Lesson 8 Topics For The Week 8 Security Technology: Firewall and Vpns

LESSON 8
Topics for the Week 8

Security Technology: Firewall and VPNs

• Access Control
• Firewalls
• Protecting Remote Connections
• Security Technology: Firewall and VPNs Access Control
• is the method by which systems determine whether and how to admit a user into a
trusted area of the organization—that is, information systems, restricted areas
such as computer rooms, and the entire physical location.
• Mandatory access controls (MACs) – use data classification schemes; they give users and
data owners limited control over access to information resources.
• Nondiscretionary controls - are a strictly-enforced version of MACs that are managed by a

central authority in the organization and can be based on an individual’s role (role- based
controls) or a specified set of tasks (subject- or object-based) task-based controls.
• Discretionary access controls (DACs) - are implemented at the discretion or option of the
data user.

In general, all access control approaches rely on as the following mechanisms:

 Identification
 Authentication
 Authorization
 Accountability

• Identification - is a mechanism whereby an unverified entity—called a supplicant—that
seeks access to a resource proposes a label by which they are known to the system.
• Authentication - is the process of validating a supplicant’s purported identity. Three widely used
authentication mechanisms, or authentication factors:

 Something a supplicant knows
 Something a supplicant has
 Something a supplicant is
• Authorization - is the matching of an authenticated entity to a list of information

assets and corresponding access levels. This list is usually an ACL or access control
matrix.
• Firewalls

- A firewall in an information security program is similar to a building’s firewall in that it prevents
specific types of information from moving between the outside world, known as the untrusted network
(for example, the Internet), and the inside world, known as the trusted network.
- The firewall may be a separate computer system, a software service running on an existing router or
server, or a separate network containing a number of supporting devices.
• Firewalls can be categorized by:

 Processing Mode
 Development Era / Generation
 Structure.
SOHO Firewall Devices
Source: Course Technology/Cengage Learning

• Firewall Architectures

Four Common Architectural Implementations:

 Packet-filtering routers
 Screened host firewalls
 Dual-homed firewalls
 Screened Subnet firewalls
Screened Host Firewall

Dual-Homed Host Firewall
Screened Subnet (DMZ)
• Best Practices for Firewalls

 All traffic from the trusted network is allowed out
 The firewall device is never directly accessible from the public network for configuration or
management purposes.
 Simple Mail Transport Protocol (SMTP) data is allowed to enter through the firewall, but is routed to
a well-configured SMTP gateway to filter and route messaging traffic securely.
 All Internet Control Message Protocol (ICMP) data should be denied.
 Telnet (terminal emulation) access to all internal servers from the public networks should be
blocked.
 When Web services are offered outside the firewall, HTTP traffic should be blocked from internal
networks through the use of some form of proxy access or DMZ architecture.
 All data that is not verifiably authentic should be denied.
Protecting Remote Connections Remote Access
RADIUS, TACACS, and Diameter - systems that authenticate the credentials of users who are trying to
access an organization’s network via a dial-up connection.
• Two authentication systems for secured 3rd party authentication:

 Kerberos - named after the three-headed dog of Greek mythology (spelled Cerberus in
Latin) that guards the gates to the underworld—uses symmetric key encryption to validate
an individual user to various network resources. Kerberos keeps a database containing the
private keys of clients and servers—in the case of a client, this key is simply the client’s
encrypted password.
 SESAME - The Secure European System for Applications in a Multivendor Environment
(SESAME) is the result of a European research and development project partly funded by
the European Commission.
 It is similar to Kerberos in that the user is first authenticated to an authentication server and receives a
token. The token is then presented to a privilege attribute server (instead of a ticket granting service as
in Kerberos) as proof of identity to gain a privilege attribute certificate (PAC).
• Virtual Private Networks (VPNs)

- Virtual private networks are implementations of cryptographic technology. is a private and
secure network connection between systems that uses the data communication capability
of an unsecured and public network.
• IPSec - the dominant protocol used in VPNs, uses either transport mode or tunnel
mode.
• IPSec can be used as a stand-alone protocol, or coupled with the Layer Two Tunneling
Protocol (L2TP).
• Transport Mode - the data within an IP packet is encrypted, but the header information is
not. This allows the user to establish a secure link directly with the remote host, encrypting
only the data contents of the packet. The downside to this implementation is that packet
eavesdroppers can still identify the destination system.
Transport Mode VPN
• Tunnel Mode - establishes two perimeter tunnel servers that encrypt all traffic that will
traverse an unsecured network. In tunnel mode, the entire client packet is encrypted
and added as the data portion of a packet addressed from one tunneling server to
another.
Tunnel Mode VPN

Lesson 8 Topics For The Week 8 Security Technology: Firewall and Vpns

Uploaded by

Copyright:

Available Formats

Lesson 8 Topics For The Week 8 Security Technology: Firewall and Vpns

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lesson 8 Topics For The Week 8 Security Technology: Firewall and Vpns

Uploaded by

Copyright:

Available Formats

LESSON 8

Topics for the Week 8

• Nondiscretionary controls - are a strictly-enforced version of MACs that are managed by a

authentication mechanisms, or authentication factors:

• Authorization - is the matching of an authenticated entity to a list of information

• Virtual Private Networks (VPNs)

You might also like