IAS Chapter 3 Edited

Chapter-Three
Network Firewall Security
Information Assurance and Security 2015 E.C

Terminologies
• Network - a group or system of interconnected people or things
• Computer network: is a group of computers that use a set of common communication

protocols connected with each other to communicate and share resources.
• Protocols: a set of rules and guidelines for communicating data. Rules are defined for each
step and process during communication between two or more computers.
• Private networks :is a computer network that uses a private address space of IP addresses.

Both the IPv4 and the IPv6 specifications define private IP address ranges.
• Firewalls :is a network security device/software that monitors and filters incoming and
outgoing network traffic based on an organization’s previously established security policies
Basic Firewall Components
• Policy
• Advanced authentication
• Packet inspection
• Application gateways
Who do Firewalls Guard Against?
• Internal Users
• Hackers
• Corporate Espionage
• Terrorists
• Common Thieves
Firewall
 A firewall is a typical border control mechanism or perimeter defense.
 It monitors incoming and outgoing network traffic.
 The purpose of a firewall is to block traffic from the outside, but it could also
be used to block traffic from the inside based on a defined set of security rules.
 Firewalls can provide different levels of protection.
 Firewalls can be implemented in both hardware and software, or a

combination of both.
Hardware-based firewalls
• A hardware-based firewall is an appliance that acts as a secure gateway

between devices inside the network perimeter and those outside it. Because
they are self-contained appliances, hardware-based firewalls don't consume
processing power or other resources of the host devices.
• Sometimes called network-based firewalls, these appliances are ideal for

medium and large organizations looking to protect many devices.
• Hardware-based firewalls require more knowledge to configure and manage

than their host-based counterparts.
Software-based firewalls
• A software-based firewall, or host firewall, runs on a server or other device.
• It needs to be installed on each device requiring protection. As such, software-

based firewalls consume some of the host device's CPU and RAM resources.
• It provide individual devices significant protection against viruses and others.
• They can distinguish different programs running on the host, while filtering
inbound and outbound traffic.
• This provides a fine-grained level of control, making it possible to enable

communications to/from one program but prevent it to/from another.
Firewall Objectives
• Network firewall is similar to firewalls in building construction, because in both

cases they are intended to isolate one "network" or "compartment" from another.
• In otherworld, Security wall between private (protected) network and outside

word
• Keep intruders, malicious code and unwanted traffic or information out.
• Keep private and sensitive information.

Firewall Characteristics
Design goals:
 Blocking access except via the firewall: All traffic from inside to outside must
pass through the firewall (physically blocking all access to the local network
except via the firewall).
 Defined the local security police: Only authorized traffic will be allowed to pass.
 Immunity: The firewall itself is immune to penetration (use of trusted system

with a secure operating system)
Firewall Techniques
Techniques that use to control access and enforce the site's security policy are
 Service control
Determines the type of internet services that can be accessed, inbound
or outbound.
The firewall may filter traffic on this basis of IP address and TCP port number;
may provide proxy software that receives and interprets each service request
before passing it on; or may host the server software itself, such as web or
mail service.
Firewall Techniques Cont..
 Direction control
Determines the direction in which particular service request may be initiated
and allowed to flow through the firewall.
 User control
Controls access to a service according to which user is attempting to access it.
 Behavior control
Controls how particular services are used (e.g. filter e-mail)
Policy Actions
• Packets flowing through a firewall can have one of three outcomes:
Accepted: allowed through the firewall.
Dropped: not allowed through with no indication of failure.
Rejected: not allowed through, accompanied by an attempt to inform the
source that the packet was rejected.

Policy Actions Cont.….
 Policies used by the firewall to handle packets are based on several properties of
the packets being inspected, including the protocol used, such as:
TCP or UDP
The source and destination IP addresses
The source and destination ports
The application-level payload of the packet (e.g., whether it contains a virus).

Firewall Rule Sets
Two fundamental approaches to creating firewall policies (or rule sets)
• Blacklist approach (default-allow)

All packets are allowed through except those that fit the rules defined
specifically in a blacklist.
• Whitelist approach (default-deny)

Packets are dropped or rejected unless they are specifically allowed by the
firewall
Limitations of firewall
• The firewall cannot protect against the transfer of virus-infected programs

or files. Because of the variety of operating systems and applications
supported inside the perimeter, it would be impractical and perhaps impossible
for the firewall to scan all incoming files, e-mail, and messages for viruses.
• The firewall does not protect against internal threats, such as a disgruntled
employee or an employee who unwittingly cooperates with an external attacker.
• The firewall cannot protect against attacks that bypass the firewall. Internal
systems may have dial-out capability to connect to an ISP.
Types of Firewalls
Firewalls fall into four broad categories :

Packet-filtering routers
Circuit-level gateways
Application-level gateways
State-full multilayer
Packet Filter
• Work at the network layer of the OSI model
• Each packet is compared to a set of criteria before it is forwarded, If a packet

matches the packet filter's set of rules, the packet filter will accept it.
Circuit level
• Ii is work at the session layer of the OSI model,
• Monitor TCP handshaking between packets to determine whether a requested

session is legitimate.
Application Level
• It also called proxies, are similar to circuit-level gateways except that they are
application specific.
• Gateway that is configured to be a web proxy will not allow any ftp, telnet or
other traffic through.
• It may inspect the contents of the traffic, blocking what it views as inappropriate
content (i.e. websites, viruses, vulnerabilities, ...)
Application Level
State full Multilayer
• Combine the aspects of the other three types of firewalls.
• They filter packets at the network layer, determine whether session packets are
legitimate and evaluate contents of packets at the application layer.
Thank You!!!

IAS Chapter 3 Edited

Uploaded by

Copyright:

Available Formats

IAS Chapter 3 Edited

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IAS Chapter 3 Edited

Uploaded by

Copyright:

Available Formats

Chapter-Three

Network Firewall Security

Information Assurance and Security 2015 E.C

• Computer network: is a group of computers that use a set of common communication

• Private networks :is a computer network that uses a private address space of IP addresses.

 A firewall is a typical border control mechanism or perimeter defense.

 It monitors incoming and outgoing network traffic.

 Firewalls can provide different levels of protection.

 Firewalls can be implemented in both hardware and software, or a

• A hardware-based firewall is an appliance that acts as a secure gateway

• Sometimes called network-based firewalls, these appliances are ideal for

• Hardware-based firewalls require more knowledge to configure and manage

• A software-based firewall, or host firewall, runs on a server or other device.

• It needs to be installed on each device requiring protection. As such, software-

• It provide individual devices significant protection against viruses and others.

• This provides a fine-grained level of control, making it possible to enable

• Network firewall is similar to firewalls in building construction, because in both

• In otherworld, Security wall between private (protected) network and outside

• Keep intruders, malicious code and unwanted traffic or information out.

• Keep private and sensitive information.

 Immunity: The firewall itself is immune to penetration (use of trusted system

and allowed to flow through the firewall.

• Packets flowing through a firewall can have one of three outcomes:

Accepted: allowed through the firewall.

Dropped: not allowed through with no indication of failure.

Rejected: not allowed through, accompanied by an attempt to inform the

source that the packet was rejected.

The source and destination IP addresses

The source and destination ports

The application-level payload of the packet (e.g., whether it contains a virus).

Two fundamental approaches to creating firewall policies (or rule sets)

• Blacklist approach (default-allow)

• Whitelist approach (default-deny)

• The firewall cannot protect against the transfer of virus-infected programs

Firewalls fall into four broad categories :

• Work at the network layer of the OSI model

• Each packet is compared to a set of criteria before it is forwarded, If a packet

• Ii is work at the session layer of the OSI model,

• Monitor TCP handshaking between packets to determine whether a requested

• Combine the aspects of the other three types of firewalls.

You might also like