WHITE PAPER Network Security: A Simple Guide to Firewalls Network Security There are experts who say, “If you are connected to the Internet, you need a firewall.” The decision may not be A Simple Guide to Firewalls more complicated than that. However, you’ll probably consider a combina- Loss of irreplaceable data is a very real tion of factors. Start with the basic threat for any business owner whose questions you’d ask about any other network connects to the outside world. security system. Remote access for employees and con- nection to the Internet may improve Do I Have Anything Worth communication in ways you’ve hardly Protecting? imagined. Access to the Internet can Be sure to consider: open the world to communicating with customers and vendors, and is an • Confidential client, supplier, or immense source of information. But employee information that might these same opportunities open a local expose you to a lawsuit if you allow area network (LAN) to the possibility someone else to capture it of attack by thieves and vandals and abuse by your own employees. • Intellectual property that gives you a competitive edge in the market Figuring out the right amount of secu- CONTENTS rity for your network takes some con- • Critical business records that would sideration. The first thing to consider is have to be recovered and/or Why a Firewall—Am I Really at what your data is worth. A quick recreated Risk? . 1 answer is, “Maybe more than you think.” When you consider the value of What Is a Firewall? . 2 It isn’t always safe to assume that no your data, remember risks such as legal one else wants your data. Some hack- Types of Attack . 2 liability and loss of competitive edge, or ers operate on a nonprofit basis. They the effect of lost production if your net- Firewall Technologies . 3 may capture data or vandalize your work is compromised. Many analysts system just because they can. Additional Firewall Features say very bluntly, “If you are on the and Functionality . 4 Internet, you need a firewall.” Aren’t My Valuables Already Choosing a Firewall . 5 The benefits of connecting to the Inter- Adequately Protected? Designing a Firewall into net are clear. This paper discusses the The truth is that if you have valuable Your Network . 6 risks you face when you connect to the electronic property, it may not be as Internet, describes the types of attacks safe as you would like to think it is. Conclusion . 6 that can occur, and offers an overview You can do a lot to protect your sys- of firewall technology, which can protect tem if you: your network from hackers. Specifically, the paper discusses the implementation • Back up your information every of a firewall and what you should con- night sider in choosing the type of firewall you require. • Set up unshared folders behind tough passwords and password Why a Firewall—Am I rules Really at Risk? • Use your access router or browser Anyone can become a hacker. It to filter incoming traffic from all doesn’t require a technological whiz but trusted sites kid to wreak havoc on your network. A wide range of tools and utilities can Unfortunately, hackers have many be easily downloaded from the Inter- sophisticated software tools at their net; and with their help, almost any- disposal. Given enough time and one can become a competent hacker determination, a skilled hacker may at the touch of a button. get through the standard safeguards. 1 If he does, he can run software pro- • It screens outgoing traffic to limit grams to break your passwords. If Internet use and/or access to remote you have valuable data on your net- sites. work and the network is exposed to outside computers, chances are very Screening Levels good you need a firewall. A firewall can screen both incoming and outgoing traffic. Because incom- What Is a Firewall? ing traffic poses a greater threat to the A firewall is a system that enforces an network, it’s usually screened more access control policy between two closely than outgoing traffic. networks—such as your private LAN and the unsafe, public Internet. The When you are looking at firewall firewall determines which inside ser- hardware or software products, you’ll vices can be accessed from the out- probably hear about three types of side, and vice versa. The actual means screening that firewalls perform: 3DES Data Encryption Standard by which this is accomplished varies • Screening that blocks any incoming (168-bit) widely, but in principle, the firewall can be thought of as a pair of mecha- data not specifically ordered by a DMZ demilitarized zone nisms: one to block traffic, and one to user on the network permit traffic. A firewall is more than DoS denial of service the locked front door to your net- • Screening by the address of the FTP File Transfer Protocol work—it’s your security guard as sender well. HTTP Hypertext Transfer Protocol • Screening by the contents of the ICSA International Computer Firewalls are also important because communication Security Association they provide a single “choke point” where security and audits can be Think of screening levels as a process LAN local area network imposed. A firewall can provide a net- of elimination. The firewall first work administrator with data about determines whether the incoming NAT Network Address Translation what kinds and amount of traffic transmission is something requested POP3 Post Office Protocol, Version 3 passed through it, how many attempts by a user on the network, rejecting were made to break into it, and so on. anything else. Anything that is SMTP Simple Mail Transfer Protocol Like a closed circuit security TV sys- allowed in is then examined more TCP/IP Transmission Control tem, your firewall not only prevents closely. The firewall checks the sender’s computer address to ensure Protocol/Internet Protocol access, but also monitors who’s been sniffing around, and assists in identi- that it is a trusted site. It also checks VPN virtual private network fying those who attempt to breach the contents of the transmission. your security. WAN wide area network Types of Attack Basic Purpose of a Firewall Before determining exactly what type Basically, a firewall does three things of firewall you need, you must first to protect your network: understand the nature of security threats that exist. The Internet is one • It blocks incoming data that might large community, and as in any com- contain a hacker attack. munity it has both good and bad ele- ments. The bad elements range from • It hides information about the net- incompetent outsiders who do dam- work by making it seem that all age unintentionally, to the proficient, outgoing traffic originates from the malicious hackers who mount deliber- firewall rather than the network. ate assaults on companies using the This is called Network Address Internet as their weapon of choice. Translation (NAT). NETWORK SECURITY 2 Generally there are three types of Denial-of-Service Attacks attack that could potentially affect DoS attacks are purely malicious. your business: They don’t result in any gain for the hacker other than the “joy” of render- • Information theft: Stealing company ing the network, or parts of it, confidential information, such as unavailable for legitimate use. DoS employee records, customer records, attacks overload a system so that it or company intellectual property isn’t available—they deny your abil- ity to use your network service. To • Information sabotage: Changing overload the system, the hacker sends information in an attempt to dam- very large packets of data or programs age an individual or company’s rep- that require the system to respond utation, such as changing employee continuously to a bogus command. medical or educational records or uploading derogatory content onto To launch a DoS attack, a hacker must your Web site know the IP address of the target machine. A good firewall doesn’t • Denial of service (DoS): Bringing reveal its own IP address or the IP down your company’s network or addresses on the LAN. The hacker servers so that legitimate users can- may think he has contacted the net- not access services, or so that nor- work when he has only contacted the mal company operations such as firewall—and he can’t lock up the production are impeded network from there. Furthermore, when a hacker launches an attack, Attempts to Gain Access some firewalls can identify the incom- A hacker may attempt to gain access ing data as an attack, reject the data, for sport or greed. An attempt to gain alert the system administrator, and access usually starts with gathering track the data back to the sender, information about the network. Later who can then be apprehended. attacks use that information to achieve the real purpose—to steal or destroy Firewall Technologies data. Firewalls come in all shapes, sizes, and prices. Choosing the correct one A hacker may use a port scanner—a depends mainly on your business piece of software that can map a net- requirements and the size of your net- work. It is then possible to find out work. This section discusses the dif- how the network is structured and ferent types of firewall technologies what software is running on it. and formats available. Once the hacker has a picture of the Above all, no matter what type of network, he can exploit known soft- firewall you choose or its functional- ware weaknesses and use hacking ity, you must ensure that it is secure tools to wreak havoc. It is even possi- and that a trusted third party, such as ble to get into the administrator’s files the International Computer Security and wipe the drives, although a good Association (ICSA), has certified it.