled through http, how can we discriminate 'good' from 'bad' content? As an extreme example consider Skype traffic which is encrypted end to end and can be tunneled as https (port 443) traffic: for example it is not an easy task to forbid only Skype traffic and allow all other kinds of https traffic. So instead of full content analysis what it is possible to do is Content Filtering that is to filter out traffic which is either known to be bad or considered to be suspicious or not standard. This still requires to analyze the full contents of each packet but looking only for known attacks or new patterns (as we will describe better below). Proxy and Application Level Gateway (ALG) Layer 7 filtering has traditionally been done by Proxies or Application Level Gateway. In a clientserver TCP/IP connection a Proxy intercepts the packets and behaves towards the client as if it was the server and towards the server as if it was the client. It thus breaks the connection in two (this could be seen as a kind of legal Man In The Middle attack) and has the possibility of checking the content of each packet as it passes by. Actually very few Proxies check the contents of each packet for possible attacks. Indeed the simplest version of Proxies, also called Circuit Level Proxies, do not look at all at the content of the packets but split the connection in two and in case are able to add an authentication layer if they sit in front of a sever which does not authenticate the clients. More common Proxies, like the ones usually employed for web traffic, can do client authentication, cache common web pages and do some protocol verification. They can also use white or black lists to limit the clients or
4 Computer Fraud & Security, May 2007 page 4/10 servers which can connect to them. A few Proxies are more security aware and are able to recognize also attacks and prevent them. But the most important feature of traditional Proxies is that for each application there must be a specialized Proxy since it must implement the full application logic to be able to understand and protect the traffic. Often each Proxy requires its own server and special network configuration to be able to intercept the traffic. This does not make it simpler for the network and security managers and on top does not cover all types of traffic but only the ones for which a Proxy is available. If we look at Proxies from the point of view of full network security, we realize that they are fundamental components but still do not give all the answers to our needs of security. Today every network security system must have at least a Web and a (anti virus and anti spam) Proxy, but we need something else to cover the general problem of Content Filtering. From IDS to IPS For generic network Content Filtering we turn our attention to Intrusion Detection Systems (IDS). An IDS works in a similar way to an anti virus (there are IDS based on recognition of unusual traffic but we do not consider them here): given a database of rules to detect malicious packets, an IDS checks all packets which are sent to it for their presence. In case an IDS finds a malicious packet, it sends an Alert to the Console, in other words it sends an alarm message to the person in charge. Once the alarm has arrived, it must be evaluated, managed and finally an appropriate response has to be initiated. Often all these activities are manual, some time part of them are automatic. An IDS can analyze the full packet, but usually not the original one. Indeed the work of an IDS is very onerous and to avoid delays in the network traffic, an IDS receives copies of the packets in transit and analyzes the copies without worry to delay the original packets. In this way, the real packet, even if malicious, reaches anyway its destination and often the alarm arrives some time after it. In case of very heavy traffic IDS are known to drop packets, that is not to analyze some packets if they start to lag too much behind the real network traffic.
5 Computer Fraud & Security, May 2007 page 5/10 Another aspects of IDS is the kind of rules used to match malicious packets. Since IDS are not used to stop attacks in real time, they are used to gather information about possible attacks. In other words, since they do not interfere with the true traffic, it is considered better if they report false positives, that is alarms which actually do not correspond to real attacks, than they have false negatives, that is that they miss some attacks. Indeed it is often difficult to create rules to match malicious packets that in some situations do not match also normal packets, and there is a delicate threshold between the number of attacks undetected and the number of false attacks reported: as one decreases the other increases. This is the reason why all alarms generated by an IDS are reported to a console where they have to be studied, correlated and finally it has to be decided if they correspond to a real attack or a false positive. IDS are in any case very useful, because they give the possibility to correlate traffic and to discover patterns, like for example of reconnaissance traffic, which can lead to an attack. But IDS are difficult to use and they often require the intervention of highly specialized personnel. So IDS are not the final solution to the security of today network traffic. On the other side, IDS are able to analyze all kind of traffic at the application level and implement part of what Content Filtering should be. But what if we give to an IDS the possibility to stop malicious traffic? This will be then a reactive IDS which is often called an Intrusion Prevention System (IPS) [notice that there exist many different, albeit similar, definitions of the term IPS]. The first idea would be that the IDS sends the alarms directly to a firewall which then adds a rule to stop the malicious packets. But doing in this way the first malicious packet will for sure arrive to destination. Moreover the number of rules added to the firewall can become very large and reduce the efficiency of the firewall itself besides the risks of a self induced denial of service attack. The only practical way to go, is to merge firewall and IPS as follows. We can put on the same security device first a layer 4 stateful firewall which imposes the security network policies: only packets allowed by the security network policies pass the stateful firewall and reach the IPS which follows. Then the IPS scans the real packets, and not copies, and if it finds that a packet matches
6 Computer Fraud & Security, May 2007 page 6/10 one or more rules, it drops, i.e. cancels, the packets (optionally it can also send a reset to the sender/receiver to stop the connection). In this way we limit the work of the IPS only to packets already filtered by the layer 4 stateful firewall but we guarantee that if a packet matches a rule, it is dropped and it does not reach its destination. Limits of an IPS An IPS as described has opposite problems to an IDS. Indeed for an IPS the problem of false positives is very important: there must not be false positives otherwise lawful connections will be dropped. So we must select only those rules which guarantee to match only malicious packets. Another problem for IPS is the one of delays: since an IPS works on real packets, it cannot delay them nor drop them due to heavy load. So the number of checks that an IPS can do on a packet is limited to very few. To speed up IPS various techniques are implemented: from hardware dedicate devices, to filtering only some kind of traffic as for example not filtering traffic since anyway it has to go through the anti virus, and, as already mentioned, reducing the number of used rules. If we compare an IPS to and IDS, we see that the two practically work in opposite regimes: an IDS should not have false negatives (i.e. attacks undetected) but can have many false positives; it usually uses as many rules as possible, works off line on copies of the packets, can drop packets under heavy load and sends alerts after the real malicious packets are already delivered; an IPS should not have false positives but can have false negatives; it uses a limited number of rules, works in line on the real packets, cannot drop packets under heavy load but directly drops the malicious packets if they match a rule. So how are we standing with network security today? From this discussion it should be obvious that we do not have the perfect solution, the tool or approach to network security which allows us to control all traffic. Content filtering is difficult and
7 Computer Fraud & Security, May 2007 page 7/10 we must adopt different and parallel approaches to be able to reach a reasonable confidence that the data which transit in our networks is not malicious. Today we definitely need to use all tools at our disposal, from the old layer 4 stateful firewall, the basis of all network security, to the specialized Proxies, the IDS and the IPS. Managing all these tools is not always an easy task, even if the latest security devices do include most of them and allow to manage them in a coherent and unified way. Snort inline Since the IPS is the latest kid on the block, we conclude by briefly indicating how one can build a very simple open source IPS to verify its functioning. Snort [1,2] is probably the most famous IDS, besides being open source. It has also a version, called Snort inline [3] which is a reactive IDS, that is, according to our definition, an IPS. Installing Snort inline on a Linux machine is an easy and well documented process. Here we are interested in discussing a few important points of the configuration. First of all, the layer 4 Linux stateful firewall, called iptables, sends to Snort inline only packets for the port 80, that is typically web traffic. As indicated in Table 1, this is done by sending to the QUEUE target the packets directed to port 80 instead of forwarding them directly, which would be done with the target ACCEPT. The configuration of Snort inline in Table 2 contains only rules and commands which can be related to web traffic. Comparing this configuration with that for a typical Snort IDS (the configuration file is the same for Snort and Snort inline) one can see that the one for Snort inline is reduced to the only necessary items. The only differences in the configuration between Snort and Snort inline are in the rules themselves. The typical Snort action in a rule, see the first line in Table 3, is alert, that is to send an alert, whereas Snort inline adds other possible actions to execute if a packet matches a rule. Among the most common actions, see Table 3, there are: drop which drops the packet and sends an alert, sdrop which silently drops the packet, reject which drops the packet and sends a reset to the sender of the packet.
8 Computer Fraud & Security, May 2007 page 8/10 From this simple configuration it should be obvious that the main differences between Snort and Snort inline are that: Snort inline receives the real packets from the firewall, whereas Snort works on copies of the packets obtained as a sniffer with libpcap Snort inline either allows the packet to continue to transit or drops the packet, whereas Snort just sends an alert in the configuration of Snort inline one should limit oneself to the real necessary commands and rules. Andrea Pasquinucci PhD CISA CISSP References [1] [2] [3] snort inline.sourceforge.net # activate ip_queue modprobe ip_queue # add rule to send packets to snort_inline iptables -A FORWARD -i eth0 -p tcp --dport 80 -j QUEUE
9 Computer Fraud & Security, May 2007 page 9/10 # send to snort_inline also the return packets iptables -A FORWARD -o eth0 -p tcp --sport 80 -j QUEUE Table 1. Iptables rules to send packets to Snort inline in Linux ### Network variables var HOME_NET /24 # Ports you run web servers on var HTTP_PORTS 80 # Path to your rules files (this can be a relative path) var RULE_PATH /etc/snort_inline/rules ### preprocessors preprocessor flow: stats_interval 0 hash 2 preprocessor stream4: disable_evasion_alerts, stream4inline, \ enforce_state, memcap , timeout 3600, \ truncate, window_size 4000 preprocessor stream4_reassemble: both preprocessor http_inspect: global \ iis_unicode_map unicode.map 1252 preprocessor http_inspect_server: server default \ profile all ports { 80 } oversize_dir_length 500 ### Logging alerts output alert_fast: snort_inline-fast # Include classification & priority settings include $RULE_PATH/classification.config include $RULE_PATH/reference.config ### The Drop Rules include $RULE_PATH/ftp.rules include $RULE_PATH/web-cgi.rules include $RULE_PATH/web-coldfusion.rules include $RULE_PATH/web-iis.rules include $RULE_PATH/web-frontpage.rules include $RULE_PATH/web-misc.rules include $RULE_PATH/web-client.rules include $RULE_PATH/web-php.rules include $RULE_PATH/sql.rules Table 2. An over simplified configuration of Snort inline
10 Computer Fraud & Security, May 2007 page 10/10 alert udp any any <> any 53 (msg: "Alert DNS";) drop tcp any any -> $HOME_NET 80 (msg:"drop TCP port 80";content:... ) sdrop tcp any any -> $HOME_NET 80 (msg:"sdrop TCP port 80";content:... ) reject tcp any any -> $HOME_NET 80 (msg:"reject TCP port 80";content:... ) Table 3. Example of rules for Snort inline (the content part of the rule is not displayed)
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users
Lesson 5: Network perimeter security
Lesson 5: Network perimeter security Alejandro Ramos Fraile aramosf@sia.es Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide
Intrusion Detection & SNORT. Fakrul Alam fakrul@bdhbu.com
Intrusion Detection & SNORT Fakrul Alam fakrul@bdhbu.com Sometimes, Defenses Fail Our defenses aren t perfect Patches weren t applied promptly enough Antivirus signatures not up to date 0- days get through
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds ravikantvanjara@gmail.com What is Firewall? A firewall
Internet Security Firewalls
Overview Internet Security Firewalls Ozalp Babaoglu! Exo-structures " Firewalls " Virtual Private Networks! Cryptography-based technologies " IPSec " Secure Socket Layer ALMA MATER STUDIORUM UNIVERSITA
Security Type of attacks Firewalls Protocols Packet filter
Overview Security Type of attacks Firewalls Protocols Packet filter Computer Net Lab/Praktikum Datenverarbeitung 2 1 Security Security means, protect information (during and after processing) against impairment
Overview. Packet filter
Computer Network Lab 2015 Fachgebiet Technische h Informatik, Joachim Zumbrägel Overview Security Type of attacks Firewalls Protocols Packet filter Security Security means, protect information (during
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
IP Firewalls. an overview of the principles
page 1 of 16 IP Firewalls an overview of the principles 0. Foreword WHY: These notes were born out of some discussions and lectures with technical security personnel. The main topics which we discussed
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. b.zdrnja@auckland.ac.nz Abstract Honeypots are security resources which trap malicious activities, so they
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
How To Understand A Firewall
Module II. Internet Security Chapter 6 Firewall Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 6.1 Introduction to Firewall What Is a Firewall Types of Firewall
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA
JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates
Voice Over IP and Firewalls
Introduction Voice Over IP and Firewalls By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com Use of Voice Over IP (VoIP) in enterprises is becoming more and more
Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html
Red Hat Docs > Manuals > Red Hat Enterprise Linux Manuals > Red Hat Enterprise Linux 4: Security Guide Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS)
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS) Internet (In)Security Exposed Prof. Dr. Bernhard Plattner With some contributions by Stephan Neuhaus Thanks to Thomas Dübendorfer, Stefan
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
Chapter 5. Figure 5-1: Border Firewall. Firewalls. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall
Figure 5-1: Border s Chapter 5 Revised March 2004 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Border 1. (Not Trusted) Attacker 1 1. Corporate Network (Trusted) 2 Figure
Stateful Inspection Technology
Stateful Inspection Technology Security Requirements TECH NOTE In order to provide robust security, a firewall must track and control the flow of communication passing through it. To reach control decisions
CSCI 4250/6250 Fall 2015 Computer and Networks Security
CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter 5-6 Tunnels } The contents of TCP packets are not normally encrypted, so if someone is eavesdropping on a TCP
TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY
IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...
Snort. A practical NIDS
Snort A practical NIDS What is SNORT Snort is a packet logger/analyzer, which can be used to implement a NIDS. It can based be used in 4 modes: Sniffer mode Packet Logger mode Network Intrusion Detection
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.
1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams
Firewalls, Tunnels, and Network Intrusion Detection. Firewalls
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
Firewalls (IPTABLES)
Firewalls (IPTABLES) Objectives Understand the technical essentials of firewalls. Realize the limitations and capabilities of firewalls. To be familiar with iptables firewall. Introduction: In the context
Track 2 Workshop PacNOG 7 American Samoa. Firewalling and NAT
Track 2 Workshop PacNOG 7 American Samoa Firewalling and NAT Core Concepts Host security vs Network security What is a firewall? What does it do? Where does one use it? At what level does it function?
Network Security Management
Network Security Management TWNIC 2003 Objective Have an overview concept on network security management. Learn how to use NIDS and firewall technologies to secure our networks. 1 Outline Network Security
Gateway Security at Stateful Inspection/Application Proxy
Gateway Security at Stateful Inspection/Application Proxy Michael Lai Sales Engineer - Secure Computing Corporation MBA, MSc, BEng(Hons), CISSP, CISA, BS7799 Lead Auditor (BSI) Agenda Who is Secure Computing
Load Balancing Smoothwall Secure Web Gateway
Load Balancing Smoothwall Secure Web Gateway Deployment Guide rev. 1.1.7 Copyright 2002 2015 Loadbalancer.org, Inc. 1 Table of Contents About this Guide...3 Loadbalancer.org Appliances Supported...3 Loadbalancer.org
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
How To Set Up An Ip Firewall On Linux With Iptables (For Ubuntu) And Iptable (For Windows)
Security principles Firewalls and NAT These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Host vs Network
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
1. Introduction. 2. DoS/DDoS. MilsVPN DoS/DDoS and ISP. 2.1 What is DoS/DDoS? 2.2 What is SYN Flooding?
Page 1 of 5 1. Introduction The present document explains about common attack scenarios to computer networks and describes with some examples the following features of the MilsGates: Protection against
Firewalls. ITS335: IT Security. Sirindhorn International Institute of Technology Thammasat University ITS335. Firewalls. Characteristics.
ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October 2013 its335y13s2l08, Steve/Courses/2013/s2/its335/lectures/firewalls.tex,
Firewalls. Contents. ITS335: IT Security. Firewall Characteristics. Types of Firewalls. Firewall Locations. Summary
2 : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October 2013 its335y13s2l08, Steve/Courses/2013/s2/its335/lectures/firewalls.tex, r2958
Load Balancing Web Proxies Load Balancing Web Filters Load Balancing Web Gateways. Deployment Guide
Load Balancing Web Proxies Load Balancing Web Filters Load Balancing Web Gateways Deployment Guide rev. 1.4.9 Copyright 2015 Loadbalancer.org, Inc. 1 Table of Contents About this Guide... 3 Appliances
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
7. Firewall - Concept
7. - Concept ค อ อ ปกรณ Hardware หร อ Software ซ งถ กต ดต ง เพ อ อน ญาต (permit), ปฏ เสธ(deny) หร อ เป นต วแทน(proxy data) ให ผ านไปย งเคร อข ายท ม ระด บความเช อถ อต างก น 7. - Concept components Network
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Firewalls P+S Linux Router & Firewall 2013
Firewalls P+S Linux Router & Firewall 2013 Firewall Techniques What is a firewall? A firewall is a hardware or software device which is configured to permit, deny, or proxy data through a computer network
Divide and Conquer Real World Distributed Port Scanning
Divide and Conquer Real World Distributed Port Scanning Ofer Maor CTO Hacktics 16 Feb 2006 Hackers & Threats I, 3:25PM (HT1-302) Introduction Divide and Conquer: Real World Distributed Port Scanning reviews
CSCI 7000-001 Firewalls and Packet Filtering
CSCI 7000-001 Firewalls and Packet Filtering November 1, 2001 Firewalls are the wrong approach. They don t solve the general problem, and they make it very difficult or impossible to do many things. On
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
Fig. 4.2.1: Packet Filtering
4.2 Types of Firewalls /DKo98/ FIREWALL CHARACTERISTICS 1. All traffic from inside to outside, and vice versa, must pass through the firewall. This is achieved by physically blocking all access to the
Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Chapter 5: Security Concepts for Networks Firewalls Intrusion Detection
NETASQ MIGRATING FROM V8 TO V9
UTM Firewall version 9 NETASQ MIGRATING FROM V8 TO V9 Document version: 1.1 Reference: naentno_migration-v8-to-v9 INTRODUCTION 3 Upgrading on a production site... 3 Compatibility... 3 Requirements... 4
Firewalls. Pehr Söderman KTH-CSC Pehrs@kth.se
Firewalls Pehr Söderman KTH-CSC Pehrs@kth.se 1 Definition A firewall is a network device that separates two parts of a network, enforcing a policy for all traversing traffic. 2 Fundamental requirements
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
Lab exercise: Working with Wireshark and Snort for Intrusion Detection
CS 491S: Computer and Network Security Fall 2008 Lab exercise: Working with Wireshark and Snort for Intrusion Detection Abstract: This lab is intended to give you experience with two key tools used by
Chapter 4: Security of the architecture, and lower layer security (network security) 1
Chapter 4: Security of the architecture, and lower layer security (network security) 1 Outline Security of the architecture Access control Lower layer security Data link layer VPN access Wireless access
DMZ Network Visibility with Wireshark June 15, 2010
DMZ Network Visibility with Wireshark June 15, 2010 Ashok Desai Senior Network Specialist Intel Information Technology SHARKFEST 10 Stanford University June 14-17, 2010 Outline Presentation Objective DMZ
Load Balancing Bloxx Web Filter. Deployment Guide
Load Balancing Bloxx Web Filter Deployment Guide rev. 1.1.8 Copyright 2002 2016 Loadbalancer.org, Inc. 1 Table of Contents About this Guide...4 Loadbalancer.org Appliances Supported...4 Loadbalancer.org
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
8. Firewall Design & Implementation
DMZ Networks The most common firewall environment implementation is known as a DMZ, or DeMilitarized Zone network. A DMZ network is created out of a network connecting two firewalls; i.e., when two or
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
3. Firewall Evaluation Criteria
Firewall Management Prep. drd. Radu Constantinescu Academy of Economics Studies, Bucharest ABSTRACT Network connectivity can be both a blessing and a curse. On the one hand, network connectivity can enable
Chapter 12. Security Policy Life Cycle. Network Security 8/19/2010. Network Security
Chapter 12 Network Security Security Policy Life Cycle A method for the development of a comprehensive network security policy is known as the security policy development life cycle (SPDLC). Network Security
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Industrial Firewalls Endpoint Security
Industrial Firewalls Endpoint Security Is there a need for a new type of industrial firewall? Industries have a huge park of different management and control systems to monitor their production. These
PROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
Internet Security Firewalls
Internet Security Firewalls Ozalp Babaoglu ALMA MATER STUDIORUM UNIVERSITA DI BOLOGNA Overview Exo-structures Firewalls Virtual Private Networks Cryptography-based technologies IPSec Secure Socket Layer
FIREWALLS & CBAC. philip.heimer@hh.se
FIREWALLS & CBAC philip.heimer@hh.se Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
Firewalls. Chien-Chung Shen cshen@cis.udel.edu
Firewalls Chien-Chung Shen cshen@cis.udel.edu The Need for Firewalls Internet connectivity is essential however it creates a threat vs. host-based security services (e.g., intrusion detection), not cost-effective
Protecting and controlling Virtual LANs by Linux router-firewall
Protecting and controlling Virtual LANs by Linux router-firewall Tihomir Katić Mile Šikić Krešimir Šikić Faculty of Electrical Engineering and Computing University of Zagreb Unska 3, HR 10000 Zagreb, Croatia
CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006
CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on
Introduction to Endpoint Security
Chapter Introduction to Endpoint Security 1 This chapter provides an overview of Endpoint Security features and concepts. Planning security policies is covered based on enterprise requirements and user
Network Security. Protective and Dependable. 52 Network Security. UTM Content Security Gateway CS-2000
Network Security Protective and Dependable With the growth of the Internet threats, network security becomes the fundamental concerns of family network and enterprise network. To enhance your business
Proxies. Chapter 4. Network & Security Gildas Avoine
Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open
Maruleng Local Municipality
Maruleng Local Municipality. 22 November 2011 1 Version Control Version Date Author(s) Details 1.1 23/03/2012 Masilo Modiba New Policy 2 Contents ICT Firewall Policy 1 Version Control.2 1. Introduction.....4
Source-Connect Network Configuration Last updated May 2009
Source-Connect Network Configuration Last updated May 2009 For further support: Chicago: +1 312 706 5555 London: +44 20 7193 3700 support@source-elements.com This document is designed to assist IT/Network
How To Protect Your Firewall From Attack From A Malicious Computer Or Network Device
Ch.9 Firewalls and Intrusion Prevention Systems Firewalls: effective means of protecting LANs Internet connectivity is essential for every organization and individuals introduces threats from the Internet
CIT 480: Securing Computer Systems. Firewalls
CIT 480: Securing Computer Systems Firewalls Topics 1. What is a firewall? 2. Types of Firewalls 1. Packet filters (stateless) 2. Stateful firewalls 3. Proxy servers 4. Application layer firewalls 3. Configuring
12. Firewalls Content
Content 1 / 17 12.1 Definition 12.2 Packet Filtering & Proxy Servers 12.3 Architectures - Dual-Homed Host Firewall 12.4 Architectures - Screened Host Firewall 12.5 Architectures - Screened Subnet Firewall
Linux MDS Firewall Supplement
Linux MDS Firewall Supplement Table of Contents Introduction... 1 Two Options for Building a Firewall... 2 Overview of the iptables Command-Line Utility... 2 Overview of the set_fwlevel Command... 2 File
THE ROLE OF IDS & ADS IN NETWORK SECURITY
THE ROLE OF IDS & ADS IN NETWORK SECURITY The Role of IDS & ADS in Network Security When it comes to security, most networks today are like an egg: hard on the outside, gooey in the middle. Once a hacker
The Advantages of a Firewall Over an Interafer
FIREWALLS VIEWPOINT 02/2006 31 MARCH 2006 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to the Centre for the Protection
Architecture Overview
Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and
Did you know your security solution can help with PCI compliance too?
Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment
Top tips for improved network security
Top tips for improved network security Network security is beleaguered by malware, spam and security breaches. Some criminal, some malicious, some just annoying but all impeding the smooth running of a
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
COMPUTER SECURITY. J. Magalhães Cruz Computer Security Protection of Local Systems (short) 1 25
COMPUTER SECURITY 9. Protection of local systems (2) Goal (2) Actions to take (3) Protection by Prevention in Local Networks (LAN Protection) (4) Definitions (5) Firewall devices (corta fogos): traffic
Intrusion Detection Systems
Intrusion Detection Systems Assessment of the operation and usefulness of informatics tools for the detection of on-going computer attacks André Matos Luís Machado Work Topics 1. Definition 2. Characteristics
Linux firewall. Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users
Linux firewall Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users Linux firewall Linux is a open source operating system and any firewall
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 40 Firewalls and Intrusion
Fail-Safe IPS Integration with Bypass Technology
Summary Threats that require the installation, redeployment or upgrade of in-line IPS appliances often affect uptime on business critical links. Organizations are demanding solutions that prevent disruptive
Automating Server Firewalls
Automating Server Firewalls With CloudPassage Halo Contents: About Halo Server Firewalls Implementing Firewall Policies Create and Assign a Firewall Policy Specify Firewall-Related Components Managing