Lesson 9: Installing and Configuring Security Appliances Flashcards
1
Q
firewall
A
- one of the longest serving types of network security control
- principally used to implement security zones, such as intranet, demilitarized zone (DMZ), and the Internet
- basic function of a firewall is traffic filtering
- firewalls can protect a whole network (placed inline in the network and inspecting all traffic that passes through)
- firewalls that protect a single host only (installed on the host and only inspect traffic destined for that host)
- firewall can control only inbound traffic (ingress) or both inbound and outbound traffic (egress)
2
Q
packet filtering
A
- earliest type of network firewall
- stateless technique because the firewall examines each packet in isolation and has no record of previous packets
- stateless means that it does not preserve information about the connection between two hosts
- configured by specifying a group of rules, called an access control list (ACL)
- an action can be either to deny (block or drop the packet, and optionally log an event) or to accept (let the pack pass through the firewall)
- when a packet arrives, the firewall checks it to confirm whether it belongs to an existing connection | if it does not, it applies the ordinary packet filtering rules to determines whether to allow it | once the connection has been allowed, the firewall allows traffic to pass unmonitored, in order to conserve processing effort
- can inspect the headers of IP packets
- headers:
- IP filtering—accepting or denying traffic on the basis of its source and/or destination IP address.
- Protocol ID/type (TCP, UDP, ICMP, routing protocols, and so on).
- Port filtering/security—accepting or denying a packet on the basis of source and destination port numbers (TCP or UDP application type).
3
Q
circuit-level stateful inspection firewall
A
- maintains stateful information about the sessions established between two hosts (including malicious attempts to start a bogus session)
- information about each session is store in a dynamically updated state table
- examines the TCP three-way handshake and can detect attempts to open maliciously (a flood guard)
- monitors packet sequence numbers and can prevent session hijacking attacks
4
Q
application aware firewall
A
- also known as: application layer gateway, stateful multilayer inspection, or deep packet inspection
- one that can inspect the contents of packets at the application layer
- have to be configured with separate filters for each type of traffic (HTTP and HTTPS, SMTP/POP/IMAP, FTP, and so on)
- very powerful
- possible to craft DoS attacks against exploitable vulnerabilities in the firewall firmware
- firewall cannot examine encrypted data packets (unless configured with an SSL inspector)
5
Q
appliance firewall
A
- stand-alone hardware firewall that performs the function of a firewall only
- a type of network-based firewall and monitors all traffic passing into and out of a network segment
- could be implemented with routed interfaces or as a layer 2/virtual wire transparent firewall
6
Q
advanced firewall
A
- likely to be performed by an all-in-one or unified threat management (UTM) security appliance, combining the function of firewall, intrusion detection, malware inspection, and web security gateway (content inspection and URL filtering)
7
Q
router firewall
A
- similar to appliance firewall, except that the functionality is built into the router firmware
- most SOHO Internet router/modems have this type of firewall functionality
8
Q
application-based firewalls
A
- Host-based firewall (or personal firewall)—implemented as a software application running on a single host designed to protect that host only.
- Application firewall—software designed to run on a server to protect a particular application only (a web server firewall, for instance, or a firewall designed to protect an SQL Server® database). This is a type of host-based firewall and would typically be deployed in addition to a network firewall.
- Network operating system (NOS) firewall—a software-based firewall running under a network server OS, such as Windows® or Linux®. The server would function as a gateway or proxy for a network segment.
9
Q
host-based firewalls
A
while they can perform basic packet filtering, host-based firewalls tend to be program-or processed-based; that is, when a program tries to initiate (in the case of outbound) or accept (inbound) a TCP/IP network connection, the firewall prompts the user to block, allow once, or allow always
- unlike a network firewall, a host-based firewall will usually display an alert to the user when a program is blocked, allowing the user to override the block rule or add an accept rule (if the user has sufficient permissions to reconfigure firewall settings)
10
Q
personal firewall
A
- drawbacks of a personal firewall is that as software it is open to compromise by malware
- would have no means of determining the integrity of the process
11
Q
web application firewalls
A
- designed specifically to protect software running on web servers and their backend databases from code injection and DoS attacks
- use application-aware processing rules to filter traffic
- can be programmed with signatures of known attacks and use pattern matching to block requests containing suspect code
- WAF products include:
- ModSecurity (http://www.modsecurity.org) is an open source (sponsored by Trustwave) WAF for Apache®, Nginx, and IIS.
- NAXSI (https://github.com/nbs-system/naxsi) is an open source module for the nginx web server software.
- Imperva (http://www.imperva.com) is a commercial web security offering with a particular focus on data centers. Imperva markets WAF, DDoS, and database security through its SecureSphere appliance.
12
Q
proxy server
A
- works on a store-and-forward model
- rather than inspecting traffic as it passes through, the proxy deconstructs each packet, performs analysis, then rebuilds the packet and forwards it on (providing it conforms to the rules)
- more legitimate “man in the middle”
13
Q
web proxy
A
- web security gateways as usually their primary functions are to prevent viruses or Trojans infecting computers from the Internet, block spam, and restrict web use to authorized sites, acting as a content filter
- main benefit of proxy server is that client computers connect to a specified point within the perimeter network for web access
- most web proxy servers provide caching engines, whereby frequently requested web pages are retained on the proxy, negating the need to re-fetch those pages for subsequent requests
- some proxy servers also pre-fetch pages that are referenced in pages that have been requested
14
Q
multipurpose proxy
A
one configured with filters for multiple protocol types, such as HTTP, FTP, and SMTP
15
Q
non-transparent or transparent proxy servers
A
- non-transparent server means that the client must be configured with the proxy server address and port number to use it. The port on which the proxy server accepts client connections is often configured as port 8080.
• transparent (or forced or intercepting) proxy intercepts client traffic without the client having to be reconfigured. A transparent proxy must be implemented on a switch or router or other inline network appliance.
16
Q
reverse proxy servers
A
- provides for protocol-specific inbound traffic
- can publish applications from the corporate network to the Internet in this way
- proxy servers can handle encryption/decryption and authentication issues that arise when remote users attempt to connect to corporate servers, reducing overhead on those servers
17
Q
rule-based management
A
- firewall and other filtering rules are configured on the principle of least access
- least access is the same as the principle of least privilege; only allow the minimum amount of traffic required for the operation of valid network services and no more
18
Q
tuples
A
- each rule can specify whether to block or allow traffic based on several parameters, often referred to as tuples
- think of each rule being like a row in a database, tuples are the columns
19
Q
misconfigured firewall/content filter troubleshooting
A
- can cause an application or protocol to fail to function correctly | this type of error will usually be easy to identify, as users will report incidents connected with the failure of the data traffic
- other possible outcome of a badly configured firewall is that packets may be allowed through that should be blocked (more serious outcome because the result is to open the system to security vulnerabilities)
20
Q
Denial of Service (DOS)
A
- this type attack is one of a network’s worst fears
- can be extremely destructive and very difficult to mitigate
- Denial of Service (DoS) attack causes a service at a given host to fail or to become unavailable to legitimate users
- DoS attacks focus on overloading a service by using up CPU, system RAM, disk space, or network bandwidth (resource exhaustion)
- DoS focus on exploiting historical vulnerabilities in the TCP/IP protocol suite (TCP/IP was never designed for security; it assumes that all hosts and networks are trusted)
- can have severe impacts on service availability, with a consequent effect on the productivity and profitability of a company
- most bandwidth-directed DoS attacks are distributed (meaning attacks are launched from multiple, compromised computers)
- an attacker will compromise one or two machines to use as handlers, masters, or herders
- handlers are used to compromise hundreds or thousands or millions of zombie (agent) PCs with DoS tools (bots) forming a botnet | to compromise a computer, the attacker must install a backdoor application that gives them access to the PC; they can then use the backdoor application to install DoS software and trigger the zombies to launch the attack at the same time
- might be coordinated between groups of attackers
- growing evidence that nation states are engaging in cyber warfare, and terrorist groups have also been implicated in DoS attacks on well-known companies and governments institutions; there are also hacker collectives that might target an organization as part of a campaign
- some types of attacks simply aim to consume network bandwidth, denying it to legitimate and others cause resource exhaustion on the hosts processing requests, consuming CPU cycles and memory (this could potentially crash the host system completely)
21
Q
SYN flood attack
A
works by withholding the client’s ACK packet during TCP’s three-way handshake
22
Q
Distributed Reflection DoS (DRDoS) or amplification attack
A
- more powerful TCP SYN flood attack
- in this attack, the adversary spoofs the victim’s IP address and attempts to open connections with multiple servers | those servers direct their SYN/ACK responses to the victim server
- amplification attack types:
- Smurf attack–adversary spoofs the victim’s IP address and pings the broadcast address of a third-party network (one with many hosts; referred to as “amplifying network”)
- bogus DNS queries–bombard victim network with responses
- Network Time Protocol–helps server on a network and on the Internet to keep the correct time
23
Q
blackhole
A
- when a network is faced with a DDoS or similar flooding attack, an ISP can use either an ACL or a blackhole to drop packets for the affected IP address(es)
- an area of the network that cannot reach any other part of the network
- blackhole option is preferred, as evaluating each packet in a multi-gigabit stream against ACLs overwhelms the processing resources available
- makes attack less damaging to the ISP’s other customers
24
Q
sinkhole routing
A
- another option is to use sinkhole routing so that the traffic flooding a particular IP address is routed to a different network where it can be analyzed
25
Q
load balancer
A
- distributes client requests across available server nodes in a farm or pool
- clients use the single name/IP address of the load balancer to connect to the servers in the farm
- provides fault tolerance
- if there are multiple servers available in a farm, all addressed by a single name/IP address via a load balancer, then if a single server fails, client requests can be routed to another server in the farm
- two main types of load balancers:
- Layer 4 load balancer–early instances of load balancers would base forwarding decisions on IP address and TCP/UDP port values (working at up to layer 4 in the OSI model) | stateless
- Layer 7 load balancer (content switch)–as web applications have become more complex, modern load balancers need to be able to make forwarding decisions based on application-level data, such as a request for a particular URL or data types like video or audio streaming
- load balancer features:
Configurable load—the ability to assign a specific server in the farm for certain types of traffic or a configurable proportion of the traffic. - TCP offload—the ability to group HTTP packets from a single client into a collection of packets assigned to a specific server.
- SSL offload—when you implement SSL/TLS to provide for secure connections, this imposes a load on the web server (or other server). If the load balancer can handle the processing of authentication and encryption/decryption, this reduces the load on the servers in the farm.
- Caching—as some information on the web servers may remain static, it is desirable for the load balancer to provide a caching mechanism to reduce load on those servers.
- Prioritization—to filter and manage traffic based on its priority.
26
Q
Virtual IP (VIP) address
A
each server node or instance needs its own IP address, but externally a load-balanced service is advertised using a VIP
- one of the most widely used protocols is the Common Access Redundancy Protocol (CARP) | Cisco’s proprietary Gateway Load Balancing Protocol (GLBP)
27
Q
scheduling algorithm
A
- code and metrics that determine which node is selected for processing each incoming request
- round robin
- simplest type of scheduling, this means picking the next node
- other methods include picking the node with fewest connections or best response
- each method can also be weighted, using administrator set preferences or dynamic load information or both
