1 Topic 2: Lesson 3 Intro to Firewalls Summary

2 Basic questions What is a firewall? What is a firewall? What can a firewall do? What can a firewall do? What is packet filtering? What is packet filtering? What is proxying? What is proxying? What is stateful packet filtering? What is stateful packet filtering? Compare network layer firewalls and application layer firewalls. Compare network layer firewalls and application layer firewalls. Enumerate the benefits of a firewall Enumerate the benefits of a firewall Enumerate the limitations of a firewall Enumerate the limitations of a firewall

3 What is a firewall? Protect internal network from outside threats Protect internal network from outside threats creates choke point from outside of network creates choke point from outside of network mechanism that permits access control between two or more networks mechanism that permits access control between two or more networks come in various forms: hardware and software, usually a combination come in various forms: hardware and software, usually a combination

4 What can a firewall do? keep outsiders from breaking in keep outsiders from breaking in keep insiders from exposing valuable data keep insiders from exposing valuable data enable secure communication between networks enable secure communication between networks Firewall protects both direction Firewall protects both direction Firewall can proxy an Internet service Firewall can proxy an Internet service block services known to be problematic block services known to be problematic

5 What is packet filtering? One of the three types of firewall technology One of the three types of firewall technology determines whether a packet can be accepted or not based on IP address, port number, protocol type determines whether a packet can be accepted or not based on IP address, port number, protocol type spoofed with IP or port # filtering, doesn’t look at contents spoofed with IP or port # filtering, doesn’t look at contents firewall sets up rule set, verifies packets with header information firewall sets up rule set, verifies packets with header information what is inside a packet header: what is inside a packet header: –source IP, destination IP, protocol, source port, destination port, size of packet, sequence # Can viruses or Trojans attack a firewall? Can viruses or Trojans attack a firewall? –Yes, vulnerabilities in firewalls that can be exploited –previous employer, viruses disable firewalls

6 What is proxying? use a proxy server as an intermediary between two servers. Communication sent between the proxy and internal use a proxy server as an intermediary between two servers. Communication sent between the proxy and internal hides real IP address from whoever you are communicating to hides real IP address from whoever you are communicating to does logging and access control does logging and access control based on policy, takes requests for user in group based on policy, takes requests for user in group don’t permit traffic between networks don’t permit traffic between networks

7 What is stateful packet filtering? across b/w functionality of packet filtering and firewalls across b/w functionality of packet filtering and firewalls provides more security checks provides more security checks inspects first packet, adds entry to state table inspects first packet, adds entry to state table state table= tabulates state of the system, state is how you define it to be. State is connections being made updated after valid connections are made. Follow-up packets for new connections use that table for verification. state table= tabulates state of the system, state is how you define it to be. State is connections being made updated after valid connections are made. Follow-up packets for new connections use that table for verification. use valid host to transmit malicious code use valid host to transmit malicious code Does state table have an expiration time? Session time, start and termination time- time window, beyond the connection ends Does state table have an expiration time? Session time, start and termination time- time window, beyond the connection ends Does termination expire instantaneously- depends based on configured session time; Does termination expire instantaneously- depends based on configured session time; How does it determine if first packet is valid - for efficiency, if you spoof original packet, not sure How does it determine if first packet is valid - for efficiency, if you spoof original packet, not sure

8 Compare network layer firewalls and application layer firewalls. app layer firewalls block traffic based on what application u are using – network layer examine addressing and others app layer firewalls block traffic based on what application u are using – network layer examine addressing and others network layer firewalls are faster but do less inspection network layer firewalls are faster but do less inspection can just block port rather than app? can just block port rather than app? –ports used by app can change most firewalls include aspects of both most firewalls include aspects of both firewall can be strengthened by changing firmware firewall can be strengthened by changing firmware example of network is packet filtering and example of application layer is proxying example of network is packet filtering and example of application layer is proxying

9 Enumerate the benefits of a firewall cost benefits of firewall make economic sense, inexpensive and high rewards cost benefits of firewall make economic sense, inexpensive and high rewards enforce organizational security policies enforce organizational security policies enable logging of connections and data enable logging of connections and data logs produced can give valuable information about the network logs produced can give valuable information about the network help prevent net security issues from spreading across network segments help prevent net security issues from spreading across network segments firewalls are only as useful as the unified security policy which is defined firewalls are only as useful as the unified security policy which is defined

10 Enumerate the limitations of a firewall firewalls cant protect against malicious inside attacks firewalls cant protect against malicious inside attacks not too effective against dialup not too effective against dialup susceptible to IP spoofing susceptible to IP spoofing stop attacks at network level, so many attacks which they cannot block stop attacks at network level, so many attacks which they cannot block cant prevent against Trojans, viruses, etc cant prevent against Trojans, viruses, etc can be compromised like any other part of the network can be compromised like any other part of the network exploit problems in for DOS attacks exploit problems in for DOS attacks only as good as updates- need security updates/firmware only as good as updates- need security updates/firmware cant protect against vulnerable protocols- TCP/IP, http, etc cant protect against vulnerable protocols- TCP/IP, http, etc If you are greedy, you will eat the honey in the pot If you are greedy, you will eat the honey in the pot