Firewall features:
- All traffic must pass through the firewall
- Traffic only passes if it abides by the firewall’s policy
- Can’t be penetrated
Characteristics of firewall access policy:
- IP address and protocol values
- Application protocol
- User identity
- Network activity
Packet filtering firewall policies:
- Discard
- Forward
Packet Filter Weaknesses:
- Limited logging
- Vulnerable to protocol bugs
- Vulnerable to application bugs
- No user authentication
Packet Filter Attacks:
- IP address spoofing
- Source route attacks
- Tiny fragment attacks
Locations of circuit-level gateway TCP connections:
- One between itself and a TCP user on an inner host
- One on an outside host
SOCKS:
Framework that enables the use of a firewall
SOCKS components:
- SOCKS server on the firewall
- SOCKS client library on all internal hosts
- SOCKS-ified client applications
Firewall locations:
- Bastion host
- Host-based
- Personal firewall
Bastion Host Common characteristics:
- Secure
- Authentication
- Many proxies
- Small proxies
- Independent proxies
- Proxies can restrict access
Host-based advantages:
- Made for hosts
- Protection against internal and external threats
- Works as an additional layer of protection
Firewall Topologies:
- Host-resident
- Screening router
- Single bastion inline
- Single bastion T
- Double bastion inline
- Double bastion T
- Distributed firewall
Host-resident firewall:
Personal firewall + firewall on server
Screening router:
Router between internal and external network
Single bastion inline:
Firewall between internal and external router
Distributed firewalls:
Combination of firewalls on 100s if PCs under one admin
Firewall capabilities:
- Single choke point
- Monitoring security events
Firewall limits:
- Cannot protect against attacks bypassing firewall
- Devices infected outside then used inside
Host-based IPS identifies attacks using:
- Signature techniques
- Anomaly detection
Network-based IPS identifies attacks using:
- Pattern matching
- Stateful matching
- Protocol anomaly
- Traffic anomaly
Snort inline new rule types:
- Reject (Sdrop)
- Reject and log (Drop)
- Reject, log, and return error (Reject)
