Chapter 6: Network Access Control
|
|
- Alyson Gibbs
- 8 years ago
- Views:
Transcription
1 Managing and Securing Computer Networks Guy Leduc Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March (section 8.9) Chapter 6: Network Access Control Network Security - PRIVATE Communication in a PUBLIC World C. Kaufman, R. Pearlman, M. Speciner Pearson Education, (chapter 23) 6: Network Access Control 6-1 Chapter 6: Network Access Control Chapter goals: security in practice: operational security Firewalls Intrusion Detection Systems (IDS) 6: Network Access Control 6-2 1
2 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control 6-3 Firewalls firewall isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others administered network trusted good guys firewall public Internet untrusted bad guys 6: Network Access Control 6-4 2
3 Firewalls: Why? because the internal network is unlikely to be properly secured weak passwords, patches not installed, etc because the Internet is a scary place spies from unfriendly countries, users from competing companies, criminals, disgruntled ex-employees, vandals compensating their lack of social life by annoying others, to prevent denial of service attacks e.g., SYN flooding: attacker establishes many bogus TCP connections, no resources left for real connections to prevent illegal modification/access of internal data e.g., attacker replaces CIA s homepage with something else to allow only authorized access to inside network set of authenticated users/hosts 6: Network Access Control 6-5 Analogies Security is aggregated at a single point Analogies Apartments are locked at the entrance (not necessarily at each door) Passports are checked at the border of a country Offices don't usually have a door to the outside world Additional security precautions may be required under certain circumstances A bank has a vault to store money and valuable goods 6: Network Access Control 6-6 3
4 Firewall Design goals for a firewall: All traffic from inside to outside, and vice versa, must pass through the firewall Only authorized traffic, as defined by the local security policy, will be allowed to pass The firewall itself is immune to penetration Capabilities that are within the scope of a firewall It provides a location for monitoring security-based events. Audits and alarms can be implemented on it It is a convenient platform for several Internet functions that are not security related (network address translator, network management related to Internet usage, ) It can be used to implement Virtual Private Networks (VPN) by using a tunnel mode capability 6: Network Access Control 6-7 Limitations of firewalls The firewall cannot protect against attacks that bypass the firewall WiFi networks reachable from outside the company Dial-out capability of some systems to connect to an ISP Modem pool on an internal LAN to provide dial-in capability for traveling employees No protection against internal threats No protection against virus-infected programs or files Impractical or impossible to scan all the incoming files 6: Network Access Control 6-8 4
5 Firewall Policy Two levels of policy that directly influence the design, installation, and use of a firewall system: The higher-level policy, the service access policy, defines the TCP/IP protocols and services that should be allowed or denied from the protected network how these services should be used how exceptions to this policy are handled The lower-level policy, the firewall design policy, describes how the firewall actually goes about restricting access and filtering the TCP/IP protocols and services according to the service access policy The policy should be as flexible as possible To address the organization's needs to change as the Internet offers new services, 6: Network Access Control 6-9 Service Access Policy It is part of the Network Security Policy (NSP), which is a document that describes an organization's network security concerns and specifies how network security should be achieved Examples allow no inbound access to an intranet, but allow full outbound access to the Internet some inbound access, but perhaps only to selected systems, such as information servers or gateways allow access to some internal systems but only with strong user authentication Clear trade-off between the accessibility and security of intranet resources 6: Network Access Control
6 Firewall Design Policy It refines the Service Access Policy It defines the rules used by the firewall to implement the Service Access Policy One may implement one of the following two stances: Permit any service unless it is expressly denied Deny any service unless it is expressly permitted Preferable The first stance would allow users to access new services currently not denied run denied services on non standard ports not expressly denied by the policy 6: Network Access Control 6-11 Types of Firewalls 1. Packet filter, or packet-filtering router Stateless or stateful 2. Application, or application-level, gateway 3. Circuit-level gateway Firewall Application TCP IP (2) (3) (1) 6: Network Access Control
7 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control 6-13 Stateless packet filtering Should arriving packet be allowed in? Departing packet let out? internal network connected to Internet via router firewall router filters packet-by-packet, decision to forward/drop packet based on: source IP address, destination IP address other IP protocol fields TCP/UDP source and destination port numbers ICMP message type TCP SYN and ACK bits Not solely based on IP header! 6: Network Access Control
8 Stateless packet filtering: example example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23 result: all incoming, outgoing UDP flows and telnet connections are blocked example 2: block inbound TCP segments with SYN=1, ACK=0 result: prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside 6: Network Access Control 6-15 Stateless packet filtering: more examples Policy No outside Web access No incoming TCP connections, except those for institution s public Web server Prevent Web-radios from eating up the available bandwidth Prevent your network from being used for a smurf DoS attack Prevent your network from being tracerouted Firewall Setting Drop all outgoing packets to any IP address, port 80 Drop all incoming TCP SYN packets to any IP except , port 80 Drop all incoming UDP packets - except DNS and router broadcasts Drop all ICMP packets going to a broadcast address (e.g., ) Drop all outgoing ICMP TTL expired traffic 6: Network Access Control
9 Packet Filter Rules Two parts Selection criteria: sort of pattern matching Action field: action to be taken if an IP packet meets the selection criteria Block (deny) Permit (allow) ACL: Access Control Lists For each incoming IP packet: check the selection criteria in sequence until one matches the packet, the order is thus relevant apply the specified action and stop checking remaining rules if no rule matches the packet, apply the default policy or add the default policy at the end with a wildcard pattern 6: Network Access Control 6-17 Access Control Lists ACL: table of rules, applied top to bottom to incoming packets: (action, condition) pairs action source address allow dest address outside of protocol source port dest port flag bit TCP > any allow outside of TCP 80 > 1023 ACK allow allow outside of outside of UDP > UDP 53 > deny all all all all all all 6: Network Access Control
10 IP spoofing attack IP spoofing: the source IP address has been modified by an intruder e.g.: Trudy replaces her address by the address of a trusted host on the intranet Nothing ensures the authenticity of a source IP address Sequence number prediction attack based on IP spoofing Alice trusts Bob Trudy uses Bob's address to open a connection with Alice Trudy sends a TCP SYN segment to Alice with initial number x Alice replies by a SYN-ACK segment with her initial number y, to Bob! Trudy should intercept this message (otherwise Bob sends back a RST) Typically by using a SYN flooding attack on Bob Trudy should reply to Alice with an ACK (y+1) but does not know y! Should guess it! Not that difficult in practice: y is not random Firewall solution to block IP spoofing: Add a packet filter rule that discards any inbound packet that contains a source IP address of an internal machine 6: Network Access Control 6-19 IP Fragmentation Problem When an IP packet is fragmented, only the first fragment contains the transport (TCP or UDP) header! First possibility: Filtering is applied to first fragment Other fragments pass through Anyway, when reassembled, partial IP packets (without 1st fragment) are discarded by the destination But: may still be dangerous for outbound packets, because big parts of transport segments could escape the intranet (possibly with sensitive data) Other possibility: Maintain a cache of recently seen first fragments, together with the associated action (Permit or Deny) that was applied Apply same decision to non first fragments May not work if first fragment does not arrive first (reordering)! Not stateless any longer! 6: Network Access Control
11 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control 6-21 Stateful packet filtering stateless packet filter: heavy handed tool admits packets that make no sense, e.g., dest port = 80, ACK bit set, even though no TCP connection established: action source address dest address protocol source port dest port flag bit allow outside of TCP 80 > 1023 ACK stateful packet filter: track status of every TCP connection track connection setup (SYN), teardown (FIN): can determine whether incoming, outgoing packets make sense timeout inactive connections at firewall: no longer admit packets 6: Network Access Control
12 Stateful packet filtering ACL augmented to indicate need to check connection state table before admitting packet action source address allow allow outside of allow allow outside of dest address outside of outside of proto source port dest port flag bit TCP > any check connecti on TCP 80 > 1023 ACK x UDP > UDP 53 > x deny all all all all all all 6: Network Access Control 6-23 Discussion on packet filtering Packet filters (screening routers) are used and widely deployed, for several reasons: It is a low-cost technology It is transparent to applications (no changes needed) It is not based on cryptography: good for worldwide distribution Packet filters are not a panacea, because they have weaknesses Configuring packet filter rules correctly is difficult and errorprone Is optimized for the router, not for the administrator Care with the rule ordering is required, when there are exceptions Requires intricate knowledge of TCP/IP Think in terms of bidirectional flows whose characteristics may be different No user authentication Rules are applied to non authenticated packets 6: Network Access Control
13 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control 6-25 Application gateways filters packets on application data as well as on IP/TCP/ UDP fields example: allow select internal users to telnet outside host-to-gateway telnet session application gateway router and filter gateway-to-remote host telnet session 1. Require all telnet users to telnet through gateway 2. For authorized users, gateway sets up telnet connection to dest host. Gateway relays data between the 2 connections 3. Router/filter blocks all telnet connections not originating from gateway 6: Network Access Control
14 Application Gateways An application-level gateway, also called proxy server, acts as a relay of application-level traffic The user (from the intranet or the Internet) contacts the gateway using a TCP/IP application, such as Telnet or FTP, and the gateway asks the user for the name of the remote host to be accessed When the user responds and provides a valid user ID and authentication information, the gateway contacts the application on the remote host and relays the application data between the two endpoints If the gateway does not implement the proxy code for a specific application, the service is not supported and cannot be forwarded across the firewall The gateway can be configured to support only specific features of an application that the network administrator considers acceptable, while denying others 6: Network Access Control 6-27 More on application gateways Such gateway must have as many proxy servers as there are applications to be supported The authentication may be different if the user is from the intranet or from the Internet, e.g., From intranet: simple list of IP addresses allowed to connect to external applications (IP spoofing possible) From Internet: strong authentication An application gateway relays TCP segments between the two TCP connections in the 2 directions (Client < > Proxy < > Server) For outbound packets, the gateway may replace the source IP address by its own IP address (NAT) Internal IP addresses are not exposed to the Internet 6: Network Access Control
15 Impact of proxies on the client The use of proxy servers usually requires some customization and modification of either user procedures or client software The approach just explained has no impact on the client's software, but the user has to be trained for an extra step to logon to the proxy Another approach is to customize and modify the client software Provides transparency to users accessing the Internet Done by additional software at the client that intercepts and directs the application traffic Not always easy and feasible The 2 approaches have their disadvantages 6: Network Access Control 6-29 Filtering application exchanges Another benefit of a proxy server is that application protocols can be filtered Examples Filter out inbound FTP PUT command Filter out Java applets and ActiveX controls from HTTP traffic in order to protect internal hosts from executable content and softwaredriven attacks 6: Network Access Control
16 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control 6-31 Circuit-level gateway The circuit-level gateway is an intermediate solution between the packet filter and the application gateway Runs at the transport layer, and can thus act as proxy for any application Like an application gateway, the circuit-level gateway does not permit an end-to-end TCP connection Rather, it sets up 2 TCP connections too and relays the TCP segments from one to the other But, it does not examine the application data Typical use When the system administrator trusts the internal users, a circuit-level gateway is enough for outbound connections No overhead for outgoing data An application gateway can still be used for inbound connections Requires to modify the client software too For transparency 6: Network Access Control
17 SOCKS SOCKS (RFC 1928) refers to a circuit-level gateway SOCKS is a networking proxy mechanism that enables hosts on one side of a SOCKS server to gain full access to hosts on the other side without requiring direct IP reachability Client software should be socksified Most recent HTTP clients have been socksified The client has to connect to the SOCKS server at the firewall It is attached to a well-known port Then the client enters a negotiation for the authentication method to be used, and authenticates with the chosen method Then the client sends a connection relay request to the SOCKS server, containing the desired destination IP address and transport port The SOCKS server informs the client, and in case of success starts relaying the data between the 2 connections An alternative to socksifying clients would be to socksify the TCP/IP stack 6: Network Access Control 6-33 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control
18 Firewall configurations Packet filters and gateways are usually combined in firewall configurations Three firewall configurations: Dual-homed firewalls Screened host firewalls Screened subnet firewalls 6: Network Access Control 6-35 Dual-Homed Firewalls The term multihomed host is generally used to refer to a host with multiple network interfaces If IP routing and IP forwarding are disabled on the multihomed host, it provides isolation between the network segments and may be used in a firewall configuration accordingly Bastion Host Intranet (Application gateway) Packet filter Internet Intermediate LAN The packet filter ensures that any IP packet arriving from the Internet is correctly addressed to the Bastion Host The intermediate LAN could host other systems (e.g. information or network access servers) 6: Network Access Control
19 Entire architecture of a Dual- Homed Firewall Packet filter Intranet Bastion Host (Application gateway) Packet filter Internet Inner LAN Outer LAN The Bastion host could also be replicated for efficiency reasons Parallel dual-homed firewall Distribute the proxy or SOCKS servers on several bastion hosts 6: Network Access Control 6-37 Screened host firewalls Intranet Bastion Host (Application gateway) Packet filter Internet The Bastion host has a unique network interface One does not need an intermediate LAN Requires fewer IP addresses The packet filter, after filtering, must forward all IP traffic originated from the Internet to the Bastion Host Forwarding tables must be configured correctly and must be protected More flexible Some applications could be accessed directly without passing through the Bastion host If no proxy exists (proprietary app.) or if they are felt harmless (e.g. NTP) Less secure 6: Network Access Control
20 Screened subnet firewalls Intranet Packet filter Bastion Host (Application gateway) Packet filter Internet Inner subnet, also called Sandbox or demilitarized zone (DMZ) Adds an extra security layer with respect to the screened host firewall Both the Internet and the internal network have access to the DMZ, but traffic across the DMZ is blocked Note that the bastion host (and the additional servers on the DMZ) could be set up so that they would be the only systems seen from the Internet No other system name needs to be known or used in a DNS database accessible from the outside world And similarly for the intranet 6: Network Access Control 6-39 Limitations of firewalls and gateways IP spoofing: router can t know if data really comes from claimed source if multiple app s need special treatment, each has own app. gateway. client software must know how to contact gateway. e.g., must set IP address of proxy in Web browser filters often use all or nothing policy for UDP tradeoff: degree of communication with outside world versus level of security many highly protected sites still suffer from attacks 6: Network Access Control
21 Discussion Firewalls are a fact of life Provide effective access control, but this is not a panacea It is not a substitute for careful security management within a corporate intranet Attacker could disguise traffic by carrying it in a firewall-friendly protocol like HTTP No protection against data-driven attacks E.g. Virus-infected softwares If an external intruder has an accomplice in the intranet, they can set up a (authorized) tunnel through the firewall Basically, firewalls are not a solution to network security problems, but a network response to host security problems Historical analogies During Stone Age, everyone knew everyone in the same cave No need for security In the Middle Ages, they lived in castles or villages surrounded by town walls History has shown that this security model does not work either The Internet has entered the Middle Ages 6: Network Access Control 6-41 Chapter Roadmap Firewalls Introduction and types of firewalls Traditional (stateless) packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations IDS: Intrusion Detection Systems 6: Network Access Control
22 Intrusion detection systems packet filtering: operates on TCP/UDP/IP headers only no correlation check among sessions IDS/IPS: Intrusion Detection/Prevention System Deep Packet Inspection (DPI): look at packet contents (e.g., check character strings in packet against database of known virus, attack strings) Application gateways do that too, but only for specific applications examine correlation among multiple packets port scanning network mapping DoS attack IDS: send alert - IPS: drop packets beyond that, similar 6: Network Access Control 6-43 Intrusion detection systems multiple IDSs: different types of checking at different locations firewall internal network Internet IDS sensors Web DNS server FTP server server demilitarized zone 6: Network Access Control
23 Types of IDS Signature-based IDS Needs a database of known attacks with their signatures Signature defines types and order of packets characterizing an attack Limitations: Only known attacks detected False alarm possible: a normal packet stream may match the signature of an attack Well-known public open-source IDS: Snort Anomaly-based IDS Create traffic profile in normal operation Look at traffic profiles that are statistically unusual, e.g. ICMP unusual load, exponential growth in port scans, etc. Challenge: how to distinguish between normal traffic and statistically unusual traffic? 6: Network Access Control 6-45 Summary Firewalls Types of firewalls Stateless packet filters Stateful packet filters Application gateways Circuit-level gateways Firewall configurations Dual-homed Screened host Screened subnet IDS: Intrusion Detection Systems Signature-based versus anomaly-based 6: Network Access Control
Chapter 8 Network Security
[Computer networking, 5 th ed., Kurose] Chapter 8 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 84Securing 8.4 e-mail 8.5 Securing TCP connections: SSL 8.6 Network
More informationChapter 8 Security Pt 2
Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,
More informationFIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
More informationInternet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
More informationCOSC4377. Chapter 8 roadmap
Lecture 28 Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7
More informationWe will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall
Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,
More informationVLAN und MPLS, Firewall und NAT,
Internet-Technologien (CS262) VLAN und MPLS, Firewall und NAT, 15.4.2015 Christian Tschudin Departement Mathematik und Informatik, Universität Basel 6-1 Wiederholung Unterschied CSMA/CD und CSMA/CA? Was
More informationNetwork Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 roadmap 1 What is network security? 2 Principles of cryptography 3 Message integrity, authentication
More informationFirewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls
CEN 448 Security and Internet Protocols Chapter 20 Firewalls Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
More informationProxy Server, Network Address Translator, Firewall. Proxy Server
Proxy Server, Network Address Translator, Firewall 1 Proxy Server 2 1 Introduction What is a proxy server? Acts on behalf of other clients, and presents requests from other clients to a server. Acts as
More informationFirewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
More informationChapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
More informationFirewall Tutorial. KAIST Dept. of EECS NC Lab.
Firewall Tutorial KAIST Dept. of EECS NC Lab. Contents What is Firewalls? Why Firewalls? Types of Firewalls Limitations of firewalls and gateways Firewalls in Linux What is Firewalls? firewall isolates
More informationFirewalls. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49. Firewall Design Principles
Firewalls Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Firewall Design Principles Firewall Characteristics Types of Firewalls Firewall Configurations
More informationSecurity Technology: Firewalls and VPNs
Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up
More informationChapter 20. Firewalls
Chapter 20. Firewalls [Page 621] 20.1 Firewall Design Principles Firewall Characteristics Types of Firewalls Firewall Configurations 20.2 Trusted Systems Data Access Control The Concept of Trusted Systems
More informationCMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
More informationWhat is a Firewall? Computer Security. Firewalls. What is a Firewall? What is a Firewall?
What is a Firewall? Computer Security Firewalls fire wall 1 : a wall constructed to prevent the spread of fire 2 usually firewall : a computer or computer software that prevents unauthorized access to
More informationCS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
More informationFirewalls. Ahmad Almulhem March 10, 2012
Firewalls Ahmad Almulhem March 10, 2012 1 Outline Firewalls The Need for Firewalls Firewall Characteristics Types of Firewalls Firewall Basing Firewall Configurations Firewall Policies and Anomalies 2
More informationFirewall Design Principles Firewall Characteristics Types of Firewalls
Firewall Design Principles Firewall Characteristics Types of Firewalls Special Thanks to our friends at The Blekinge Institute of Technology, Sweden for providing the basis for these slides. Fall 2008
More informationFirewalls (IPTABLES)
Firewalls (IPTABLES) Objectives Understand the technical essentials of firewalls. Realize the limitations and capabilities of firewalls. To be familiar with iptables firewall. Introduction: In the context
More informationFirewalls and VPNs. Principles of Information Security, 5th Edition 1
Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches
More informationFirewall Configuration. Firewall Configuration. Solution 9-314 1. Firewall Principles
Configuration Configuration Principles Characteristics Types of s Deployments Principles connectivity is a common component of today s s networks Benefits: Access to wide variety of resources Exposure
More informationFirewall Introduction Several Types of Firewall. Cisco PIX Firewall
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall What is a Firewall? Non-computer industries: a wall that controls the spreading of a fire. Networks: a designed device that controls
More informationFirewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
More informationWhat is a Firewall? A choke point of control and monitoring Interconnects networks with differing trust Imposes restrictions on network services
Firewalls What is a Firewall? A choke point of control and monitoring Interconnects networks with differing trust Imposes restrictions on network services only authorized traffic is allowed Auditing and
More informationLecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 22 Firewalls.
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 22 Firewalls. 1 Information systems in corporations,government agencies,and other organizations
More informationLehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Chapter 5: Security Concepts for Networks Firewalls Intrusion Detection
More informationCryptography and network security
Cryptography and network security Firewalls slide 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible
More informationFirewalls. Basic Firewall Concept. Why firewalls? Firewall goals. Two Separable Topics. Firewall Design & Architecture Issues
CS 155 May 20, 2004 Firewalls Basic Firewall Concept Separate local area net from internet Firewall John Mitchell Credit: some text, illustrations from Simon Cooper Router All packets between LAN and internet
More informationCSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Firewall 1 Basic firewall concept Roadmap Filtering firewall Proxy firewall Network Address Translation
More informationModule 8. Network Security. Version 2 CSE IIT, Kharagpur
Module 8 Network Security Lesson 3 Firewalls Specific Instructional Objectives On completion of this lesson, the students will be able to answer: What a firewall is? What are the design goals of Firewalls
More informationVirtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
More information12. Firewalls Content
Content 1 / 17 12.1 Definition 12.2 Packet Filtering & Proxy Servers 12.3 Architectures - Dual-Homed Host Firewall 12.4 Architectures - Screened Host Firewall 12.5 Architectures - Screened Subnet Firewall
More informationFIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall
More informationFirewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
More informationWhat would you like to protect?
Network Security What would you like to protect? Your data The information stored in your computer Your resources The computers themselves Your reputation You risk to be blamed for intrusions or cyber
More informationContent Distribution Networks (CDN)
229 Content Distribution Networks (CDNs) A content distribution network can be viewed as a global web replication. main idea: each replica is located in a different geographic area, rather then in the
More informationA host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
More informationFirewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
More informationFirewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
More informationLecture 23: Firewalls
Lecture 23: Firewalls Introduce several types of firewalls Discuss their advantages and disadvantages Compare their performances Demonstrate their applications C. Ding -- COMP581 -- L23 What is a Digital
More informationIntroduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
More informationHow To Protect Your Firewall From Attack From A Malicious Computer Or Network Device
Ch.9 Firewalls and Intrusion Prevention Systems Firewalls: effective means of protecting LANs Internet connectivity is essential for every organization and individuals introduces threats from the Internet
More informationCSE 4482 Computer Security Management: Assessment and Forensics. Protection Mechanisms: Firewalls
CSE 4482 Computer Security Management: Assessment and Forensics Protection Mechanisms: Firewalls Instructor: N. Vlajic, Fall 2013 Required reading: Management of Information Security (MIS), by Whitman
More informationFirewalls CSCI 454/554
Firewalls CSCI 454/554 Why Firewall? 1 Why Firewall (cont d) w now everyone want to be on the Internet w and to interconnect networks w has persistent security concerns n can t easily secure every system
More informationCSCI 7000-001 Firewalls and Packet Filtering
CSCI 7000-001 Firewalls and Packet Filtering November 1, 2001 Firewalls are the wrong approach. They don t solve the general problem, and they make it very difficult or impossible to do many things. On
More informationInternet Ideal: Simple Network Model
Middleboxes Reading: Ch. 8.4 Internet Ideal: Simple Network Model Globally unique identifiers Each node has a unique, fixed IP address reachable from everyone and everywhere Simple packet forwarding Network
More informationComputer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 9 Firewalls and Intrusion Prevention Systems First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Firewalls and Intrusion
More informationSecurity threats and network. Software firewall. Hardware firewall. Firewalls
Security threats and network As we have already discussed, many serious security threats come from the networks; Firewalls The firewalls implement hardware or software solutions based on the control of
More informationChapter 15. Firewalls, IDS and IPS
Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet
More informationComputer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/ Fall 2010 Sonja Buchegger buc@kth.se Lecture 6, Nov. 10, 2010 Firewalls, Intrusion Prevention, Intrusion Detection
More informationFirewalls. ITS335: IT Security. Sirindhorn International Institute of Technology Thammasat University ITS335. Firewalls. Characteristics.
ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October 2013 its335y13s2l08, Steve/Courses/2013/s2/its335/lectures/firewalls.tex,
More informationFirewalls. Contents. ITS335: IT Security. Firewall Characteristics. Types of Firewalls. Firewall Locations. Summary
2 : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October 2013 its335y13s2l08, Steve/Courses/2013/s2/its335/lectures/firewalls.tex, r2958
More informationComputer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
More informationThe International Conference for High Performance Computing, Networking, Storage and Analysis
The International Conference for High Performance Computing, Networking, Storage and Analysis SC12 9500 attendees 350+ corporate exhibitors in 150,000 ft2 of space 7 days of tutorials, workshops, technical
More informationChapter 5. Figure 5-1: Border Firewall. Firewalls. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall
Figure 5-1: Border s Chapter 5 Revised March 2004 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Border 1. (Not Trusted) Attacker 1 1. Corporate Network (Trusted) 2 Figure
More informationChapter 8 Network Security
Chapter 8 Network Security A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you can add, modify, and
More informationCS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
More informationINTRODUCTION TO FIREWALL SECURITY
INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ
More informationIntranet, Extranet, Firewall
Indian Institute of Technology Kharagpur Intranet, Extranet, Firewall Prof. Indranil Sen Gupta Dept. of Computer Science & Engg. I.I.T. Kharagpur, INDIA Lecture 31: Intranet, Extranet, Firewall On completion,
More informationInternet Security Firewalls
Internet Security Firewalls Ozalp Babaoglu ALMA MATER STUDIORUM UNIVERSITA DI BOLOGNA Overview Exo-structures Firewalls Virtual Private Networks Cryptography-based technologies IPSec Secure Socket Layer
More informationFirewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
More informationInternet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
More informationFirewalls, Tunnels, and Network Intrusion Detection. Firewalls
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
More informationTopics NS HS12 2 CINS/F1-01
Firewalls Carlo U. Nicola, SGI FHNW With extracts from slides/publications of : John Mitchell, Stanford U.; Marc Rennhard, ZHAW; E.H. Spafford, Purdue University. CINS/F1-01 Topics 1. Purpose of firewalls
More informationIMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT Roopa K. Panduranga Rao MV Dept of CS and Engg., Dept of IS and Engg., J.N.N College of Engineering, J.N.N College of Engineering,
More informationNetwork Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik
Network Security Chapter 3 Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: October 21, 2015 IN2101, WS 15/16, Network Security 1 Security Policies and
More informationFig. 4.2.1: Packet Filtering
4.2 Types of Firewalls /DKo98/ FIREWALL CHARACTERISTICS 1. All traffic from inside to outside, and vice versa, must pass through the firewall. This is achieved by physically blocking all access to the
More informationChapter 20 Firewalls. Cryptography and Network Security Chapter 22. What is a Firewall? Introduction 4/19/2010
Cryptography and Network Security Chapter 22 Fifth Edition by William Stallings Chapter 20 Firewalls The function of a strong position is to make the forces holding it practically unassailable On O War,
More informationFirewalls. Mahalingam Ramkumar
Firewalls Mahalingam Ramkumar Evolution of Networks Centralized data processing LANs Premises network interconnection of LANs and mainframes Enterprise-wide network interconnection of LANs in a private
More informationΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
More informationCSE331: Introduction to Networks and Security. Lecture 12 Fall 2006
CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on
More informationNetwork Security. Internet Firewalls. Chapter 13. Network Security (WS 2002): 13 Internet Firewalls 1 Dr.-Ing G. Schäfer
Network Security Chapter 13 Internet Firewalls Network Security (WS 2002): 13 Internet Firewalls 1 Introduction to Network Firewalls (1)! In building construction, a firewall is designed to keep a fire
More informationSFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004
SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004 Introduction: A computer firewall protects computer networks from unwanted intrusions which could compromise confidentiality
More informationNetwork Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
More informationInternet Security Firewalls
Overview Internet Security Firewalls Ozalp Babaoglu! Exo-structures " Firewalls " Virtual Private Networks! Cryptography-based technologies " IPSec " Secure Socket Layer ALMA MATER STUDIORUM UNIVERSITA
More information20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
More informationSecurity Technology White Paper
Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without
More informationProxy firewalls. thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/
Proxy firewalls thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Content Proxy Firewalls How Proxy Firewalls Work Forward / Reverse Proxies Application-Level Proxies Gateways (Circuit-Level
More informationIPv6 Firewalls. ITU/APNIC/MICT IPv6 Security Workshop 23 rd 27 th May 2016 Bangkok. Last updated 17 th May 2016
IPv6 Firewalls ITU/APNIC/MICT IPv6 Security Workshop 23 rd 27 th May 2016 Bangkok Last updated 17 th May 2016 1 Acknowledgements p Contains material from n Stallings and Brown (2015) n Ian Welch (Victoria
More informationSecurity+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network
More informationNetwork Security in Practice
Network Security in Practice Practices of Network Security ccess control: firewalls ttacks and counter measures Security protocol case studies Kai Shen 12/8/2014 CSC 257/457 - Fall 2014 1 12/8/2014 CSC
More informationFIREWALLS & CBAC. philip.heimer@hh.se
FIREWALLS & CBAC philip.heimer@hh.se Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
More informationFirewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 5 / 2 01 6 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 5 / 2 01 6 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A Slides are based on slides by Dr Lawrie Brown (UNSW@ADFA) for Computer
More informationChapter 12 Supporting Network Address Translation (NAT)
[Previous] [Next] Chapter 12 Supporting Network Address Translation (NAT) About This Chapter Network address translation (NAT) is a protocol that allows a network with private addresses to access information
More informationFirewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
More informationCornerstones of Security
Internet Security Cornerstones of Security Authenticity the sender (either client or server) of a message is who he, she or it claims to be Privacy the contents of a message are secret and only known to
More information1. Firewall Configuration
1. Firewall Configuration A firewall is a method of implementing common as well as user defined security policies in an effort to keep intruders out. Firewalls work by analyzing and filtering out IP packets
More informationOutline (Network Security Challenge)
Outline (Network Security Challenge) Security Device Selection Internet Sharing Solution Service Publishing 2 Security Device Selection Firewall Firewall firewall: An introduction to firewalls A firewall
More informationΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science
ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users
More informationCIT 480: Securing Computer Systems. Firewalls
CIT 480: Securing Computer Systems Firewalls Topics 1. What is a firewall? 2. Types of Firewalls 1. Packet filters (stateless) 2. Stateful firewalls 3. Proxy servers 4. Application layer firewalls 3. Configuring
More informationFirewall. User Manual
Firewall User Manual 1 IX. Firewall This chapter introduces firewall general policy, access rule, and content filter settings to ensure network security. 9.1 General Policy The firewall is enabled by default.
More informationChapter 4 Firewall Protection and Content Filtering
Chapter 4 Firewall Protection and Content Filtering This chapter describes how to use the content filtering features of the ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN to protect your network.
More informationHow To Understand A Firewall
Module II. Internet Security Chapter 6 Firewall Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 6.1 Introduction to Firewall What Is a Firewall Types of Firewall
More informationSOFTWARE ENGINEERING 4C03. Computer Networks & Computer Security. Network Firewall
SOFTWARE ENGINEERING 4C03 Computer Networks & Computer Security Network Firewall HAO WANG #0159386 Instructor: Dr. Kartik Krishnan Mar.29, 2004 Software Engineering Department of Computing and Software
More informationCS155 - Firewalls. Simon Cooper <sc@sgi.com> CS155 Firewalls 22 May 2003
CS155 - Firewalls Simon Cooper CS155 Firewalls 22 May 2003 1 Why Firewalls? Need for the exchange of information; education, business, recreation, social and political Need to do something
More informationFIREWALL AND NAT Lecture 7a
FIREWALL AND NAT Lecture 7a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 3, 2015 Source of most of slides: University of Twente FIREWALL An integrated collection of security
More information