network security technologies
Post on 15-Jan-2015
1.615 Views
Preview:
DESCRIPTION
TRANSCRIPT
Network SecurityNetwork SecurityTechnologiesTechnologies
CS490 - Security in Computing
Copyright © 2005 by Scott Orr and the Trustees of Indiana University
ReferencesReferences
Security in Computing, 3Security in Computing, 3rdrd Ed. Ed. Chapter 7 (pgs. 457-479)Chapter 7 (pgs. 457-479)
Section OverviewSection Overview
Firewall ComponentsFirewall Components
Firewall ArchitecturesFirewall Architectures
Network Intrusion SystemsNetwork Intrusion Systems
HoneypotsHoneypots
Internet FirewallsInternet Firewalls
DMZDMZ
InternetInternetInternalInternalNetworkNetwork
Firewall BenefitsFirewall Benefits
Host Service ProtectionHost Service Protection Host Access ControlHost Access Control Centralized Point of SecurityCentralized Point of Security Enhanced PrivacyEnhanced Privacy Increased Audit LoggingIncreased Audit Logging Policy EnforcementPolicy Enforcement
Implementation IssuesImplementation Issues
Service RestrictionsService Restrictions Allowed Service VulnerabilitiesAllowed Service Vulnerabilities User BackdoorsUser Backdoors InsiderInsider Attacks Attacks VirusesViruses Network Throughput to/from InternetNetwork Throughput to/from Internet Single Point of FailureSingle Point of Failure
Firewall ComponentsFirewall Components
Network PolicyNetwork Policy Advanced AuthenticationAdvanced Authentication Packet FilteringPacket Filtering Application GatewaysApplication Gateways
Network PolicyNetwork Policy
Service Access PolicyService Access Policy Extension of Site Security PolicyExtension of Site Security Policy WhichWhich services are allowed to/from services are allowed to/from whichwhich hosts hosts Who is authorized to change policyWho is authorized to change policy
Firewall Design PolicyFirewall Design Policy HowHow Service Access Policy is implemented Service Access Policy is implemented Either…Either…
PermitPermit any service unless it is expressly denied any service unless it is expressly denied DenyDeny any service unless it is expressly permitted any service unless it is expressly permitted
Advanced AuthenticationAdvanced Authentication
UnauthenticatedUnauthenticated AuthenticatedAuthenticated
Using one-time password techniquesUsing one-time password techniquesto allow access via certain servicesto allow access via certain services
InternetInternet Internal NetworkInternal Network
Packet Filtering RoutersPacket Filtering Routers
Allowing/Restricting access based on:Allowing/Restricting access based on: IP Addresses (source/destination)IP Addresses (source/destination) Protocol (TCP/UDP/ICMP)Protocol (TCP/UDP/ICMP) TCP/UDP Ports (source/destination)TCP/UDP Ports (source/destination) ICMP Message TypeICMP Message Type Packet SizePacket Size Router Interface/DirectionRouter Interface/Direction
Single and multiple addresses/ports per Single and multiple addresses/ports per entryentry
ScreeningScreening Routers Routers
Packet Filtering OptionsPacket Filtering Options
Send the packetSend the packet Reject the packetReject the packet Drop the packetDrop the packet Log information about the packetLog information about the packet Notify administrator (set off an Notify administrator (set off an
alarm)alarm)
Packet Filtering WeaknessesPacket Filtering Weaknesses
Hard to configureHard to configure Hard to testHard to test More complex the rules, more More complex the rules, more
performance might be impactedperformance might be impacted No Advanced Authentication supportNo Advanced Authentication support
Application GatewaysApplication Gateways
Service components allowed/denied based Service components allowed/denied based on rule seton rule set
Each packet repackaged after examinationEach packet repackaged after examination Information hidingInformation hiding Robust authentication and loggingRobust authentication and logging
Application GW WeaknessesApplication GW Weaknesses
ScalabilityScalability Each service requires it’s own Each service requires it’s own proxyproxy
Difficult to manage Connectionless Difficult to manage Connectionless ProtocolsProtocols
PerformancePerformance Each packet gets repackagedEach packet gets repackaged
OS/Service BugsOS/Service Bugs
Circuit GatewaysCircuit Gateways
Similar to Application GatewaySimilar to Application Gateway No packet processing done at the No packet processing done at the
gatewaygateway
Stateful Multi-Layer Stateful Multi-Layer InspectionInspection
Inspects Inspects rawraw packets packets Inspection engine intercepts packet at Inspection engine intercepts packet at
the OSI Network Layerthe OSI Network Layer Context AwareContext Aware Creates a Creates a virtual statevirtual state for for
connectionless protocolsconnectionless protocols
Source: Source: Checkpoint SoftwareTechnologies Ltd.
Firewall ArchitecturesFirewall Architectures
Single DeviceSingle Device Screening RouterScreening Router Dual-Homed HostDual-Homed Host
Multi-DeviceMulti-Device Screened HostScreened Host Screened SubnetScreened Subnet Split-Screened SubnetSplit-Screened Subnet
Screening RouterScreening Router
InternetInternetInternalInternalNetworkNetwork
ScreeningScreeningRouterRouter
Dual-Homed GatewayDual-Homed Gateway
InternetInternet InternalInternalNetworkNetwork
ProxyProxyServerServer
InfoInfoServerServer
Network Address Network Address TranslationTranslation
Not specifically for security (Not specifically for security (RFC 1918RFC 1918)) Hides internal network configurationHides internal network configuration 1 to 1 allocation1 to 1 allocation
StaticStatic DynamicDynamic
IP MasqueradingIP Masquerading Many internal addresses using 1 external Many internal addresses using 1 external
addressaddress Only internal hosts can initiate a connectionOnly internal hosts can initiate a connection
Screened HostScreened Host
InternetInternet InternalInternalNetworkNetwork
BastionBastionHostHost
InternetInternetServerServer
ScreeningScreeningRouterRouter
Screened SubnetScreened Subnet
InternetInternetInternalInternalNetworkNetwork
BastionBastionHostHost
InternetInternetServerServer
ScreeningScreeningRouterRouter
ScreeningScreeningRouterRouter
Split Screened SubnetSplit Screened Subnet
InternetInternetInternalInternalNetworkNetwork
Dual-HomedDual-HomedProxyProxy
InternetInternetServerServer
ScreeningScreeningRouterRouter
ScreeningScreeningRouterRouter
IntranetIntranetServerServer
Network Intrusion DetectionNetwork Intrusion DetectionInternetInternet
InternalInternalNetworkNetwork
Dual-HomedDual-HomedProxyProxy
ScreeningScreeningRouterRouter
ScreeningScreeningRouterRouter
AnalysisAnalysisStationStation
SensorsSensors
IDS AnalysisIDS Analysis
Knowledge based (attack signatures)Knowledge based (attack signatures) Port ScansPort Scans Denial of ServiceDenial of Service Known Service AttacksKnown Service Attacks SpoofingSpoofing ContentContent
Behavioral basedBehavioral based
IDS WeaknessesIDS Weaknesses
Very young technologyVery young technology False PositivesFalse Positives False NegativesFalse Negatives ScalabilityScalability
HoneypotsHoneypots
Sacrificial host used to lure attackersSacrificial host used to lure attackers Simulates a vulnerable systemSimulates a vulnerable system Used to study attacker techniquesUsed to study attacker techniques
Firewall/IDS traffic logsFirewall/IDS traffic logs System logsSystem logs File Integrity Checker logsFile Integrity Checker logs Keystroke capturingKeystroke capturing
Early Case – “Early Case – “BerferdBerferd””
top related