Download - Personal Info
PowerPoint Presentation
Personal Info1Prepared by: Mr. NHEAN SophanPresenter: Mr. NHEAN SophanPosition: Desktop SupportCompany: Khalibre Co,. LtdE-mail: [email protected]: 0979514961 or 086493591Skype: sophan.nheanFacebook: www.facebook.com/sophan.nhean1What Firewall can do to protect your Network?2Prepared by: Mr. NHEAN Sophan
Firewall2Agenda3What is a firewall?What does a firewall do?What cant a firewall do?Who need a firewall?How does a firewall work?What are the protection methods of firewall?How do we implement a firewall?Conclusion Benefits of firewallScenario Questions and Answers
Prepared by: Mr. NHEAN Sophan3
What is a firewall?4Firewall is a component or set of computer that restrict access between a protected network and the Internet or between a sets of networks.Protects networked computers from intentional hostile intrusion from outside.Places a bottleneck (or Choke Point) between the networks All communications must pass through the bottleneck this gives us a single point of control
Prepared by: Mr. NHEAN Sophan4
What is a firewall?5There are two types of firewall
Prepared by: Mr. NHEAN SophanHardware firewall deviceFortinetJuniperCISCO ASA
Software firewall programIP Chains & IPTablesIPCopSELinuxISA
Advantages of Hardware Firewalls- Single Central Solution, Easier to Maintain and Ideal for Large OrganizationsRequire Little Configuration or User InputCan Handle Greater Amounts of TrafficAdvanced and Extra Features
Disadvantages of Hardware Firewall- Expensive- Less Upgradable- May Not Adequately Block Outgoing Traffic
Advantages of Software Firewall- Portable- Easily upgrade- Cheap and Ideal for Individual and Small Business- Can Effectively Block Outgoing Traffic
Disadvantages of Software Firewall- Can Be Defeated by User's Lack of Computer Security- Harder to Maintain- Only Protect Individual Computers5What can a firewall do?6A firewall examines all traffic routed between two networks to see if it meets certain criteria (allowed if it does, otherwise it dropped)Focus on security decision (Choke point)Enforce security policyLog Internet Activities efficiently
Prepared by: Mr. NHEAN Sophan6What can a firewall do?7It filters traffic base on:Source and Destination IP addressSource and Destination Port numberProtocols usedIt protect your computer and personal information from:Hackers break into your systemCan prevent some kind of virusPrepared by: Mr. NHEAN Sophan7What can't a firewall do?8A firewall cant protect you against:Phishing scam, spyware or viruses spread through email.Malicious insider: people who gain physical access to your computer or networkFor an unprotected wireless networkAfter network has been compromisedConnections that dont go through firewall (Modem users)Completely new threats
Prepared by: Mr. NHEAN SophanDont allow users on the internal network to use a modem in their machine to connect to and external ISP (AOL) to connect to the Internet, this exposes everything that user is connected to the external networkMany users dont like the restrictions that firewalls place on them and will try to subvert those restrictions
8Who need a firewall?9Anyone who is responsible for a private network that is connected to a public network.Big, Medium, and Small EnterpriseAnyone who connect from single computer to internet via modem, etc.
Prepared by: Mr. NHEAN Sophan
9How does firewall work?10A firewall may allow all traffic through unless it meets certain criteria, or it may deny all traffic unless it meets certain criteria.
Prepared by: Mr. NHEAN Sophan
OutboundInboundBasic Firewall Operation10What are the protection methods of firewall?11Packet FilteringRejects TCP/IP packets from unauthorized hosts and/or connection attempts but unauthorized hosts Network Address Translation (NAT)Translates the addresses of internal hosts so as to hide them from the outside worldAlso known as IP masquerading Proxy ServicesMakes high level application level connections to external hosts on behalf of internal hosts to completely break the network connection between internal and external hosts
Prepared by: Mr. NHEAN SophanPacket Filtering (Work at Layer 3)Compare network and transport protocols to a database of rules and then forward only the packets that meet the criteria of the rulesImplemented in routers and sometimes in the TCP/IP stacks of workstation machines- in a router a filter prevents suspicious packets from reaching your network- in a TCP/IP stack it prevents that specific machine from responding to suspicious trafficshould only be used in addition to a filtered router not instead of a filtered router NATSingle host makes requests on behalf of all internal users- hides the internal users behind the NATs IP address- internal users can have any IP addressshould use the reserved ranges of 192.168.n.m or 10.n.m.p to avoid possible conflicts with duplicate external addressesOnly works at the TCP/IP leveldoesnt do anything for addresses in the payloads of the packetsProxyHides internal users from the external network by hiding them behind the IP of the proxyPrevents low level network protocols from going through the firewall eliminating some of the problems with NATRestricts traffic to only the application level protocols being proxiedproxy is a combination of a client and a server; internal users send requests to the server portion of the proxy which then sends the internal users requests out through its client ( keeps track of which users requested what, do redirect returned data back to appropriate user)
11How do we implement the firewall?12Determine the access denial methodology to useDetermine Inbound access policyDetermine Outbound access policyDecide whether to buy a complete firewall product, have one implemented by a systems integrator or implement one yourself.
Prepared by: Mr. NHEAN SophanPacket Filtering (Work at Layer 3)Compare network and transport protocols to a database of rules and then forward only the packets that meet the criteria of the rulesImplemented in routers and sometimes in the TCP/IP stacks of workstation machines- in a router a filter prevents suspicious packets from reaching your network- in a TCP/IP stack it prevents that specific machine from responding to suspicious trafficshould only be used in addition to a filtered router not instead of a filtered router NATSingle host makes requests on behalf of all internal users- hides the internal users behind the NATs IP address- internal users can have any IP addressshould use the reserved ranges of 192.168.n.m or 10.n.m.p to avoid possible conflicts with duplicate external addressesOnly works at the TCP/IP leveldoesnt do anything for addresses in the payloads of the packetsProxyHides internal users from the external network by hiding them behind the IP of the proxyPrevents low level network protocols from going through the firewall eliminating some of the problems with NATRestricts traffic to only the application level protocols being proxiedproxy is a combination of a client and a server; internal users send requests to the server portion of the proxy which then sends the internal users requests out through its client ( keeps track of which users requested what, do redirect returned data back to appropriate user)
12Benefits of firewall13Protects private Local Area Network form hostile intrusion from internetBlock harmful packet to reach important resourcesAllows network administrators to offer access to specific types of Internet services to selected LAN usersIt can protect:Your Data: the information you keep on computersYour resource: the computers themselvesYour reputation: Intruders on the Internet appear with your identity.Prepared by: Mr. NHEAN SophanPacket Filtering (Work at Layer 3)Compare network and transport protocols to a database of rules and then forward only the packets that meet the criteria of the rulesImplemented in routers and sometimes in the TCP/IP stacks of workstation machines- in a router a filter prevents suspicious packets from reaching your network- in a TCP/IP stack it prevents that specific machine from responding to suspicious trafficshould only be used in addition to a filtered router not instead of a filtered router NATSingle host makes requests on behalf of all internal users- hides the internal users behind the NATs IP address- internal users can have any IP addressshould use the reserved ranges of 192.168.n.m or 10.n.m.p to avoid possible conflicts with duplicate external addressesOnly works at the TCP/IP leveldoesnt do anything for addresses in the payloads of the packetsProxyHides internal users from the external network by hiding them behind the IP of the proxyPrevents low level network protocols from going through the firewall eliminating some of the problems with NATRestricts traffic to only the application level protocols being proxiedproxy is a combination of a client and a server; internal users send requests to the server portion of the proxy which then sends the internal users requests out through its client ( keeps track of which users requested what, do redirect returned data back to appropriate user)
13Challenging question14Prepared by: Mr. NHEAN SophanIs a firewall sufficient to secure my network or do I need anything else?NO!Packet Filtering (Work at Layer 3)Compare network and transport protocols to a database of rules and then forward only the packets that meet the criteria of the rulesImplemented in routers and sometimes in the TCP/IP stacks of workstation machines- in a router a filter prevents suspicious packets from reaching your network- in a TCP/IP stack it prevents that specific machine from responding to suspicious trafficshould only be used in addition to a filtered router not instead of a filtered router NATSingle host makes requests on behalf of all internal users- hides the internal users behind the NATs IP address- internal users can have any IP addressshould use the reserved ranges of 192.168.n.m or 10.n.m.p to avoid possible conflicts with duplicate external addressesOnly works at the TCP/IP leveldoesnt do anything for addresses in the payloads of the packetsProxyHides internal users from the external network by hiding them behind the IP of the proxyPrevents low level network protocols from going through the firewall eliminating some of the problems with NATRestricts traffic to only the application level protocols being proxiedproxy is a combination of a client and a server; internal users send requests to the server portion of the proxy which then sends the internal users requests out through its client ( keeps track of which users requested what, do redirect returned data back to appropriate user)
14Scenario15Firewall Scenario
Prepared by: Mr. NHEAN Sophan15Scenario 1: Saturday, Midnight16Prepared by: Mr. NHEAN Sophan
165 Minutes later17Prepared by: Mr. NHEAN Sophan
17Scenario 2: Monday, Midnight18Prepared by: Mr. NHEAN Sophan
Black HackerOK, lets try the Insurance company.This should take about 5 minutes!181 minutes later19Prepared by: Mr. NHEAN Sophan
Information Security ManagerInsurance Company
195 Hours later20Prepared by: Mr. NHEAN Sophan
Black Hacker
2021Thanks for Your Paying Attention!Prepared by: Mr. NHEAN Sophan
Questions?Source by Building Internet Firewalls Elizabeth D. Zwicky, Simon Cooper & D. Brent Chapmanhttp://www.vicomsoft.com/learning-center/firewalls/21