PROFESSIONAL SECURITY SYSTEMS

PROFESSIONAL SECURITY SYSTEMS Check Point SecurePlatform Firewall security platform for use in the systems with increased security requirements IT technologies are essential for proper operation of majority of companies and organizations. Business tasks execution often depends on these technologies. For banks and online stores as well as many other companies, interference in IT system operation directly mean loss in profit. Maintaining system security and availability of its resources have become a must. As IT systems develop, their protection has been becoming more and more difficult. This is so, because systems operate in environments which are complex and difficult to control such as Internet, intranet and extranet. Security means included within operating systems, databases and applications are not sufficient anymore. Key security tasks are performed by dedicated network security means. Network protections most often used in the corporations nowadays are based on products of Israeli company Check Point Software Technologies (according to market analysis performed by Gartner Inc.). The Check Point's showcase product is a VPN-1 / FireWall-1 firewall system. VPN-1/FireWall-1 protections are delivered together with specialized devices such as Crossbeam X40S and Nortel ASF, or installed within general-purpose hardware and operating systems (e.g. Linux, SUN Solaris or Windows NT/2000). There are also numerous solution available described as Firewall Appliances or Security Appliances, where Check Point software is installed by device manufacturer also on ordinary PC equipment and operating systems of general use (most often Linux and FreeBSD). The firewall platform and VPN-1/FireWall-1 software make up one object from the security perspective of enterprise's IT resources being protected as well as security system itself. The advanced network traffic technology will serve no purpose if intruder gets access to firewall platform, for instance through Telnet or HTTP, and turns the security modules off. The most serious threat with this respect is Firewall Appliances, which had not been prepared properly. While installing Check Point software on Windows NT/2000, SUN Solaris, or Linux operating systems, the majority of people realize that it is necessary to prepare the operating system before the firewall software installation (e.g. not necessary protocols and services should be removed). Detailed instructions on how to do this are delivered by Check Point and it's partners. While deploying Check Point security means on Firewall Appliance hardware, it is often rashly assumed that Firewall platform had been properly prepared (hardened) by its vendor. In practice however, often Firewall Appliance manufacturers focus on creating relevant cover of its devices and on hiding the real name of operating system and type of the processor used, in order to make an impression that they provide dedicated firewall solution and its huge price is justified. In many Firewall Appliance solutions, it is also observed, that administrative tools (e.g. Web-based management tools) are deliberately made complex and complicated. This creates a threat of making mistakes by administrators, especially when they had not been trained on the subject, and company had not purchased technical support services from the appliance vendor. CLICO Ltd., Al. 3-go Maja 7, 30-063 Kraków, Poland; Tel: +48 12 6325166; +48 12 2927522... 24 ; Fax: +48 12 6323698; E-mail: support@clico.pl, orders@clico.pl.; http://www.clico.pl

Each deployment of Check Point VPN-1/FireWall-1 security system, no matter if it is being done on general purpose operating system platform or device called Firewall Appliance, should include a comprehensive security analysis. The analysis covers both protection of IT systems' resources and the security system itself, which can also become a target of an attack. Basic requirements for firewall platform in this respect include: Safety resistance to penetration and unauthorized access attempts as well as destructive and destabilizing DoS attacks (e.g. operating system hardening, removing of remote access tools, which create threat to the system such as Telnet, FTP, HTTP), Performance security means do not lower accessibility and quality of IT system services for authorized users, Reliability resistance to hardware failures and interference in firewall security means operation, Scalability possibility for efficient enhancement and upgrade of hardware (e.g. replacement of CPU for a faster one, RAM memory increase, adding network adapters), Flexibility possibility to create network security architecture in accordance with specific needs (i.e. creating relevant security zones, expanding security means functionality), Management and monitoring easy-to-use and complete tools for configuration and operating system status monitoring (e.g. CPU and memory workload, file system usage, security modules status), Reasonable price the cost of Firewall hardware should not absorb funds, which could be spent on security means functionality enhancement (i.e. purchase of dedicated tools for analysis and events reporting) and for administrators' qualifications improvement (e.g. training for Check Point specialization grades Check Point Certified Security Administrator and Check Point Certified Security Expert). Having in mind VPN-1/FireWall-1 technology deployment in systems with increased security requirements (e.g. banking, financial, military, governmental) Check Point has worked out, and distributes free of charge its own operating system distribution. The name of this system is SecurePlatform. The system makes possible to fulfil requirements listed above - and what is important - without bearing work and financial expenditures for hardware purchase. SecurePlatform is the operating system worked out and delivered by Check Point within distribution of its security products. In reality SecurePlatform is not a new unchecked technology. It has been worked out based on the Linux kernel (Red Hat distribution) - the most efficient with respect to network operations operating system, which has been existing for many years now. In terms of security and efficiency of firewall platform it has been tuned in every detail. SecurePlatform installation is carried out from specially prepared CD-ROM. The setup program always starts from disk formatting. Next, the tuned operating system is being installed together with chosen Check Point security modules. SecurePlatform installation can also be carried out through a serial port without necessity to connect a console to a firewall machine. 2002 CLICO LTD. ALL RIGHTS RESERVED 2

When designing SecurePlatform it has been assumed that the firewall machine operating system is needed for supporting hardware operation only. All the functionality is included in the Check Point software. Together with Check Point software, the set of dedicated tools for security means monitoring and management, operating system monitoring, and centralized installation of new Check Point software versions and license management are delivered. In IT systems, there are two basic security models in force: allow all and deny all (RFC 2196, Site Security Handbook). The allow all model assumes that all the services are available by default, and only those which create threat are blocked. The deny all model assumes that by default all the services are disabled, and only those which are needed are enabled. During SecurePlatform design, the deny all model was accepted, as creating less risk to firewall security. The default SecurePlatform installation contains packages limited to the essential minimum. While creating SecurePlatform the most significant firewall platform threats were taken into account: Human mistakes: SecurePlatform system does not include the root account, which is the account used by default by majority of administrators to login, and which guarantees them unlimited rights in the system. In SecurePlatform, the administrator logs in using admin account. The admin account is not only an apparent name change of the root account, as it is in one of the common Firewall Appliance. The admin rights allow only for using diagnostic tools, creating backups and restoring system and security means configuration using specially prepared tools, and configuring basic device parameters (e.g. IP addresses, routing) as well as Check Point modules (e.g. adding a license) using specially prepared application sysconfig. Access to operating system commands is possible only after additional administrator authentication and entering into an expert mode. Unauthorized access: In default SecurePlatform installation there is no any remote access services such as Telnet, FTP or HTTP which potentially create a threat. Access to the device from the network is possible only using encrypted SSH connection. It results from the fact, that after Firewall has been installed and configured, the changes in operating system are made very rarely, and sometimes no changes at all are needed. Only Check Point security means are managed through the network using SmartCenter console. This communication however, is cryptographically protected (session encryption, authentication using X.509 certificates). The SmartCenter console provided by Check Point besides security means management, has also possibilities of detailed Firewall machine operating system monitoring (e.g. CPU workload, RAM memory usage, free space on HDD, status of processes). Removing remote access services from the SecurePlatform results in complete elimination of the threat that an intruder will eavesdrop the access password to the device sent using Telnet or HTTP. Service vulnerability: Firewall platform with HTTP servers, Telnet, FTP or dynamic routing protocols installed is vulnerable to security errors and has vulnerabilities typical for these services. Because such services are installed on the firewall machine, a serious threat exists that an intruder will use them in order to take control over the Firewall (i.e. administrator has not blocked access to them in Check Point FireWall-1 configuration or FireWall-1 module or policy has been temporarily turned off). SecurePlatform is not equipped with services, which create possibility to attack the firewall machine, even when Check Point FireWall- 1 is turned off. In many Firewall Appliance solutions, the whole range of dangerous services are available. For instance, on firewall machine a Web server is installed in order to allow for IP addresses and routing configuration using Web browser. On SecurePlatform additional services may be deliberately installed when needed by the administrator with expert rights in the system. 2002 CLICO LTD. ALL RIGHTS RESERVED 3

SecurePlatform is based on the Linux operating system kernel, which is the most efficient in terms of network operations speed. The system has been additionally tuned by the security means manufacturer with respect to Firewall and VPN performance. Thanks to this, it achieves performance over 3.0 Gb/s on standard equipment with Intel architecture. From among all the hardware solutions available for Check Point, the performance at this level can be achieved only by specialized devices of two companies: Crossbeam and Nortel. A detailed information on this subject can be found on the vendor's web page: http://www.checkpoint.com/products/choice/platforms/platforms_matrix.html The performance of VPN-1/FireWall-1 security system with SecurePlatform can be additionally increased by Check Point Performance Pack module and hardware encryption cards (DES, 3DES). With Check Point ClusterXL module it is also possible to build Firewall clusters where network traffic is evenly distributed through many machines working within the cluster. A high performance of Check Point VPN-1/FireWall-1 NG security means working with SecurePlatform has been confirmed by an independent organization Tolly Group (August, 2002). The tests results are available on the Web on the following address: http://www.checkpoint.com/products/connect/tollyreport.html This is also important, that the cost of the equipment used for SecurePlatform installation be less than 5.000 USD. The previous performance tests of Check Point security means conducted by the Tolly Group (March, 2002) using Firewall Appliance-type hardware, which costed almost 50.000 USD was just discrediting. Despite official information from Firewall Appliance manufacturer about performance over 2.0 Gb/s, in real tests conducted by the Tolly Group, this factor was less than 180 Mb/s (tests for 64-bytes packets), and with greater session number, the performance dropped below 120 Mb/s. It should be mentioned, that the manufacturer of this Firewall Appliance has implemented its own version of the Check Point Performance Pack, in which increase in performance has been achieved by limiting of FireWall-1 security (e.g. TCP Sequence Validator feature has been turned off). Ensuring permanent availability of IT system services is a security factor of great importance in many organizations. Often this is more important than the other factors: confidentiality, authenticity, integrity, accountability or service's non-repudiation. In such systems, this is necessary that network protections be equipped with means protecting them against hardware and software failures. Network security system configurations equipped with facilities for protection against failures are described as High Availability (HA) systems. Taking a specificity of its operation into account, a typical problem of network protection against failures is applicable to Firewall systems (Firewall failure results in blocking access to all elements of the protected network). In HA configuration, the Firewall system consists of two or more inspection machines which control one another and in case of failure take over tasks of the damaged one without loss in most open network connections. Firewall machines included in HA are properly synchronized one with another and in majority of them contain failure detection features as well as facilities allowing for automatic take over tasks from the damaged machine. The synchronization is based on sharing connection state tables by firewall machines, so that each firewall machine knows, what network connections are going through remaining machines and what is the status of these connections. 2002 CLICO LTD. ALL RIGHTS RESERVED 4

The Firewall and VPN security means protection system's quality against hardware and application failures can be measured using the following factors: Failure detection and cluster switching: an effective protection of the firewall system against failures conducts hardware tests and monitors operating system status and, what in reality turns out to be most important, performs a comprehensive security means monitoring (e.g. controls if VPN-1/FireWall-1 module operates properly, if for some reason security means have not been turned off, if Security Servers processes have not been blocked, if the firewall security policy has been installed, etc.). Fulfilling of these requirements is possible after using a dedicated HA module provided by Check Point (ClusterXL) or its OPSEC partners. Keeping session alive during failure: VPN-1/FireWall-1 module is equipped with built-in synchronization facilities for internal state tables without necessity to install additional software. Thanks to this, each Firewall machine in the cluster is provided with an up-to-date information regarding ongoing sessions on the remaining machines in the cluster and in case of failure, network connections can be maintained on the machine which is in working order. For majority of protocols and services, the firewall failure will not be noticed at all by the users. SecurePlatform with Check Point ClusterXL module allows for creating firewall clusters which fulfil requirements of an effective protection against hardware and application failures listed above. Firewall clusters build on SecurePlatform can operate in Hot Stand-by configuration (active reserve) and Load Sharing (workload distribution between firewall machines). As opposed to SecurePlatform, Firewall Appliances, on which running ClusterXL module or other dedicated HA module operating on the security means level is impossible (e.g. StoneBeat FullCluster, Rainfinity RainWall ), in reality do not at all allow to deploy a reliable protection of firewall security system against failures. External devices of the Load Balancer type, routing protocols (e.g. VRRP) or clustering techniques available in the operating system are unable to detect security system failures but only serious hardware failures. Professional design of network security system is carried out according to beforehand planned specification of requirements and the risk analysis. It is required that the security technology be scalable and flexible. The security system should support both existing and planned communication protocols as well as network services. A quick development of an IT environment requires that the security system being designed be scalable and flexible and allow for future efficient changes in the network, application and service environments. SecurePlatform is installed on the standard equipment of Intel architecture. It is recommended that the brand-name server equipment be chosen, and not so called noname. Thus, there are no problems with enhancement and modernization of the SecurePlatform hardware. The fact out of question is also that firewall security system are performing more and more detailed network application control, and to make it efficiently, the firewall hardware must be equipped with faster and faster processors and more RAM memory (e.g. Check Point recently has introduced an intrusion detection system SmartDefence built-in in the FireWall-1 module). If we purchase as a hardware platform for VPN-1/FireWall-1 a Firewall Appliance type, which is not based on generally available, brand-name computer hardware (e.g. HP/Compaq, IBM or Siemens ) we will be doomed to using it for many years without possibility to modernize it (e.g. mainboard replacement, replacement of the CPU for the faster one, mounting a bigger HDD), and afterwards the only option will be to throw away such an equipment and to purchase a new model of the Firewall Appliance. 2002 CLICO LTD. ALL RIGHTS RESERVED 5

In the systems with increased security requirements (e.g. banking, financial, governmental and military) network security means should ensure precise firewall system, DMZ zones as well as other separated zones, routers and communication links to external networks operation monitoring in order to generate relevant alerts. It is not advisable that in such systems the security be based on the one multifunctional firewall machine (e.g. firewall on the WAN router). This is so, because in such a configuration, there is no possibility to monitor links to external network through dedicated IDS device (usually it is not technically possible to connect an IDS device directly to a WAN link). It is recommended that the IT system protection tasks be separated from network data transfer and link accessibility protection tasks (e.g. dynamic routing). These tasks should be performed by dedicated for that purpose systems and devices (e.g. access control and communication monitoring is the task of Check Point FireWall-1, and network traffic control is the task of the routers). Such a division is recommended because of easier management, problems diagnosis and maintaining system completeness. When looking for a suitable platform for security system VPN-1/FireWall-1 deployment, it is reasonable to choose the platform for which a new Check Point software versions are created without delays. This can be easily verified by analysis, when the newest product version - Next Generation (NG) appeared for the specific platforms. Linux and SecurePlatform are operating systems for which the new Check Point software versions as well as new types of security modules are introduced in the first place. In particular SecurePlatform as an operating system, delivered directly by Check Point supports wide range of security modules e.g.: VPN-1/FireWall-1 SmallOffice, VPN-1 Net, VPN-1 Pro, VPN-1 XL (Performance Pack), FireWall-1, FireWall-1 XL (Performance Pack), FloodGate-1, ClusterXL, SmartView Monitor, VPN-1/FireWall-1 VSX, User Authority Server and VPN-1 SecureClient Policy Server. Safety cannot be purchased as a product. Safety is a state, which can be achieved using technical (e.g. Firewall, VPN, IDS), organizational (e.g. procedures and inspection) and legal (e.g. insurance) measures. Maintaining a high level of safety and proper operation of security system requires its proper management and monitoring. Currently, in more and more sophisticated and complex network environments, the key role plays a security management. Firewall platform should be equipped with easy-to-use and complete tools for configuration and monitoring of the operating system and security processes status. The SecurePlatform contains the specially prepared application sysconfig for network interfaces configuration, IP routing, host and domain names, DNS, time and system date and security modules (cpconfig). The graphical Check Point console (SmartView) has possibilities of a very detailed operating system of the firewall machine monitoring (e.g. CPU workload, RAM memory usage, free space on HDD, status of processes). When using the SmartUpdate feature, a new versions and software patches for Check Point software as well as SecurePlatform itself are installed from centralized firewall management console. The SmartUpdate feature is also used for centralized product license management. There is no logical justification that additional remote management tools be installed on the firewall machine if they are available on Check Point console. Such situation, which exists in some Firewall Appliances, where Web server is installed for operating system configuration through Web browser, unnecessarily creates a threat for security and stability of firewall platform, and lowers system performance (each process, in particular a Web server in the operating system will be an additional load for RAM memory and CPU). 2002 CLICO LTD. ALL RIGHTS RESERVED 6

Each company has a limited budget, which can be spent on IT system security means. Statistically, expenses on security amounts to approximately 5 percent of all the expenses related to IT. The cost of firewall hardware should not absorb funds, which could be spent on security means functionality enhancement (i.e. purchase of dedicated tools for analysis and events reporting) and for administrators' qualifications improvement (e.g. training for Check Point professional grades Check Point Certified Security Administrator and Check Point Certified Security Expert). The SecurePlatform installed on the standard, brand-name computer hardware, the cost of which does not exceed 5.000 USD, can achieve very high performance of Firewall and VPN security means. This hardware can be freely upgraded and modernized during Firewall operation. The SecurePlatform has been built based on open-source software (Linux kernel) and is also the product which is distributed by Check Point free of charge. When planning hardware purchase for Check Point security system the offer presented by the vendor should be thoroughly analyzed. The subject of a particular concern should be Firewall Appliances offers. Sometimes the price of such a hardware significantly exceeds the cost of security means software and contains hidden costs (e.g. installation of a new Check Point software version requires installation of the new version of operating system of the Firewall Appliance). Many of Firewall Appliance solutions based on Check Point security system have been designed in such a way, that they give impression that they are dedicated devices (e.g. a real name of operating system used has been changed, nonstandard mainboards and CPUs are used). Adding to the PC additional LAN/WAN cards, dynamic routing protocols or Web-based management console, does not create a dedicated firewall device. In reality the security and performance level offered by these solutions are incomparably lower than those offered by SecurePlatform. What also happens, vendors of some Firewall Appliance solutions encourage to purchase their devices giving false information that Check Point licenses for this hardware are cheaper. Lower profits from Check Point licenses sale are then compensated by profits from sale of expensive hardware. It would be wrong to generalize and describe all available on the market Firewall Appliance solutions as dangerous and based on a low quality hardware. A good quality Firewall Appliance solutions are provided among others by brand-name computer hardware manufacturers such as HP/Compaq, IBM and Siemens. This is usually integrators decision to choose security technology and the firewall platform. They are fully responsible for that. SecurePlatform is only one of the options available. This is however a real challenge for integrators, to transform from the role of hardware and software vendor into security solution vendor. Mariusz Stawowski About author: The author has been professional IT system security expert for many years. He has various speciality certificates in this field, among others Check Point expert, Entrust consultant. He is an author of two books and many publications in IT magazines. He has dealt with Check Point security products since 1996. 2002 CLICO LTD. ALL RIGHTS RESERVED 7