Building Your Own Firewall Chapter 10

Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain how enterprise firewalls work

Enterprise versus Desktop Firewalls Enterprise firewall Protects entire network or a network segment Can be a separate hardware appliance or software-only Desktop firewall Software-only firewall intended to be installed on one client computer on the network and provide protection only to that device Also known as a personal firewall

Enterprise Firewall

Desktop Firewalls Have generally replaced hardware firewalls for protection of a single device Intercept and inspect all data that enters or leaves the computer Traffic can generally be blocked by IP address, port address, or application Protects against rogue access points and worms

Desktop Firewalls

Rogue Access Point

Desktop Firewalls Help protect network by providing additional level of security at each network device Recent increase in popularity Popular desktop firewalls Tiny Personal Firewall Sygate Personal Firewall ZoneAlarm

Tiny Personal Firewall Unique for advanced security features Based on a technology certified by ICSA Made up of several different “engines” Includes an Intrusion Detection System (IDS) engine Uses sandbox technology to create a closed environment around an application and restrict access to resources

Firewall Engine Performs stateful packet inspection Filters network activity based on TCP/IP protocol Supports rules that link to specific applications (Application Filter) Ensures that an application program on the computer is the real program and not a Trojan horse Creates and checks MD5 signatures (checksums) of application programs

Tiny Personal Firewall Engine

Checksums

IDS Engine Report

Sandbox Technology Protects resources Device drivers Registry database that contains all configurations of the computer File system Shields and constantly monitors application programs to protect privacy and integrity of the computer system continued

Sandbox Technology Protects against active content programs being used to perform: Theft of information and data Remote access via Internet Manipulation of communication Deletion of files Denial of service

Tiny Personal Firewall Sandbox

Sandbox Objects

Sygate Firewalls Protect corporate networks and desktop systems from intrusion Prevent malicious attackers from gaining control of corporate information network Range in design from enterprise-based security systems to personal firewall systems Secure Enterprise Personal Firewall Pro

Sygate Secure Enterprise Top-of-the-line product that combines protection with centralized management Made up of Sygate Management Server (SMS) and Sygate Security Server SMS enables security managers to create a global security policy that applies to all users and groups Subgroups can be created within the global group Can produce detailed reports of firewall’s actions

Sygate Management Server

Sygate Personal Firewall Pro Designed for business users but lacks centralized management features Provides in-depth low-level tools for protecting computers from a variety of attacks

Sygate Personal Firewall Pro

Blocks or allows specific services and applications instead of restricting specific TCP network ports Fingerprinting system ensures that an application program is the real program and not a Trojan horse

Sygate Personal Firewall Pro

Provides flexibility over rules that govern the firewall Contains other features not commonly found on most desktop firewall products (eg, testing and connection) Protects against MAC and IP spoofing

Sygate Personal Firewall Pro

ZoneAlarm Firewalls Bi-directional; provide protection from incoming and outgoing traffic Pop-up windows alert users to intrusion attempts Four interlocking security services Firewall Application Control Internet Lock Zones

ZoneAlarm Firewall

Uses fingerprints to identify components of a program as well as the program itself Prevents malicious code from gaining control of computer Stops potentially malicious active content

ZoneAlarm Firewall Application Control Allows users to decide which applications can or cannot use the Internet Internet Lock Blocks all Internet traffic while computer is unattended or while Internet is not being used Zones Monitors all activities on the computer; sends an alert when a new application tries to access the Internet

Internet Lock Settings

Zone Security

ZoneAlarm Logging Options

Enterprise Firewalls Still perform bulk of the work in protecting a network First line of defense in a security management plan Provide “perimeter security” Allow security managers to log attacks that strike the network

Popular Enterprise Firewall Products Linksys firewall/router Microsoft Internet Security and Acceleration (ISA) server

Linksys Offers a wide variety of routers, hubs, wireless access points, firewalls, and other networking hardware Produces solid products that provide strong security and are easy to set up and use

Linksys Firewall/Router Comes in a variety of configurations Good solutions for connecting a group of computers to a high-speed broadband Internet connection or to a 10/100 Ethernet backbone and also support VPN

Linksys Firewall/Router Features an advanced stateful packet inspection firewall Does not block transmissions based on the application Supports system traffic logging and event logging

Linksys Firewall/Router Features Web filter Block WAN request Multicast pass through IPSec pass through PPTP pass through Remote management

Microsoft ISA Server 2000 Enterprise firewall that integrates with Microsoft Windows 2000 operating system for policy-based security and management Provides control over security, directory, virtual private networking (VPN), and bandwidth Available in two product versions ISA Server Standard Edition ISA Server Enterprise Edition

Microsoft ISA Server 2000 Provides two tightly integrated modes Multilayer firewall Web cache server Software uses a multihomed server Firewall protection is based on rules which are processed in a certain order

Multihomed Server

Order of Processing ISA Server Rules Incoming requests 1.Packet filters 2.Web publishing rules 3.Routing rules 4.Bandwidth rules Outgoing requests 1.Bandwidth rules 2.Protocol rules 3.Site and content rules 4.Routing rules 5.Packet filters

Microsoft ISA Server Policy Elements Schedules Bandwidth priorities Destination sets Client Address sets Content groups

Chapter Summary Types of firewalls currently available for enterprise, small office home office (SOHO), and single computer protection Features of these firewalls that provide the necessary protection to help keep a network or computer secure