Security fundamentals Topic 10 Securing the network perimeter

Agenda

• • • Secure network topologies and security zones Network perimeter security and models Implementing firewalls

Secure topologies

• • • Goal is to separate network traffic so that no network segment carries traffic not required on the segment Performance will also be more efficient Security zones: – Areas of the network that contain resources with similar security requirements – Group computers and devices according to security needs – Reduce the attack surface of your resources – Builds a network security framework • What are the threats?

• What can be used to protect?

Security zones

• VLANs – Create security zones with VLANs: subnets created by switches and joined by routers • 802.1q tagging • Servers can sit on many VLANS • Limits broadcast domains • Flexible for adding, moving and changing port VLANs • Hides physical configuration • Fast isolation of devices that are the source of threats • Vulnerable to Layer 2 attacks

Security zones

• • • • • • Create security zones by placing firewalls between internal and external networks Perimeter network, screened subnet, DMZ: a separate security zone for Internet facing resources.

Intranet (trusted) Extranet (partners) Perimeter network (access from internet) Internet (untrusted)

Intranets

• • • Internal network, private network, LAN Typically trusted but not safe from disgruntled employees and contractors Protection: – Firewall protection from internet and DMZ – Antivirus on all network hosts – Audit critical resources and confidential data – Use firewalls on hosts with confidential data – Document and audit physical infrastructure and critical systems for unauthorised devices and connections – Restrict and monitor access to critical systems – Remove unnecessary services from mission critical servers

Perimeter networks

• • • Deploy public resources such as DNS, mail and web servers Also use for untrusted networks (eg wireless) Protection: – Firewall external network – – Limit services and remove unnecessary services Audit all services – – Name resolution is separated from internal network Remove or restrict remote management service – Document and audit all physical and logical configurations – Perform frequent data and configuration backups

Extranets

• • • • Partner access to resources Partners must authenticate and then get access to non public resources Access can be provided by a VPN Protection: – Firewall from external network – Authenticate all access – Limit services and remove unnecessary services – Audit all network and service access

Perimeter network types

• • Three-pronged firewall – Single firewall with three interfaces for internet, internal network and DMZ – Small organisations and branch offices – Weakness is if firewall fails all networks are vulnerable Back-to-back firewalls – Two firewalls with DMZ behind the first firewall and internal network behind the first and second firewalls.

– Defence in depth strategy: Two firewalls to break to reach the internal network – More restrictive rules on the 2nd firewall.

– Security by diversity by using different brands of firewalls

N-Tier architecture & bastion hosts

• • • • For e-business operations Business function servers each have separate tiers: web tier, middle tier, data tier.

Each tier is protected by a firewall and traffic between tiers is controlled, thereby reducing the attack surface Bastion hosts: – Single host provides external services – Single firewall protects internal network and only allows traffic to bastion host – If the bastion is compromised the attacker is on the internal network – Least secure design

Perimeter security and traffic

• • • • By default block network traffic and then make exceptions for required network traffic Allow only required traffic: block by protocol, port and destination Don’t automatically trust outgoing traffic (may be confidential data on the way out) Review network traffic that was blocked and investigate the source of this traffic

Firewalls

• • • • • • Packet filtering Application filtering Circuit level inspection Stateful inspection Content inspection Proxy

Packet filtering

• • Inspects the IP header of each packet Applies rules, permit or deny, inbound or outbound – Source IP – Destination IP – Layer 4 protocol TCP/UDP – Source port number – Destination port number – ICMP message type (eg echo request) – Fragmentation flags – IP Options (mostly used for diagnostics) – Packet size – No inspection of payload

Circuit level inspection

• • • • Monitors for hosts establishing connections If the connection is allowed, then all following traffic is allowed without further inspection Does not inspect payload More efficient than packet filtering

Stateful inspection

• • • • • • Monitors for hosts establishing connections If the connection is allowed, then all following traffic is allowed Continues to monitor the packets within the connection and checks that the packets are valid – sequence numbers are checked Each connection is tracked using a state table Does not inspect payload Initially a feature of checkpoint firewalls

Application layer filtering/Gateway

• • Examines the payload of network packets Inspection depends on the application layer protocol – Will inspect HTTP, SMTP, FTP and other protocol commands – – – – – Will inspect Microsoft® ActiveX, Java® etc Used to check email for viruses Used to inspect web requests for signs of attack ISA server Can be slow as it is deep packet inspection and multiple packets in a sequence can be examined in context

Tunnelling

• • • Used to bypass firewall inspection by encapsulating traffic with a header that will pass inspection Also used to bypass firewall inspection by encapsulating encrypted traffic that can’t be inspected To protect from tunnel traffic: – Perform application layer filtering – – Block encrypted traffic Implement Intrusion detection

Proxy servers

• • • • Accepts a connection from a client and then creates a separate connection to the server/destination No direct connection between client and server Application layer proxy will also filter content and cache web content May require the clients to be configured to use the proxy

NAT

• • • • • • • • • RFC 3022 Changes IP addresses and port numbers Allows a network to use a single external IP Private addresses are not routable on the internet Hides internal addresses No payload inspection Static NAT one-to-one IPs Dynamic NAT many-to-many IPs PAT using up to 64,000 port numbers per IP

Protecting firewalls

• • • • • • • • • Rules: – Start with a default deny any – Put specific rules first – Permit only required ports, protocols, applications Keep the firewall updated – watch security announcements Update virus definition files routinely Physically protect the firewall Document firewall configuration and review Limit and authenticate remote management Use complex passwords Know and test rules Ensure no connections circumvent the firewall

Lesson summary

• • • Learned about the concept of secure network topologies, segmented logically into security zones, with different trust levels How to use models and zones to secure the network perimeter How to go about implementing and using firewalls for network security, and different types