ADVANCED FUNCTIONALITY & TROUBLESHOOTING

1. ADVANCED FUNCTIONALITY &TROUBLESHOOTING

2. Agenda • Internet Shield Architecture • Advanced functionality • IDS vs. packet filter • Stateful packet filters • Dynamic firewall rules • Cisco Network Admission Control (NAC) • Troubleshooting • Troubleshooting Internet Shield configurations • Inspecting logfiles

3. PROCESSES AND SERVICES

4. AVCS Processes • F-Secure Management Agent • fameh32.exe, fch32.exe, fsih32.exe, fsnrb32.exe, fsm32.exe, fsma32.exe, fsmb32.exe, fsguidll.exe • F-Secure Virus & Spy Protection • fsav32.exe, fsaw.exe, fsgk32.exe, fsgk32st.exe, fsdfwd.exe, fsqh.exe, fsrw.exe, fssm32.exe • F-Secure Automatic Update Agent • fsbwsys.exe, F-Secure Automatic Update.exe

5. Processes: FSMA • fsm32.exeF-Secure Manager, displays the F- tray icon • fsma32.exeF-Secure Management Agent (Service) • fsmb32.exe Message Broker, processes communication between the different modules of the various products • fsnrb32.exe Handles the communication between the hosts and the PMS • fameh32.exe Alert and Messaging Handler, handles alert and log forwarding • fch32.exe Configuration Handler, reads the base policy files and writes the incremental policy files • fsih32.exe Installation Handler. Launches ilaunchr.exe during installations

6. Processes: Virus & Spy Protection • fsav32.exe Anti-Virus Handler • fsaw.exe F-Secure Ad-Watch (Browser Control) • fsdfwd.exe Anti-Virus Firewall Daemon. Redirects e-mails to the Scanner Manager (Service) • fsqh.exe Handles object quarantine • fsgk32.exe Gatekeeper Handler. Receives real-time scan requests from the Gatekeeper • fsgk32st.exe Gatekeeper Handler Starter (Service) • fsrw.exe F-Secure Reg-Watch (System Control) • fssm32.exe Scanner Manager. Manages scanning engines

7. Virus & Spy Protection Services • F-Secure Management Agent Environment • NET STOP/START FSMA: fameh32.exe, fsaw.exe, fch32.exe, fsih32.exe, fnrb32.exe, fsm32.exe, fsma32.exe, fsmb32.exe, fsdfwd.exe, fsrw.exe, fsguidll.exe • F-Secure Gatekeeper Environment • NET STOP/START FSGKHS: fsgk32.exe, fsgk32st.exe, fssm32.exe • F-Secure Automatic Update Environment • NET STOP/START FSBWSYS:fsbwsys.exe, F-Secure Automatic Update.exe

8. INTERNET SHIELD ARCHITECTURE

9. Product Components Desktop F-Secure Manager User Interfaces Firewall Plug-ins Services Management Agent (FSMA) Firewall Daemon Email Scanning Module Dial-up Control API Hook Kernel Firewall Engine Packet Filter IDS Interceptor

10. Firewall Engine • Fsdfw.sys • Kernel mode component • Firewall engine does the actual filteringbased on rules • Intrusion detection, packet filtering andapplication control are all done in Firewall Engine • IDS handles the packets before packet filter • TDI Driver is taking care of connection request filtering / checking which is needed for application control • TCP "listen", TCP "connect", UDP "listen", UDP "sendto", RAWIP "create“

11. Interceptor • Fsndis5.sys • Kernel mode component • Loaded by Firewall Engine (fsdfw.sys) • Intercepting network traffic in the NDIS layer • Main purpose is to hook the network traffic and forward it to firewall engine

12. Dial-up ControlAPI Hooking • Fsdc.dll • DC hooking DLL is injected into the dialer process. • RAS API calls are redirected to the DC hooking DLL • Allow or deny decision comes through policy (whitelist) or through user decision (prompt)

13. Firewall Daemon • Fsdfwd.exe • User mode component • Receives alerts and status information directly from firewall engine • Reads everything from policy tables • Reads connection information received from TDI Driver • Receives dial requests from the DC DLL and makes the decision to allow or deny the operation • Sends firewall rules (filter) and IDS database to firewall engine • Writes ACTION.LOG and DIAL.LOG

14. Firewall Plug-in • Fsdfwpi.dll • User lnterface component • IS Plug-in for F-Secure Manager (fsm32.exe) • Displays dialogs to the end user (note: static firewall settings are handled by the AV main & advanced GUI)

15. ADVANCED FUNCTIONALITYIDS VS. PACKET FILTER

16. Packet Filter Limitations • Intrusion Detection Systems are becoming more and more popular • Packet filters aren’t enough to secure the corporate networks • While a firewall closes all unused ports, it cannot protect you from intentionally left open ports • Closing all ports would affect the corporation’s operational requirements • Example: A corporation leaves open TCP 80, so that HTTP traffic can reach the web server • How can the firewall then protect the network against the countless HTTP based exploits • This is where IDS comes in…

17. The Anti-Virus for your Network… • Basically, IDS does for your network what Anti-Virus does for your file system • IDS Solutions • Signature based engines • Pre-defined patterns tell the system, what type of network traffic most commonly correspond to an attack • Heuristic engines • The IDS learns over time, what patterns are considered normal for your network • Pro: Doesn’t rely on signatures, able to detect unknown patterns • Contra: Increasing number of false positives

18. Intrusion Detection System (IDS) • IDS engine is divided in 3 parts • Generic IP engine • UDP protocol engine • TCP protocol engine • The system currently alerts on 31 malicous packets (13 IP, 5 UDP, 13 TCP) • Database selected carefully to avoid false positives

19. Header Payload => TCP <Port> None Header Payload => TCP <Port> Worm Was that Really a Network Worm? Worm traffic Normal traffic Firewall Engine Packet Filter 1 IDS 2

20. STATEFUL PACKET FILTERS

21. Stateful Packet Filter • The firewall keeps a log of all open connections and the current state of all active connections • Maintains a database of allowed and active IP based connections • Uses the connection database to check if the datagram is part of an accepted connection • Works for all IP Protocols (most common TCP, UDP and ICMP)

22. Echo Echo Reply Echo Outbound (Ping):Static Filter Host A Initiator Host BResponder • Following packet filter rules are needed • Outbound: allow echo (Protocol: ICMP, Type: 8) • Inbound: allow echo reply (Protocol: ICMP, Type: 0)

23. Echo Echo Reply Echo Outbound (Ping):Stateful Filter Host A Initiator Host BResponder • Following packet filter rules are needed • Outbound: allow echo (Protocol: ICMP, Type: 8) Listen ICMP, 0

24. APPLICATION CONTROLDYNAMIC FIREWALL RULES

25. Static Rules vs. Dynamic Rules • The Internet Shield stateful packet filter works with two kinds of rules types • Static rules • Included in the pre-defined security levels or created by administrators • Applied to domains or host via security levels (on PMC), always valid! • Dynamic rules • Created on the host at application launch (not related to security levels) • Valid as long as the process is running • Created only for server network applications opening a listening connection

26. Dynamic Firewall RulesWhere to check them...? • Dynamic firewall rules can only be viewed in the Policy Manager Console • There is no reporting of such rules back to the Policy Manager Server • The rules can be viewed from the local advanced user interface or in specific logfiles (fulldiag.htm) Static Rules Dynamic Rules

27. Firewall Dynamic RulesPlacement • Dynamic firewall rules are placed between the second last packet filter rule and the deny all rule • The catch rule is not blocking inbound traffic, which matches one of many dynamic listening rules! • Block unwanted inbound traffic with specific static rules!

28. Firewall Dynamic RulesOperation Host C 4 X Listen TCP 110 <= 0.0.0.0/0 2 Host A Host B 3 POP3 Server 1

29. CISCO NETWORKADMISSION CONTROL

30. System Components • NAC is built from components of Cisco and various third party vendors (e.g. F-Secure) • Cisco components • Cisco Trust Agent (CTA) • Cisco IOS Network Access Device (NAD) • Access Control Server (ACS) • F-Secure components • Policy Manager Console • Cisco NAC support plug-in CTAFS Plug-in ACS NAD

31. Cisco Trust Agent (CTA) • One of the core components of the NAC system • Must be installed on each client, whose policy state is to be validated before permitting network access • Can be rolled out with PMC • Checks Anti-Virus Client Security for the following posture validation attributes

32. F-Secure Plug-in for Cisco NAC • Used by the Cisco Trust Agent, when checking the posture validation attributes of Anti-Virus Client Security • Posture validation attributes are • Virus definitions update status • Real-time scanning protection status • Firewall protection status • Installed at the same time as CTA is installed • Intelligent or policy based installation with PMC

33. Cisco Network Access Device (NAD) • The NAD permits or denies network access • Begins the client posture validation • Typically a Cisco router

34. Cisco Access Control Server (ACS) • ACS is responsible for obtaining and evaluating the posture validation attributes • Determines the overall system posture • Provides the appropriate network access policy to the NAD, based on the system posture • ACS configuration example • Healthy: Full network access granted • Checkup: Outdated virus definitions => usually no access restrictions • Quarantine: Outdated virus definitions during outbreak => access restrictions • Unknown: No Cisco Trust Agent installed => access restrictions

35. TROUBLESHOOTING

36. Typical Connection Problems • Application Level (Application connection control) • Application was by mistake denied from establishing connections • Acting as client (e.g. Internet Explorer) • Acting as server (e.g. nslookup) • Firewall Level (NDIS Layer) • Firewall blocks or allows all or certain connections • Second Firewall is installed (e.g XP firewall, overblocking traffic) • Firewall allows certain traffic, even though you have no specific allow rules • Remember the Application Control dynamic rules • Create specific static deny rules (or use pre-defined security levels)

37. Analyzing Internet Shield Problems • Recommended ways to analyze Internet Shield problems are • Locally: Using the AVCS user interface • Remotely: Using Internet Shield web interface or console 2 1

38. Local TroubleshootingFirewall Rules • Static rules (outbound and inbound) • Any rules blocking traffic? • Any rules allowing unnecessary inbound traffic? • Dynamic rules • Any applications running, which allow unwanted inbound traffic?

39. Local TroubleshootingFirewall Settings • Trusted Interface • Make sure that this setting is locked (PMC => Advanced interface) • If adapters are trusted, all traffic passes unfiltered! • Suspicious traffic alerting • Don’t enable alerting of illegal packets (will create unnecessary alerts, increasing the size of your commdir) • Can be used for debugging purposes on specific hosts

40. Local TroubleshootingApplication Control Rules • Application Connection Control list • Listing all connection rules • Separate row for server and client applications • To avoid wrong user decisions, configure Application Control as follows • First create a detailed application list (using test computers) • After that, deny all new, unknown connections (client and server applications!)

41. Local TroubleshootingMain Logfiles • Two main log files • Action log; All firewall actions • Packet log; All packets (header + payload)

42. Remote TroubleshootingInternet Shield Web Interface • HTTP interface, providing you with the following information • Firewall Rules • Active security level • FW rules (grey: enabled, white: disabled) • Services • Pre-defined and custom services • Firewall alerts • Including detailed information • All information seen in the web interface is in real-time! • Compared to the console, where you always have a certain delay

43. Example: Remote Troubleshooting • Remote administration often works best when combining different tools • Problem: Security Level on host doesn’t change (eventhough setting is final and forced down) • Using remote web interface tells you the current active level • Solution: Currently selected security level is not enabled, therefore even forcing setting change doesn’t work • Enable it and distribute the policies

44. Testing Firewall Configurations • Problem: You don’t know if the security level holds up against different kind of network attacks • Select a host which currently has the security level in question active • Run a full portscan (e.g. using nmap portscan tool) • Only target that specific host • Never run portscans in production networks! (unless you are responsible for the network)

45. Example: RPC Port Scan • Portscan Tool: nmap (available at www.insecure.org) • Type of scan: RPC scan (Remote Procedure Call related ports) • Security Level: Custom (no static rules, active dynamic rules!)

46. F-Secure Diagnostics Tool FSDIAG.EXE • Diagnostics tool included in the installation package • Collects important system information (eg. logfiles) to an archive on the local disk • Access points • C:\Program Files\F-Secure\Common\ fsdiag.exe • Fsdiag.tar.gz in the same directory

47. System information osver.log hardware.log netstart.log system.evt Network information ipconfig.log route.log Conflicting Software appliation.evt reg_run.log AVCS internal alerts logfile.log Firewall overview fulldiag.htm Virus definitions update information header.ini daas.log Analyzing FSDIAG

48. Summary • Internet Shield Architecture • Advanced functionality • IDS vs. packet filter • Stateful packet filters • Dynamic firewall rules • Cisco Network Admission Control (NAC) • Troubleshooting • Troubleshooting Internet Shield configurations • Inspecting logfiles