1. 1 OFF SYMB - 12/7/2015 Firewalls Basics

2. 2 OFF SYMB - 12/7/2015 Overview Why we have firewalls What a firewall does Why is the firewall configured the way it is

3. 3 OFF SYMB - 12/7/2015 Why Do We Have Firewalls?? Recent Network Security Compromises — Pentagon Domain Name Server — March AFB Web Server — Senate Web Server Network hacking has been simplified by the proliferation of tools available on the Internet — Satan — Crack — Ping of Death

4. 4 OFF SYMB - 12/7/2015 Why Do We Have Firewalls?? l Establishes a physical perimeter to protect your internal assets. l Centralizes & consolidates management & enforcement of network access policies. $ l Saves $ by consolidating security measures, investments, & admin. but... l … also consolidates your risks (all eggs in one basket) Guard or Firewall Internet Attackers User Local area network User Internal Servers User Internal Servers Components: Your Policy: “ Deny access to any service unless it is expressly permitted ” implemented & enforced via a combination of: Each Component performs a different role in implementing your policy Hardware, OS Software, Application Software

5. 5 OFF SYMB - 12/7/2015 What does the Firewall Do?? Overview Proxying Stateful Packet Inspection IP Filtering Access Control Lists Network Address Translation Logging Centralized Security Policy Type Enforcement

6. 6 OFF SYMB - 12/7/2015 Proxying Proxies are applications “running” on the firewall built to intercept communications for specific protocols and will explicitly allow only necessary, secure, and valid operations. — Proxies are written by the vendor to handle a specific type of traffic (RealAudio, SQL*NET) — Proxies examine all packets of a connection and therefore exact a performance penalty

7. 7 OFF SYMB - 12/7/2015 Stateful Packet Inspection Stateful Packet Inspection (SPI) technology keeps tables to track the status of each connection, as well as commands that appear in the data stream, and regulates traffic flow accordingly. — The tables are checked before data is processed by the OS of the firewall — Header information from the original connection passes through the firewall unchanged if the defined policy allows the access.

8. 8 OFF SYMB - 12/7/2015 IP Filtering IP Filtering allows all ports for a particular protocol (TCP,UDP,ICMP) to pass through the firewall — IP filters allows packets to pass through unaltered and does not check headers for traffic types — IP filtering provides very little protection and should not be used (Consider it a hole in the firewall)

9. 9 OFF SYMB - 12/7/2015 Access Control Lists Access Control List (ACL) is a mechanism that permits IP addresses to communicate in accordance to certain rules ACLs are used in conjunction with proxies, SPI, and IP filters ACLs provide granularity to the control over access

10. 10 OFF SYMB - 12/7/2015 Network Address Translation Network Address Translation (NAT) hides the addresses of all devices initiating connections from inside your network by converting their source address to the firewall's external address. NAT prevents external threats from gaining knowledge of the internal network structure of the base

11. 11 OFF SYMB - 12/7/2015 Logging Firewalls provide a central logging point that records all connections both successful and failed These logs can then be parsed to determine problem areas ( i.e. Misconfigured internal machines, person engaging in improper use of the network)

12. 12 OFF SYMB - 12/7/2015 Centralized Security Policy Reduces the number of systems that are exposed to security risks as only the firewall is exposed to attacks from the Internet Gives a single point at which an administrator can control network access to and from the Internet Simplifies security management by providing a GUI

13. 13 OFF SYMB - 12/7/2015 Type Enforcement Advantages l Provides “breach containment” l Separates applications into domains l Controls which resources each domain can access l Software in a domain is granted access only to resources it needs, and forbidden access to anything else l An access violation is triggered if any access outside of the current domain is attempted l Restricts malicious activity to the offending or compromised domain l Unique to the Sidewinder firewall Admin User News Network Telnet FTP WWW

14. 14 OFF SYMB - 12/7/2015 Network Security Policy Defines overall roles and responsibilities of network security Defines security requirements, principles, and policies Network Infrastructure Services and Protocols Policy — Listing of 33 infrastructure services and policies, their vulnerabilities, and usage policy