Security Functions and Purposes of Network Devices and Technologies (SY0-301) Firewalls. Audiobooks

Transcription

1

2 Maual Security+ Domai 1 Network Security Every etwork is uique, ad architecturally defied physically by its equipmet ad coectios, ad logically through the applicatios, services, ad idustries it serves. Network ifrastructures ca be complex, ad esurig that the appropriate security cotrols are i place ca be a ivolved process. While orgaizatios must be able to coduct busiess efficietly ad effectively, they must also be able to do so i a secure maer. Remember, leavig a etwork carelessly usecured is like leavig the frot door ulocked at ight. That beig said, it ca be challegig for both busiesses ad security professioals to balace the eeds of the busiess with that of security. Security professioals eed to recogize that the impact to busiess processes must be miimal which is to say, itegratio of security cotrols should be as seamless as possible. Naturally, achievig seamless itegratio ca be challegig: each device, coectio, protocol, ad iterface comprisig a etwork carries its ow set of cocers ad cosideratios that security professioals must be able to recogize, commuicate, ad address whe implemetig the security solutios that will protect the etwork from itrusios, data loss, ad outages. Security Fuctios ad Purposes of Network Devices ad Techologies Firewalls Firewalls are a itegral part of a orgaizatio s overall etwork security strategy ad are ofte the first lie of defese whe protectig agaist threats that origiate from the Iteret. Right ow, you may be picturig a tall brick structure i flames, but i this cotext, a firewall is a appliace or software package that logically segregates public ad private etworks, ad moitors the traffic that is trasmitted betwee them. Remember that firewalls moitor traffic travellig i both directios ito a etwork (igress) ad out of a etwork (egress). Also, firewalls may be deployed to protect iteral sub-etworks withi a larger etwork scope. To idetify which traffic should be allowed or deied, firewalls utilize rule sets ad other traffic filterig mechaisms. Figures 1 ad 2 show how firewalls operate withi a iteral etwork ad throughout a larger etwork, respectively. Figure 1: Iteret facig firewall deployed at the etwork perimeter LearSmart Cloud Classroom: Video Traiig Mauals

3 Maual Security+ Figure 2: Firewall deploymet throughout a etwork Sice their iceptio, firewalls have evolved sigificatly with respect to how they fuctio, what platforms are support, ad their placemet o a etwork. Moder firewalls perform a deep packet aalysis of etwork traffic by combiig applicatio filterig ad itrusio prevetio techology ito a sigle uit. Due to the advacemets see i the latest threats, firewalls are frequetly deployed o iteral etworks ad to workstatios ad servers ot just to the etwork perimeter. Packet Filterig Firewall The first geeratio of firewalls employed packet filterig as a security cotrol to moitor etwork traffic. Packet filterig firewalls operate at the first three layers of the OSI model (Physical, Data-Lik, ad Network layers) ad determie whether the packets should be allowed or dropped by comparig the iformatio cotaied i pre-defied rule sets to the iformatio cotaied i the packet. Bear i mid that most routers are also capable of packet filterig. Figure 3: The OSI Model LearSmart Cloud Classroom: Video Traiig Mauals

4 Maual Security+ The rule sets, or access cotrol lists (ACLs), are typically cofigured to make a decisio about the packet by aalyzig packet headers for source ad destiatio addresses, protocols, ports (TCP/UDP), or a combiatio thereof. I other words, like a perso waitig i lie to eter a exclusive club, the packet is examied from top to bottom, ad the accepted or deied. While packet filterig firewalls perform well, are scalable, ad ca restrict the flow of traffic, they are susceptible to attacks that exploit vulerabilities i applicatios, ad are uable to detect etwork packets that cotai forged (spoofed) etwork addresses. Applicatio Filterig Firewall The secod geeratio of firewalls provided a meas of filterig cotet i etwork traffic by operatig at layers oe through seve of the OSI model. Applicatio filterig firewalls examie the service beig requested (web, DNS, FTP, etc.), port usage, ad the iput ad output commads beig called. Applicatio firewalls are ofte implemeted i a proxy or reverse proxy cofiguratio ad require pre-defied rule sets or a ability to lear what is cosidered ormal behavior for a applicatio. This process is ofte referred to as baseliig. Applicatio filterig firewalls are effective at stoppig peer-to-peer etwork traffic ad are a key compoet used i Next Geeratio firewalls. Stateful Firewall Stateful firewalls are cosidered the third geeratio of firewall, ad use stateful packet ispectio to restrict the flow of traffic betwee hosts. Stateful firewalls maitai a state table to record commuicatio sessios. The state table is checked for a existig coectio whe a packet is received. If the state table does t cotai ay coectios relative to the iformatio i the packet, the the packet will be compared agaist the firewall s ACL to determie if a ew coectio should be allowed. Stateful firewalls operate at layers oe through four of the OSI model. Next Geeratio Firewall (NGF) Next geeratio firewalls are the ewest type of firewall. Vedors ad security aalysts have rapidly adopted this term. Next Geeratio firewalls attempt to combie some of the most popular etwork perimeter security cotrols ito a sigle system. Ofte, this combiatio results i the pairig of a applicatio filter ad a itrusio prevetio system (IPS). Each vedor s offerig i this space differs, ad some solutios also iclude ispectio of URL cotet ad malware idetificatio. Dual-Homed ad Multi-Homed Firewalls A dual-homed firewall has two etwork iterfaces: oe for the exteral etwork, ad the other for the iteral etwork. O the other had, a multi-homed firewall ca cotai multiple iterfaces for both iteral ad exteral coectios which are ofte used to defie a orgaizatio s demilitarized zoe (DMZ). DMZ segmets are used to allow Iteret facig services such as , DNS, servers, ad more to exist without exposig the iteral etwork. Figure 4 illustrates this particular cofiguratio. LearSmart Cloud Classroom: Video Traiig Mauals

5 Maual Security+ Figure 4: Stadard Demilitarized Zoe (DMZ) cofiguratio Screeed Subet A screeed subet is defied by a cofiguratio where all exteral traffic is first passed through a router ad the to a firewall. If the traffic is destied for hosts o the iteral etwork, it must first pass through aother firewall. Figure 5 shows how a DMZ is typically cofigured as a screeed subet. Figure 5: Stadard Screeed Subet cofiguratio Routers Network routers are packet-switchig devices with ehaced traffic-hadlig capabilities. While switches are used primarily to joi local etwork segmets, routers establish coectivity betwee public ad private etworks (or amog separate private etworks). A router commuicates i etwork-layer (OSI layer 3) protocol packets ad multi-protocol routers traslate betwee several differet etwork protocols. Also, routers forward packets based o source ad destiatio IP addresses ad may provide basic security through ACLs. LearSmart Cloud Classroom: Video Traiig Mauals

6 Maual Security+ Routers are ofte used i combiatio with a firewall (especially o a Iteret-facig coectio). Some routers iclude a firewall or firewall capabilities. Routers ca also perform etwork address traslatio (NAT), which hides the addresses of systems behid the router from the systems that establish coectios through the exteral iterface of the router. The router replies to those coectios with a address that is uique to the router. Usig routig tables, the router is able to forward traffic to the proper destiatio. Ulike firewalls, routers are ot devices that are dedicated to security, ad several hardeig guidelies should be followed whe addig a router to a etwork. Special attetio should be give to Iteretfacig routers, wireless routers, ad wireless access poits as they are more exposed tha routers o a iteral etwork or those that are coected oly by physical cables. Both NAT ad securig routers are discussed later i this maual. Switches Network switches operate at OSI protocol layers oe ad two (ad sometimes layer three) devices that coect separate computers ad etwork segmets. Switches come i differet shapes ad sizes, ragig from compact four-port Etheret uits to eterprise-class 48-port Gigabit Etheret desigs. Network traffic is delivered directly betwee seder ad recipiet sice switches forward frames based o MAC address. Ulike hubs, which broadcast all traffic o all ports, switches reduce etwork traffic by oly deliverig traffic to the port o the switch that the host is coected to. Switches are able to deliver i this way because they maitai a table that maps device MAC addresses to switchport umbers. More moder switches, also kow as multilayer switches, ca ispect packets, prioritize traffic, perform routig, serve as load balacers, ad add Quality of Service (QoS) fuctioality to etwork traffic. Also, etwork switches are capable of creatig virtual LANs (VLANs) to ehace corporate etwork admiistratio ad security. A VLAN is a logical groupig of systems whose deploymet ca be drive by security, busiess, or resource requiremets istead of physical locatio. Ufortuately, switches ca be vulerable to umerous types of attacks like MAC spoofig, MAC floodig, ARP spoofig, ad Deial-of-Service (DoS). Switches ad VLANs eed to be properly cofigured to defed agaist these attacks. Load Balacers Load balacers are primarily available i two differet forms, hardware ad software, ad ca vary greatly i terms of the services they provide. Aother type of load balacig is roud robi DNS. Roud robi DNS does ot require dedicated hardware or software ad works by assigig multiple IP addresses to a sigle fully qualified domai ame (FQDN). The primary beefit of a load balacer, as the ame would suggest, is to distribute the load betwee multiple systems, etworks, or devices so that a sigle etity that is providig a resource is ot overwhelmed. Load balacig also adds redudacy i the evet a system fails. There are other beefits as well. Load balacers are a frequet requiremet i a busiess cotiuity pla, ad serve as a compesatig cotrol that allows services to cotiue to be available should oe of the resources behid the load balacer fail due to attack or a outage. Load balacers ca serve as a effective cotrol agaist Deial of Service (DoS) attacks targeted at resources coected to the load balacer. Implemetig redudacy behid load balacers (e.g., clusterig) further expads o the beefits gaied by deployig a load balacig solutio. LearSmart Cloud Classroom: Video Traiig Mauals