Firewalls CSCI 454/554

Transcription

1 Firewalls CSCI 454/554 Why Firewall? 1

2 Why Firewall (cont d) w now everyone want to be on the Internet w and to interconnect networks w has persistent security concerns n can t easily secure every system in org w need "harm minimisation" w a Firewall usually part of this What is a Firewall? w firewall is any mechanism that acts to restrict access to a network according to a set of defined rules. n Function as front doors to a network n a choke point of control and monitoring w imposes restrictions on incoming and outgoing traffic n only authorized traffic is allowed w provides perimeter defence 2

3 Rules Determine WHO? WHEN? WHAT? HOW? My PC INTERNE T Firewall Firewall Limitations w cannot protect from attacks bypassing it n dial-in/out connection, trusted organisations, trusted services (eg SSL/SSH) w cannot protect against internal threats n eg disgruntled employee w cannot protect against transfer of all virus infected programs or files n because of huge range of O/S & file types 3

4 Firewall Classification w Two (three) types of firewall n Packet-filtering firewall l Address filtering (stateless) l Stateful packet filtering n Application-level gateway n Circuit-level gateway Firewalls Packet Filters 4

5 Packet Filters w foundation of any firewall system w examine each IP packet and permit or deny according to rules w hence restrict access to services (ports) w possible default policies n allow all except what is defined as unwanted n deny all except what is defined as wanted Address Filtering (stateless) 5

6 Stateful Packet Filters w examine each IP packet in context n keeps tracks of client-server sessions n checks each packet based on other packets and connections as well w better able to detect bogus packets out of context Example Stateful Firewall Connection State Table 6

7 Attacks on Packet Filters w IP address spoofing n fake source address to be trusted n countermeasure: add filters on router s interfaces to block w source routing attacks n attacker sets a route other than default n countermeasure: block source routed packets w tiny fragment attacks n split header info over several tiny packets n countermeasure: either discard or reassemble before check Application Level Gateway (or Proxy) 7

8 Application Level Gateway (or Proxy) w Look beyond IP/TCP/UDP headers n decision based on application data w Proxy relay information between two ends n more secure than packet filters n only scrutinize the specific application n easy to log and audit w need separate proxies for each service n clients need to be modified n relay incurs additional processing overhead Circuit Level Gateway 8

9 Circuit Level Gateway w relays between two TCP connections w imposes security by limiting which such connections are allowed w once created usually relays traffic without examining contents w typically used when trust internal users by allowing general outbound connections w SOCKS (Socket Secure) commonly used for this SOCKS Circuit-Level Gateway l l l SOCKS v5 defined in RFC1928 provide a framework for clientserver applications in TCP/UDP domains to conveniently and securely use the services of a network firewall client application contacts SOCKS server, authenticates, sends relay request l server evaluates and either establishes or denies the connection components SOCKSified client applications SOCKS server SOCKS client library 9

10 Bastion Host w highly secure host system w potentially exposed to "hostile" elements w hence is secured to withstand this w may support 2 or more network connections w may be trusted to enforce trusted separation between network connections w runs application level gateways w or provides externally accessible services Firewall Configurations 10

11 Firewall Configurations ㅇ Firewall Configurations DMZ 11

12 Internet Boundary router Example Firewall Configuration Web server(s) Internal DMZ network server DNS server Internal protected network External firewall LAN switch Internal firewall Application and database servers LAN switch Workstations Figure 9.3 Example Firewall Configuration Host-Based Firewalls w used to secure an individual host w available in operating systems or can be provided as an add-on package w filter and restrict packet flows w common location is a server advantages: filtering rules can be tailored to the host environment protection is provided independent of topology provides an additional layer of protection 12

13 Personal Firewall l controls traffic between a personal computer and the Internet or enterprise network l for both home or corporate use l typically is a software module on a personal computer l can be housed in a router that connects all of the home computers to a DSL, cable modem, or other Internet interface l typically much less complex than server-based or standalone firewalls l primary role is to deny unauthorized remote access l may also monitor outgoing traffic to detect and block worms and malware activity Data Access Control w given system has identified a user w determine what resources they can access w general model is that of access matrix with n subject - active entity (user, process) n object - passive entity (file or resource) n access right way object can be accessed w can decompose by n columns as access control lists (for each object) n rows as capability tickets (for each user) 13

14 Access Control Matrix Concept of Trusted Systems w information security is increasingly important w have varying degrees of sensitivity of information n cf military info classifications: confidential, secret etc w subjects (people or programs) have varying rights of access to objects (information) w want to consider ways of increasing confidence in systems to enforce these rights w known as multilevel security n subjects have maximum & current security level n objects have a fixed security level classification 14

15 Bell LaPadula (BLP) Model w one of the most famous security models w implemented as mandatory policies on system w has two key policies: w no read up (simple security property) n no subject may read objects at higher level w no write down (*-property) n no subject may write objects to a lower level Reference Monitor 15

16 Summary w have considered: n firewalls n types of firewalls n configurations n data access control n trusted systems 16