Presentation is loading. Please wait.

Presentation is loading. Please wait.

Lecture 7 Network & ISP security. Firewall Simple packet-filters Simple packet-filters evaluate packets based solely on IP headers. Source-IP spoofing.

Published byStanley Davis Modified over 8 years ago

Similar presentations

Presentation on theme: "Lecture 7 Network & ISP security. Firewall Simple packet-filters Simple packet-filters evaluate packets based solely on IP headers. Source-IP spoofing."— Presentation transcript:

1 Lecture 7 Network & ISP security

2

3 Firewall Simple packet-filters Simple packet-filters evaluate packets based solely on IP headers. Source-IP spoofing attacks generally aren't blocked by packet-filters, and since allowed packets are literally passed through the firewall, packets with "legitimate" IP headers but dangerous data payloads (as in buffer- overflow attacks) can often be sent intact to "protected" targets.

4 Stateful packet filtering

5 Application-layer proxies A proxying firewall acts as an intermediary in all transactions that traverse it (see figure). proxying firewalls are often called "application- layer" proxies because, unlike other types of proxies that enhance performance but not necessarily security, proxying firewalls usually have a large amount of application-specific intelligence about the services they broker.

6 Placing Firewall "Inside Versus Outside" Architecture Because public services such as SMTP, DNS, and HTTP must either be sent through the firewall to internal servers or hosted on the firewall itself the risk of server compromising is increased. As result the DMZ (DeMilitarized Zone) network is used.

7 The "Three-Homed Firewall" DMZ Architecture

8 A Weak Screened-Subnet Architecture Rarely used Lack of firewall is the weak point obsolete

9 A Strong Screened-Subnet Architecture

10 2) Secure Resources Firewall, Encryption, Authentication, Audit 1) ISP’s Security Policy 3) Monitor and Respond Intrusion Detection, work the incidence, 4) Test, Practice, Drill Vulnerability Scanning 5) Manage and Improve Post Mortem, Analyze the Incident, modify the plan/procedures What Do ISPs Need to Do? Security incidence are a normal part of an ISP’s operations!

11 PREPARATION Prep the network Create tools Test tools Prep procedures Train team Practice IDENTIFICATION How do you know about the attack? What tools can you use? What’s your process for communication? CLASSIFICATION What kind of attack is it? TRACEBACK Where is the attack coming from? Where and how is it affecting the network? REACTION What options do you have to remedy? Which option is the best under the circumstances? POST MORTEM What was done? Can anything be done to prevent it? How can it be less painful in the future? Six Phases of Incident Response

12 The Old World: Router Perspective Policy enforced at process level (VTY ACL, SNMP ACL, etc.) Some early features such as ingress ACL used when possible “untrusted” telnet, snmp Attacks, junk Router CPU

13 The New World: Router Perspective Central policy enforcement, prior to process level Granular protection schemes On high-end platforms, hardware implementations “untrusted” telnet, snmp Attacks, junk Router CPU Protection

14 Secure Routing Route Authentication Configure Routing Authentication Signs Route Updates Verifies Signature Campus SignatureRoute Updates Certifies Authenticity of Neighbor and Integrity of Route Updates

15 References http://www.cs.fsu.edu/~burmeste/CIS4360/Physical%20Security.ppt http://www.google.com/url?sa=t&rct=j&q=datacenter%20security%20design%20 examplee%20ppt&source=web&cd=10&ved=0CHEQFjAJ&url=http%3A%2F%2 Fwww.nanog.org%2Fmeetings%2Fnanog36%2Fpresentations%2Fgreene.ppt& ei=6usCT8rmAsfQ4QSN6_GCDw&usg=AFQjCNHw7IRd4CrNra6tKN- R_3Dfp7D_Ig&cad=rja http://www.cs.fsu.edu/~burmeste/CIS4360/Physical%20Security.ppt https://www.owasp.org/index.php/Threat_Risk_Modeling http://www.cert.org/octave/ Joseph G. Boyce Dan W. Jennings, Information Assurance - Managing Organizational IT Security Risks, Elsevier Science, 2002 https://www.networkworld.com/news/2010/020210-black-hat-processor- security.htmlhttps://www.networkworld.com/news/2010/020210-black-hat-processor- security.html http://www.backupcentral.com/mr-backup-blog-mainmenu-47/13-mr-backup- blog/167-encrypted-data-hacked.htmlhttp://www.backupcentral.com/mr-backup-blog-mainmenu-47/13-mr-backup- blog/167-encrypted-data-hacked.html http://www.csoonline.com/article/220665/19-ways-to-build-physical-security-into- a-data-center?page=3http://www.csoonline.com/article/220665/19-ways-to-build-physical-security-into- a-data-center?page=3 http://fengnet.com/book/bssl/bssrvrlnx-CHP-2-SECT-2.html http://www.checkpoint.com/

16 Any wall have some weak points

Download ppt "Lecture 7 Network & ISP security. Firewall Simple packet-filters Simple packet-filters evaluate packets based solely on IP headers. Source-IP spoofing."

Similar presentations

Point Protection 111. Check List AAA to the Network Devices Controlling Packets Destined to the Network Devices Config Audits.

Point Protection 111. Check List AAA to the Network Devices Controlling Packets Destined to the Network Devices Config Audits.
Prepare your NOC 111. SP’s/ISP’s NOC Team Every SP and ISP needs a NOC Anyone who has worked or run a NOC has their own list of what should be in a NOC.

Prepare your NOC 111. SP’s/ISP’s NOC Team Every SP and ISP needs a NOC Anyone who has worked or run a NOC has their own list of what should be in a NOC.
FIREWALLS Chapter 11.

FIREWALLS Chapter 11.
Firewalls Dr.P.V.Lakshmi Information Technology GIT,GITAM University

Firewalls Dr.P.V.Lakshmi Information Technology GIT,GITAM University
FIREWALLS. What is a Firewall? A firewall is hardware or software (or a combination of hardware and software) that monitors the transmission of packets.

FIREWALLS. What is a Firewall? A firewall is hardware or software (or a combination of hardware and software) that monitors the transmission of packets.
Network Security. Reasons to attack Steal information Modify information Deny service (DoS)

Network Security. Reasons to attack Steal information Modify information Deny service (DoS)
Security Firewall Firewall design principle. Firewall Characteristics.

Security Firewall Firewall design principle. Firewall Characteristics.
Network Security Topologies Chapter 11. Learning Objectives Explain network perimeter’s importance to an organization’s security policies Identify place.

Network Security Topologies Chapter 11. Learning Objectives Explain network perimeter’s importance to an organization’s security policies Identify place.
Chapter 11 Firewalls.

Chapter 11 Firewalls.
6/4/2015National Digital Certification Agency1 Security Engineering and PKI Applications in Modern Enterprises Mohamed HAMDI National.

6/4/2015National Digital Certification Agency1 Security Engineering and PKI Applications in Modern Enterprises Mohamed HAMDI National.
K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.

K. Salah 1 Chapter 31 Security in the Internet. K. Salah 2 Figure 31.5 Position of TLS Transport Layer Security (TLS) was designed to provide security.
Firewall Security Chapter 8. Perimeter Security Devices Network devices that form the core of perimeter security include –Routers –Proxy servers –Firewalls.

Firewall Security Chapter 8. Perimeter Security Devices Network devices that form the core of perimeter security include –Routers –Proxy servers –Firewalls.
Firewalls1 Firewalls Mert Özarar Bilkent University, Turkey

Firewalls1 Firewalls Mert Özarar Bilkent University, Turkey
Security Issues on Distributed Systems 7 August, 1999 S 1 Prepared by : Lorrien K. Y. Lau Student I.D. : 97077200 7 August 1999 The Chinese University.

Security Issues on Distributed Systems 7 August, 1999 S 1 Prepared by : Lorrien K. Y. Lau Student I.D. : August 1999 The Chinese University.
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 6 Packet Filtering By Whitman, Mattord, & Austin© 2008 Course Technology.

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 6 Packet Filtering By Whitman, Mattord, & Austin© 2008 Course Technology.
Data Security in Local Networks using Distributed Firewalls

Data Security in Local Networks using Distributed Firewalls
Controls for Information Security

Controls for Information Security
Chapter 8 Information Systems Controls for System Reliability— Part 1: Information Security Copyright © 2012 Pearson Education, Inc. publishing as Prentice.

Chapter 8 Information Systems Controls for System Reliability— Part 1: Information Security Copyright © 2012 Pearson Education, Inc. publishing as Prentice.
COEN 252: Computer Forensics Router Investigation.

COEN 252: Computer Forensics Router Investigation.
1 Lecture 20: Firewalls motivation ingredients –packet filters –application gateways –bastion hosts and DMZ example firewall design using firewalls – virtual.

1 Lecture 20: Firewalls motivation ingredients –packet filters –application gateways –bastion hosts and DMZ example firewall design using firewalls – virtual.

Similar presentations

Ads by Google