Ch 6 - Security Technology-Firewalls and VPNs Flashcards
Story Time
Beg. Chapter
Kelvin Urich - scheduled to present a plan to Charlie Moody and the IT planning staff in 2 weeks on the Internet connection architecture
W/O this they cannot start costing the project or planning for deployment
Laverne Nguyen (architecture team) - No consensus on 2 design alternatives presented by the consultant:
- Screened subnet with bastion hosts
- Screened subnet with proxy servers
Miller Harrison (contractor brought in to help with the project) - seems to be in disagreement and pouting.
Ends with Kelvin calling for a meeting the next day with the consultant to make the decision
Learning Objectives
- Recognize the important role of access control in computerized information systems, and identify and discuss commonly used authentication factors
- Describe firewall technology and the various approaches to its implementation
- Identify the various approaches to control remote and dial-up access by means of the authentication and authorization of users
- Discuss content filtering technology
- Describe the technology that enables the use of VPNs (virtual private networks).
Access Control
is the method by which systems determine whether and how to admit a user into a trusted area of the organization.
Restricted areas could be: computer room
How is access control achieved? via a combination of policies, programs, and technologies
ACs can be: mandatory, non-discretionary or discretionary
Mandatory access controls (MACs)
use data classification schemes, giving users and data owners limited controls over access to information resources.
How does a data classification scheme work?
Information is rated by sensitivity and each user is assigned the level of information that they may access
Lattice-based access control
a form of access control where users are assigned a matrix of authorizations for particular areas of access.
It relies on:
Access Control List (ACL) - column of attributes of a particular object (i.e. printer)
Capabilities Table - a row of attributes associated with a particular subject
Nondiscretionary Controls
strictly enforced version of MACs that are managed by a central authority in the organization.
Can be role-based controls or task-based controls
Discretionary access controls (DACs)
implemented at the discretion or option of the data user.
Authentication
process of validating a supplicant’s purported identity
3 Widely used authentication mechanisms/factors:
- Something the supplicant knows
- Something a supplicant has
- Something a supplicant is
Something a supplicant knows?
- password
- passphrase
Something a supplicant has?
- dumb cards - atm
- smart cards
- synchronous tokens
- asynchronous tokens
Something a supplicant is or can produce
- Fingerprints, palm prints, hand topography
- iris scans, voice patterns
- signatures
biometrics
authorization
the matching of an authenticated entity to a list of information assets and corresponding access levels
accountability or auditability
ensures all actions on a system authorized or otherwise can be attributed to an authenticated identity
Firewalls
prevents specific types of information from moving between the outside world, known as the untrusted network, and the inside world, known as the trusted network.
Firewalls can be categorized by:
processing mode,
development,
or structure
Firewall processing mode categories
- Packet-filtering firewalls
- Application gateways
- Circuit gateways
- MAC layer firewalls
- Hybrids-use a combination of the previous 4 - most firewalls fall in this category
Packet-filtering firewalls
Packet-filtering firewalls examine every incoming packet header and can selectively filter packets based on header information such as destination address, source address, packet type, and other key information
Packet-filtering Firewalls Types
- Static
- Dynamic
- Stateful (More thorough, more processing req.)
Application Gateways - application-level firewall - application firewall
is frequently installed on a dedicated computer, separate from the filtering router, but is commonly used in conjunction with a filtering router. The application firewall is also known as a proxy server since it runs special software that acts as a proxy for a service request.
Circuit Gateways Firewall
operates at the transport layer.
Again, connections are authorized based on addresses. Like filtering firewalls, circuit gateway firewalls do not usually look at traffic flowing between one network and another, but they do prevent direct connections between one network and another. They accomplish this by creating tunnels connecting specific processes or systems on each side of the firewall, and then allowing only authorized traffic, such as a specific type of TCP connection for authorized users, in these tunnels.
MAC Layer Firewalls
Thus, MAC layer firewalls link the addresses of specific host computers to ACL entries that identify the specific types of packets that can be sent to each host, and block all other traffic
Firewall processing inspection location
Firewalls by generation
First - Fifth
- static packet-filtering firewalls
- application-level firewalls or proxy servers
- stateful inspection firewalls
- dynamic packet-filtering
- Kernel proxy - a specialized form that works under Windows NT Executive. Evaluates packets at multiple layers of the protocol stack
Firewalls Categorized by Structure
- Commercial-grade firewall applicances
- Commercial-grade firewall systems
- Small office/Home office (SOHO) Firewall appliances
- Residential-Grade Firewall Software
Firewall Architectures
- Packet-filtering routers
- Screened-host firewalls
- Dual-Homed firewalls
- Screened subnet firewalls
Packet Filtering Routers
Most organizations with an Internet connection have some form of a router at the boundary between the organization’s internal networks and the external service provider. Many of these routers can be configured to reject packets that the organization does not want to allow into the network
Sreened Host Firewalls
Screened host firewalls combine the packet-filtering router with a separate, dedicated firewall, such as an application proxy server.
Bastion Host - the separate host/proxy server - sole defender on the network perimeter - sometimes called sacrificial host
Dual-Homed Host Firewalls
When this architectural approach is used, the bastion host contains two NICs (network interface cards) rather than one, as in the bastion host configuration. One NIC is connected to the external network, and one is connected to the internal network, providing an additional layer of protection. With two NICs, all traffic must physically go through the firewall to move between the internal and external networks.
Screened Subnet Firewalls (with DMZ)
The dominant architecture used today is the screened subnet firewall. The architecture of a screened subnet firewall provides a DMZ. The DMZ can be a dedicated port on the firewall device linking a single bastion host, or it can be connected to a screened subnet
Until recently, servers providing services through an untrusted network were commonly placed in the DMZ. Examples of these include Web servers, file transfer protocol (FTP) servers, and certain database servers. More recent strategies using proxy servers have provided much more secure solutions
4 Questions to consider to select the right firewall
- Which type of firewall technology offers the right balance between protection and cost for the needs of the organization?
- What features are included in the base price? What features are available at extra cost? Are all cost factors known?
- How easy is it to set up and configure the firewall? How accessible are the staff technicians who can competently configure the firewall?
- Can the candidate firewall adapt to the growing network in the target organization?
VPNs must:
- Encapsulate
- Encrypt
- Authenticate
VPNs Transport Mode and Tunnel Mode
Transport Mode
In transport mode, the data within an IP packet is encrypted, but the header information is not. This allows the user to establish a secure link directly with the remote host, encrypting only the data contents of the packet. The downside to this implementation is that packet eavesdroppers can still identify the destination system. Once an attacker knows the destination, he or she may be able to compromise one of the end nodes and acquire the packet information from it
Tunnel Mode
Tunnel mode establishes two perimeter tunnel servers that encrypt all traffic that will traverse an unsecured network. In tunnel mode, the entire client packet is encrypted and added as the data portion of a packet addressed from one tunneling server to another. The receiving server decrypts the packet and sends it to the final address. The primary benefit to this model is that an intercepted packet reveals nothing about the true destination system
