You are on page 1of 37

Security Issues

Perspective ...
● less then 200 security incident in 1989.
● about 400 in 1989.
● about 1400 in 1993.
● estimated more than 2241 in 1994.
● Nobody knows the correct statistics on how
many attacks are actually detected by the
sites broken into.
Layout Firewall
In te r N e t

F ir e w a ll

In te r n a l
N e tw o rk
What are you trying to
protect?
● Your Data.
● Your Resources.
● Your Reputation.
What Are You Trying To
Protect Against?
Type of attacks

● Intrusion.
● Denial of Service.
● Information Theft.
Type of Attackers
● Joyriders.
● Vandals.
● Score Keepers.
● Spies (Industrial & Otherwise).
● Stupidity & Accidents.
How Can You Protect Your
Site
● No Security.
● Security Through Obscurity.
● Host Security.
● Network Security.
● No Security Model Can Do It All.
What Can A Firewall Do?
● A firewall is a focus for security decisions.
● A firewall can enforce security policy.
● A firewall can log Internet activity
efficiently.
● A firewall limits your exposure.
What Can’t A Firewall Do?
● A firewall can’t protect you against
malicious insiders.
● A firewall can’t protect you against
connections that don’t go through it.
● A firewall can’t protect against completely
new threats.
● A firewall can’t protect against viruses.
List of A Must Secure Internet
Services
● Electronic mail (SMTP).
● File Transfer (FTP).
● Usenet News (NNTP).
● Remote Terminal Access (Telnet).
● World Wide Web Access (HTTP).
● Hostname / Address lookup (DNS).
Security Strategies.
● Least Privilege.
● Defense in Depth (multiple security mechanism).
● Choke Point forces attackers to use a narrow channel.
● Weakest Link.
● Fail-Safe Stance.
● Diversity of Defense.
● Simplicity.
Building Firewalls
Some Firewall Definitions
● Firewall
– A component or set of components that restricts
access between a protected network and the
Internet, or between other sets of networks.
● Host
– A computer system attached to a network.
Firewall Def’s Cont’ ..
● Bastion Host
– A computer system that must be highly secured
because it is vulnerable to attack, usually because
it is exposed to the Internet and is a main point of
contact for users of internal networks.
● Dual-homed host
– A general-purpose computer system that has at
least two network interfaces (or homes).
Firewall Def’s Cont ...
● Packet.
– The fundamental unit of communication on the Internet.
● Packet filtering.
– The action a device takes to selectively control the flow of
data to and from a network.
● Perimeter network.
– a network added between a protected network and external
network, to provide additional layer of security.
Firewall Def’s Cont ...
● Proxy Server
– A program that deals with external servers on
behalf of internal clients. Proxy client talk to
proxy servers, which relay approved client
requests on to real servers,and relay answer
back to clients.
Packet Filtering
In te r N e t

R o u te s o r b lo c k s p a c k e ts ,
S c r e e n in g
a s d e t e r m i n e d b y s i t e 's
R o u te r
s e c u r ity p o lic y .

In te r n a l
N e tw o rk
Proxy Services
In te r N e t
E x te rn a l H o s t
R ea l S erve r

P ro xy S erve r
F ir e w a ll D ual hom ed H ost

In te r n a l
N e tw o rk
In te r n a l H o s t
P r o x y C lie n t
Screened Host Architecture
In te r N e t

F ir e w a ll

S c r e e n in g
R o u te r

B a s tio n H o s t

In te r n a l
N e tw o rk
De-Militarized Zone
Architecture
F ir e w a ll

In te r N e t E x te r io r R o u te r

B a s tio n H o s t

In te r n a l P e r im e t e r
N e tw o rk N e tw o rk
In te r io r R o u te r
C h o k e R o u te r
DMZ With Two Bastion Hosts
F ir e w a ll

In t e r N e t E x te rio r R o u te r

F T P /W W W H o s t

In te r n a l P e r im e t e r
N e tw o rk N e tw o rk
In te r io r R o u te r
C h o k e R o u te r SM TP / DNS Host
It’s OK
● Merge Interior & Exterior Router
● Merge Bastion Host & Exterior Router
● Use Mutiple Exterior Router
● Have Multiple Perimeter Network
● Use Dual -Homed Hosts & Screened
Subnets
It’s Dangerous
● Use Multiple Interior Router
● Merge Bastion Host and Interior Router
Private IP Address
● Use within Internal Network
● Reference RFC 1597
● IP address alocation:
– Class A: 10.x.x.x
– Class B: 172.16.x.x - 172.31.x.x
– Class C: 192.168.0.x - 192.168.255.x
Bastion Host
● It is our presence in Internet.

● Keep it simple.
● Be prepared for the bastion host to be
compromised.
Special Kinds of Bastion
Hosts
● Nonrouting Dual-Homed Hosts.
● Victim Machine.
● Internal Bastion Hosts.
Choosing A Bastion Host
● What Operating System?
– Unix
● How Fast a Machine?
– 386-based UNIX.
– MicroVAX II
– Sun-3
Proxy Systems
● Why Proxying?
– Proxy systems deal with the insecurity
problems by avoiding user logins on the dual-
homed host and by forcing connections through
controlled software.
– It’s also impossible for anybody to install
uncontrolled software to reach Internet; the
proxy acts as a control point.
Proxy - Reality & Illusion
P e r c ie v e d C o n n e c tio n

A c tu a l C o n n e c tio n Real
Ser ver's
Il lusio
n S e rv e r
P ro x y S e rv e r

C lie n t

U s e r 's I l l u s i o n
Advantages of Proxying
● Proxy services allow users to access
Internet services “directly”
● Proxy services are good at logging.
Disadvantages of Proxying
● Proxy services lag behind non-proxied services.
● Proxy services may require different servers for each service.
● Proxy services usually require modifications to clients,
procedures, or both.
● Proxy services aren’t workable for some services.
● Proxy services don’t protect you from all protocol weaknesses.
Proxying without a Proxy
Server
● Store-and-Forward services naturally
support proxying.
● Examples:
– E-mail (SMTP).
– News (NNTP).
– Time (NTP).
Internet Resources on
Security Issues
WWW Pages
● http://www.telstra.com.au/info/security.html
● http://www.cs.purdue.edu/coast/coast.html
Mailing Lists
● firewalls@greatcircle.com
– ftp://ftp.greatcircle.com/pub/firewalls/
– http://www.greatcircle.com/firewalls/
● fwall-users@tis.com
● academic-firewalls@net.tamu.edu
– ftp://net.tamu.edu/pub/security/lists/academic-
firewalls
● bugtraq@fc.net
Newsgroups
● comp.security.announce.
● comp.security.unix.
● comp.security.misc.
● comp.security.firewalls.
● alt.security.
● comp.admin.policy.
● comp.protocols.tcp-ip.
● comp.unix.admin.
● comp.unix.wizards
Summary
● In these dangerous times, firewalls are the
best way to keep your site secure.
● Although you’ve got to include other types
of security in the mix, if you’re serious
about connecting to the Internet, firewall
should be at the very center of your security
plans.

You might also like