1. UNIT -5 Password Management Firewall Design Principles.

2. 2 NETWORK SECURITY By: Homera Durani

3. P ASSWORD P ROTECTION User ID and password: User authorized to gain access to the system Privileges accorded to the user Discretionary access control 3 NETWORK SECURITY By: Homera Durani

4. P ASSWORD P ROTECTION Unix system (user ID, cipher text password, plain text salt) password 8 printable characters - 56-bit value (7-bit ASCII) encryption routine (crypt(3)) based on DES modified DES algorithm with 12-bit salt value (related to time of password assignment) 25 encryptions with 64-bit block of zeros input 64-bit - 11 character sequence 4 NETWORK SECURITY By: Homera Durani

5. L OADING A N EW P ASSWORD 5 NETWORK SECURITY By: Homera Durani

6. P ASSWORD P ROTECTION Purposes of salt: Prevents duplicate passwords from being visible Effectively increases password length without the user needing to remember additional 2 characters (possible passwords increased by 4096) Prevent use of hardware DES implementation for a brute-force guessing attack 6 NETWORK SECURITY By: Homera Durani

7. O BSERVED P ASSWORD L ENGTHS I N A P URDUE S TUDY 7 NETWORK SECURITY By: Homera Durani

8. P ASSWORDS C RACKED F ROM A S AMPLE S ET easy pickin’s 8 NETWORK SECURITY By: Homera Durani

9. A CCESS C ONTROL One Method: Deny access to password file Systems susceptible to unanticipated break-ins An accident in protection may render the password file readable compromising all accounts Users have accounts in other protection domains using the same passwords 9 NETWORK SECURITY By: Homera Durani

10. A CCESS C ONTROL Answer: Force users to select passwords that are difficult to guess Goal: Eliminate guessable passwords while allowing the user to select a password that is memorable 10 NETWORK SECURITY By: Homera Durani

11. P ASSWORD S ELECTION S TRATEGIES (B ASIC T ECHNIQUES ) User education Users may ignore the guidelines Computer-generated passwords Poor acceptance by users Difficult to remember passwords 11 NETWORK SECURITY By: Homera Durani

12. P ASSWORD S ELECTION S TRATEGIES Reactive password checking System runs its own password cracker Resource intensive Existing passwords remain vulnerable until reactive checker finds them Proactive password checking Password selection is guided by the system Strike a balance between user accessibility and strength May provide guidance to password crackers (what not to try) Dictionary of bad passwords (space and time problem) 12 NETWORK SECURITY By: Homera Durani

13. P ROACTIVE P ASSWORD C HECKER There are two techniques currently in use: Markov Model – search for guessable password Bloom Filter – search in password dictionary 13 NETWORK SECURITY By: Homera Durani

14. M ARKOV M ODEL Probability that b follows a M = {states, alphabet, prob, order} 14 NETWORK SECURITY By: Homera Durani

15. M ARKOV M ODEL “Is this a bad password?”…same as… “Was this password generated by this Markov model?” Passwords that are likely to be generated by the model are rejected Good results for a second-order model 15 NETWORK SECURITY By: Homera Durani

16. B LOOM F ILTER A probabilistic algorithm to quickly test membership in a large set using multiple hash functions into a single array of bits Developed in 1970 but not used for about 25 years Used to find words in a dictionary also used for web caching Small probability of false positives which can be reduced for different values of k, # hash funcs 16 NETWORK SECURITY By: Homera Durani

17. B LOOM F ILTER A vector v of N bits k independent hash functions. Range 0 to N-1 For each element x, compute hash functions H 1 (x), H 2 (x)…H k (x) Set corresponding bits to 1 Note: A bit in the resulting vector may be set to 1 multiple times H 1 (x)=P 1 H 2 (x)=P 2 H 3 (x)=P 3 H 4 (x)=P 4 Element: x 1 1 1 1 N bits Bit Vector: v 17 NETWORK SECURITY By: Homera Durani

18. B LOOM F ILTER To query for existence of an entry x, compute H 1 (x), H 2 (x)…H k (x) and check if the bits at the corresponding locations are 1 If not, x is definitely not a member Otherwise there may be a false positive (passwords not in the dictionary but that produce a match in the hash table). The probability of a false positive can be reduced by choosing k and N 18 NETWORK SECURITY By: Homera Durani

19. P ERFORMANCE OF B LOOM F ILTER Dictionary of 1 million words with 0.01 probability of rejecting a password We need a hash table of 9.6 X 10 6 bits 19 NETWORK SECURITY By: Homera Durani

20. F IREWALL 20 NETWORK SECURITY By: Homera Durani

21. O UTLINE Firewall Design Principles Firewall Characteristics Types of Firewalls Firewall Configurations 21 NETWORK SECURITY By: Homera Durani

22. F IREWALLS Effective means of protection a local system or network of systems from network-based security threats while affording access to the outside world via WAN`s or the Internet 22 NETWORK SECURITY By: Homera Durani

23. F IREWALL D ESIGN P RINCIPLES Information systems undergo a steady evolution (from small LAN`s to Internet connectivity) Strong security features for all workstations and servers not established 23 NETWORK SECURITY By: Homera Durani

24. F IREWALL D ESIGN P RINCIPLES The firewall is inserted between the premises network and the Internet Aims: Establish a controlled link Protect the premises network from Internet-based attacks Provide a single choke point 24 NETWORK SECURITY By: Homera Durani

25. F IREWALL C HARACTERISTICS Design goals: All traffic from inside to outside must pass through the firewall (physically blocking all access to the local network except via the firewall) Only authorized traffic (defined by the local security police) will be allowed to pass 25 NETWORK SECURITY By: Homera Durani

26. F IREWALL C HARACTERISTICS Design goals: The firewall itself is immune to penetration (use of trusted system with a secure operating system) 26 NETWORK SECURITY By: Homera Durani

27. F IREWALL C HARACTERISTICS Four general techniques: Service control Determines the types of Internet services that can be accessed, inbound or outbound Direction control Determines the direction in which particular service requests are allowed to flow 27 NETWORK SECURITY By: Homera Durani

28. F IREWALL C HARACTERISTICS User control Controls access to a service according to which user is attempting to access it Behavior control Controls how particular services are used (e.g. filter e-mail) 28 NETWORK SECURITY By: Homera Durani

29. T YPES OF F IREWALLS Three common types of Firewalls: Packet-filtering routers Application-level gateways Circuit-level gateways (Bastion host) 29 NETWORK SECURITY By: Homera Durani

30. T YPES OF F IREWALLS Packet-filtering Router 30 NETWORK SECURITY By: Homera Durani

31. T YPES OF F IREWALLS Packet-filtering Router Applies a set of rules to each incoming IP packet and then forwards or discards the packet Filter packets going in both directions The packet filter is typically set up as a list of rules based on matches to fields in the IP or TCP header Two default policies (discard or forward) 31 NETWORK SECURITY By: Homera Durani

32. T YPES OF F IREWALLS Advantages: Simplicity Transparency to users High speed Disadvantages: Difficulty of setting up packet filter rules Lack of Authentication 32 NETWORK SECURITY By: Homera Durani

33. T YPES OF F IREWALLS Possible attacks and appropriate countermeasures IP address spoofing Source routing attacks Tiny fragment attacks 33 NETWORK SECURITY By: Homera Durani

34. T YPES OF F IREWALLS Application-level Gateway 34 NETWORK SECURITY By: Homera Durani

35. T YPES OF F IREWALLS Application-level Gateway Also called proxy server Acts as a relay of application-level traffic 35 NETWORK SECURITY By: Homera Durani

36. T YPES OF F IREWALLS Advantages: Higher security than packet filters Only need to scrutinize a few allowable applications Easy to log and audit all incoming traffic Disadvantages: Additional processing overhead on each connection (gateway as splice point) 36 NETWORK SECURITY By: Homera Durani

37. T YPES OF F IREWALLS Circuit-level Gateway 37 NETWORK SECURITY By: Homera Durani

38. T YPES OF F IREWALLS Circuit-level Gateway Stand-alone system or Specialized function performed by an Application- level Gateway Sets up two TCP connections The gateway typically relays TCP segments from one connection to the other without examining the contents 38 NETWORK SECURITY By: Homera Durani

39. T YPES OF F IREWALLS Circuit-level Gateway The security function consists of determining which connections will be allowed Typically use is a situation in which the system administrator trusts the internal users An example is the SOCKS package 39 NETWORK SECURITY By: Homera Durani

40. T YPES OF F IREWALLS Bastion Host A system identified by the firewall administrator as a critical strong point in the network´s security The bastion host serves as a platform for an application-level or circuit-level gateway 40 NETWORK SECURITY By: Homera Durani

41. F IREWALL C ONFIGURATIONS In addition to the use of simple configuration of a single system (single packet filtering router or single gateway), more complex configurations are possible Three common configurations 41 NETWORK SECURITY By: Homera Durani

42. F IREWALL C ONFIGURATIONS Screened host firewall system (single-homed bastion host) 42 NETWORK SECURITY By: Homera Durani

43. F IREWALL C ONFIGURATIONS Screened host firewall, single-homed bastion configuration Firewall consists of two systems: A packet-filtering router A bastion host 43 NETWORK SECURITY By: Homera Durani

44. F IREWALL C ONFIGURATIONS Configuration for the packet-filtering router: Only packets from and to the bastion host are allowed to pass through the router The bastion host performs authentication and proxy functions 44 NETWORK SECURITY By: Homera Durani

45. F IREWALL C ONFIGURATIONS Greater security than single configurations because of two reasons: This configuration implements both packet-level and application-level filtering (allowing for flexibility in defining security policy) An intruder must generally penetrate two separate systems 45 NETWORK SECURITY By: Homera Durani

46. F IREWALL C ONFIGURATIONS This configuration also affords flexibility in providing direct Internet access (public information server, e.g. Web server) 46 NETWORK SECURITY By: Homera Durani

47. F IREWALL C ONFIGURATIONS Screened host firewall system (dual-homed bastion host) 47 NETWORK SECURITY By: Homera Durani

48. F IREWALL C ONFIGURATIONS Screened host firewall, dual-homed bastion configuration The packet-filtering router is not completely compromised Traffic between the Internet and other hosts on the private network has to flow through the bastion host 48 NETWORK SECURITY By: Homera Durani

49. F IREWALL C ONFIGURATIONS Screened-subnet firewall system 49 NETWORK SECURITY By: Homera Durani

50. F IREWALL C ONFIGURATIONS Screened subnet firewall configuration Most secure configuration of the three Two packet-filtering routers are used Creation of an isolated sub-network 50 NETWORK SECURITY By: Homera Durani

51. F IREWALL C ONFIGURATIONS Advantages: Three levels of defense to thwart intruders The outside router advertises only the existence of the screened subnet to the Internet (internal network is invisible to the Internet) 51 NETWORK SECURITY By: Homera Durani

52. F IREWALL C ONFIGURATIONS Advantages: The inside router advertises only the existence of the screened subnet to the internal network (the systems on the inside network cannot construct direct routes to the Internet) 52 NETWORK SECURITY By: Homera Durani