3. Network Security Major Problems Network Security Major Problems Why Firewall? Why Firewall? Problems with Firewalls Problems with Firewalls What is an Intrusion Detector? What is an Intrusion Detector? Problems with Intrusion Detectors Problems with Intrusion Detectors What is a Content Management Firewall? What is a Content Management Firewall? HACKTRAP Features HACKTRAP Features Future Trends Future Trends Demo Demo Topics

4. Network Security Major Problems Providing information confidentiality. Providing information confidentiality. Providing data integrity. Providing data integrity. Protecting network services availability. Protecting network services availability.

5. Why Firewall?

6. Problems with Firewalls Checks packet headers ONLY Checks packet headers ONLY Does NOT detect header intrusions Does NOT detect header intrusions

8. What is an Intrusion Detector? A tool that detects intrusion attempts. A tool that detects intrusion attempts. Alerts the network administrator with detected intrusions. Alerts the network administrator with detected intrusions.

9. Problems with Intrusion Detectors Does NOT take permanent actions Does NOT take permanent actions Does NOT block specific IPs and PORTs Does NOT block specific IPs and PORTs

10. Intrusion Detector

11. What is a Content Management Firewall? A new approach of firewalls. A new approach of firewalls. Combines the features of BOTH Firewalls and Intrusion Detectors. Combines the features of BOTH Firewalls and Intrusion Detectors. Checks NOT ONLY packet’s header but contents as well. Checks NOT ONLY packet’s header but contents as well. Blocks the source of the detected intrusions. Blocks the source of the detected intrusions.

12. HACKTRAP A content management firewall IS OUR SOLUTION

13. HACKTRAP

14. HACKTRAP Features Three Security Levels Three Security Levels FRA ( Fast Response Action ) Firewall RulesFRA ( Fast Response Action ) Firewall Rules IDS ( Intrusion Detection system ) AlertsIDS ( Intrusion Detection system ) Alerts ISS (Integrated security system) feedback from IDS to FRAISS (Integrated security system) feedback from IDS to FRA

15. External Network Internal Network ISS FRA IDS 1 2 3 13 HACKTRAP Model Generate FRA

16. HACKTRAP Features Dynamic Action Generation Dynamic Action Generation FWRule IDSPRule IDMPRule FRActions

17. Administrator point of viewAdministrator point of view Add and Remove types of attacks. Add and Remove types of attacks. Different types of alerts : popup messages, Data base, XML format,TCP dump format. Different types of alerts : popup messages, Data base, XML format,TCP dump format. Restrict and unrestrict hosts accessing firewall. Restrict and unrestrict hosts accessing firewall. Close and open different services (ports) for outside hosts. Close and open different services (ports) for outside hosts. Developer point of viewDeveloper point of view Intrusions can be easily implemented Intrusions can be easily implemented HACKTRAP Features

18. Future Work Enhance for better performance. Enhance for better performance. Using iptables with the ipchains. Using iptables with the ipchains. Using ACID to make a good analysis on the intrusion detection output to the data base and display neat graphs representing it. Using ACID to make a good analysis on the intrusion detection output to the data base and display neat graphs representing it. Adding another output modules such as email & SMS. Adding another output modules such as email & SMS.

19. Internet LAN Hacker Web Server Unix Server

20. Internet xy yz x y Packet forwarding And NAT (Masquerading) xy x V Z V

21. rule4 rule3 rule2 rule1 Input chain rule4 rule3 rule2 Forward chain rule4 rule3 rule2 Output chain router d e m a s q log host Local process DENYACCEPT

23. + preprocessorAttacks rules Input chain Forward chain Output chain Log file Samba alert database Alert file

24. Demo

25. Internet LAN Hacker Windows Lunix HACKTRAP