Topic 2: Lesson 3 Intro to Firewalls

1. Topic 2: Lesson 3Intro to Firewalls Summary

2. Basic questions • What is a firewall? • What can a firewall do? • What is packet filtering? • What is proxying? • What is stateful packet filtering? • Compare network layer firewalls and application layer firewalls. • Enumerate the benefits of a firewall • Enumerate the limitations of a firewall

3. What is a firewall? • Protect internal network from outside threats • creates choke point from outside of network • mechanism that permits access control between two or more networks • come in various forms: hardware and software, usually a combination

4. What can a firewall do? • keep outsiders from breaking in • keep insiders from exposing valuable data • enable secure communication between networks • Firewall protects both direction • Firewall can proxy an Internet service • block services known to be problematic

5. What is packet filtering? • One of the three types of firewall technology • determines whether a packet can be accepted or not based on IP address, port number, protocol type • spoofed with IP or port # filtering, doesn’t look at contents • firewall sets up rule set, verifies packets with header information • what is inside a packet header: • source IP, destination IP, protocol, source port, destination port, size of packet, sequence # • Can viruses or Trojans attack a firewall? • Yes, vulnerabilities in firewalls that can be exploited • previous employer, viruses disable firewalls

6. What is proxying? • use a proxy server as an intermediary between two servers. Communication sent between the proxy and internal • hides real IP address from whoever you are communicating to • does logging and access control • based on policy, takes requests for user in group • don’t permit traffic between networks

7. What is stateful packet filtering? • across b/w functionality of packet filtering and firewalls • provides more security checks • inspects first packet, adds entry to state table • state table= tabulates state of the system, state is how you define it to be . State is connections being made updated after valid connections are made. Follow-up packets for new connections use that table for verification. • use valid host to transmit malicious code • Does state table have an expiration time? Session time, start and termination time- time window, beyond the connection ends • Does termination expire instantaneously- depends based on configured session time; • How does it determine if first packet is valid - for efficiency, if you spoof original packet, not sure

8. Compare network layer firewalls and application layer firewalls. • app layer firewalls block traffic based on what application u are using – network layer examine addressing and others • network layer firewalls are faster but do less inspection • can just block port rather than app? • ports used by app can change • most firewalls include aspects of both • firewall can be strengthened by changing firmware • example of network is packet filtering and example of application layer is proxying

9. Enumerate the benefits of a firewall • cost benefits of firewall make economic sense, inexpensive and high rewards • enforce organizational security policies • enable logging of connections and data • logs produced can give valuable information about the network • help prevent net security issues from spreading across network segments • firewalls are only as useful as the unified security policy which is defined

10. Enumerate the limitations of a firewall • firewalls cant protect against malicious inside attacks • not too effective against dialup • susceptible to IP spoofing • stop attacks at network level, so many attacks which they cannot block • cant prevent against Trojans, viruses, etc • can be compromised like any other part of the network • exploit problems in e-mail for DOS attacks • only as good as updates- need security updates/firmware • cant protect against vulnerable protocols- TCP/IP, http, etc • If you are greedy, you will eat the honey in the pot