453 Network Security

1. 453 Network Security Section 5: Firewalls Dr. E.C. Kulasekere Sri Lanka Institute of Information Technology - 2006

2. Introduction • Evolution of information systems • Now everyone want to be on the Internet and to interconnect networks • This will generate persistent security concerns • can’t easily secure every system in organization • Organizations need "harm minimisation" • a Firewall usually part of this

3. What is a Firewall? • a choke point of control and monitoring • interconnects networks with differing trust • imposes restrictions on network services • only authorized traffic is allowed • auditing and controlling access • can implement alarms for abnormal behavior • is itself immune to penetration • provides perimeter defence

4. What is a Firewall? … • Firewalls essentially keeps problems of other networks from getting into yours. • All firewalls do some kind of packet filtering. • Firewalls once detected by type can be penetrated using weak link security. • Firewalls on software like what Linux has can be effective in terms of easy configuration. eg gfcc.

5. Firewall Limitations • cannot protect from attacks bypassing it • eg sneaker net, utility modems, trusted organisations, trusted services (eg SSL/SSH) • cannot protect against internal threats • eg disgruntled employee • cannot protect against transfer of all virus infected programs or files • because of huge range of O/S & file types

6. How Firewalls Function • Two approaches to control access • Everything not specifically permitted is denied. • Everything not specifically denied is permitted. • Most often recommended is everything not specifically permitted is denied. • This is restrictive but provides more security with the downside of legitimate users also getting blocked.

7. Firewall Types • Mainly two+one types • Application Gateways • Packet filters • Stateful Inspection screening systems. • The application can be modeled by where it operates in the OSI layers. • Hybrid packet screening methods can be implemented by combining two or more of these together.

8. Firewalls and OSI Model

9. Firewalls – Packet Filters

10. Firewalls – Packet Filters (1) • simplest of components • foundation of any firewall system • examine each IP packet (no context) and permit or deny according to rules • hence restrict access to services (ports) • Hence a service can be disallowed but a function within the service cannot be disallowed. • Example: FTP can be stopped but mget function cannot be stopped.

11. Firewalls – Packet Filters (2) • The most common implementation is on a router or dual-homed gateway. • Packet filtering can be done based on • Source IP address • Destination IP address • Protocol type (TCP/UDP) • Source port • Destination port

12. Firewalls – Packet Filters (3)

13. Strengths of a Packet Filter Firewall • Faster since the screening of packets are done at a lower level. • If implemented properly this type of firewall will have little effect on network performance. • This is less expensive and most of the hardware and software these days have some form of a packet filter built in. • This type of firewall can also scale up very easily. • Packet filtering firewalls are application independent. Decisions are based on information contained in the packet's header and not on information that relates to a specific application.

14. Weaknesses of a Packet Filter Firewall • Packet filtering firewalls allow a direct connection to be made between the two endpoints. • Even though the filtering is fast it is a all-or-nothing approach hence if a port is open all traffic for the port is open and in effect it’s a security hole. • Hard to match the access of a client and requirements of an organization. • Testing of a rule set is near impossible. • Open to attacks that use the packet header information. • Packet filtering firewalls do not perform user authentication.

15. Attacks on Packet Filters • IP address spoofing • fake source address to be trusted • add filters on router to block • source routing attacks • attacker sets a route other than default • block source routed packets • tiny fragment attacks • split header info over several tiny packets • either discard or reassemble before check

16. Firewalls – Stateful Packet Inspection (1) • This uses the same technique as packet filtering firewall with additional header checking from the network layer to the application layer to see if this packet is a part of a legitimate connection. • i.e. examine each IP packet in context • keeps tracks of client-server sessions • checks each packet validly belongs to one • better able to detect bogus packets out of context

17. Firewalls – Stateful Packet Inspection (2) • packet header information is examined and fed into a dynamic state table where it is stored. • The packets are compared to pre-configured rules or filters and allow or deny decisions are made based on the results of the comparison. • The data in the state table is then used to evaluate subsequent packets to verify that they are part of the same connection.

18. Firewalls – Stateful Packet Inspection (3) • This method can make decisions based on one or more of the following: • Source IP address • Destination IP address • Protocol type (TCP/UDP) • Source port • Destination port • Connection state • By having the ability to "remember" the status of a connection, this method of packet screening is better equipped to guard against attacks than standard packet filtering.

19. Firewalls – Stateful Packet Inspection (4)

20. Strengths of a Stateful Packet Filter • Like packet filtering firewalls, have very little impact on network performance, can be implemented transparently and are application independent. • Since it digs deeper into the header information this is more secure than normal packet filter firewalls. • These have some logging capabilities. Logging can help identify and track the different types of traffic that pass though the firewall.

21. Weaknesses of a Stateful Packet Filter • Like packet filtering, this does not break the client/server model and therefore allows a direct connection to be made between the two endpoints. • Rules and filters in this packet screening method can become complex, hard to manage, prone to error and difficult to test.

22. Application Level Gateway (or Proxy)

23. Firewall – Application Gateway/Proxy (1) • This is considered to be the most complex packet screening method. • This type of firewall is usually implemented on a secure host system configured with two network interfaces where the firewall acts as an intermediately between the two interfaces. • Operates at the application level of the OSI model. Hence the proxy service must be implemented for each application protocol.

24. Firewall – Application Gateway/Proxy (2) • These can be made very reliable since this is the only connection point between the two networks. • Another strength of this method of packet screening is that the interfaces on the host system do not forward packets. • There is no direct connection between the host and the client.

25. Firewall – Application Gateway/Proxy (3) • The operation is as follows • The client issues a request from an untrusted network and a connection is established with the application/proxy. • The proxy will determine if the request is valid by comparing rules etc. • Then a new request is generated by the proxy on behalf of the client and sent to the destination. • The request thus sent to the destination is also answered in the same manner.

26. The Proxy/Gateway View

27. Firewall – Application Gateway/Proxy (4) • Unlike packet filtering and stateful packet inspection, an application gateway/proxy can see all aspects of the application layer so it can look for more specific pieces of information. • Eg. the difference between a piece of e-mail containing text and a piece of e-mail containing a graphic image, or the difference between a webpage using Java and a webpage without can be determined. • Method is far superior to the others but not the most practical to apply.

28. Strengths of an Application Level Gateway/Proxy (1) • No direct connection; breaks the client server model; keeps the internal and external networks separate. • No routing is done. Hence this method of packet screening inherently provides a form of Network Address Translation. • They can permit or deny specific applications or specific features of an application. Many security experts believe that application gateways / proxies are more secure because of this granular control.

29. Strengths of an Application Level Gateway/Proxy (2) • Enhanced filtering capabilities. Since they have the ability to examine the payload of the packet, they are capable of making decisions based on content. • These offer tight user administration that can be coupled with systems databases. • It is capable of logging user activity and different types of traffic. This ability can provide a valuable resource when dealing with security incidents and policy implementation.

30. Weaknesses of an Application Level Gateway/Proxy (1) • When packets are screened at application level the system performance is affected. This can sometimes be a bottleneck. • Each protocol (HTTP, SMTP, etc.) requires its own gateway/proxy application. If one does not exist, then the corresponding protocol will not be allowed through the firewall. In addition, since each protocol requires its own gateway/proxy, support for new applications can become a problem.

31. Weaknesses of an Application Level Gateway/Proxy (2) • Clients on the network may require specialized software or configuration changes to be able to connect to the application gateway/proxy. This can have quite an impact on larger networks with numerous clients. • Performance typically degrades when the number of clients increases or the number of gateways/proxies located on any one host system increases. Hence low scalability.

32. Weaknesses of an Application Level Gateway/Proxy (3) • When installed on general-purpose operating systems are vulnerable to the security loopholes of the underlying system. If the underlying system is not secure, the firewall is not secure. • It is also more susceptible to DDS attacks. If enough data is forced on the application gateway/proxy, it can cease to operate. • The enhanced security of application gateways/proxies may require the purchase of additional hardware, software, expertise, or support, which in turn drives up the cost of the firewall solution.

33. Other Hybrid Type of Firewalls • There are several other hybrid types. • Adaptive proxies: Enhanced form of application level gateways/proxies. • Circuit level gateways: Works on sessions rather than screening packets. • The capabilities can be improved by hybrid firewalls.

34. Adaptive Proxies • Constructed by combining the merits of both application gateways/proxies and packet filtering firewalls. • These work by inspecting the first part of a connection at the application layer to make allow or deny decisions. • Then subsequent packets are inspected at the network layer and allowed or denied at that layer. • If the subsequent packets are deemed new then they are passed back into the application layer for inspection. • This will enhance performance since it is faster.

35. Firewalls - Circuit Level Gateway (1) • Unlike the packet filtering firewall, this does not examine individual packets. • This will monitor TCP/UDP sessions instead. • Once a session has been established, it leaves the port open to allow all other packets belonging to that session to pass. The port is closed when the session is terminated. • This method of packet screening resembles application gateways/proxies and adaptive proxies, but circuit-level gateways operate at the transport layer (layer 4) of the OSI model.

36. Firewalls - Circuit Level Gateway (2)

37. Important Aspects of Effective Firewalls • First, the device or host system on which the firewall solution resides must be secure. If the system can be compromised, then the firewall can also be compromised. If the firewall you choose is based on a well-known network operating system, make sure the operating system is fully patched and all security updates have been applied. • Second, for a firewall to be effective, all traffic to and from your network must pass through it. If a firewall can be physically or logically bypassed, there is no guarantee that your trusted network is safe. The architecture used for your firewall solution is very important.

38. Discuss the security issues in a LAN. • The difference between the levels of security comes from the degree of control you have on what is happening in the network. For a LAN you have complete control over the hosts, however in a WAN you have little or no control over the other hosts and services. • User authentication: Restricting access using passwd file and shadow passwords. The passwd files should not be world readable. Specially the shadow passwd file. Use pwconv to update. • Resource protection: This can be used to restrict which users can • access objects, and which ones as well as do auditing to track usage as well as abuse of privileges. • Physical safeguards: securing the physical unit itself is essential for security. Eg. Linux single user mode penetrates a firewall.

39. Discuss the security issues in a WAN. • In WANs you are open to an infinite number of security risks. • Using a firewall one can reduce the security risks by having only a single point of control for Internet connections. • In TCP applications, buffer over flow can crash the service opening a hole, by not trapping unexpected behavior (recover by patching or updating). • IP forging can get a stray packet into your network which can initiate a legal connection to the outside world. • Password theft. Use encryption and crack protocol to set up passwords. • Viruses and Trojan Horses. • Forged Emails: Use digital signature to identify.

40. What are the firewall architectures? • Firewall implementations can be simple or complex based on the architecture used. • Traffic to and fro must pass through the Firewall. • There are several types of architectures • A packet filtering router. • Screened host (Bastion host) • Dual homed gateway • Screened subnet of demilitarized zone (DMZ) • Firewall appliance.

41. Packet Filtering Router • This is a router configured to screen packets between two networks. • It will route packets between the two networks and uses packet filtering rules to accept or deny traffic. • Implementing this is not easy since routers are not meant for this purpose and the command interface is neither simple or intuitive.

42. Screened Host (Bastion Host) (1) • This is generally located in the trusted network shielded from the untrusted network by a packet filtering router. • All the traffic coming from the packet filter is directed to the screened host.

43. Screened Host (Bastion Host) (2) • Outbound traffic may or may not be going through the screen host. • It is most often software based and runs on a general-purpose computer that is running a secure version of the operating system. • Security is usually implemented at the application level.

44. Dual Homed Gateway (1) • A dual-homed gateway typically sits behind the gateway (usually a router) to the untrusted network and most often is a host system with two network interfaces. • Traffic forwarding on this system is disabled, thereby forcing all traffic between the two networks to pass through some kind of application gateway or proxy.

45. Dual Homed Gateway (2) • Only gateways or proxies for the services that are considered essential are installed on the system. • This particular architecture will usually require user authentication before access to the gateway/proxy is allowed. • Each proxy is independent of all other proxies on the host system.

46. Screened Subnet or Demilitarized Zone (DMZ) (1) • A screened subnet or DMZ is typically created between two packet filtering routers. • When using this architecture, the firewall solution is housed on this screened subnet segment along with any other services available to the untrusted network. • Conceptually, this architecture is similar to that of a screened host, except that an entire network rather than a single host is reachable from the outside.

47. Firewall Appliance (1) • A firewall appliance typically sits behind the gateway (usually a router) to the untrusted network. • This architecture resembles the packet filtering router and dual-homed Gateway architectures in that all traffic must pass through the appliance. In most instances these appliances come pre-configured on their own box.

48. Firewall Appliance (2) • They may also have other services built in, such as Web servers and e-mail servers. • No extensive configurations required hence easy to use.

49. Selecting and Implementing a Firewall • In order to pick the best architecture and packet screening method for a firewall solution, the following questions should be considered: • What does the firewall need to do? • What additional services would be desirable? • How will it fit in the existing network? • How will it effect existing services and users? • Note that a firewall implemented with little thought may be worse than having no firewall at all

50. Access Control • given system has identified a user • determine what resources they can access • general model is that of access matrix with • subject - active entity (user, process) • object - passive entity (file or resource) • access right – way object can be accessed • can decompose by • columns as access control lists • rows as capability tickets