Firewalls

Question 1

What is IP spoofing

Answer 1

IP Spoofing sending packets using a source IP address that is not yours
Often related to DoS attacks (DNS amplification attack)

Question 2

Name two strategies how a firewall can be implemented

Answer 2

stateful, stateless

Question 3

Name all the firewall architectures

Answer 3

• Screened Subnet Architecture
• ScreenedHostArchitecture
  -Dual Homed Bastion Host
• Simple packet filtering Architecture

Question 4

What are NIDS and HIDS?

Answer 4

Network based IDS
- Unauthorized network access
- Reconnaissance network scans
- Abuse of bandwidth resources
- network protocol violations

Host based IDS
- Privilege Abuse
- Accidentally assigned privileges
- Account compromise
- Access and modificatin of critical data
- Information leakage

Question 5

What is the benefit of Screened Subnet Architecture?

Answer 5

There are 2 Filters beside the Bastion Host
There is a second packet filter in case a service in DMZ is compromised

Question 6

What are the three security components?

Answer 6

Security Requirements
Security Policy
Security Mechanisms

Question 7

Spoofing Protection

Answer 7

Outgoing
- Only allow source IPs which belong to you
- Dont be an operator who facilitates DOS attacks to the Internet
Incoming
- Only allow ‘valid’ source IPs
- For a varying definition fo ‘valid’
- IPs which belong to you are not valid
- local and special purpose IPs are not valid
Rule of thumb: UNIV \ (Your IPs U Special Purpose IPs)

Question 8

Name two Firewall default strategies and which one should we choose

Answer 8

Default deny strategy
- only explicitly allowed traffic is permitted
- minimizes attack surface
Default permit strategy
- allow everything by default

Question 9

How does a stateful firewall work

Answer 9

• tracks the state of connections
• Maintains a connection table
• Allows packets that belong to an established or related connection
• Only the initial packet must match a rule, replies are allowed automatically

Question 10

Upside and Downside of a stateless firewall

Answer 10

Upside:
High performance
- No connection tracking
- Less memory and CPU usage

Downside
- No connection awareness
- Return traffic must be explicitly allowed
-More error-prone configuration

Question 11

Would you add HIDS to the web and Mail server, what would be the trade offs

Answer 11

The HIDS could monitor the machines for attacks that compromise configuration integrity on the server itself. However, running a HIDS would add performance drawbacks by real time monitoring of the host activity.