cryptography and network security chapter 22
DESCRIPTION
Cryptography and Network Security Chapter 22. Fifth Edition by William Stallings Lecture slides by Lawrie Brown. Chapter 22 – Firewalls. The function of a strong position is to make the forces holding it practically unassailable — On War, Carl Von Clausewitz. Introduction. - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/1.jpg)
Cryptography and Cryptography and Network SecurityNetwork Security
Chapter 22Chapter 22
Fifth EditionFifth Edition
by William Stallingsby William Stallings
Lecture slides by Lawrie BrownLecture slides by Lawrie Brown
![Page 2: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/2.jpg)
Chapter 22 – FirewallsChapter 22 – Firewalls
The function of a strong position is to make The function of a strong position is to make the forces holding it practically the forces holding it practically unassailableunassailable
——On War, On War, Carl Von ClausewitzCarl Von Clausewitz
![Page 3: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/3.jpg)
IntroductionIntroduction
seen evolution of information systemsseen evolution of information systems now everyone want to be on the Internet now everyone want to be on the Internet and to interconnect networks and to interconnect networks has persistent security concernshas persistent security concerns
can’t easily secure every system in orgcan’t easily secure every system in org typically use a typically use a FirewallFirewall to provide to provide perimeter defenceperimeter defence as part of comprehensive security strategyas part of comprehensive security strategy
![Page 4: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/4.jpg)
What is a Firewall?What is a Firewall?
a a choke pointchoke point of control and monitoring of control and monitoring interconnects networks with differing trustinterconnects networks with differing trust imposes restrictions on network servicesimposes restrictions on network services
only authorized traffic is allowed only authorized traffic is allowed auditing and controlling accessauditing and controlling access
can implement alarms for abnormal behaviorcan implement alarms for abnormal behavior provide NAT & usage monitoringprovide NAT & usage monitoring implement VPNs using IPSecimplement VPNs using IPSec must be immune to penetrationmust be immune to penetration
![Page 5: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/5.jpg)
What is a Firewall?What is a Firewall?
![Page 6: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/6.jpg)
Firewall LimitationsFirewall Limitations cannot protect from attacks bypassing itcannot protect from attacks bypassing it
eg sneaker net, utility modems, trusted eg sneaker net, utility modems, trusted organisations, trusted services (eg SSL/SSH)organisations, trusted services (eg SSL/SSH)
cannot protect against internal threatscannot protect against internal threats eg disgruntled or colluding employeeseg disgruntled or colluding employees
cannot protect against access via WLANcannot protect against access via WLAN if improperly secured against external useif improperly secured against external use
cannot protect against malware imported cannot protect against malware imported via laptop, PDA, storage infected outsidevia laptop, PDA, storage infected outside
![Page 7: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/7.jpg)
Firewalls – Packet FiltersFirewalls – Packet Filters
simplest, fastest firewall component simplest, fastest firewall component foundation of any firewall system foundation of any firewall system examine each IP packet (no context) and examine each IP packet (no context) and
permit or deny according to rules permit or deny according to rules hence restrict access to services (ports)hence restrict access to services (ports) possible default policiespossible default policies
that not expressly permitted is prohibited that not expressly permitted is prohibited that not expressly prohibited is permittedthat not expressly prohibited is permitted
![Page 8: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/8.jpg)
Firewalls – Packet FiltersFirewalls – Packet Filters
![Page 9: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/9.jpg)
Firewalls – Packet FiltersFirewalls – Packet Filters
![Page 10: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/10.jpg)
Attacks on Packet FiltersAttacks on Packet Filters
IP address spoofingIP address spoofing fake source address to be trustedfake source address to be trusted add filters on router to blockadd filters on router to block
source routing attackssource routing attacks attacker sets a route other than defaultattacker sets a route other than default block source routed packetsblock source routed packets
tiny fragment attackstiny fragment attacks split header info over several tiny packetssplit header info over several tiny packets either discard or reassemble before checkeither discard or reassemble before check
![Page 11: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/11.jpg)
Firewalls – Stateful Packet FiltersFirewalls – Stateful Packet Filters traditional packet filters do not examine traditional packet filters do not examine
higher layer contexthigher layer context ie matching return packets with outgoing flowie matching return packets with outgoing flow
stateful packet filters address this needstateful packet filters address this need they examine each IP packet in contextthey examine each IP packet in context
keep track of client-server sessionskeep track of client-server sessions check each packet validly belongs to onecheck each packet validly belongs to one
hence are better able to detect bogus hence are better able to detect bogus packets out of contextpackets out of context
may even inspect limited application datamay even inspect limited application data
![Page 12: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/12.jpg)
Firewalls - Firewalls - Application Level Application Level Gateway (or Proxy)Gateway (or Proxy)
have application specific gateway / proxy have application specific gateway / proxy has full access to protocol has full access to protocol
user requests service from proxy user requests service from proxy proxy validates request as legal proxy validates request as legal then actions request and returns result to userthen actions request and returns result to user can log / audit traffic at application level can log / audit traffic at application level
need separate proxies for each service need separate proxies for each service some services naturally support proxying some services naturally support proxying others are more problematic others are more problematic
![Page 13: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/13.jpg)
Firewalls - Firewalls - Application Level Application Level Gateway (or Proxy)Gateway (or Proxy)
![Page 14: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/14.jpg)
Firewalls - Firewalls - Circuit Level GatewayCircuit Level Gateway
relays two TCP connectionsrelays two TCP connections imposes security by limiting which such imposes security by limiting which such
connections are allowedconnections are allowed once created usually relays traffic without once created usually relays traffic without
examining contentsexamining contents typically used when trust internal users by typically used when trust internal users by
allowing general outbound connectionsallowing general outbound connections SOCKS is commonly usedSOCKS is commonly used
![Page 15: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/15.jpg)
Firewalls - Firewalls - Circuit Level GatewayCircuit Level Gateway
![Page 16: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/16.jpg)
Bastion HostBastion Host
highly secure host system highly secure host system runs circuit / application level gateways runs circuit / application level gateways or provides externally accessible servicesor provides externally accessible services potentially exposed to "hostile" elements potentially exposed to "hostile" elements hence is secured to withstand thishence is secured to withstand this
hardened O/S, essential services, extra authhardened O/S, essential services, extra auth proxies small, secure, independent, non-privileged proxies small, secure, independent, non-privileged
may support 2 or more net connectionsmay support 2 or more net connections may be trusted to enforce policy of trusted may be trusted to enforce policy of trusted
separation between these net connectionsseparation between these net connections
![Page 17: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/17.jpg)
Host-Based FirewallsHost-Based Firewalls
s/w module used to secure individual hosts/w module used to secure individual host available in many operating systems available in many operating systems or can be provided as an add-on packageor can be provided as an add-on package
often used on serversoften used on servers advantages:advantages:
can tailor filtering rules to host environmentcan tailor filtering rules to host environment protection is provided independent of topologyprotection is provided independent of topology provides an additional layer of protectionprovides an additional layer of protection
![Page 18: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/18.jpg)
Personal FirewallsPersonal Firewalls controls traffic between PC/workstation controls traffic between PC/workstation
and Internet or enterprise networkand Internet or enterprise network a software module on personal computera software module on personal computer or in home/office DSL/cable/ISP routeror in home/office DSL/cable/ISP router typically much less complex than other typically much less complex than other
firewall typesfirewall types primary role to deny unauthorized remote primary role to deny unauthorized remote
access to the computeraccess to the computer and monitor outgoing activity for malwareand monitor outgoing activity for malware
![Page 19: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/19.jpg)
Personal FirewallsPersonal Firewalls
![Page 20: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/20.jpg)
Firewall ConfigurationsFirewall Configurations
![Page 21: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/21.jpg)
Firewall ConfigurationsFirewall Configurations
![Page 22: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/22.jpg)
Firewall ConfigurationsFirewall Configurations
![Page 23: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/23.jpg)
DMZ DMZ NetworksNetworks
![Page 24: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/24.jpg)
Virtual Private NetworksVirtual Private Networks
![Page 25: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/25.jpg)
Distributed Distributed FirewallsFirewalls
![Page 26: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/26.jpg)
Summary of Firewall Summary of Firewall Locations and TopologiesLocations and Topologies
host-resident firewallhost-resident firewall screening routerscreening router single bastion inlinesingle bastion inline single bastion Tsingle bastion T double bastion inlinedouble bastion inline double bastion Tdouble bastion T distributed firewall configurationdistributed firewall configuration
![Page 27: Cryptography and Network Security Chapter 22](https://reader033.vdocuments.us/reader033/viewer/2022061311/56813223550346895d98846e/html5/thumbnails/27.jpg)
SummarySummary
have considered:have considered: firewallsfirewalls types of firewallstypes of firewalls
• packet-filter, stateful inspection, application proxy, packet-filter, stateful inspection, application proxy, circuit-levelcircuit-level
basingbasing• bastion, host, personalbastion, host, personal
location and configurationslocation and configurations• DMZ, VPN, distributed, topologiesDMZ, VPN, distributed, topologies