*Ola FlygtVxj University, Swedenhttp://w3.msi.vxu.se/users/ofl/Ola.Flygt@vxu.se+46 470 70 86 49Firewalls

*OutlineFirewall Design PrinciplesFirewall CharacteristicsTypes of FirewallsFirewall ConfigurationsTrusted SystemsData Access ControlThe Concept of Trusted systemsTrojan Horse Defence

*FirewallsEffective means of protection a local system or network of systems from network-based security threats while affording access to the outside world via WANs or the Internet

*Firewall DesignPrinciplesInformation systems undergo a steady evolution (from small LANs to Internet connectivity)Strong security features for all workstations and servers not established

*Firewall DesignPrinciplesThe firewall is inserted between the premises network and the InternetAims:Establish a controlled linkProtect the premises network from Internet-based attacksProvide a single choke point

*Firewall CharacteristicsDesign goals:All traffic from inside to outside must pass through the firewall (physically blocking all access to the local network except via the firewall)Only authorized traffic (defined by the local security police) will be allowed to pass

*Firewall CharacteristicsDesign goals:The firewall itself is immune to penetration (use of trusted system with a secure operating system)

*Firewall CharacteristicsFour general techniques:Service controlDetermines the types of Internet services that can be accessed, inbound or outboundDirection controlDetermines the direction in which particular service requests are allowed to flow

*Firewall CharacteristicsUser controlControls access to a service according to which user is attempting to access itBehaviour controlControls how particular services are used (e.g. filter e-mail)

*Firewall TypesDifferent scopesPersonal - a single host is protectedTypically implemented in software run as an application under a host OSSite - the firewall protects an entire siteTypically a dedicated hardware device with hardened software

We will assume the latter type in the rest of this presentation

*Types of FirewallsThree common types of Firewalls:Packet-filtering routersApplication-level gatewaysCircuit-level gateways

(Bastion host)

*Types of FirewallsPacket-filtering Router

*Packet-filtering RouterApplies a set of rules to each incoming IP packet and then forwards or discards the packetFilter packets going in both directionsThe packet filter is typically set up as a list of rules based on matches to fields in the IP or TCP headerTwo default policies (discard or forward)

*Filtering rule examples

PolicyFirewall SettingNo outside Web access.Drop all outgoing packets to any IP address, port 80Outside connections to public Web server only.Drop all incoming TCP SYN packets to any IP except 130.207.244.203, port 80Prevent Web-radios from eating up the available bandwidth.Drop all incoming UDP packets - except DNS and router broadcasts.Prevent your network from being used for a Smurf DoS attack.Drop all ICMP packets going to a broadcast address (eg 130.207.255.255).Prevent your network from being traceroutedDrop all outgoing ICMP

*Filtering rule examples

actionsourceaddressdestaddressprotocolsourceportdestportflagbitallow222.22/16outside of222.22/16TCP> 102380any

allowoutside of222.22/16222.22/16TCP80> 1023ACKallow222.22/16outside of222.22/16UDP> 102353---allowoutside of222.22/16222.22/16UDP53> 1023----denyallallallallallall

*Packet-filtering RouterAdvantages:SimplicityTransparency to usersHigh speedDisadvantages:Difficulty of setting up packet filter rulesLack of Authentication

*Packet-filtering RouterPossible attacksIP address spoofingSource routing attacksTiny fragment attacks

*Stateful vs. Stateless FirewallsA stateless packet filtering FW is investigating each packet on its on merits.A stateful firewall is an advanced packet filter that keeps track of the state of the network connections going through it.Whenever a packet arrives to the stateful firewall, it checks whether it matches an ongoing connection. If a match is found the packet can pass through.

*Stateful FirewallsA stateful inspecting firewall is not limited to the network TCP/IP protocols. For known applications it looks at the application protocol as well.This enables the firewall to detect when a communication link does something out of the ordinaryIt also enables the firewall to filter out certain parts of the data transmitted.For the HTTP protocol it may filter out javascriptsFor the SMTP protocol it may filter out certain types of attachments.

*Stateful Filtering rule exampleLog each TCP connection initiated through firewall: SYN segmentTimeout entries which see no activity for, say, 60 seconds

If rule table indicates that stateful table must be checked:check to see if there is already a connection in stateful tableStateful filters can also remember outgoing UDP segments

sourceaddressdestaddresssourceportdestport222.22.1.737.96.87.1231269980222.22.93.2199.1.205.233765480222.22.65.143203.77.240.434871280

*Stateful Filtering rule examplePacket arrives from outside: SA=37.96.87.123, SP=80,DA=222.22.1.7, DP=12699, SYN=0, ACK=1Check filter table check stateful table

Connection is listed in connection table let packet through

actionsourceaddressdestaddressprotosourceportdestportflagbitcheck conn.allow222.22/16outside of222.22/16TCP> 102380any

allowoutside of222.22/16222.22/16TCP80> 1023ACKx

allow222.22/16outside of222.22/16UDP> 102353---allowoutside of222.22/16222.22/16UDP53> 1023----x

denyallallallallallall

*Types of FirewallsApplication-level Gateway

*Types of FirewallsApplication-level GatewayAlso called proxy serverActs as a relay of application-level traffic

*Types of FirewallsAdvantages:Higher security than packet filtersOnly need to scrutinize a few allowable applicationsEasy to log and audit all incoming trafficDisadvantages:Additional processing overhead on each connection (gateway as splice point)

*Types of FirewallsCircuit-level Gateway

*Types of FirewallsCircuit-level GatewayStand-alone system orSpecialized function performed by an Application-level GatewaySets up two TCP connectionsThe gateway typically relays TCP segments from one connection to the other without examining the contents

*Types of FirewallsCircuit-level GatewayThe security function consists of determining which connections will be allowedTypically use is a situation in which the system administrator trusts the internal usersAn example is the SOCKS package

*Types of FirewallsBastion HostA system identified by the firewall administrator as a critical strong point in the networks securityThe bastion host serves as a platform for an application-level or circuit-level gateway

*Firewall ConfigurationsIn addition to the use of simple configuration of a single system (single packet filtering router or single gateway), more complex configurations are possibleThree common configurations

*Firewall ConfigurationsScreened host firewall system (single-homed bastion host)

*Firewall ConfigurationsScreened host firewall, single-homed bastion configurationFirewall consists of two systems:A packet-filtering routerA bastion host

*Firewall ConfigurationsConfiguration for the packet-filtering router:Only packets from and to the bastion host are allowed to pass through the routerThe bastion host performs authentication and proxy functions

*Firewall ConfigurationsGreater security than single configurations because of two reasons:This configuration implements both packet-level and application-level filtering (allowing for flexibility in defining security policy)An intruder must generally penetrate two separate systems

*Firewall ConfigurationsThis configuration also affords flexibility in providing direct Internet access (public information server, e.g. Web server)

*Firewall ConfigurationsScreened host firewall system (dual-homed bastion host)

*Firewall ConfigurationsScreened host firewall, dual-homed bastion configurationThe packet-filtering router is not completely compromisedTraffic between the Internet and other hosts on the private network has to flow through the bastion host

*Firewall ConfigurationsScreened-subnet firewall system

*Firewall ConfigurationsScreened subnet firewall configurationMost secure configuration of the threeTwo packet-filtering routers are usedCreation of an isolated sub-network

*Firewall ConfigurationsAdvantages:Three levels of defence to thwart intrudersThe outside router advertises only the existence of the screened subnet to the Internet (internal network is invisible to the Internet)

*Firewall ConfigurationsAdvantages:The inside router advertises only the existence of the screened subnet to the internal network (the systems on the inside network cannot construct direct routes to the Internet)

*Combining Firewalls with other functionsAn firewall may be co-implemented with other functionality such as:VPNIDSNATRouterAuthentication Server

*Firewall TestingAfter having designed, implemented, and configured your firewall, it is extremely important to test your firewall thoroughly before putting it in use. Eg:Your firewall should not allow any packet from outside the network to go into your internal network if the source address is the same as any host in your internal network.

*Firewall TestingIf you have a proxy firewall, running Squid e.g, make sure that only the needed ports are open. Daemons such as Telnetd, FTPd, HTTPd and others should be shut down when they are not needed.You may sometimes require the ability to remotely administer your firewall. However, you should consider disabling all remote logins to your internal system.It is best to allow only interactive logins at your firewall hosts.If you must log in the firewall host from other machines, use only a relatively secure login application, such as SSH with one time passwords.

*Firewall TestingRegularly testing your firewall system and verifying that it operates properly. In general, a firewall professional has at least to test the following:Host hardware (processor, disk, memory, network interfaces, etc.).Operating system software (booting, console access programs, start-up scripts, etc.).Network interconnection equipment (cables, switches, hubs, routers, APs, etc.).Firewalls.To check all possible flaws in the software is difficult and this requires expert knowledge, but you still can use software such as a packet injector and listening sniffer (together with other tools: port canners, system vulnerability checking tools and some hacking tools) to test your firewalls. Check if configuration files, log files, audit files are modified by unauthorised people or processes.

*Firewall TestingExhaustive tests of all the possibilities are expensive and practically not possible.However we can use boundary tests. Eg.identify boundaries in your packet filtering firewall rules.then test the regions immediately adjacent to each boundary.

*Firewall TestingTests also should be conducted thoroughly:Test the routing configuration, packet filtering rules (including service-specific testing), and logging and alert options separately and together.Test the firewall system as a whole (such as hardware/software failure recovery, sufficient log file space, proper archival procedure of logs, performance monitoring).Exercise both normal conditions and abnormal conditions.

*Firewall Testing ToolsThere is no way that you can manually test a firewall as complete as possible, you need to employ firewall testing tools:Network traffic generators (Eg: SPAK (Send PAcKets), ipsend, etc.).Network monitors (Eg: tcpdump and Network Monitor) Port scanners (Eg: strobe, nmap, etc) Vulnerability detection tools (Eg: COPS, Tiger, ISS, Nessus, SAINT, MacAnalysis, etc.) Intrusion detection systems Snort, Cisco IDS, etc.

*Trusted SystemsOne way to enhance the ability of a system to defend against intruders and malicious programs is to implement trusted system technology

*Data Access ControlThrough the user access control procedure (log on), a user can be identified to the systemAssociated with each user, there can be a profile that specifies permissible operations and file accessesThe operation system can enforce rules based on the user profile

*Data Access ControlGeneral models of access control:Access matrixAccess control listCapability list

*Data Access ControlAccess Matrix

*Data Access ControlAccess Matrix: Basic elements of the modelSubject: An entity capable of accessing objects, the concept of subject equates with that of processObject: Anything to which access is controlled (e.g. files, programs)Access right: The way in which an object is accessed by a subject (e.g. read, write, execute)

*Data Access ControlAccess Control List: Decomposition of the matrix by columns

*Data Access ControlAccess Control ListAn access control list, lists users and their permitted access rightThe list may contain a default or public entry

*Data Access ControlCapability list: Decomposition of the matrix by rows

*Data Access ControlCapability listA capability ticket specifies authorized objects and operations for a userEach user have a number of tickets

*The Concept ofTrusted SystemsTrusted SystemsProtection of data and resources on the basis of levels of security (e.g. military)Users can be granted clearances to access certain categories of data

*The Concept ofTrusted SystemsMultilevel securityDefinition of multiple categories or levels of dataA multilevel secure system must enforce:No read up: A subject can only read an object of less or equal security level (Simple Security Property)No write down: A subject can only write into an object of greater or equal security level (*-Property)

*The Concept ofTrusted SystemsReference Monitor Concept: Multilevel security for a data processing system

*The Concept ofTrusted SystemsReference MonitorControlling element in the hardware and operating system of a computer that regulates the access of subjects to objects on basis of security parametersThe monitor has access to a file (security kernel database)The monitor enforces the security rules (no read up, no write down)

*The Concept ofTrusted SystemsProperties of the Reference MonitorComplete mediation: Security rules are enforced on every accessIsolation: The reference monitor and database are protected from unauthorized modificationVerifiability: The reference monitors correctness must be provable (mathematically)

*The Concept ofTrusted SystemsA system that can provide such verifications (properties) is referred to as a trusted system

*Trojan Horse DefenceSecure, trusted operating systems are one way to secure against Trojan Horse attacks

*Trojan Horse Defence

*Trojan Horse Defence