Cryptography and Cryptography and Network SecurityNetwork Security
Chapter 20Chapter 20
Fourth EditionFourth Edition
by William Stallingsby William Stallings
Chapter 20 – FirewallsChapter 20 – Firewalls
The function of a strong position is to make The function of a strong position is to make the forces holding it practically the forces holding it practically unassailableunassailable
——On War, On War, Carl Von ClausewitzCarl Von Clausewitz
IntroductionIntroduction
seen evolution of information systemsseen evolution of information systems now everyone want to be on the Internet now everyone want to be on the Internet and to interconnect networks and to interconnect networks has persistent security concernshas persistent security concerns
can’t easily secure every system in orgcan’t easily secure every system in org typically use a typically use a FirewallFirewall to provide to provide perimeter defenceperimeter defence as part of comprehensive security strategyas part of comprehensive security strategy
What is a Firewall?What is a Firewall?
a a choke pointchoke point of control and monitoring of control and monitoring interconnects networks with differing trustinterconnects networks with differing trust imposes restrictions on network servicesimposes restrictions on network services
only authorized traffic is allowed only authorized traffic is allowed auditing and controlling accessauditing and controlling access
can implement alarms for abnormal behaviorcan implement alarms for abnormal behavior provide NAT & usage monitoringprovide NAT & usage monitoring implement VPNs using IPSecimplement VPNs using IPSec must be immune to penetrationmust be immune to penetration
Firewall LimitationsFirewall Limitations
cannot protect from attacks bypassing itcannot protect from attacks bypassing it eg sneaker net, utility modems, trusted eg sneaker net, utility modems, trusted
organisations, trusted services (eg SSL/SSH)organisations, trusted services (eg SSL/SSH) cannot protect against internal threatscannot protect against internal threats
eg disgruntled or colluding employeeseg disgruntled or colluding employees cannot protect against transfer of all virus cannot protect against transfer of all virus
infected programs or filesinfected programs or files because of huge range of O/S & file typesbecause of huge range of O/S & file types
Firewalls – Packet FiltersFirewalls – Packet Filters
simplest, fastest firewall component simplest, fastest firewall component foundation of any firewall system foundation of any firewall system examine each IP packet (no context) and examine each IP packet (no context) and
permit or deny according to rules permit or deny according to rules hence restrict access to services (ports)hence restrict access to services (ports) possible default policiespossible default policies
that not expressly permitted is prohibited that not expressly permitted is prohibited that not expressly prohibited is permittedthat not expressly prohibited is permitted
Firewalls – Packet FiltersFirewalls – Packet Filters
Firewalls – Packet FiltersFirewalls – Packet Filters
Attacks on Packet FiltersAttacks on Packet Filters
IP address spoofingIP address spoofing fake source address to be trustedfake source address to be trusted add filters on router to blockadd filters on router to block
source routing attackssource routing attacks attacker sets a route other than defaultattacker sets a route other than default block source routed packetsblock source routed packets
tiny fragment attackstiny fragment attacks split header info over several tiny packetssplit header info over several tiny packets either discard or reassemble before checkeither discard or reassemble before check
Firewalls – Stateful Packet FiltersFirewalls – Stateful Packet Filters
traditional packet filters do not examine traditional packet filters do not examine higher layer contexthigher layer context ie matching return packets with outgoing flowie matching return packets with outgoing flow
stateful packet filters address this needstateful packet filters address this need they examine each IP packet in contextthey examine each IP packet in context
keep track of client-server sessionskeep track of client-server sessions check each packet validly belongs to onecheck each packet validly belongs to one
hence are better able to detect bogus hence are better able to detect bogus packets out of context packets out of context
Firewalls - Firewalls - Application Level Application Level Gateway (or Proxy)Gateway (or Proxy)
have application specific gateway / proxy have application specific gateway / proxy has full access to protocol has full access to protocol
user requests service from proxy user requests service from proxy proxy validates request as legal proxy validates request as legal then actions request and returns result to userthen actions request and returns result to user can log / audit traffic at application level can log / audit traffic at application level
need separate proxies for each service need separate proxies for each service some services naturally support proxying some services naturally support proxying others are more problematic others are more problematic
Firewalls - Firewalls - Application Level Application Level Gateway (or Proxy)Gateway (or Proxy)
Firewalls - Firewalls - Circuit Level GatewayCircuit Level Gateway
relays two TCP connectionsrelays two TCP connections imposes security by limiting which such imposes security by limiting which such
connections are allowedconnections are allowed once created usually relays traffic without once created usually relays traffic without
examining contentsexamining contents typically used when trust internal users by typically used when trust internal users by
allowing general outbound connectionsallowing general outbound connections SOCKS is commonly usedSOCKS is commonly used
Firewalls - Firewalls - Circuit Level GatewayCircuit Level Gateway
Bastion HostBastion Host
highly secure host system highly secure host system runs circuit / application level gateways runs circuit / application level gateways or provides externally accessible servicesor provides externally accessible services potentially exposed to "hostile" elements potentially exposed to "hostile" elements hence is secured to withstand thishence is secured to withstand this
hardened O/S, essential services, extra authhardened O/S, essential services, extra auth proxies small, secure, independent, non-privileged proxies small, secure, independent, non-privileged
may support 2 or more net connectionsmay support 2 or more net connections may be trusted to enforce policy of trusted may be trusted to enforce policy of trusted
separation between these net connectionsseparation between these net connections
Firewall ConfigurationsFirewall Configurations
Firewall ConfigurationsFirewall Configurations
Firewall ConfigurationsFirewall Configurations
Access ControlAccess Control given system has identified a user given system has identified a user determine what resources they can accessdetermine what resources they can access general model is that of access matrix withgeneral model is that of access matrix with
subjectsubject - active entity (user, process) - active entity (user, process) objectobject - passive entity (file or resource) - passive entity (file or resource) access rightaccess right – way object can be accessed – way object can be accessed
can decompose bycan decompose by columns as access control listscolumns as access control lists rows as capability ticketsrows as capability tickets
Access Control MatrixAccess Control Matrix
Trusted Computer SystemsTrusted Computer Systems
information security is increasingly important information security is increasingly important have varying degrees of sensitivity of informationhave varying degrees of sensitivity of information
cf military info classifications: confidential, secret etc cf military info classifications: confidential, secret etc
subjects (people or programs) have varying subjects (people or programs) have varying rights of access to objects (information)rights of access to objects (information)
known as multilevel securityknown as multilevel security subjects have subjects have maximummaximum & & currentcurrent security level security level objects have a fixed security level objects have a fixed security level classificationclassification
want to consider ways of increasing confidence want to consider ways of increasing confidence in systems to enforce these rightsin systems to enforce these rights
Bell Bell LaPadula (BLP) ModelLaPadula (BLP) Model
one of the most famous security modelsone of the most famous security models implemented as mandatory policies on system implemented as mandatory policies on system has two key policies: has two key policies: no read upno read up (simple security property) (simple security property)
a subject can only read/write an object if the current a subject can only read/write an object if the current security level of the subject dominates (>=) the security level of the subject dominates (>=) the classification of the objectclassification of the object
no write downno write down (*-property) (*-property) a subject can only append/write to an object if the a subject can only append/write to an object if the
current security level of the subject is dominated by current security level of the subject is dominated by (<=) the classification of the object(<=) the classification of the object
Reference MonitorReference Monitor
Evaluated Computer SystemsEvaluated Computer Systems
governments can evaluate IT systemsgovernments can evaluate IT systems against a range of standards:against a range of standards:
TCSEC, IPSEC and now Common CriteriaTCSEC, IPSEC and now Common Criteria define a number of “levels” of evaluation define a number of “levels” of evaluation
with increasingly stringent checkingwith increasingly stringent checking have published lists of evaluated productshave published lists of evaluated products
though aimed at government/defense usethough aimed at government/defense use can be useful in industry alsocan be useful in industry also
Common CriteriaCommon Criteria
international initiative specifying security international initiative specifying security requirements & defining evaluation criteriarequirements & defining evaluation criteria
incorporates earlier standardsincorporates earlier standards eg eg CSEC, ITSEC, CTCPEC (Canadian), Federal CSEC, ITSEC, CTCPEC (Canadian), Federal
(US)(US) specifies standards forspecifies standards for
evaluation criteriaevaluation criteria methodology for application of criteriamethodology for application of criteria administrative procedures for evaluation, administrative procedures for evaluation,
certification and accreditation schemescertification and accreditation schemes
Common CriteriaCommon Criteria
definesdefines set of security requirementsset of security requirements have a have a Target Of Evaluation (TOE)Target Of Evaluation (TOE) requirements fall in two categoriesrequirements fall in two categories
functionalfunctional assuranceassurance
both organised in classes of families & both organised in classes of families & componentscomponents
Common Criteria Common Criteria RequirementsRequirements
Functional RequirementsFunctional Requirements security audit, crypto support, security audit, crypto support,
communications, user data protectioncommunications, user data protection,, identification & authenticationidentification & authentication, security , security management, privacy, management, privacy, protection of protection of trusted security functionstrusted security functions,, resource resource utilizationutilization,, TOE access, trusted path TOE access, trusted path
Assurance RequirementsAssurance Requirements configuration management, delivery & configuration management, delivery &
operation, development, guidance documents, operation, development, guidance documents, life cycle support, tests, vulnerability life cycle support, tests, vulnerability assessment, assurance maintenance assessment, assurance maintenance
Common CriteriaCommon Criteria
Common CriteriaCommon Criteria
SummarySummary
have considered:have considered: firewallsfirewalls types of firewallstypes of firewalls configurationsconfigurations access controlaccess control trusted systemstrusted systems common criteriacommon criteria