Module 7: Advanced Application and Web Filtering.

Slides:

Advertisements

Similar presentations

Enabling Secure Internet Access with ISA Server

Advertisements

Module 5: Configuring Access to Internal Resources.

Module 5: Configuring Access for Remote Clients and Networks.

Working with Proxy Servers and Application-Level Firewalls Chapter 5.

Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.

Introduction to ISA 2004 Dana Epp Microsoft Security MVP.

Implementing ISA Server Caching. Caching Overview ISA Server supports caching as a way to improve the speed of retrieving information from the Internet.

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 6 Packet Filtering By Whitman, Mattord, & Austin© 2008 Course Technology.

Lesson 19: Configuring Windows Firewall

 Proxy Servers are software that act as intermediaries between client and servers on the Internet.  They help users on private networks get information.

1 Integrating ISA Server and Exchange Server. 2 How works.

1 Enabling Secure Internet Access with ISA Server.

Firewalls Marin Stamov. Introduction Technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts.

1 Advanced Application and Web Filtering. 2 Common security attacks Finding a way into the network Exploiting software bugs, buffer overflows Denial of.

Managing Client Access

Packet Filtering. 2 Objectives Describe packets and packet filtering Explain the approaches to packet filtering Recommend specific filtering rules.

Configuring a Web Server. Overview Overview of IIS Preparing for an IIS Installation Installing IIS Configuring a Web Site Administering IIS Troubleshooting.

Module 8: Configuring Virtual Private Network Access for Remote Clients and Networks.

Securing Microsoft® Exchange Server 2010

Chapter 6: Packet Filtering

Intrusion Prevention System. Module Objectives By the end of this module, participants will be able to: Use the FortiGate Intrusion Prevention System.

Implementing ISA Server Publishing. Introduction What Are Web Publishing Rules? ISA Server uses Web publishing rules to make Web sites on protected networks.

Chapter 13 – Network Security

1 Chapter 6: Proxy Server in Internet and Intranet Designs Designs That Include Proxy Server Essential Proxy Server Design Concepts Data Protection in.

Module 14: Configuring Server Security Compliance

OV Copyright © 2013 Logical Operations, Inc. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention.

Module 10: Monitoring ISA Server Overview Monitoring Overview Configuring Alerts Configuring Session Monitoring Configuring Logging Configuring.

Module 4: Configuring ISA Server as a Firewall. Overview Using ISA Server as a Firewall Examining Perimeter Networks and Templates Configuring System.

OV Copyright © 2011 Element K Content LLC. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention.

Module 11: Remote Access Fundamentals

Module 2: Installing and Maintaining ISA Server. Overview Installing ISA Server 2004 Choosing ISA Server Clients Installing and Configuring Firewall Clients.

11 CONFIGURING TCP/IP ADDRESSING AND SECURITY Chapter 11.

Packet Filtering Chapter 4. Learning Objectives Understand packets and packet filtering Understand approaches to packet filtering Set specific filtering.

Module 11: Implementing ISA Server 2004 Enterprise Edition.

Network and Perimeter Security Paula Kiernan Senior Consultant Ward Solutions.

Overview of Microsoft ISA Server. Introducing ISA Server New Product—Proxy Server In 1996, Netscape had begun to sell a web proxy product, which optimized.

1 Chapter Overview Password Protection Security Models Firewalls Security Protocols.

Network Security. 2 SECURITY REQUIREMENTS Privacy (Confidentiality) Data only be accessible by authorized parties Authenticity A host or service be able.

Module 5: Configuring Internet Explorer and Supporting Applications.

Securing Internet Access Designing an Internet Acceptable Use Policy Securing Access to the Internet by Private Network Users Restricting Access to Content.

© 2006 Cisco Systems, Inc. All rights reserved. Cisco IOS Threat Defense Features.

Module 4 Quiz. 1. Which of the following statements about Network Address Translation (NAT) are true? Each correct answer represents a complete solution.

Module 6: Integrating ISA Server 2004 and Microsoft Exchange Server.

Module 9: Implementing Caching. Overview Caching Overview Configuring General Cache Properties Configuring Cache Rules Configuring Content Download Jobs.

Extending ISA/IAG beyond the limit. AGAT Security suite - introduction AGAT Security suite is a set of unique components that allow extending ISA / IAG.

Lesson 11: Configuring and Maintaining Network Security

Module 11: Designing Security for Network Perimeters.

1 Network Firewalls CSCI Web Security Spring 2003 Presented By Yasir Zahur.

Microsoft ISA Server 2000 Presented by Ricardo Diaz Ryan Fansa.

Module 7: Implementing Security Using Group Policy.

Module 10: Windows Firewall and Caching Fundamentals.

Module 12: Implementing ISA Server 2004 Enterprise Edition: Back-to-Back Firewall Scenario.

Firewall Technology and InterCell Communication Peter T. Dinsmore Trusted Information Systems Network Associates Inc 3060 Washington Rd (Rt. 97) Glenwood,

Securing the Network Perimeter with ISA Server 2004 Ravi Sankar IT Professional Evangelist Microsoft.

3/5/2016Faculty : Trần Thị Ngọc Hoa1 From Proxy Server To ISA 2006  Overview  History  Functions  Caching Process  Caching Types  How does it work.

Regan Little. Definition Methods of Screening Types of Firewall Network-Level Firewalls Circuit-Level Firewalls Application-Level Firewalls Stateful Multi-Level.

Unit 2 Personal Cyber Security and Social Engineering Part 2.

Presented By Hareesh Pattipati.  Introduction  Firewall Environments  Type of Firewalls  Future of Firewalls  Conclusion.

Firewalls. Overview of Firewalls As the name implies, a firewall acts to provide secured access between two networks A firewall may be implemented as.

25/09/ Firewall, IDS & IPS basics. Summary Firewalls Intrusion detection system Intrusion prevention system.

Defining Network Infrastructure and Network Security Lesson 8.

Security fundamentals

TMG Client Protection 6NPS – Session 7.

Module 3: Enabling Access to Internet Resources

Enabling Secure Internet Access with TMG

CONNECTING TO THE INTERNET

Securing the Network Perimeter with ISA 2004

Firewall – Survey Purpose of a Firewall Characteristic of a firewall

Configuring TMG as a Firewall

Firewall Installation

Presentation transcript:

Module 7: Advanced Application and Web Filtering

Overview Advanced Application and Web Filtering Overview Configuring HTTP Web Filters Additional Application and Web Filters

Lesson: Advanced Application and Web Filtering Overview What Is an Application Filter? What Is a Web Filter? Why Use Application and Web Filters? Application and Web Filter Architecture

What Is an Application Filter? Application filters can: Enable firewall traversal for complex protocols Enable protocol-level intrusion detection Enable protocol-level content filtering Generate alerts and log events ISA Server Application Server

What Is a Web Filter? Web filters can: Scan and modify HTTP requests Scan and modify HTTP responses Block specified responses Log and analyze traffic Encrypt and compress data Implement custom authentication schemes ISA Server Web Server

Why Use Application and Web Filters? Application and Web filters provide: Protection against malicious code by blocking packets that have worm or virus characteristics Protection against user actions by blocking the download of harmful programs or ensuring that some types of data do not leave the network Protection against specific network connections by blocking connection attempts by specific applications Integration with third-party or custom filters that have been developed using the application filter API or the Web filter API Protection against malicious code by blocking packets that have worm or virus characteristics Protection against user actions by blocking the download of harmful programs or ensuring that some types of data do not leave the network Protection against specific network connections by blocking connection attempts by specific applications Integration with third-party or custom filters that have been developed using the application filter API or the Web filter API

Web Proxy Filter Web Filter API Application Filter API Application and Web Filter Architecture Rules Engine Rules Engine 3 3 Application Filters Web Filters Firewall Service Firewall Engine

Lesson: Configuring HTTP Web Filters HTTP Web Filtering Overview How to Configure HTTP Web Filter General Properties How to Configure HTTP Web Filter Methods How to Configure HTTP Web Filter Extensions How to Configure HTTP Web Filter Headers How to Configure HTTP Web Filter Signatures How to Identify an HTTP Application Signature Best Practice: HTTP Filter Configuration for Web Publishing

HTTP Web Filtering Overview Use HTTP filtering to: HTTP filtering is rule specific so you can configure different filters for each access or publishing rule Use HTTP filtering to: HTTP filtering is rule specific so you can configure different filters for each access or publishing rule Filter traffic from internal clients to other networks Filter traffic from Internet clients to internal Web servers Filter traffic from internal clients to other networks Filter traffic from Internet clients to internal Web servers HTTP filters enable filtering of HTTP packets based on several criteria

How to Configure HTTP Web Filter General Properties Configure maximum payload length Configure maximum payload length Configure maximum URL and query length Configure maximum URL and query length Configure maximum header length Configure maximum header length

How to Configure HTTP Web Filter Methods Configure allowed or blocked methods Configure allowed or blocked methods

How to Configure HTTP Web Filter Extensions Configure allowed or blocked extensions Configure allowed or blocked extensions

How to Configure HTTP Web Filter Headers Configure server header settings Configure server header settings Configure Via header settings Configure Via header settings Configure headers that will be blocked Configure headers that will be blocked

How to Configure HTTP Web Filter Signatures Configure blocked signatures Configure blocked signatures

GET. GET. How to Identify an HTTP Application Signature Request Header Request Header HTTP Header HTTP Header Signature HTTP Request

Best Practice: HTTP Filter Configuration for Web Publishing To configure a baseline HTTP filter: Configure maximum header, payload, URL and query lengths Verify normalization and do not block high-bit characters Allow only GET, HEAD, and POST Block executable and server side includes extensions Block potentially malicious signatures Configure maximum header, payload, URL and query lengths Verify normalization and do not block high-bit characters Allow only GET, HEAD, and POST Block executable and server side includes extensions Block potentially malicious signatures Use the httpfilterconfig.vbs script from the ISA Server CD to import and export HTTP filter configurations

Practice: Configuring HTTP Filtering Testing HTTP Connections with Default HTTP Filter Importing and Testing Sample HTTP Filter Settings Modifying HTTP Filter Settings Den-Web-01 Internet Den-ISA-01 Den-DC-01 Gen-Web-01

Lesson: Additional Application and Web Filters About the FTP Application Filter About the SOCKS V4 Application Filter Other Application and Web Filters How to Develop Application and Web Filters

About the FTP Application Filter ISA Server Contoso Ltd FTP Site Connect on Port 20 Reply to port 2457 Connect on Port 20 Reply to port 2457 Connect on Port 21 Reply to port 2456 Connect on Port 21 Reply to port 2456 ftp://ftp.contoso.com

About the SOCKS Version 4 Application Filter ISA Server Application Server SOCKS Application

Other Application and Web Filters ISA Server 2004 includes: Application filters that enable complex and secure client to server connections while hiding the complexity of the firewall configuration from the administrator Web filters to implement features such as special authentication mechanisms and link translation Application filters that enable complex and secure client to server connections while hiding the complexity of the firewall configuration from the administrator Web filters to implement features such as special authentication mechanisms and link translation

How to Develop Application and Web Filters ISA Server filters that can be developed include: Protocol-enabling filters Protocol-scanning filters Redirection filters NAT supporting filters Intrusion detection filters Content filtering filters Protocol-enabling filters Protocol-scanning filters Redirection filters NAT supporting filters Intrusion detection filters Content filtering filters Use the ISA Server SDK to create custom filters

Lab: Configuring the HTTP Web Filter Exercise 1: Identifying an Application Method and Signature Exercise 2: Modifying the HTTP Web Filter Den-Web-01 Internet Den-ISA-01 Den-DC-01 Gen-Web-01