CS 356 – Lecture 19 and 20 Firewalls and Intrusion Prevention

Spring 2013 Review • Chapter 1: Basic Concepts and Terminology • Chapter 2: Basic Cryptographic Tools • Chapter 3 – User Authentication • Chapter 4 – Access Control Lists • Chapter 5 – Database Security (skipped) • Chapter 6 – Malicious Software • Networking Basics (not in book) • Chapter 7 – Denial of Service • Chapter 8 – Intrusion Detection • Chapter 9 – Firewalls and Intrusion Prevention Chapter 9

Firewalls and Intrusion Prevention Systems

The Need For Firewalls l internet connectivity is essential l however it creates a threat l effective means of protecting LANs l inserted between the premises network and the Internet to establish a controlled link l can be a single computer system or a set of two or more systems working together l used as a perimeter defense l single choke point to impose security and auditing l insulates the internal systems from external networks Firewall Characteristics

design goals techniques used by • all traffic from inside to firewalls to control outside must pass through access and enforce the the firewall site’s security policy are: • only authorized traffic as defined by the local security • service control policy will be allowed to pass • direction control • the firewall itself is immune to • user control penetration • behavior control capabilities: • defines a single choke point • provides a location for monitoring security events • convenient platform for several Internet functions that are not security related • can serve as the platform for IPSec limitations: • cannot protect against attacks bypassing firewall • may not protect fully against internal threats • improperly secured wireless LAN can be accessed from outside the organization • laptop, PDA, or portable storage device may be infected outside the corporate network then used internally Types of Firewalls Packet Filtering Firewall

• applies rules to each incoming and outgoing IP packet – typically a list of rules based on matches in the IP or TCP header – forwards or discards the packet based on rules match

filtering rules are based on information contained in a network packet

• source IP address • destination IP address • source and destination transport-level address • IP protocol field • interface • two default policies: – discard - prohibit unless expressly permitted • more conservative, controlled, visible to users – forward - permit unless expressly prohibited • easier to manage and use but less secure Packet Filter Rules Packet Filter Advantages And Weaknesses • advantages – simplicity – typically transparent to users and are very fast • weaknesses – cannot prevent attacks that employ application specific vulnerabilities or functions – limited logging functionality – do not support advanced user authentication – vulnerable to attacks on TCP/IP protocol bugs – improper configuration can lead to breaches Stateful Inspection Firewall

tightens rules for TCP reviews packet information traffic by creating a but also records directory of outbound TCP information about TCP connections connections

• there is an entry for each • keeps track of TCP sequence currently established numbers to prevent attacks connection that depend on the sequence number • packet filter allows incoming traffic to high numbered ports • inspects data for protocols only for those packets that fit like FTP, IM and SIPS the profile of one of the commands entries in this directory Stateful Firewall Connection State Table Application-Level Gateway l also called an application proxy l acts as a relay of application-level traffic l user contacts gateway using a TCP/IP application l user is authenticated l gateway contacts application on remote host and relays TCP segments between server and user l must have proxy code for each application l may restrict application features supported l tend to be more secure than packet filters l disadvantage is the additional processing overhead on each connection Circuit-Level circuit level proxy Gateway

• sets up two TCP connections, one between itself and a TCP user on an inner host and one on an outside host • relays TCP segments from one connection to the other without examining contents • security function consists of determining which connections will be allowed

typically used when inside users are trusted

• may use application-level gateway inbound and circuit- level gateway outbound • lower overheads SOCKS Circuit-Level Gateway l SOCKS v5 defined in components RFC1928 l designed to provide a framework for client-server applications in TCP/UDP SOCKS- SOCKS domains to conveniently and ified client securely use the services of a applications server network firewall l client application contacts SOCKS server, authenticates, SOCKS sends relay request client library • server evaluates and either establishes or denies the connection Types of Firewalls Bastion Hosts l system identified as a critical strong point in the network’s security l serves as a platform for an application-level or circuit-level gateway l common characteristics: l runs secure O/S, only essential services l may require user authentication to access proxy or host l each proxy can restrict features, hosts accessed l each proxy is small, simple, checked for security l each proxy is independent, non-privileged l limited disk use, hence read-only code Host-Based Firewalls

• used to secure an individual host • available in operating systems or can be provided as an add-on package • filter and restrict packet flows • common location is a server

advantages:

• filtering rules can be tailored to the host environment • protection is provided independent of topology • provides an additional layer of protection Personal Firewall l controls traffic between a personal computer or workstation and the Internet or enterprise network l for both home or corporate use l typically is a software module on a personal computer l can be housed in a router that connects all of the home computers to a DSL, cable modem, or other Internet interface l typically much less complex than server-based or stand-alone firewalls l primary role is to deny unauthorized remote access l may also monitor outgoing traffic to detect and block worms and malware activity Personal Firewall Interface Firewall Configuration Virtual Private Networks (VPNs) Distributed Firewall Configuration Firewall Topologies

• includes personal firewall software and firewall host-resident firewall software on servers

• single router between internal and external networks screening router with stateless or full packet filtering

• single firewall device between an internal and single bastion inline external router

• has a third network interface on bastion to a DMZ single bastion T where externally visible servers are placed double bastion inline • DMZ is sandwiched between bastion firewalls

• DMZ is on a separate network interface on the double bastion T bastion firewall

distributed firewall • used by large businesses and government configuration organizations Intrusion Prevention Systems (IPS) l recent addition to security products l inline network-based IDS that can block traffic l functional addition to firewall that adds IDS capabilities l can block traffic like a firewall l makes use of algorithms developed for IDSs l may be network or host based Host-Based IPS (HIPS) l identifies attacks using both signature and anomaly detection techniques • signature: focus is on the specific content of application payloads in packets, looking for patterns that have been identified as malicious • anomaly: IPS is looking for behavior patterns that indicate malware l can be tailored to the specific platform l can also use a sandbox approach to monitor behavior

advantages

• the various tools work closely together • threat prevention is more comprehensive • management is easier Network-Based IPS (NIPS) l inline NIDS with the authority to discard packets and tear down TCP connections l uses signature and anomaly detection l may provide flow data protection l monitoring full application flow content l can identify malicious packets using: l pattern matching l stateful matching l protocol anomaly l traffic anomaly l statistical anomaly Snort Inline l enables Snort to function as an intrusion prevention capability drop reject Sdrop l includes a replace option which allows the Snort Snort user to modify packets packet is rejects a rejected packet rather than drop them and based on result is the packet is l useful for a honeypot logged rejected options and an but not implementation defined error logged in the message l attackers see the rule and is logs the failure but can’t figure returned out why it occurred result Unified Threat Management Products Sidewinder G2 Security Appliance Attack Protections Summary - Transport Level Examples Sidewinder G2 Security Appliance Attack Protections Summary - Application Level

Examples (page 1 of 2) Summary l firewalls l firewall location and l need for configurations l characteristics of l DMZ networks l techniques l virtual private networks l distributed firewalls l capabilities/limitations l intrusion prevention systems l types of firewalls (IPS) l packet filtering firewall l host-based IPS (HIPS) l stateful inspection firewalls l network-based IPS (NIPS) l application proxy firewall l Snort Inline l circuit level proxy firewall l UTM products l bastion host l host-based firewall l personal firewall