IOT
Max02
Stewart_James_Michael_Network_security_firewallz-lib.org.pdf
World Headquarters Jones & Bartlett Learning
5 Wall Street
Burlington, MA 01803
978-443-5000
www.jblearning.com
Jones & Bartlett Learning books and products are available through most
bookstores and online booksellers. To contact Jones & Bartlett Learning directly,
call 800-832-0034, fax 978-443-8000, or visit our website, www.jblearning.com.
Substantial discounts on bulk quantities of Jones & Bartlett Learning
publications are available to corporations, professional associations, and other
qualified organizations. For details and specific discount information, contact
the special sales department at Jones & Bartlett Learning via the above
contact information or send an email to [email protected].
Copyright © 2014 by Jones & Bartlett Learning, LLC, an Ascend
Learning Company All rights reserved. No part of the material protected by
this copyright may be reproduced or utilized in any form, electronic or
mechanical, including photocopying, recording, or by any information storage
and retrieval system, without written permission from the copyright owner.
The content, statements, views, and opinions herein are the sole expression of
the respective authors and not that of Jones & Bartlett Learning, LLC. Reference
herein to any specific commercial product, process, or service by trade name,
trademark, manufacturer, or otherwise does not constitute or imply its
endorsement or recommendation by Jones & Bartlett Learning, LLC and such
reference shall not be used for advertising or product endorsement purposes. All
trademarks displayed are the trademarks of the parties noted herein. Network
Security, Firewalls, and VPNs, Second Edition is an independent publication and
has not been authorized, sponsored, or otherwise approved by the owners of the
trademarks or service marks referenced in this product.
There may be images in this book that feature models; these models do not
necessarily endorse, represent, or participate in the activities represented in the
images. Any screenshots in this product are for educational and instructive
purposes only. Any individuals and scenarios featured in the case studies
throughout this product may be real or fictitious, but are used for instructional
purposes only.
This publication is designed to provide accurate and authoritative information in
regard to the subject matter covered. It is sold with the understanding that the
publisher is not engaged in rendering legal or other professional service. If legal
advice or other expert assistance is required, the service of a competent
professional person should be sought.
Production Credits
Chief Executive Officer: Ty Field
President: James Homer
SVP, Editor-in-Chief: Michael Johnson SVP, Curriculum Solutions: Christopher Will
Director of Sales, Curriculum Solutions: Randi Roger Senior Marketing
Manager: Andrea DeFronzo Associate Marketing Manager: Kelly Thompson VP,
Design and Production: Anne Spencer VP, Manufacturing and Inventory
Control: Therese Connell Manufacturing and Inventory Control Supervisor: Amy
Bacus Editorial Management: High Stakes Writing, LLC, President: Lawrence J.
Goodrich Senior Editor, HSW: Ruth Walker
Senior Editorial Assistant: Rainna Erikson Production Manager: Susan Schultz
Composition: Gamut+Hue, LLC
Cover Design: Kristin E. Parker
Director of Photo Research and Permissions: Amy Wrynn Rights & Photo
Research Assistant: Joseph Veiga Cover Image: © HunThomas/ShutterStock,
Inc.
Chapter Opener Image: © Rodolfo Clix/Dreamstime.com
Printing and Binding: Edwards Brothers Malloy Cover Printing: Edwards Brothers
Malloy ISBN: 978-1-284-03167-6
Library of Congress Cataloging-in-Publication Data Not available at time
of printing.
6048
Printed in the United States of America 17 16 15 14 13 10 9 8 7 6 5 4 3 2 1
Contents
Preface
PART ONE Foundations of Network Security
CHAPTER
1
Fundamentals of Network Security
What Is Network Security?
What Is Trust?
Who—or What—Is Trustworthy?
What Are Security Objectives?
What Are You Trying to Protect?
Seven Domains of a Typical IT
Infrastructure
Goals of Network Security
How Can You Measure the Success of
Network Security?
Why Are Written Network Security Policies
Important?
Planning for the Worst
Who Is Responsible for Network Security?
Examples of Network Infrastructures and
Related Security Concerns
Workgroups
SOHO Networks
Client/Server Networks
LAN Versus WAN
Thin Clients and Terminal Services
Remote Control, Remote Access, and VPN
Boundary Networks
Strengths and Weaknesses of Network
Design
Enhancing the Security of Wired Versus
Wireless LAN Infrastructures
Internal and External Network Issues
Common Network Security Components
Used to Mitigate Threats
Hosts and Nodes
IPv4 Versus IPv6
Firewall
Virtual Private Networks
Proxy Servers
Network Address Translation
Routers, Switches, and Bridges
The Domain Name System
Directory Services
Intrusion Detection Systems and
Intrusion Prevention Systems
Network Access Control
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 1 ASSESSMENT
CHAPTER
2
Firewall Fundamentals
What Is a Firewall?
What Firewalls Cannot Do
Why Do You Need a Firewall?
What Are Zones of Risk?
How Firewalls Work and What Firewalls Do
TCP/IP Basics
OSI Reference Model
Sub-Protocols
Headers and Payloads
Addressing
Types of Firewalls
Ingress and Egress Filtering
Types of Filtering
Static Packet Filtering
Stateful Inspection and Dynamic Packet
Filtering
Network Address Translation (NAT)
Application Proxy
Circuit Proxy
Content Filtering
Software Versus Hardware Firewalls
IPv4 Versus IPv6 Firewalls
Dual-Homed and Triple-Homed Firewalls
Placement of Firewalls
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 2 ASSESSMENT
CHAPTER
3
VPN Fundamentals
What Is a Virtual Private Network?
What Are the Benefits of Deploying a VPN?
What Are the Limitations of a VPN?
What Are Effective VPN Policies?
VPN Deployment Models and Architecture
Tunnel Versus Transport Mode
The Relationship Between Encryption and
VPNs
Symmetric Cryptography
Asymmetric Cryptography
Hashing
What Is VPN Authentication?
VPN Authorization
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 3 ASSESSMENT
CHAPTER
4
Network Security Threats and
Issues
Hacker Motivation
Favorite Targets of Hackers
Threats from Internal Personnel and External
Entities
The Hacking Process
Fallback Attacks
Common IT Infrastructure Threats
Hardware Failures and Other Physical
Threats
Natural Disasters
Accidents and Intentional Concerns
Malicious Code (Malware)
Advanced Persistent Threat
Fast Growth and Overuse
Wireless Versus Wired
Eavesdropping
Replay Attacks
Insertion Attacks
Fragmentation Attacks, Buffer Overflows,
and XSS Attacks
Fragmentation Attacks
Buffer Overflows
XSS (Cross-Site Scripting) Attacks
Man-in-the-Middle, Session Hijacking, and
Spoofing Attacks
Man-in-the-Middle Attacks
Session Hijacking
Spoofing Attacks
Covert Channels
Network and Resource Availability Threats
Denial of Service (DoS)
Distributed Denial of Service (DDoS)
Hacker Tools
Social Engineering
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 4 ASSESSMENT
PART TWO Technical Overview of Network
Security, Firewalls, and VPNs
CHAPTER
5
Network Security Implementation
Seven Domains of a Typical IT Infrastructure
Network Design and Defense in Depth
Protocols
Common Types of Addressing
IPv6
Controlling Communication Pathways
Hardening Systems
Equipment Selection
Authentication, Authorization, and
Accounting
Communication Encryption
Hosts: Local-Only or Remote and Mobile
Redundancy
Endpoint Security
Clients
Servers
Routers
Switches
Firewalls and Proxies
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 5 ASSESSMENT
Network Security Management
CHAPTER
6
Network Security Management Best
Practices
Fail-Secure, Fail-Open, and Fail-Close Options
Physical Security
Watching for Compromise
Incident Response
Trapping Intruders and Violators
Why Containment Is Important
Imposing Compartmentalization
Using Honeypots, Honeynets, and Padded
Cells
Essential Host Security Controls
Backup and Recovery
User Training and Awareness
Network Security Management Tools
Security Checklist
Network Security Troubleshooting
Compliance Auditing
Security Assessment
Configuration Scans
Vulnerability Scanning
Penetration Testing
Post-Mortem Assessment Review
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 6 ASSESSMENT
CHAPTER
7
Firewall Basics
Firewall Rules
Authentication, Authorization, and
Accounting
Monitoring and Logging
Understanding and Interpreting Firewall Logs
and Alerts
Intrusion Detection
Limitations of Firewalls
Improving Performance
The Downside of Encryption with Firewalls
Firewall Enhancements
Management Interfaces
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 7 ASSESSMENT
CHAPTER
8
Firewall Deployment
Considerations
What Should You Allow and What Should You
Block?
Common Security Strategies for Firewall
Deployments
Security Through Obscurity
Least Privilege
Simplicity
Defense in Depth
Diversity of Defense
Chokepoint
Weakest Link
Fail-Safe
Forced Universal Participation
Essential Elements of a Firewall Policy
Software and Hardware Options for Firewalls
Benefit and Purpose of Reverse Proxy
Use and Benefit of Port-Forwarding
Considerations for Selecting a Bastion Host
OS
Constructing and Ordering Firewall Rules
Evaluating Needs and Solutions in Designing
Security
What Happens When Security Gets in the
Way of Doing Business?
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 8 ASSESSMENT
CHAPTER
9
Firewall Management and Security
Best Practices for Firewall Management
Security Measures in Addition to a Firewall
Selecting the Right Firewall for Your Needs
The Difference Between Buying and Building
a Firewall
Mitigating Firewall Threats and Exploits
Concerns Related to Tunneling Through or
Across a Firewall
Testing Firewall Security
Important Tools for Managing and Monitoring
a Firewall
Troubleshooting Firewalls
Proper Firewall Implementation Procedure
Responding to Incidents
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 9 ASSESSMENT
CHAPTER
10
Using Common Firewalls
Individual and Small Office/Home Office
(SOHO) Firewall Options
Uses for a Host Software Firewall
Examples of Software Firewall Products
Using Windows 7’s Host Software Firewall
Using a Linux Host Software Firewall
Managing the Firewall on an ISP Connection
Device
Converting a Home Router into a Firewall
Commercial Software Network Firewalls
Open-Source Software Network Firewalls
Appliance Firewalls
Virtual Firewalls
Simple Firewall Techniques
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 10 ASSESSMENT
CHAPTER
11
VPN Management
VPN Management Best Practices
Developing a VPN Policy
Developing a VPN Deployment Plan
Bypass Deployment
Internally Connected Deployment
DMZ-Based Implementation
VPN Threats and Exploits
Commercial or Open Source VPNs
Differences Between Personal and
Enterprise VPNs
Balancing Anonymity and Privacy
Protecting VPN Security to Support
Availability
The Importance of User Training
VPN Troubleshooting
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 11 ASSESSMENT
CHAPTER
12
VPN Technologies
Differences Between Software and Hardware
Solutions
Software VPNs
Hardware VPNs
Differences Between Layer 2 and Layer 3
VPNs
Internet Protocol Security (IPSec)
Layer 2 Tunneling Protocol (L2TP)
Secure Sockets Layer (SSL)/Transport Layer
Security (TLS)
SSL/TLS and VPNs
Secure Shell (SSH) Protocol
Establishing Performance and Stability for
VPNs
Performance
Stability
Using VPNs with Network Address
Translation (NAT)
Types of Virtualization
Desktop Virtualization
SSL VPN Virtualization
Differences Between Internet Protocol
Version 4 (IPv4) and Internet Protocol
Version 6 (IPv6)
The TCP/IP Protocol Suite
IPv4 Challenges
IPv6
IPSec and IPv6
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 12 ASSESSMENT
PART THREE Implementation, Resources, and
the Future
CHAPTER
13
Firewall Implementation
Constructing, Configuring, and Managing a
Firewall
SmoothWall
Examining Your Network and Its Security
Needs
What to Protect and Why
Preserving Privacy
Firewall Design and Implementation
Guidelines
Selecting a Firewall
Hardware Requirements for SmoothWall
Planning a Firewall Implementation with
SmoothWall
Firewalling a Big Organization:
Application-Level Firewall and Package
Filtering, a Hybrid System
Firewalling a Small Organization: Packet
Filtering or Application-Level Firewall,
a Proxy Implementation
Firewalling in a Subnet Architecture
Installing a Firewall with SmoothWall
Configuring a Firewall with SmoothWall
Elements of Firewall Deployment
Performing Testing with SmoothWall
Firewall Troubleshooting
Additional SmoothWall Features
Firewall Implementation Best Practices
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 13 ASSESSMENT
CHAPTER
14
Real-World VPNs
Operating System–Based VPNs
VPN Appliances
Configuring a Typical VPN Appliance
Client-Side Configuration
Remote Desktop Protocol
Using Remote Control Tools
Using Remote Access
The Technology for Remote Use
Choosing Between IPSec and SSL Remote
Access VPNs
Terminal Services
TS RemoteApp
TS Web Access
Microsoft DirectAccess
DMZ, Extranet, and Intranet VPN Solutions
Intranet VPNs
Extranet VPNs
Internet Café VPNs
Online Remote VPN Options
Security
Wake-on-LAN Support
File Sharing
Remote Printing
Mac Support
The Tor Application
Planning a VPN Implementation
Requirements
Installation
Deployment
Testing and Troubleshooting
VPN Implementation Best Practices
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 14 ASSESSMENT
CHAPTER
15
Perspectives, Resources, and the
Future
What the Future Holds for Network Security,
Firewalls, and VPNs
Threats
Firewall Capabilities
Encryption
Authentication
Metrics
Focus
Securing the Cloud
Securing Mobile Devices
Mobile IP
Bring Your Own Device (BYOD)
Resource Sites for Network Security,
Firewalls, and VPNs
Tools for Network Security, Firewalls, and
VPNs
Commercial Off-the-Shelf (COTS)
Software
Open Source Applications and Tools
The Impact of Ubiquitous Wireless
Connectivity
Potential Uses of Security Technologies
What Happens When There Is No
Perimeter?
Specialized Firewalls Available
Intrusion Detection Systems (IDSs) and
Intrusion Prevention Systems (IPSs)
Effect of Honeypots, Honeynets, and Padded
Cells
Emerging Network Security Technologies
IP Version 6
VPNs, Firewalls, and Virtualization
Steganography
Anti-Forensics
CHAPTER SUMMARY
KEY CONCEPTS AND TERMS
CHAPTER 15 ASSESSMENT
APPENDIX
A
Answer Key
APPENDIX
B
Standard Acronyms
Glossary of Key Terms
References
Index
Preface
Purpose of This Book
This book is part of the Information Systems Security &
Assurance Series from Jones & Bartlett Learning
(www.jblearning.com). Designed for courses and curriculums
in IT Security, Cybersecurity, Information Assurance, and
Information Systems Security, this series features a
comprehensive, consistent treatment of the most current
thinking and trends in this critical subject area. These titles
deliver fundamental information-security principles packed
with real-world applications and examples. Authored by
Certified Information Systems Security Professionals
(CISSPs), they deliver comprehensive information on all
aspects of information security. Reviewed word for word by
leading technical experts in the field, these books are not
just current, but forward-thinking—putting you in the
position to solve the cybersecurity challenges not just of
today, but of tomorrow, as well.
The first part of this book on network security focuses on
the business challenges and threats that you face as soon
as you physically connect your organization’s network to the
public Internet. It will present you with key concepts and
terms, and reveal what hackers do when trying to access
your network, thus providing you with the necessary
foundation in network security for the discussions that
follow. It will define firewalls and virtual private networks
(VPNs), providing you with an understanding of how to use
them as security countermeasures to solve business
challenges.
Part 2 discusses how to implement network security and
reviews best practices. It discusses to how select and deploy
firewalls and the tools for managing and monitoring them. It
also reviews implementing a VPN, the technologies
involved, and VPN-management best practices.
Part 3 focuses on the practical, giving concrete, step-by-
step examples of how to implement a firewall and a VPN. It
also discusses what challenges the future holds for
information security professionals involved in network
security. It covers the tools and resources available to the
professional and scans the horizon of emerging
technologies.
Learning Features
The writing style of this book is practical and conversational.
Step-by-step examples of information security concepts and
procedures are presented throughout the text. Each chapter
begins with a statement of learning objectives. Illustrations
are used both to clarify the material and to vary the
presentation. The text is sprinkled with Notes, Tips, FYIs,
Warnings, and sidebars to alert the reader to additional and
helpful information related to the subject under discussion.
Chapter Assessments appear at the end of each chapter,
with solutions provided in the back of the book.
Chapter summaries are included in the text to provide a
rapid review or preview of the material and to help students
understand the relative importance of the concepts
presented.
Audience
The material is suitable for undergraduate or graduate
computer science majors or information science majors,
students at a two-year technical college or community
college who have a basic technical background, or readers
who have a basic understanding of IT security and want to
expand their knowledge.
About the Author
James Michael Stewart has been working with computers
and technology for more than 25 years. His work focuses on
security, certification, and various operating systems.
Recently, Michael has been teaching job-skill and
certification courses such as CISSP, CEH, and Security+. He
is the primary author of the CISSP Study Guide, 4th Edition
and the Security+ 2008 Review Guide. In addition, Michael
has written numerous books on other security and Microsoft
certification and administration topics. He has developed
certification courseware and training materials as well as
presented these materials in the classroom. Michael holds
the following certifications: CISSP, ISSAP, SSCP, MCT, CEI,
CEH, TICSA, CIW SA, Security+, MCSE+Security: Windows
2000, MCSA Windows Server 2003, MCDST, MCSE NT &
W2K, MCP+I, Network+, iNet+. He graduated in 1992 from
the University of Texas at Austin with a bachelor’s degree in
philosophy.
PART ONE
Foundations of Network
Security
CHAPTER
1
Fundamentals of Network Security
CHAPTER
2
Firewall Fundamentals
CHAPTER
3
VPN Fundamentals
CHAPTER
4
Network Security Threats and
Issues
CHAPTER
1 Fundamentals of
Network Security
COMPUTER NETWORK SECURITY is very complex. New threats from inside and outside networks appear constantly.
Just as constantly, the security community is developing
new products and procedures to defend against threats of
the past and unknowns of the future.
As companies merge, people lose their jobs, new
equipment comes online, and business tasks change, people
do not always do what you expect. Network security
configurations that worked well yesterday might not work
quite as well tomorrow. In an ever-changing business
climate, whom should you trust? Has your trust been
violated? How would you even know? Who is attempting to
harm your network this time? And why?
Because of these complex issues, you need to
understand the essentials of network security. This chapter
will introduce you to the basic elements of network security.
Once you have a firm grasp of these fundamentals, you will
be well equipped to put effective security measures into
practice on your organization’s network.
Chapter 1 Topics
This chapter covers the following topics and
concepts:
What network security is
What you are trying to protect within the
seven domains of a typical IT infrastructure
What the goals of network security are
How you can assess the success of your
network security implementation
Why written network security policies are
important
Who is responsible for network security
What some examples of network
infrastructures and related security concerns
are
Which controls can enhance the security of
wired vs. wireless local area network (LAN)
infrastructures
What some examples of internal and external
network issues are
Which common network security
components are used to mitigate threats
throughout the IT infrastructure
Chapter 1 Goals
When you complete this chapter, you will be able
to:
Describe the key concepts and terms
associated with network security
Describe the importance of a written security
policy and explain how policies help mitigate
risk exposure and threats to a network
infrastructure
Define network security roles and
responsibilities and who within an IT
organization is accountable for these security
implementations
Identify examples of network security
concerns or threats that require enhanced
security countermeasures to properly
mitigate risk exposure and threats
Describe the security requirements needed
for wired versus wireless LAN infrastructures
in order to provide an enhanced level of
security
Compare and contrast common network
security components and devices and their
use throughout the IT infrastructure
What Is Network Security?
Network security is the control of unwanted intrusion into,
use of, or damage to communications on your organization’s
computer network. This includes monitoring for abuses,
looking for protocol errors, blocking non-approved
transmissions, and responding to problems promptly.
Network security is also about supporting essential
communication necessary to the organization’s mission and
goals, avoiding the unapproved use of resources, and
ensuring the integrity of the information traversing the
network.
Network security includes elements that prevent
unwanted activities while supporting desirable activities.
This is hard to do efficiently, cost effectively, and
transparently. Efficient network security provides quick and
easy access to resources for users. Cost-effective network
security controls user access to resources and services
without excessive expense. Transparent network security
supports the mission and goals of the organization through
enforcement of the organization’s network security policies,
without getting in the way of valid users performing valid
tasks.
Computer networking technology is changing and
improving faster today than ever before. Wireless
connectivity is now a realistic option for most companies
and individuals. Malicious hackers are becoming more adept
at stealing identities and money using every means
available.
Today, many companies spend more time, money, and
effort protecting their assets than they do on the initial
installation of the network. And little wonder. Threats, both
internal and external, can cause a catastrophic system
failure or compromise. Such security breaches can even
result in a company going out of business. Without network
security, many businesses and even individuals would not
be able to work productively.
Network security must support workers in doing their
jobs while protecting against compromise, maintaining high
performance, and keeping costs to a minimum. This can be
an incredibly challenging job, but it is one that many
organizations have successfully tackled.
Network security has to start somewhere. It has to start
with trust.
What Is Trust?
Trust is confidence in your expectation that others will act
in your best interest. With computers and networks, trust is
the confidence that other users will act in accordance with
your organization’s security rules. You trust that they will
not attempt to violate the stability, privacy, or integrity of
the network and its resources. Trust is the belief that others
are trustworthy.
Unfortunately, sometimes people violate your trust.
Sometimes they do this by accident, oversight, or ignorance
that the expectation even existed. In other situations, they
violate trust deliberately. Because these people can be
either internal personnel or external hackers, it’s difficult to
know whom to trust.
So how can you answer the question, “Who is
trustworthy?” You begin by realizing that trust is based on
past experiences and behaviors. Trust is usually possible
between people who already know each other. It’s neither
easy nor desirable to trust strangers. However, once you’ve
defined a set of rules and everyone agrees to abide by
those rules, you have established a conditional trust. Over
time, as people demonstrate that they are willing to abide
by the rules and meet expectations of conduct, then you
can consider them trustworthy.
Trust can also come from using a third-party method. If a
trustworthy third party knows you and me, and that third
party states that you and I are both trustworthy people,
then you and I can assume that we can conditionally trust
each other. Over time, someone’s behavior shows whether
the initial conditional trust was merited or not.
A common example of a third-party trust system is the
use of digital certificates that a public certificate authority
issues. As shown in Figure 1-1, a user communicates with a
Web e-commerce server. The user does not initially know
whether a Web server is what it claims to be or if someone
is “spoofing” its identity. Once the user examines the digital
certificate issued to the Web server from the same
certificate authority that issued the user’s digital certificate,
the user can then trust that the identity of the Web site is
valid. This occurs because both the user and the Web site
have a common, trustworthy third party that they both
know.
Ultimately, network security is based on trust.
Companies assume that their employees are trustworthy
and that all of the computers and network devices are
trustworthy. But not all trust is necessarily the same. You
can (and probably should) operate with different levels or
layers of trust. Those with a higher level of trust can be
assigned greater permissions and privileges. If someone
or something violates your trust, then you remove the
violator’s access to the secure environment. For example,
companies terminate an untrustworthy employee or replace
a defective operating system.
FIGURE 1-1
An example of a third-party trust system.
Who—or What—Is Trustworthy?
Determining who or what is trustworthy is an ongoing
activity of every organization, both global corporations and
a family’s home network. In both cases, you offer trust to
others on a conditional basis. This conditional trust changes
over time based on adherence to or violation of desired and
prescribed behaviors.
If a program causes problems, it loses your trust and you
remove it from the system. If a user violates security, that
person loses your trust and might have access privileges
revoked. If a worker abides by the rules, your trust grows
and privileges increase. If an Internet site does not cause
harm, you deem it trustworthy and allow access to that site.
To review, trust is subjective, tentative, and changes over
time. You can offer trust based on the reputation of a third
party. You withhold trust when others violate the rules. Trust
stems from actions in the past and can grow based on
future behaviors.
In network security, trust is complex. Extending trust to
others without proper background investigation can be
devastating. A network is only as secure as its weakest link.
You need to vet every aspect of a network, including
software, hardware, configuration, communication patterns,
content, and users, to maintain network security. Otherwise,
you will not be able to accomplish the security objectives of
your organization’s network.
What Are Security Objectives?
Security objectives are goals an organization strives to
achieve through its security efforts. Typically, organizations
recognize three primary security objectives:
Confidentiality/privacy
Integrity/nonrepudiation
Availability/uptime
Confidentiality is the protection against unauthorized
access, while providing authorized users access to resources
without obstruction. Confidentiality ensures that data is not
intentionally or unintentionally disclosed to anyone without
a valid need to know. A job description defines the
person’s need to know. If a task does not require access to a
specific resource, then that person does not have a need to
know that resource.
Integrity is the protection against unauthorized
changes, while allowing for authorized changes performed
by authorized users. Integrity ensures that data remain
consistent, both internally and externally. Consistent data do
not change over time and remain in sync with the real
world. Integrity also protects against accidents and hacker
modification by malicious code, or software written with
malicious intent.
Availability is the protection against downtime, loss of
data, and blocked access, while providing consistent uptime,
protecting data, and supporting authorized access to
resources. Availability ensures that users can get their work
done in a timely manner with access to the proper
resources.
Authentication is the proof or verification of a user’s
identity before granting access to a secured area. This can
occur both on a network as well as in the physical, real
world. While the most common form of authentication is a
password, password access is also the least secure method
of authentication. Multifactor authentication is the method
most network administrators prefer for secure logon.
Authorization is controlling what users are allowed and
not allowed to do. Authorization is dictated by the
organization’s security structure, which may focus on
discretionary access control (DAC), mandatory access
control (MAC), or role-based access control (RBAC).
Authorization restricts access based on need to know and
users’ job descriptions. Authorization is also known as
access control.
Nonrepudiation is the security service that prevents a
user from being able to deny having performed an action.
For example, nonrepudiation prevents a sender from
denying having sent a message. Auditing and public-key
cryptography commonly provide nonrepudiation services.
Privacy protects the confidentiality, integrity, and
availability of personally identifiable or sensitive data.
Private data often includes financial records and medical
information. Privacy prevents the unauthorized watching
and monitoring of users and employees.
Maintaining and protecting these security objectives can
be a challenge. As with most difficult tasks, breaking
security down into simpler or smaller components will help
you to understand and ultimately accomplish this objective.
To support security objectives, you need to know clearly
what you are trying to protect.
What Are You Trying to Protect?
In terms of security, the things you want to protect are
known as assets. An asset is anything used to conduct
business. Any object, computer, program, piece of data, or
other logical or physical component employees need to
accomplish a task is an asset.
Assets do not have to be expensive, complicated, or
large. In fact, many assets are relatively inexpensive,
commonplace, and variable in size. But no matter the
characteristics, an asset needs protection. When assets are
unavailable for whatever reason, people can’t get their work
done.
For most organizations, including SOHO (small office,
home office) environments, the assets of most concern
include business and personal data. If this information is
lost, damaged, or stolen, serious complications result.
Businesses can fail. Individuals can lose money. Identities
can be stolen. Even lives can be ruined.
What causes these problems? What violates network
security? The answer includes accidents, ignorance,
oversight, and hackers. Accidents happen, including
hardware failures and natural disasters. Poor training equals
ignorance. Workers with the best of intentions damage
systems if they don’t know proper procedures or lack
necessary skills. Overworked and rushed personnel overlook
issues that can result in asset compromise or loss. Malicious
hackers can launch attacks and exploits against the
network, seeking to gain access or just to cause damage.
Hacking originally meant tinkering or modifying systems
to learn and explore. However, the term has come to refer
to malicious and possibly criminal intrusion into and
manipulation of computers. In either case, a malicious or
criminal hacker is a serious threat. Every network
administrator should be concerned about hacking.
Some important aspects of security stem from
understanding the techniques, methods, and motivations of
hackers. Once you learn to think like a hacker, you may be
able to anticipate future attacks. This enables you to devise
new defenses before a hacker can successfully breach your
organization’s network.
So how do hackers think? Hackers think along the lines of
manipulation or change. They look into the rules to create
new ways of bending, breaking, or changing them. Many
successful security breaches have been little more than
slight variations or violations of network communication
rules.
Hackers look for easy targets or overlooked
vulnerabilities. Hackers seek out targets that provide them
the most gain, often financial rewards. Hackers turn things
over, inside out, and in the wrong direction. Hackers
attempt to perform tasks in different orders, with incorrect
values, outside the boundaries, and with a purpose to cause
a reaction. Hackers learn from and exploit mistakes,
especially mistakes of the network security professionals
who fail to properly protect an organization’s assets.
FIGURE 1-2
The seven domains of a typical IT infrastructure.
Why is thinking like a hacker critically important? A sixth
century Chinese military strategist and philosopher, Sun
Tzu, in his famous military text The Art of War, stated: “If
you know the enemy and know yourself you need not fear
the results of a hundred battles.” Once you understand how
hackers think, the tools they use, their exploits, and the
attack techniques they employ, you can create effective
defenses to protect against them.
You’ve often heard that “the best defense is a good
offense.” While this statement may have merit elsewhere,
most network security administrators do not have the luxury
—or legal right—to attack hackers. Instead, you need to turn
this strategic phrase around: The best offense is a good
defense. While network security administrators cannot
legally or ethically attack hackers, they are fully empowered
to defend networks and assets against hacker onslaughts.
Seven Domains of a Typical IT
Infrastructure
Hackers look for any and every opportunity to exploit a
target. No aspect of an IT infrastructure is without risk, nor
is it immune to the scrutiny of a hacker. When thinking like a
hacker, analyze every one of the seven domains of a
typical IT infrastructure (Figure 1-2) for potential
vulnerabilities and weaknesses. Be thorough. A hacker
needs only one crack in the protections to begin chipping
away at the defenses. You need to find every possible
breach point to secure it and harden the network.
The seven domains of a typical IT infrastructure are:
User Domain—This domain refers to actual users,
whether they are employees, consultants, contractors,
or other third-party users. Any user who accesses and
uses the organization’s IT infrastructure must review
and sign an acceptable use policy (AUP) prior to being
granted access to the organization’s IT resources and
infrastructure.
Workstation Domain—This domain refers to the end
user’s desktop devices such as a desktop computer,
laptop, VoIP telephone, or other endpoint device.
Workstation devices typically require security
countermeasures such as antivirus, anti-spyware, and
vulnerability software patch management to maintain
the integrity of the device.
LAN Domain—This domain refers to the physical and
logical local area network (LAN) technologies (i.e.,
100Mbps/1000Mbps switched Ethernet, 802.11 family
of wireless LAN technologies) used to support
workstation connectivity to the organization’s network
infrastructure.
LAN-to-WAN Domain—This domain refers to the
organization’s internetworking and interconnectivity
point between the LAN and the WAN network
infrastructures. Routers, firewalls, demilitarized
zones (DMZ), and intrusion detection systems
(IDS) and intrusion prevention systems (IPS) are
commonly used as security monitoring devices in this
domain.
Remote Access Domain—This domain refers to the
authorized and authenticated remote access
procedures for users to remotely access the
organization’s IT infrastructure, systems, and data.
Remote access solutions typically involve SSL-128 bit
encrypted remote browser access or encrypted VPN
tunnels for secure remote communications.
WAN Domain—Organizations with remote locations
require a wide area network (WAN) to interconnect
them. Organizations typically outsource WAN
connectivity from service providers for end-to-end
connectivity and bandwidth. This domain typically
includes routers, circuits, switches, firewalls, and
equivalent gear at remote locations, sometimes under
a managed service offering by the service provider.
System/Application Domain—This domain refers to
the hardware, operating system software, database
software, client/server applications, and data that is
typically housed in the organization’s data center
and/or computer rooms.
The first step is recognizing that the potential for
compromise exists throughout an organization. The next
step is to comprehend the goals of network security.
Goals of Network Security
Network security goals vary from organization to
organization. Often, however, they include a few common
mandates:
Ensure the confidentiality of resources
Protect the integrity of data
Maintain availability of the IT infrastructure
Ensure the privacy of personally identifiable data
Enforce access control
Monitor the IT environment for violations of policy
Support business tasks and the overall mission of
the organization
Whatever your organization’s security goals are, to
accomplish them, you need to write down those goals and
develop a thorough plan to execute them. Without a written
plan, security will be haphazard at best and will likely fail to
protect your assets. With a written plan, network security is
on the path to success. Once you define your security goals,
these goals will become your organization’s roadmap for
securing the entire IT infrastructure.
How Can You Measure the Success of
Network Security?
An organization measures the security of its network by how
well its stated security goals are accomplished and its
security standards maintained. In essence, this becomes the
organization’s baseline definition for information systems
security. For example, if private information on the network
does not leak to outsiders, then your efforts to maintain
confidentiality were successful. Or, if employees are able to
complete their work on time and on budget, then your
efforts to provide system integrity protection were
successful.
If violations take place that compromise your assets or
prevent the accomplishment of a security goal, however,
then network security was less than successful. But let’s
face it, security is never perfect. In fact, even with well-
designed and executed security, accidents, mistakes, and
even intentional harmful exploits will dog your best efforts.
The perfect security components do not exist. All of them
have weaknesses, limitations, backdoors, work-arounds,
programming bugs, or some other exploitable element.
Fortunately, though, successful security doesn’t rely on
the installation of just a single defensive component.
Instead, good network security relies on an interweaving of
multiple effective security components. You don’t have just
one lock on your house. By combining multiple protections,
defenses, and detection systems, you can rebuff many
common, easy hacker exploits.
Network security success is not about preventing all
possible attacks or compromises. Instead, you work to
continually improve the state of security so that in the
future, the network is better protected than it was in the
past. As hackers create new exploits, security professionals
learn about them, adapt their methods and systems, and
establish new defenses. Successful network security is all
about constant vigilance, not creating an end product.
Security is an ongoing effort that constantly changes to
meet the challenge of new threats.
Why Are Written Network Security
Policies Important?
A clearly written security policy establishes tangible goals.
Without solid and defined goals, your security efforts would
be chaotic and hard to manage. Written plans and
procedures focus security efforts and resources on the most
important tasks to support your organization’s overall
security objectives.
A written security policy is a road map. With this map,
you can determine whether your efforts are on track or
going in the wrong direction. The plan provides a common
reference against which security tasks are compared. It
serves as a measuring tool to judge whether security efforts
are helping rather than hurting the accomplishment of your
organization’s security objectives.
With a written security policy, all security professionals
strive to accomplish the same end: a successful, secure
work environment. By following the written plan, you can
track progress so that you install and configure all the
necessary components. A written plan validates what you
do, defines what you still need to do, and guides you on how
to repair the infrastructure when necessary.
Without a written security policy, you cannot trust that
your network is secure. Without a written security policy,
workers won’t have a reliable guide on what to do, and
judging security success will be impossible. Without a
written policy, you have no security.
Planning for the Worst
Things invariably go wrong. Users make mistakes. Malicious
code finds its way into your network. Hackers discover
vulnerabilities and exploit them. In anticipating problems
that threaten security, you must plan for the worst.
This type of planning has many names, including
contingency planning, worst-case scenario planning,
business continuity planning, disaster recovery planning,
and continuation of operations planning. The name is not
important. What’s crucial is that you do the planning itself.
When problems occur, shift into response gear: respond,
contain, and repair. Respond to all failures or security
breaches to minimize damage, cost, and downtime. Contain
threats to prevent them from spreading or affecting other
areas of the infrastructure. Repair damage promptly to
return systems to normal status quickly and efficiently.
Remember, the goals of security are confidentiality,
integrity, and availability. Keep these foremost in mind as
you plan for the worst.
The key purpose of planning for problems is to be
properly prepared to protect your infrastructure. With a little
luck, a major catastrophe won’t occur. But better to prepare
and not need the response plan than to allow problems to
cause your business to fail.
Who Is Responsible for Network
Security?
Network security is the responsibility of everyone who uses
the network. Within an organization, no one has the luxury
of ignoring security rules. This applies to global corporations
as well as home networks. Every person is responsible for
understanding his or her role in supporting and maintaining
network security. The weakest link rule applies here: If only
one person fails to fulfill this responsibility, security for all
will suffer.
Senior management has the ultimate and final
responsibility for security. This is for good reason—senior
management is the most concerned about the protection of
the organization’s assets. Without the approval and support
of senior management, no security effort can succeed.
Senior management must ensure the creation of a written
security policy that all personnel understand and follow.
Senior management also assigns the responsibility for
designing, writing, and executing the security plan to the IT
staff. Ideally, the result of these efforts is a secure network
infrastructure. The security staff, in turn, must thoroughly
manage all assets, system vulnerabilities, imminent threats,
and pertinent defenses. Their task is to design, execute, and
maintain security throughout the organization.
In their role as overseers of groups of personnel,
managers and supervisors must ensure that employees
have all the tools and resources to accomplish their work.
Managers must also ensure that workers are properly
trained in skills, procedures, policies, boundaries, and
restrictions. Employees can mount a legitimate legal case
against an organization that requires them to perform work
for which they are not properly trained.
Network administrators manage all the organization’s
computer resources. Resources include file servers, network
access, databases, printer pools, and applications. The
network administrator’s job is to ensure that resources are
functional and available for users while enforcing
confidentiality and network integrity.
An organization’s workers are the network users and
operators. They ultimately do the work the business needs
to accomplish. Users create products, provide services,
perform tasks, input data, respond to queries, and much
more. Job descriptions may apply to a single user or a group
of users. Each job description defines a user’s tasks. Users
must perform these tasks within the limitations of network
security.
Auditors watch for problems and violations. Auditors
investigate the network, looking for anything not in
compliance with the written security policy. Auditors watch
the activity of systems and users to look for violations,
trends toward bottlenecks, and attempts to perform
violations. The information uncovered by auditors can help
improve the security policy, adjust security configurations,
or guide investigators toward apprehending security
violators.
All of these roles exist within every organization.
Sometimes different individuals perform these roles. In
other situations, a single person performs all of these roles.
In either case, these roles are essential to the creation,
maintenance, and improvement of security.
Examples of Network Infrastructures
and Related Security Concerns
As you design a network, you need to evaluate every aspect
in light of its security consequences. With limited budgets,
personnel, and time, you must also minimize risk and
maximize protection. Consider how each of the following
network security aspects affects security for large
corporations, small companies, and even home-based
businesses.
Workgroups
A workgroup is a form of networking in which each
computer is a peer or equal. Peers are equal in how much
power or controlling authority any one system has over the
other members of the same workgroup. All workgroup
members are able to manage their own local resources and
assets, but not those of any other workgroup member.
Workgroups are an excellent network design for very
small environments, such as home family networks or very
small companies. In most cases, a workgroup comprises
fewer than 10 computers and rarely contains more than 20
computers. No single rule dictates the size of a workgroup.
Instead, the administrative overhead of larger workgroups
encourages network managers to move to a client/server
configuration.
Figure 1-3 shows a typical workgroup configuration. In
this example, a switch interconnects the four desktop
workgroup members as well as an Internet connection
device and a wireless access point. Additional clients can
connect wirelessly via the access point or wired via a cable
connecting to the switch.
Workgroups do not have a central authority that controls
or restricts network activity or resource access. Instead,
each individual workgroup member makes the rules and
restrictions over resources and assets. The security defined
for one member does not apply to nor affect any other
computer in the workgroup.
FIGURE 1-3
An example of a typical workgroup.
Due to system-by-system–based security, a worker or a
workgroup member needs to have a user account defined
on each of the other workgroup members to access
resources on those systems. Each of these accounts is
technically a unique user account, even if it is created by
using the same characters for the username and password.
This results in either several unique user accounts with
different names and different passwords or several unique
user accounts with the same name and same password. In
either case, security is poor. In the former case, the user
must remember several sets of credentials. This often
results in the user writing down the credentials. In the later
case, an intruder need compromise only one set of
credentials.
This lack of central authority is both a strength and
weakness of workgroups. This characteristic is a strength in
that each user of each computer can make his or her own
choices about sharing resources with others. However, this
is at the same time a weakness because of the inconsistent
levels of access.
Workgroups are easy to create. Often, the default
network configuration of operating systems is to be a
member of a workgroup. A new workgroup is created by just
defining a unique name on a computer. Once one computer
names the workgroup, it now exists. Other computers
become members of the new workgroup just by using the
same name. Since workgroups lack a central authority,
anyone can join or leave a workgroup at any time. This
includes unauthorized systems owned by rogue employees
or external parties.
Most workgroups use only basic resource-share
protections, fail to use encrypted protocols, and are lax on
monitoring intrusions. While imposing some security on
workgroups is possible, usually each workgroup member is
configured individually. Fortunately, since workgroups are
small, this does not represent a significant amount of effort.
SOHO Networks
SOHO stands for small office, home office. SOHO is a
popular term that describes smaller networks commonly
found in small businesses, often deployed in someone’s
home, garage, portable building, or leased office space. A
SOHO environment can be a workgroup or a client/server
network. Usually a SOHO network implies purposeful design
with business and security in mind.
SOHO networks generally are more secure than a typical
workgroup, usually because a manager or owner enforces
network security. Security settings defined on each work-
group member are more likely to be consistent when the
workgroup has a security administrator. Additionally, SOHO
networks are more likely to employ security tools such as
antivirus software, firewalls, and auditing.
Client/Server Networks
A client/server network is a form of network where you
designate some computers as servers and others as
clients. Servers host resources shared with the network.
Clients access resources and perform tasks. Users work
from a client computer to interact with resources hosted by
servers. In a client/server network, access is managed
centrally from the servers. Thus, consistent security is easily
imposed across all network members.
Figure 1-4 shows a possible basic layout of a client/server
network. In this example, three servers host the resources,
such as printers, Internet connectivity, and file storage
shared with the network. Both wired and wireless clients are
possible. Switches interconnect all nodes. Client/server
networks are more likely to use hardware or appliance
firewalls.
Client/server networks also employ single sign-on
(SSO). SSO allows for a single but stronger set of
credentials per user. With SSO, each user must perform
authentication to gain access to the client and the network.
Once the user has logged on, access control manages
resource use. In other words, client/server authentication
with SSO is often more complex than workgroup
authentication—but it’s more secure. Users only need to log
on once, not every time they contact a resource host server.
Because of their complexity, client/server networks are
invariably more secure than SOHO and workgroup networks.
But complexity alone is not security. Instead, because they
are more complex, client/server networks require more
thorough design and planning. Security is an important
aspect of infrastructure planning and thus becomes
integrated into the network’s design.
FIGURE 1-4
An example of a typical client/server network.
Client/server networks are not necessarily secure
because you can deploy a client/server network without any
thought toward security. But most organizations understand
that if they overlook network security, they are ensuring
their ultimate technological downfall. Security is rarely
excluded from the deployment process. And some networks
are by nature more secure than others.
LAN Versus WAN
LAN stands for local area network. A LAN is a network within
a limited geographic area. This means that a LAN network is
located in a single physical location rather than spread
across multiple locations. Some LANs are quite large, while
others are very small. A more distinguishing characteristic
of a LAN is that all of the segments or links of a LAN are
owned and controlled by one organization. A LAN does not
contain or use any leased or externally owned connections.
WAN stands for wide area network. A WAN is a network
not limited by any geographic boundaries. This means that
a WAN network can span a few city blocks, reach across the
globe, and even extend into outer space. A distinguishing
characteristic of a WAN is that it uses leased or external
connections and links. Most organizations rely on
telecommunication service providers (often referred to as
telcos) for WAN circuits and links to physical buildings and
facilities, including the last-mile connection to the physical
demarcation point. Both LAN and WAN networks can be
secure or insecure. They are secure if a written security
policy guides their use. With a LAN, the owner of the
network has the sole responsibility of ensuring that security
is enforced. With a WAN, the leasing entity must select a
telco that has a secure WAN infrastructure and incorporate
service level agreements (SLAs) that define the level of
service and performance that is to be provided on a monthly
basis for the customer. In most cases, WAN data is secure
only if the data sent across leased lines is encrypted before
transmission. This service is the responsibility of the data
owner, not the telecommunications service provider, unless
this option is offered as a value-added service.
Thin Clients and Terminal Services
Thin client computing, also known as terminal services,
is an old computing idea that has made a comeback in the
modern era. In the early days of computers, the main
computing core, commonly called a mainframe, was
controlled through an interface called a terminal. The
terminal was nothing more than a video screen (usually
mono-chrome) and a keyboard. The terminal had no local
processing or storage capabilities. All activities took place
on the mainframe and the results appeared on the screen of
the terminal.
With the advent of personal computers (PCs), a computer
at a worker’s desk offered local processing and storage
capabilities. These PCs became the clients of client/server
computers. Modern networking environments can offer a
wide range of options for end users. Fully capable PCs used
as workstations or client systems are the most common. PCs
can run thin-client software, which emulates the terminal
system of the past. That means they perform all tasks on
the server or mainframe system and use the PC only as a
display screen with a keyboard and mouse. Even modern
thin client terminals can connect into a server or mainframe
without using a full PC.
Remote Control, Remote Access, and VPN
Remote control is the ability to use a local computer
system to remotely take over control of another computer
over a network connection. In a way, this is the application
of the thin client concept on a modern fully capable
workstation to simulate working against a mainframe or to
virtualize your physical presence.
With remote control connection, the local monitor,
keyboard, and mouse control a remote system. This looks
and feels as if you are physically present at the keyboard of
the remote system, which could be located in another city
or even on the other side of the world. Every action you
perform locally takes place at that remote computer via the
remote control connection. The only limitations are the
speed of the intermediary network link and the inability to
physically insert or remove media such as a flash drive and
use peripherals such as a printer.
You might consider remote control as a form of software-
based thin client or terminal client. In fact, many thin client
and terminal client products are sold as remote control
solutions.
Many modern operating systems include remote control
features, such as the Remote Desktop feature found in most
versions of Windows. Once enabled, a Remote Desktop
connection remotely controls another Windows system from
across the network.
Remote access is different from remote control. A
remote access link enables access to network resources
using a WAN link to connect to the geographically distant
network. In effect, remote access creates a local network
link for a system not physically local to the network. Over a
remote access connection, a client system can technically
perform all the same tasks as a locally connected client,
with the only difference being the speed of the connection.
Network administrators can impose restrictions on what
resources and services a remote access client can use.
Remote access originally took place over dial-up
telephone links using modems. Today, remote access
encompasses a variety of connection types, including ISDN,
DSL, cable modem, satellite, mobile broadband, and more.
In most cases, a remote access connection links from a
remote client back to a primary network. A remote access
server (RAS) accepts the inbound connection from the
remote client. Once the connection goes through, the
remote client now interacts with the network as if it were
locally connected.
Another variant of remote connections is the virtual
private network (VPN). A VPN is a form of network
connection created over other network connections. In most
cases, a VPN link connects a remote system and a LAN, but
only after a normal network connection links to an
intermediary network.
In Figure 1-5, a LAN has a normal network connection to
the Internet and a remote client has established a normal
network connection to the Internet as well. These two
connections work independently of each other. The LAN’s
connection is usually a permanent or dedicated connection
supporting both inbound and outbound activities with the
Internet. The remote client’s connection to the Internet can
be dedicated or non-dedicated. In the latter case, the
connection precedes the VPN creation. Once both endpoints
of the future VPN link have a connection to the intermediary
network (in this example, the Internet), then the VPN exists.
FIGURE 1-5
Common resource access connections.
FIGURE 1-6
A VPN established betweeen a remote client and a LAN over
the Internet.
In Figure 1-6, a new network connection connects the
remote client to the LAN across the intermediary network.
This new network connection is the VPN.
A VPN is a mechanism to establish a remote access
connection across an intermediary network, often the
Internet. VPNs allow for cheap long-distance connections
over the Internet, as both endpoints only need a local
Internet link. The Internet itself serves as a “free” long-
distance carrier.
A VPN uses tunneling or encapsulation protocols.
Tunneling protocols encase the original network protocol so
that it can traverse the intermediary network. In many
cases, the tunneling protocol employs encryption so that
the original data securely traverses the intermediary
network.
Boundary Networks
A boundary network is a subnetwork, or subnet, positioned
on the edge of a LAN. A boundary network isolates certain
activities, such as programming or research and
development, from the internal environment (private LANs),
which does not need to be externally accessible. External
users can also access resources hosted in a boundary
network. Such a subnet is known as a demilitarized zone
(DMZ).
A DMZ is a boundary network that hosts resource servers
for the public Internet. An extranet is a boundary network
that hosts resource servers for a limited and controlled
group of external users, such as business partners,
suppliers, distributors, contractors, and so forth.
A DMZ subnet is a common network design component
used to host public information services, such as Web sites.
A DMZ allows for anyone on the public Internet to access
resources. But at the same time, the DMZ provides some
filtering of obvious malicious traffic and prevents Internet
users from accessing the private LAN.
An extranet subnet provides companies that need to
exchange data with external partners a safe place for that
activity. An extranet is secured so only the intended external
users can access it. Often, accessing an extranet requires
VPN connections. An extranet configuration keeps public
users from the Internet out and keeps the external partners
out of the private LAN.
You can deploy both DMZ and extranet subnets in
different ways. Two of the most common designs are a
screened subnet using a three-homed firewall (Figure 1-7)
and N-tier deployment (Figure 1-8). A screened subnet using
a three-homed firewall creates a network segment for the
private LAN and a network segment for the DMZ or
extranet. The three-homed firewall serves as a filtering
device as well as a router to control traffic entering these
two segments.
FIGURE 1-7
A DMZ or extranet deployed as a screened subnet with a
three-homed firewall.
FIGURE 1-8
A DMZ or extranet deployed in an N-tier configuration.
The N-tier deployment creates a series of subnets
separated by firewalls. The DMZ or extranet subnet serves
as a buffer network between the Internet and the private
LAN.
Strengths and Weaknesses of Network
Design
You need to evaluate every network design or layout for its
security strengths and weaknesses. While there are no
perfect deployments, some provide better security for a
given set of parameters than others. For example, a
network with only a single connection to the Internet is
easier to secure than a network with multiple connections to
the Internet.
When you are designing a network, consider the paths
that malicious traffic could use to reach the interior of your
private LAN. The more potential pathways, the more
challenging securing the network will be. However, consider
redundancy as well. If your primary connection to the
Internet fails, do you have an alternate connection?
Remember, security is not just about preventing malicious
events but also about ensuring that users can perform
essential business tasks.
Try to avoid network designs that have a single point of
failure. Always try to have redundant options to ensure that
your mission-critical functions can take place. Keep in mind
that bottlenecks are still likely to happen even with
redundant pathways. Over time, monitor traffic and use
levels on every segment across the network to look for
trends toward reduced throughput or productivity. A
bottleneck may at first be a slight hindrance to high
performance and productivity, but it can later become a
form of a denial of service (DoS) attack.
Another consideration is traffic control and filtering.
Blocking or allowing traffic is an important element in
network security. You control what traffic enters or leaves
the network. Traffic filtering often takes place at network
chokepoints. A chokepoint is a form of bottleneck and is a
single controlled pathway between two different levels of
network trust where a firewall or other filtering devices
block or allow traffic based on a set of rules. Thus, rather
than being only a benefit for filtering, a chokepoint can slow
throughput or become a target for DoS attacks.
Another network design issue is the location of
authorized users. Often, you assume that valid users are
internal users. With the proliferation of telecommuting and
outsourcing, however, valid users can often be external
users as well. Realizing this, you must design networks to
support inbound connections from valid external users. This
can involve traditional remote access connections, but more
likely will use VPN links. VPNs provide connections for
remote users that function like local connections and
encryptions to keep the content of those connections
confidential.
Enhancing the Security of Wired
Versus Wireless LAN Infrastructures
Wired networks offer a form of security that wireless
networks lack. That security is the direct physical
connection to a wired or cabled network. A hacker requires
physical access to your facility or building. Usually, access
control of the building can sufficiently prevent most external
parties from accessing your private LAN.
Realize, however, that if you allow remote connection via
telephone modem, high-speed broadband, or even basic
Internet service, then you lose the advantage of a physical
access limitation. Once remote access is allowed, the
benefits of physical isolation disappear.
The same is true if you allow wireless connections into
the network. Wireless networking grants valid and unknown
users the ability to interact with the network. This
completely eliminates the need to be physically present in
the building to connect to the network. Many organizations
are allowing, even encouraging, employees, contractors,
and visitors to Bring Your Own Device (BYOD), a move that is
cost effective and often improves efficiency, but at the risk
of control of the end users’ devices. With the right type of
antenna, an attacker could be over a mile away from your
office building and still be able to affect your wireless
network.
To regain some of the security offered by physical
isolation, try to incorporate physical isolation into your
network design. Isolate all remote access and wireless
access points from the main wired network. You can achieve
this by using separate subnets and by filtering
communications using firewalls. While design does not offer
the same level of security as physical isolation, the
arrangement provides a significant improvement over
having no control over remote or wireless connections.
All remote connections should go through a rigorous
gauntlet of verification before you grant access to the
internal LAN. Think of a castle design in the Middle Ages
that used multiple layers of defense: a moat, a drawbridge,
thick riveted walls, an inner battlement, and finally, a strong
keep or inner fortress. Your multilayer defensive design
should include multi-factor authentication and
communication encryption, such as a VPN. Additional checks
can include verification of operating system and patch level,
confirmation of physical or logical location origin (such as
caller ID, MAC address, or IP address), limitations to time of
day, and limitations on protocols above the Transport Layer.
Any intruder would need to circumvent layer after layer,
making intrusion more and more difficult.
NOTE
An attack known as “Van Eck phreaking” allows an
attacker to eavesdrop on electronic devices from a
distance. This technique is not perfect or simple to
perform, but has been demonstrated on LCD and CRT
monitors as well as keyboard cables. With minor
shielding, you can eliminate most of the risk from such
an attack.
Internal and External Network
Issues
When deploying a new network or modifying an existing
infrastructure, carefully evaluate effects on security and
security’s impact on the infrastructure. When you or your
team overlook or sidestep standard security practices, good
business stops. Business interruptions can result not only in
lost profits, but also in lost opportunities and even in lost
jobs. If the compromise is serious enough, the business
might not recover.
The threats facing business are numerous and constantly
changing. Often, these issues arise daily. Malicious code,
information leakage, zero day exploits, unauthorized
software, unethical employees, and complex network
infrastructures are just a few of the concerns that every
organization and network manager faces.
Malicious code can make its way into a computer through
any communication channel. This includes file transfers, e-
mail, portable device syncing, removable media, and Web
sites. Precautions against malicious code include network
traffic filtering with a firewall, anti-malware scanning, and
user behavior modification.
Information leakage stems from malicious employees
who purposefully release internal documentation to the
public. It can also result from accidents, or can occur when a
storage device is lost, recycled, donated, stolen, or thrown
away. Or it occurs when users accidentally publish
documents to P2P file sharing services or Web sites.
Precautions against information leakage include doing
thorough background checks on employees, using the
principle of least privilege, detail auditing and monitoring of
all user activity, classifying all information and controlling
communication pathways, using more stringent controls on
use of portable devices, and practicing zeroization—
purging a storage device to be discarded by filling its space
with zeros.
Zero day exploits are new and previously unknown
attacks for which no current specific defenses exist. Think of
them as surprise attacks on your defenses. Zero day refers
to the newness of an exploit, which may be known in the
hacker community for some time, but about which vendors
and security professionals are just learning.
The zero day label comes from the idea that work to
develop a patch begins the moment a vendor learns of a
problem. The moment of discovery of the new exploit is
called “day zero.” No specific defenses against zero day
attacks exist, but general security management, use of
intrusion detection and intrusion prevention, along with
detailed logging and monitoring can assist in discovering
and preventing new attacks quickly. Once you know of an
attack or exploit, you can begin taking steps to contain
damage or minimize the extent of the compromise.
Unauthorized software is any piece of code that a user
chooses to run on a client system that was not approved nor
provided by the company. Not all unauthorized software is
directly problematic, but you should prevent its use for
many reasons. Such software might be a waste of time and
productivity that costs the company money, time, and
effort. The software could be a license violation. Software
could include hidden malicious components, known or
unknown to the user, which could compromise the security
of the network. Steps you can take to prevent the use of
unauthorized software should include limiting installation
privileges of normal users and using whitelists to block the
execution of any program not on the approved list.
Unethical employees purposefully violate the stated rules
and goals of the organization. These employees often
believe the rules are not important, do not really apply to
them, or are not really enforced. Most believe they will
never get caught. When users violate the mission and goals
of the organization, consequences could be catastrophic.
Users are the final link in security and are often the
weakest link in network security. If a user chooses to violate
a security policy and release information to the public or
execute malicious code, the results could devastate the
organization or land the perpetrator in court. Methods of
preventing unethical employees from doing damage include
better background screening, detail auditing and monitoring
of all user activity, and regular management oversight and
job performance reviews. When you discover a problematic
person, you might be able to grant the employee a second
chance after retraining, but in many cases, the safest choice
for the organization is to terminate employment.
Complex network infrastructures lend themselves to
complex vulnerabilities. The larger a network becomes, the
more servers, clients, network devices, and segments it
includes. The sheer number of moving parts almost
guarantees that something is bound to be misconfigured, be
improperly installed, lack current firmware or patches, have
a bottleneck, or be used incorrectly. Any of these conditions
could result in a vulnerability that internal or external
attackers can exploit. The larger and more complex a
network, the more thoroughly the security team needs to
watch over the infrastructure and investigate every
symptom, trend, or alert. Preventing complexity from
becoming a liability involves detailed planning, careful
implementation, regular security management, and
constant review of the effectiveness of the infrastructure.
Studies have shown that most threats come from internal
sources, but too many organizations focus on external
sources and discount the internal threats. A better stance is
to count all threats—regardless of their source—as worthy of
investigation. Once a potential threat is understood, its risk,
potential loss, and likelihood can be better understood and
evaluated.
One of the most obvious external threats is the Internet.
The Internet is a global network linking people and
resources with high-speed real-time communications.
Unfortunately, this wonderful infrastructure also makes
great abuse more possible. Once your company installs an
Internet connection, the world is at your door—or rather, at
the fingertips of every employee. That world includes both
potential customers and potential attackers.
Without a global communication infrastructure, hackers
had to be physically present—wired in—in or near your
building to launch attacks. With the advent of the Internet
and wireless technology, any hacker anywhere can initiate
attempts to breach your network security. It’s helpful,
therefore, to think of the Internet as a threat. It’s not one
that you should lightly dismiss, nor should you discard the
Internet as a powerful tool. The benefits of Internet access
are well worth the effort and expense you should expend to
defend against its negative features.
Some of the best defenses against Internet threats
include a well-researched, written security policy;
thoroughly trained personnel; use of firewalls to filter traffic
intrusion, detection, and prevention systems; use of
encrypted communications (such as VPNs); and thorough
auditing and monitoring of all user and node activity.
Again, perfect security solutions don’t exist. Some form
of attack, compromise, or exploit can get past any single
defense. The point of network security is to interweave and
interconnect multiple security components to construct a
multifaceted scheme of protection. This is often called
multiple layers of defense or defense in depth.
The goal is to balance the strengths and weaknesses of
multiple security components. The ultimate functions of
network security are to lock things down in the best way
possible, then monitor for all attempts to violate the
established defense. Since the perfect lock doesn’t exist,
improve on the best locks available with auditing and
monitoring. Knowing this, your next step is to understand
the common network security components and their uses.
Common Network Security
Components Used to Mitigate Threats
When considering the deployment of a network or the
modification of an existing network, evaluate each network
component to determine its security strengths and
weaknesses. This section discusses many common network
security components.
Hosts and Nodes
A node is any device on the network. This includes client
computers, servers, switches, routers, firewalls, and
anything with a network interface that has a MAC address. A
Media Access Control (MAC) address is the 48-bit
physical hardware address of a network interface card (NIC)
assigned by the manufacturer. A node is a component that
can be communicated with, rather than only through or
across. For example, network cables and patch panels are
not nodes, but a printer is.
A host is a form of node that has a logical address
assigned to it, usually an Internet Protocol (IP) address. This
addressing typically implies that the node operates at or
above the Network Layer. The Network Layer includes
clients, servers, firewalls, proxies, and even routers. But it
excludes switches, bridges, and other physical devices such
as repeaters and hubs. In most cases, a host either shares
or accesses resources and services from other hosts.
In terms of network security, node and host security does
vary. Nodes and hosts can both be harmed by physical
attacks and DoS attacks. However, a host can also be
harmed by malicious code, authentication attacks, and
might even be remotely controlled by hackers. Node
protection is mostly physical access control along with basic
network filtering against flooding.
Host security can be much more involved because the
host itself should be hardened and you will need to perform
general network security. Hardening is the process of
securing or locking down a host against threats and attacks.
This can include removing unnecessary software, installing
updates, and imposing secure configuration settings.
IPv4 Versus IPv6
Internet Protocol version 4 (IPv4) has been in use as the
predominant protocol on the Internet for nearly three
decades. It was originally defined in 1981 in a technical
specification known as RFC 791. IPv4 is a connectionless
protocol that operates at the Network Layer of the Open
Systems Interconnection (OSI) Reference Model. IPv4
is the foundation of the TCP/IP protocol suite as it exists
today.
IPv4 was designed with several assumptions in mind,
many of which have been proven inaccurate, grossly
overestimated, or simply non-applicable. While IPv4 has
served well as the predominant protocol on the Internet, a
replacement has been long overdue. Some of the key issues
of concern are a dwindling, if not exhausted, address space
of only 32 bits, subnetting complexity, and lack of
integrated security. Some of these issues have been
minimized with the advent of network address
translation (NAT), classless inter-domain routing (CIDR),
and Internet Protocol Security (IPSec). But in spite of
these advancements, IPv4 is being replaced with IPv6.
IPv6 was defined in 1998 in RFC 2460. The new version
was designed specifically as the successor to IPv4 mainly
due to the dwindling availability of public addresses. IPv6
uses a 128-bit address, which is significantly larger than
IPv4. Additionally, changes to subnetting, address
assignment, and packet headers, as well as simpler routing
processing, make IPv6 much preferred over its predecessor.
Another significant improvement is native Network Layer
security. Figure 1-9 compares an IPv4 address to an IPv6
address.
NOTE
If an IPv6 address has one or more consecutive four-
digit sections of all zeros, the sections of zeros can be
dropped and replaced by just a double colon. For
example: 2001:0f58:0000:0000:0000:0000:1986:62af
can be shortened to 2001:0f58::1986:62af. However, if
there are two sections of zero sets, only a single
section can be replaced by double colons.
Be Alert to These Attacks
A man-in-the-middle (MitM) attack occurs when a
hacker is positioned between a client and a server
and the client is fooled into connecting with the
hacker computer instead of the real server. The
hacker performs a spoofing attack in order to trick the
client. The result is the connection between the client
and server is proxied by the hacker. This allows the
hacker to eavesdrop and manipulate the
communications.
A hijacking attack occurs when a hacker uses a
network sniffer to watch a communications session to
learn its parameters. The hacker then disconnects one
of the session’s hosts, impersonates the offline
system, and begins injecting crafted packets into the
communication stream. If successful, the hacker takes
over the session of the offline host, while the other
host is unaware of the switch.
A replay attack occurs when a hacker uses a
network sniffer to capture network traffic, and then
retransmits that traffic back on to the network at a
later time. Replay attacks often focus on
authentication traffic in the hope that retransmitting
the same packets that allowed the real user to log
onto a system will grant the hacker the same access.
The security features native to IPv6 were crafted into an
add-on packet for IPv4 known as IPSec. While in IPv4, IPSec
is an optional add-on; it is a built-in feature of and used by
default with IPv6. This use is a significant change in the
inherent security issues surrounding networking and the use
of the Internet. With native Network Layer encryption, most
forms of eavesdropping, man-in-the-middle attacks,
hijacking, and replay attacks are no longer possible. This
does not mean that IPv6 will be free of security problems
but at least most of the common security flaws experienced
with IPv4 will be fixed.
FIGURE 1-9
Comparing a typical IPv4 address to an IPv6 address.
As you use and manage computers and manage
networks, use IPSec with IPv4 or switch over to IPv6. Most
protocols that operate over IPv4 will operate without issue
over IPv6. You will need to replace some applications that
embed Network Layer addresses into their application-level
protocol, such as FTP and NTP. But valid IPv6 replacements
already exist.
The complete industry transition from IPv4 to IPv6 will
likely take upwards of a decade, mainly because of the need
to upgrade, replace, or reconfigure the millions of hosts and
nodes spread across the world to support IPv6. During the
transition, many techniques are available to allow a host to
interact with both IPv4 and IPv6 network connections. These
include: Dual IP stacks—This is a computer system that
runs both IPv4 and IPv6 at the same time. Windows Vista
and Windows Server 7 both have dual IP stacks by default.
IPv4 addresses embedded into an IPv6 notation
—This is a method of representing an IPv4 address
using the common notation of IPv6. For example,
::ffff:192.168.3.125 is the IPv4-mapped IPv6 address
for the IPv4 address 192.168.3.125.
Note: The IPv6 address is 80 zero bits, followed by 16
one bits, then the 32-bit IPv4 address (in dotted
decimal notation), which adds up to 128 bits total.
Tunneling—This involves encapsulating IPv6 packets
inside IPv4 packets, effectively creating a VPN-like
tunnel out of IPv4 for IPv6.
IPv4/IPv6 NAT—This involves using a network
address translation service to translate between two
networks, one running IPv4 and the other IPv6.
Whatever the hurdles of transition, the benefits of native
Network Layer encryption are immeasurable. In short: When
you have the option to use IPv6, take it because you will be
helping the world IT community upgrade sooner rather than
later.
Firewall
Not all traffic on your network is from an authorized source,
so you shouldn’t allow it to enter or leave the network. Not
all traffic is for an authorized purpose, so you should block it
from reaching its destination. Not all traffic is within the
boundaries of normal or acceptable network activity, so you
should drop it before it causes compromises.
All of these protections are the job of a firewall. As its
name implies, a firewall is a tool designed to stop damage,
just as the firewall in an engine compartment protects the
passengers in a vehicle from harm in an accident. A firewall
is either a hardware device or a software product you deploy
to enforce the access control policy on network
communications. In other words, a firewall filters network
traffic for harmful exploits, incursions, data, messages, or
other events.
Firewalls are often positioned on the edge of a network or
subnet. Firewalls protect networks against numerous threats
from the Internet. Firewalls also protect the Internet from
rogue users or applications on private networks. Firewalls
protect the throughput or bandwidth of a private network so
authorized users can get work done. Without firewalls, most
of your network’s capabilities would be consumed by
worthless or malicious traffic from the Internet. Think of how
a dam on a river works; without the dam, the river is prone
to flooding and overflow. The dam prevents the flooding and
damage.
Without firewalls, the security and stability of a network
would depend mostly on the security of the nodes and hosts
within the network. Based on the sordid security history of
most host operating systems, having no firewall would not
be a secure solution. Hardened hosts and nodes are
important for network security, but they should not be the
only component of reliable network security.
You also install firewalls on client and server computers.
These host software firewalls protect a single host from
threats from the Internet and threats from the network
itself, as well as from other internal network components.
In any case, a firewall is usually configured to control
traffic based on a deny-by-default/allow-by-exception
stance. This means that nothing passes the firewall just
because it exists on the network (or is attempting to reach
the network). Instead, all traffic that reaches the firewall
must meet a set of requirements to continue on its path.
As a network administrator or IT security officer, you get
to choose what traffic is allowed to pass through the
firewalls, and what traffic is not. Additionally, you can also
determine whether the filtering takes place on inbound
traffic (known as ingress filtering), on outbound traffic
(called egress filtering)—or both.
Firewalls are an essential component of both host and
network security.
Virtual Private Networks
A virtual private network (VPN) is a mechanism to establish
a remote access connection across an intermediary
network, often over the Internet. VPNs allow for cheap long-
distance connections when established over the Internet,
since both endpoints only need a local Internet link. The
Internet itself serves as a “free” long-distance carrier.
A VPN uses tunneling or encapsulation protocols.
Tunneling protocols encase the original network protocol so
that it can traverse the intermediary network. In many
cases, the tunneling protocol employs encryption so that the
original data traverses the intermediary network securely.
You can use VPNs for remote access, remote control, or
highly secured communications within a private network.
Proxy Servers
A proxy server is a variation of a firewall. A proxy server
filters traffic, but also acts upon that traffic in a few specific
ways. First, a proxy server acts as a middleman between the
internal client and the external server. Or, in the case of
reverse proxy, this relationship can be inverted with an
internal server and an external host. Second, a proxy server
will hide the identity of the original requester from the
server through a process known as network address
translation (NAT) (see the following section).
Another feature of a proxy server can be content
filtering. This type of filtering focuses either on the address
of the server (typically by domain name or IP address) or on
keywords appearing in the transmitted context. You can
employ this form of filtering to block employee access to
Internet resources that are not relevant or beneficial to
business tasks or that might have a direct impact on the
business network. This could include malicious code, hacker
tools, and excessive bandwidth consumption (such as video
streaming or P2P file exchange).
Proxy servers can also provide caching services. Caching
is a data storage mechanism that keeps a local copy of
content that is fairly static in nature and that numerous
internal clients have a pattern of requesting. Front pages of
popular Web sites are commonly cached by a proxy server.
When a user requests a page from the Internet in cache, the
proxy server provides that page to the user from cache
rather than pulling it again from the Internet site. This
provides the user with faster performance and reduces the
load on the Internet link.
Caching of this type often results in all users
experiencing faster Internet performance, even when the
pages served to them are pulled from the Internet.
Obviously, such caching must be tuned to prevent stale
pages in the cache. Tuning is setting the time-out value on
cached pages so they expire at a reasonable rate. All
expired cached pages are replaced by fresh content from
the original source server on the Internet.
Network Address Translation
Network address translation (NAT) translates internal
addresses into external public addresses, and vice versa.
The network performs this conversion on packets as they
enter or leave the network to mask and modify the internal
client’s configuration. The primary purpose of NAT is to
prevent internal IP and network configuration details from
being discovered by external entities, such as hackers.
Figure 1-10 shows an example of a pathway from an
internal client to an external server across a proxy or
firewall using NAT. In this example, the external server is a
Web server operating on the default HTTP port 80. The Web
server is using IP address 208.40.235.38 (used by
www.itttech.edu). The requesting internal client is using IP
address 192.168.12.153. The client randomly selects a
source port between 1,024 and 65,535 (such as 13,571).
With these source details, the client generates the initial
request packet. This is step 1. This packet is sent over the
network toward the external server, where it encounters the
NAT service.
FIGURE 1-10
An example of how NAT functions.
STEP 1 Initial request:
S: 192.168.12.153: 13571
D: 208.40.235.38: 80
STEP 2 NAT creates entry in translation mapping
table:
Internal:
192.168.12.153: 13571 <- ->
External:
72.254.149.76: 27409
The NAT service creates an entry in its translation
or mapping table for the request. The table
contains the source IP address and port and the
translated IP address and port. The NAT server
uses its own public IP address as the translated IP
address and selects a random currently unused
port for the new source port for the packet. This is
Step 2.
STEP 3 Translated request:
S: 72.254.149.76: 27409
D: 208.40.235.38: 80
Step 3 is the construction of the new packet with
the translated source information, which is then
transmitted over the Internet to the external
server. The Web server receives a request whose
source seems to be the proxy/firewall system.
STEP 4 Response from external server:
S: 208.40.235.38: 80
D: 72.254.149.76: 27409
Step 4 is the response generated and transmitted
by the Web server.
STEP 5 Response sent to client by NAT:
S: 208.40.235.38: 80
D: 192.168.12.153: 13571
The proxy/firewall receives the response to the
Web server’s request. The NAT service uses the
translation table to return the original client’s
information into the packet header as the
destination. This is step 5. This process takes place
at wirespeed. It is usually transparent to the client
and server involved in the communication,
because they are unaware that the translation took
place.
Another purpose or use of NAT is to reduce the need for a
significant number of public IP addresses you need to lease
from an ISP. Without NAT, you’d need a single public IP
address for each individual system that would ever connect
to the Internet. With NAT, you can lease a smaller set of
public IP addresses to serve a larger number of internal
users.
This consolidation is possible for two reasons. First, most
network communications are “bursty” rather than constant
in nature. This means that computers typically transmit
short, fast busts of data instead of a long, continuous
stream of data. Some forms of network traffic, such as file
transfer and video streaming, are more continuous in
nature. But these tasks are generally less common on
business networks than home networks.
Second, NAT does not reserve a specific public address
for use by a single internal client. Instead, NAT randomly
assigns an available public address to each subsequent
internal client request. Once the client’s communication
session is over, the public address returns to the pool of
available addresses for future communications.
Additionally, NAT often employs not just IP-to-IP address
translation, but a more granular option known as port
address translation (PAT). With PAT, both the port and
the IP address of the client convert into a random external
port and public IP address. This allows for multiple
simultaneous communications to take place over a single IP
address. This process, in turn, allows you to support a
greater number of communications from a single client or
multiple clients on an even smaller number of leased public
IP addresses.
NAT enables the use of private IP addresses while still
supporting Internet communications. These addresses are
known as RFC 1918 addresses, from their technical
specification. Their ranges are as follows: Class A—
10.0.0.0–10.255.255.255/8 (1 Class A network)
Class B—172.16.0.0–172.31.255.255/12 (16 Class B
networks)
Class C—192.168.0.0–192.168.255.255/16 (256 Class
C networks)
RFC 1918 addresses are for use only in private networks.
Internet routers drop any packet using one of these
addresses. Without NAT, a network using these private IP
addresses would be unable to communicate with the
Internet. By using RFC 1918 addresses, networks create
another barrier against Internet-based attacks and do not
need to pay for leasing of internal addresses.
As mentioned, NAT is one of the technologies that have
allowed the extended use of IPv4 even after the depletion of
available public IP addresses. Now that the transition to IPv6
is underway, NAT is serving a new purpose in proving IPv4-
to-IPv6 translation. Many firewall and proxy devices may
include IPv6 translation services. This feature is a
worthwhile option that you might want to include on a
feature list when researching a firewall purchase or
deployment.
technical TIP
An interesting wrinkle on NAT and PAT is that most
devices and software products that support PAT
actually state in their documentation and in their
configuration interfaces that they support NAT. It
seems that NAT has been redefined to include the
functionality of port address translation, even though
an official acronym for that specific additional
technology already exists. Most certification exams
combine the two as well. Questions might use the NAT
acronym but actually refer to port translation (PAT).
Routers, Switches, and Bridges
Routers, switches, and bridges are common network
devices. While not directly or typically labeled as network
security devices, you can deploy them to support security
rather than hinder it.
A router’s primary purpose is to direct traffic toward its
stated destination along the best-known current available
path (see Figure 1-11). Routing protocols such as RIP, OSPF,
IGRP, EIGRP, BGP, and others dynamically manage route
selection based on a variety of metrics. A router supports
security by guiding traffic down preferred routes rather than
routes that might not be as logically or physically secure. If
a hacker can trick routers into altering the pathway of
transmission, network traffic could traverse a segment
where a hacker has positioned a sniffer. A sniffer, also
known as packet analyzer, network analyzer, and protocol
analyzer, is a software utility or hardware device that
captures network communications for investigation and
analysis.
While this is an unlikely scenario, it’s not an impossible
one. Ensuring that routers are using authentication to
exchange routing data and are protected against
unauthorized physical access will prevent this and other
infrastructure level attacks. Figure 1-11 depicts an example
of a routed network deployment.
FIGURE 1-11
An example of router deployment.
FIGURE 1-12
An example of switch deployment.
Switches provide network segmentation through
hardware. Across a switch, temporary dedicated electronic
communication pathways connect the endpoints of a
session (such as a client and server). This switched pathway
prevents collisions. Additionally, switches allow you to use
the full potential throughput capacity of the network
connection by the communication instead of 40 percent or
more being wasted by collisions (as occurs with hubs). See
Figure 1-12.
You can see this basic function of a switch as a security
benefit once you examine how this process takes place. A
switch operates at Layer 2, the Data Link Layer, of the OSI
model, where the MAC address is defined and used.
Switches manage traffic through the use of the source and
destination MAC address in an Ethernet frame. The Ethernet
frame is a logical data set construction at the Data Link
Layer (Layer 2) consisting of the payload from the Network
Layer (Layer 3) with the addition of an Ethernet header and
footer (Figure 1-13).
Switches employ four main procedures, labeled as
“learn,” “forward,” “drop,” and “flood.” The learn procedure
is the collection of MAC addresses from the source location
in a frame header. The source MAC address goes into a
mapping table along with the number of the port that
received the frame. Forwarding occurs once a frame’s
destination MAC address appears in the mapping table. This
table then guides the switch to transmit the frame out the
port that originally discovered the MAC address in question.
If the frame goes on the same port that the mapping
table indicates is the destination port, then the frame is
dropped. The switch does not need to transmit the frame
back onto the network segment from which it originated.
Finally, if the destination MAC is not in the mapping table,
the switch reverts to flooding—that is, a transmission of the
frame out every port—to ensure that the frame has the best
chance of reaching the destination.
By monitoring the activity of the switch—-specifically,
watching the construction and modification of the mapping
table and the variation of MAC addresses seen in frame
headers—you can detect errors and malicious traffic.
Intelligent or multilayer switches themselves or external
IDS/IPS services can perform this security monitoring
function.
When the switch procedures fail, the network suffers.
This could mean a reduction in throughput, a blockage
causing a denial of service, or a redirection of traffic
allowing a hacker to attempt to modify or eavesdrop.
Fortunately, such attacks are “noisy” in terms of generating
significant abnormal network traffic, and thus you can
detect them with basic security sensors. This benefit alone
is a significant reason to use switches rather than hubs.
FIGURE 1-13
An IEEE 802.3 Ethernet Type II frame.
FIGURE 1-14
An example of a MAC-layer bridge deployment.
Bridges link between networks. Bridges create a path or
route between networks, used only when the destination of
a communication actually resides across the bridge on the
opposing network. An analogy of this would be a city split in
two by a river. When people in that city want to visit a
location on the same side of the river that they are, then
they have no need to cross the bridge to get there.
The same is true of a network bridge. Bridges work in a
similar manner to switches in that they use several basic
procedures to manage traffic. Bridges use the process of
learn, forward, and drop. Thus, with these processes, only
traffic intended for a destination on the opposing network
will go by the bridge to that network. All traffic intended for
a destination on the same side of the bridge that received it
will be dropped since the traffic is already on the correct
network.
Bridges are used to connect networks, network
segments, or subnets whenever you desire a simple use-
only-if-needed link and the complexity of a router, switch, or
firewall is neither specifically required nor desired. See
Figure 1-14. Bridges can also link networks with variations in
most aspects of the infrastructure barring protocol. This
includes different topologies, cable types, transmission
speeds, and even wired versus wireless.
You can use bridges to detect the same types of traffic
abuses that switches do. In addition, both bridges and
switches can impose filtering on MAC addresses. Here you
can use a blacklist or whitelist concept, where you allow all
traffic except for that on the black/block list or you block all
traffic except for that on the white/allow list.
You can arrange to log activities across a router, switch,
and bridge. You should review traffic logs regularly, typically
on the same schedule as firewall and IDS/IPS logs. You will
note the signs of abuse, intrusion, denial of service, network
consumption, unauthorized traffic patterns, and more in
these common network devices not typically considered to
be security devices.
The Domain Name System
The Domain Name System (DNS) is an essential element
of both Internet and private network resource access. Users
do not keep track of the IP address of servers. So, to access
a file server on, say, a social networking site, users rely
upon DNS to resolve the fully qualified domain names
(FQDNs) into the associated IP address. DNS is similar to
the address book in your mobile phone. Instead of
remembering people’s phone numbers, you just look up
their names; the address book associates each person’s
name with the number to dial.
Most users don’t even realize that networks rely upon IP
addresses to direct traffic toward a destination rather than
the domain name that they typed into the address field of
client software. However, without this essential but often
transparent service, most of how the Internet works today
would fail. In such a case, users would need to maintain a
list of IP addresses of sites they wanted to visit or always go
to a search engine for a site’s IP address.
DNS is the foundation of most directory services in use
today, such as Active Directory and LDAP (see the following
section). Thus, DNS is essential for internal networks, as
much as it is for the external Internet.
DNS is vulnerable in several ways. First, DNS is a non-
authentication-query-based system. This allows a false or
“spoofed” response to a DNS query to appear valid. Second,
anyone can request transfers of the DNS mapping data
(called the zone file), including external entities if TCP port
53 allows inbound access. Third, DNS uses a plaintext
communication allowing for eavesdropping, interception,
and modification.
You can address some of the faults of DNS with local
static DNS mapping in the HOSTS file, filtering DNS on
network boundaries, and using IPSec for all communications
between all hosts. (A HOSTS file is a static file on every IP-
enabled host where FQDN-to-IP address resolutions can be
hard-coded.) However, these are defenses for DNS. DNS
does not protect the network; rather, it is an essential
service that needs protection.
NOTE
A few Internet index sites still exist, but they are not as
exhaustive (nor current) as most search engines. Think
of the difference between the Yellow Pages dropped on
your front porch each year versus dialing 411: One is
more current and relevant than the other.
Directory Services
A directory service is a network index. It helps users locate
resources within a private network. A directory service is
responsible for keeping track of which servers (sometimes
as clients) are online, as well as the resources these hosts
share with the network. A directory service operates much
like a telephone book does for phone numbers and
addresses.
Prior to directory services, less efficient methods of
tracking or locating available resources were in service.
These included local static or dynamic lists, which networks
maintained using broadcast announcements. Only
workgroup networks still use these outdated methods.
A directory service is another essential piece of modern
networks that does not itself provide obvious security
services. However, directory services need the protection
provided by other security services and devices. You should
limit access to directory services to authorized and
authenticated clients and users of the local network. Your
network should ignore all external requests for information,
with the exception of valid remote access or VPN links. If
possible, you should deploy IPSec so that you protect every
internal network communication.
Intrusion Detection Systems and Intrusion
Prevention Systems
Intrusion detection systems (IDS) and intrusion prevent
systems (IPS) have become popular topics of discussion in
the IT and security fields. The concept of an IDS is a system
that watches internal hosts or networks for symptoms of
compromise or intrusion. Effectively, an IDS is a form of
burglar alarm that detects when an attack is occurring
within the network.
An IDS serves as a companion mechanism to firewalls.
Once an IDS detects an intruder, it can send commands or
requests to the firewall to break a connection, block an IP
address, or block a port or protocol. You must configure the
firewall to receive these commands and authorize the IDS to
send them. Not all IDSs and firewalls are compatible in this
manner.
Eventually, the IPS concept appeared. The IPS strives to
detect the attempt to attack or intrude before it has the
opportunity to be successful. Once an attempt is detected,
the IPS can respond to prevent the success of the attempt
rather than waiting until after a successful breach to
respond. IPSs do not necessarily replace IDSs. Instead, they
are often used as a first or initial layer of proactive defense,
relegating the IDS to a reactive measure against those
events that the IPS misses or that internal personnel
perform.
IDSs and IPSs are important components of a complete
network security solution. However, they are not without
fault. IDSs and IPSs can create a false sense of security
under certain conditions. Two commonly discussed
conditions include unknown zero day attacks and false
positives.
When unknown zero day attacks threaten the network,
an IDS or IPS might not have the mechanism to detect it.
Thus, the lack of an alarm could cause administrators to
assume that no attacks are occurring. In most cases, the
lack of an alarm does mean that nothing malicious is
happening. So this assumption is not completely
unwarranted. But if an IDS never triggers an alarm, then you
should suspect a poor detection system rather than the
complete lack of compromise attempts or attacks.
False positives present the same result for the opposite
reason, namely too many alarms from benign occurrences.
After the first initial alarms turn out to be triggered by
benign activity, the urgency of responding to alarms
diminishes. After additional false positives, an administrator
might put off investigating alarms. Eventually, you ignore
the alarms altogether. Once this situation arises, you treat
even alarms for malicious events as false positives, once
again establishing a false sense of security.
Network Access Control
Network access control (NAC) limits access or admission
to the network based on the security compliance of a host.
NAC is essentially an enforcement tool to make sure that all
hosts connecting to the network have current and compliant
security components. With NAC, you can block or restrict
access if a computer does not have the latest antivirus
update, a certain security patch, or a host firewall.
NAC usually operates by placing an agent on each
authorized host. When the host connects to the network, the
agent contacts the master control program to find current
host requirements. If the host fails to meet those
requirements, then the NAC prevents the host from
accessing the network. A noncompliant host may be granted
access only to remediation servers. These remediation
servers can provide the patches and updates needed to
bring the host into full compliance.
Effectively, NAC is a method to enforce host-hardening
rules through an automated systemwide mechanism. With
NAC, systems must be in compliance or they are unable to
access general network resources. Only after you update
noncompliant systems are they allowed access to the
network.
CHAPTER SUMMARY
Because of the complexities and difficult questions
surrounding network security, you need to fully
understand the fundamentals of network security.
Once you have a firm grasp of these basic issues, you
will be able to put security into practice on your own
network.
A written security policy is the foundation of a
successful security endeavor. Without a written
policy, security will be chaotic and uncontrolled. A
security policy defines and assigns roles and
responsibilities to personnel within the organization.
Network infrastructure design can have a significant
impact on security. Administrators can employ
numerous network components and devices to
support a network security policy. These include
firewalls, VPNs, and IDSs/IPSs.
KEY CONCEPTS AND TERMS
Access control
Appliance
Asset
Auditing
Auditor
Authentication Authorization
Availability
Backdoor
Blacklist
Bottleneck
Breach
Bridge
Business task
Caching
Chokepoint
Client
Client/server network Confidentiality
Defense in depth Demilitarized zone (DMZ)
Denial of service (DoS) attack
Directory service Domain
Domain Name System (DNS)
Downtime
Egress filtering
Encapsulation
Encryption
Exploit
Extranet
Filtering
Firewall
Fully qualified domain name (FQDN)
Hacker
Hacking
Hardening
Hijacking
Host
HOSTS file
Ingress filtering
Integrity
Internet Protocol Security (IPSec)
Intrusion detection system (IDS)
Intrusion prevention system (IPS)
Job description
Local area network (LAN)
Log
Logging
Malicious code
Man-in-the-middle (MitM) attack
Media Access Control (MAC) address
Monitoring
Network access control (NAC)
Network address translation (NAT)
Network security
Node
Open Systems Interconnection (OSI) Reference
Model
Permission
Port address translation (PAT)
Privacy
Private IP address
Privilege
Proxy server
Public IP address
Redundancy
Remote access
Remote access server (RAS)
Remote control
Replay attack
Resources
RFC 1918 addresses
Risk Roles
Router
Security objective
Security policy
Senior management
Server
Single point of failure
Single sign-on (SSO)
Sniffer
SOHO (small office, home office)
Switch
Telco
Terminal services
Thin client computing
Threat
Trust
Tunneling
Virtual private network (VPN)
Vulnerability
Whitelist
Wide area network (WAN)
Workgroup
Zero day exploits
Zeroization
CHAPTER 1 ASSESSMENT
1. An outsider needs access to a resource hosted on your
extranet. The outsider is a stranger to you, but one of
your largest distributors vouches for him. If you allow
him access to the resource, this is known as
implementing what?
A. DMZ
B. Virtualization
C. Trusted third party
D. Remote control
E. Encapsulation
2. Which of the following are common security objectives?
A. Nonrepudiation
B. Confidentiality
C. Integrity
D. Availability
E. All of the above
3. What is an asset?
A. Anything used in a business task
B. Only objects of monetary value
C. A business process
D. Job descriptions
E. Security policy
4. What is the benefit of learning to think like a hacker?
A. Exploiting weaknesses in targets
B. Protecting vulnerabilities before they are
compromised
C. Committing crimes without getting caught
D. Increase in salary
E. Better network design
5. What is the most important characteristic of an
effective security goal?
A. It is inexpensive.
B. It is possible with currently deployed technologies.
C. It is written down.
D. It is approved by all personnel.
E. It is a green initiative.
6. What is true about all security components and
devices?
A. They are all interoperable.
B. They are all compatible with both IPv4 and IPv6.
C. They always enforce confidentiality, integrity, and
availability.
D. They are sold with pre-defined security plans.
E. They all have flaws or limitations.
7. Who is responsible for network security?
A. Senior management
B. IT and security staff
C. End users
D. Everyone
E. Consultants
8. What distinguishes workgroups from client/server
networks? (In other words, what feature is common to
one of these but not both?)
A. DNS
B. Centralized authentication
C. List of shared resources
D. User accounts
E. Encryption
9. Remote control is to thin clients as remote access is to?
A. NAC
B. VPN
C. DNS
D. IPS
E. ACL
10. What two terms are closely associated with VPNs?
A. Tunneling and encapsulation
B. Bridging and filtering
C. Path and network management
D. Encapsulation and decapsulation
E. Port forwarding and port blocking
11. What is a difference between a DMZ and an extranet?
A. VPN required for access
B. Hosted resources
C. External user access
D. Border or boundary network
E. Isolation from the private LAN
12. What is the primary security concern with wireless
connections?
A. Encrypted traffic
B. Support for IPv6
C. Speed of connection
D. Filtering of content
E. Signal propagation
13. What elements of network design have the greatest risk
of causing a DoS? (Select two.)
A. Directory service
B. Single point of failure
C. Bottlenecks
14. For what type of threat are there no current defenses?
A. Information leakage
B. Flooding
C. Buffer overflow
D. Zero day
E. Hardware failure
15. Which of the following is true regarding a Layer 2
address and Layer 3 address?
A. MAC address is at Layer 2 and is routable
B. Layer 2 address contains a network number
C. Layer 2 address can be filtered with MAC address
filtering
D. Network Layer address is at Layer 3 and is routable
E. Both C and D are true
16. Which of the following are not benefits of IPv6?
A. Native communication encryption
B. RFC 1918 address
C. Simplified routing
D. Large address space
E. Smaller packet header
17. What is the most common default security stance
employed on firewalls?
A. Allowing by default
B. Custom configuring of access based on user account
C. Caching Internet content
D. Denying by default, allowing by exception
E. Using best available path
18. What is egress filtering?
A. Investigating packets as they enter a subnet
B. Allowing by default, allowing by exception
C. Examining traffic as it leaves a network
D. Prioritizing access based on job description
E. Allowing all outbound communications without
restriction
19. Which of the following is not a feature of a proxy
server?
A. Caching Internet content
B. Filtering content
C. Hiding the identity of a requester
D. Offering NAT services
E. MAC address filtering
20. Which of the following is allowed under NAC if a host is
lacking a security patch?
A. Access to the Internet
B. Access to e-mail
C. Access to Web-based technical support
D. Access to file servers
E. Access to remediation servers
CHAPTER
2 Firewall
Fundamentals
TO SOME NETWORK ADMINISTRATORS, A FIREWALL is the key component of their infrastructure’s security. To others, a
firewall is a hassle and a barrier to accomplishing essential
tasks. In most cases, the negative view of firewalls stems
from a basic misunderstanding of the nature of firewalls and
how they work. This chapter will help dispel this confusion.
This chapter clearly defines the fundamentals of
firewalls. These include what a firewall is, what a firewall
does, how it performs these tasks, why firewalls are
necessary, the various firewall types, and filtering
mechanisms. Once you understand these fundamentals of
firewalls, you will be able to look beyond the unschooled
opinions, common mythology, and marketing hype
surrounding them, and the crucial benefits of effective
firewall architecture will become clear. Like any tool,
firewalls are useful in solving a variety of problems and in
supporting essential network security.
Chapter 2 Topics
This chapter covers the following topics and
concepts:
What a firewall is
Why you need a firewall
How firewalls work and what they do
What the basics of TCP/IP are
What the types of firewalls are
What ingress and egress filtering is
What the types of firewall filtering are
What the difference between software and
hardware firewalls is
What dual-homed and triple-homed firewalls
are
What the best placement of a firewall is
Chapter 2 Goals
When you complete this chapter, you will be able
to:
Define firewalls
Explain the need for firewalls
Describe types of firewalls, including network
router/interface firewall, hardware appliance
firewall, and host software firewall Explain
standard filtering methods, including static
packet filtering, NAT services, application
proxy filtering, circuit proxy filtering, dynamic
packet filtering, stateful inspection filtering,
and content filtering Define the meaning of
ingress and egress filtering
Compare and contrast software and
hardware firewalls
Illustrate on a typical business network
diagram possible placements for a firewall
Compare and contrast dual- and triple-
homed firewalls
What Is a Firewall?
A firewall is like a border sentry. A firewall is like a
gateway and is often called a “security gateway.” A firewall
is like a traffic control device. A firewall is a filtering device
that enforces network security policy and protects the
network against external attacks. A packet is a unit of
information that is routed between one point and another
over the Internet or any other network. The packet header
includes information such as source, type, size, and origin
and destination address. As a filtering device, a firewall
watches for traffic that fails to comply with the rules
defined by the firewall administrator. Firewalls can focus on
the packet header, the packet payload (the essential data
of the packet) or both; or on the content of a session, the
establishment of a circuit, and possibly other assets. Most
firewalls focus on only one of these. The most common
filtering focus is on the header of the packet, with the
payload of a packet a close second.
Filtering allows what you want on your network and
denies what you do not. Filtering relies on filtering rules.
Each rule has a pattern of concern and a response the
firewall will make if an incoming element matches the
pattern.
Firewalls follow a philosophy or stance of security known
as deny by default/allow by exception. All the rules on a
firewall are exceptions. Some exception rules define what
you allow. Some exception rules define what you wish to
deny. The final option, sometimes called the final rule, is
anything that did not match one of the exceptions is denied
by default.
Firewall filtering compares each packet received to a set
of exception rules. These rules state that content in the
packet is either allowed or denied. If the packet matches an
allow rule, it continues on to its destination. If the packet
matches a deny rule, then the packet is dropped. Hence, a
deny rule prevents the packet from reaching its destination.
If a packet fails to match any rule, then the firewall drops
the packet by default.
The filtering rules are the exceptions to the deny-all rule
that is the final and absolute rule of a firewall. In fact, if a
deny by default rule didn’t exist, the filtering device would
not be a firewall at all. Instead, it would be more like a
router or switch, allowing traffic to pass, even if it did not
match an expected pattern or rule. So, keep in mind the
security stance of deny by default/allow by exception. A
firewall is a filtering device that helps support this stance.
Think of a firewall as a sentry along the borders of a
country. The term firewall is not exactly the best term that
could have been selected for this device or service, which
performs essential security filtering for hosts and networks.
The term firewall comes from a building and automotive
construction concept of a wall that is built to prevent the
spread of a fire from one area into another. The firewall in a
building or car engine compartment is a physical block
against the spread of fire.
Network security administrators use the term firewall to
refer to a device or service that allows some traffic but
denies other traffic. This is not the same as a building’s
firewall, which allows a fire to spread only if the firewall fails.
In network security, firewalls allow traffic through that’s
considered safe—or at least authorizes traffic without the
entire firewall failing. Additionally, if a firewall does fail, it
fails into a secured state. This means that when the firewall
is offline, is locked or frozen, or otherwise experiences a
problem, it stops all traffic rather than allowing all traffic
through. This is known as fail-safe or fail-secure.
Better ways to envision the job of the firewall are a
sentry, doorman, or even border guard. These people
positioned at the entrance or exit of a building watch for
unauthorized attempts to enter the secure area. Some
people are allowed to enter; others are prevented. In the
event that the sentry isn’t present, the entry is locked, so
only those with a key can enter. Think of a firewall as a
border sentry.
A gateway is an entrance or exit point to access a
controlled space. People use gateways every day in a
variety of ways. An on-ramp is a gateway to the highway, a
doorway is a gateway to a building, and a personal
computer is a gateway to the Internet—and to your
organization’s network. You can also think of a firewall as
the gate at a gateway. The firewall stands at the entrance of
a network to block unwanted traffic.
Gateways are important because, typically, high levels of
traffic pass through a gateway. Thus, positioning a firewall
at a network gateway is an aspect of secure design. If the
gateway already exists in the network infrastructure, then
positioning the firewall at that point is an obvious security
improvement. A firewall so positioned watches over all
traffic crossing that gateway point.
Another place that firewalls are often deployed is in front
of (that is to say, on the public Internet side), behind (inside
the data center), or in load balancing systems, or, as they
are most often called, load balancers. Load balancers are
reasonably well named because that is what they do: They
take the load coming into a set of servers and ensure that
the load is balanced between or among the servers, based
on a variety of factors. It is a funnel point for traffic that is
an ideal place to enforce policy, and that is done through
the firewall.
If a network is still in its design phase, a network
designer might make the secure choice to create a gateway
in the network’s layout. However, in this situation, the
concentration point would be known as a chokepoint instead
of a gateway. If a gateway is an access point to other areas
of resources, a chokepoint is a specialized kind of gateway
that focuses on traffic to a single concentrated pathway to
simplify the process of filtering.
Whether labeled as a gateway for resource access or a
chokepoint to control security, the result is the same. A
firewall positioned at a gateway provides filtering services
across all traffic. The chokepoint provides filtered access to
resources. As a wise poet once said: “Good fences make
good neighbors.” So, too, do good gateways and well-
positioned firewalls make secure networks.
You can also think of a firewall as a traffic control device.
A significant amount of network security is little more than
controlling traffic. Authorized traffic passes through the
digital intersection, while unauthorized, unwanted,
abnormal, or obviously malicious traffic is blocked.
The very basic and original form of the modern firewall
was a screening router. Routers analyze traffic based on
destination address. The best-known available route to the
destination informs the forwarding decision. However,
screening routers added in additional rules that could
discard traffic based on destination or source address. Once
filtering expanded to address protocols and even ports, the
screening router became the basic static packet filtering
firewall.
In addition to filtering, firewalls can also offer routing
functions, which are a holdover from this router ancestry. A
multi-homed firewall can grant traffic access to one or
another interface or segment based on the results of
filtering. Traffic for a private LAN could traverse one
segment, while traffic destined for the DMZ could follow
another (see Figure 2-1). A firewall is an efficient, necessary
traffic control device on the highway that is your network.
FIGURE 2-1
A basic multi-homed firewall filtering and routing for two
network segments.
A firewall enforces your organization’s network security
policy. Specifically, a firewall enforces the network traffic
access control security policy. A firewall is the physical
embodiment of the security policy. It’s the most obvious or
direct enforcement of access control on your network’s
traffic. No device more than your firewall is as directly
involved in allowing authorized traffic and denying all else.
A security policy defines the goals, objectives, and
procedures of security. Every security policy focusing on
network security requires the deployment of a firewall. The
firewall’s job is to impose all restrictions and boundaries
defined in the security policy on all network traffic. A firewall
enforces your organization’s network security policy just as
a traffic policeman enforces the motor vehicle laws of a
town or state.
A firewall’s critical function is to protect your network
against external attacks. It’s no secret that external threats
are numerous. The onslaught of attacks is almost
unbelievable, like a constant flood against every Internet-
connected node. If it were not for vigilant hardening of hosts
and the use of firewalls, the Internet and private networking
could not exist as they do today.
It’s no accident that some threats to computer networks
are called viruses; external threats seem to continuously
change and evolve. Other attacks are targeted specifically
for your network or organization. Some attacks are
untargeted and random. Instead, they are directed toward
any host that happens to have a specific vulnerability.
Malicious code relentlessly infects and compromises
unprotected computer systems. Flooding attacks attempt to
interrupt timely Internet communications. And these are
only some of the external threats facing your organization’s
network.
A firewall stands as a sentry, as a front guard, as a
defense against all attacks and attempts at system
compromise. The good news is that many firewalls are well
hardened against all known-to-date attacks. These firewalls
can withstand the blitzkrieg of the attacks without faltering.
A firewall protects the network against the substantial asset
damage that external attacks can cause.
Understanding these definitions and distinctions is only
the beginning of understanding firewalls.
What Firewalls Cannot Do
A firewall is an essential part of network security. However,
it’s not the whole of network security. Don’t make the
mistake of deploying a firewall while ignoring other security
management activities. A firewall is only one piece of the
large complex puzzle of network security.
There are many things a firewall is not. Don’t be fooled
by the marketing. Some of these deficiencies can become
cloudy as vendors sell combination or multifunction
solutions. Often, these devices are designed for the SOHO or
home user and thus were never intended to provide
commercial-grade protections.
A firewall is primarily for network traffic filtering. It’s not
an authentication system. Firewalls aren’t designed to check
logon credentials, compare biometric scans, or even confirm
the validity of digital certificates. These are the functions of
an authentication service, typically hosted on a domain
controller or primary network server.
That said, you might find it necessary for a firewall to
allow authentication before granting access to a resource or
allowing a session. Some firewalls can have enhancement
features that provide for firewall-hosted authentication
services. However, in many cases, a better solution would
be to have the firewall offload that task to a dedicated
authentication server or service, such as 802.1x, public
key infrastructure (PKI), or directory services. Most
security experts do not recommend using a firewall to
authenticate users, or at least not as a replacement for a
network’s directory service or centralized authentication
solution. Firewalls are not authentication systems.
A firewall is not a remote access server. Connections
from remote users do not have an endpoint at the firewall.
Instead, the endpoint is a remote access server (RAS) or
network access server (NAS). A firewall may function before
or after the RAS/NAS to filter remote access traffic.
However, that doesn’t mean the firewall is the RAS/NAS
itself.
Your firewall should of course filter all remote traffic,
especially because remote traffic is much more likely to be
purposefully malicious or accidentally damaging than local
traffic. Why? An organization has much more control over
who can connect to its network locally than it does when it
allows remote connectivity. Remember: A firewall does not
replace a remote access server.
Unlike Superman, your firewall does not have X-ray vision
into encrypted traffic; in other words, it cannot see the
contents of encrypted traffic. A firewall can filter on the
header of traffic using transport mode encryption, since
the original header is in plaintext form. However, a firewall
cannot filter the original header of traffic using tunnel
mode encryption, since the only plaintext component is a
temporary tunnel header that only includes information
about the endpoints of the tunnel. It’s like trying tell what’s
in the boxcars of a train by observing only the locomotive
and the caboose.
Position your firewall where it can be most effective. If
the security design requires that all traffic content be
examined by a firewall, then you need to position the
firewall after encryption is removed from the traffic. If the
security design requires filtering only on non-encrypted
traffic, then positioning the firewall is not as critical.
Firewalls designed for use by Web e-commerce sites may
have an additional ability to act as the endpoint of a Secure
Sockets Layer (SSL) or Transport Layer Security (TLS)
tunnel from an Internet client. This grants the client
protection for its data as the information traverses the
Internet. This allows a firewall to filter the content of the
traffic before the Web server receives and processes the
information.
Encryption is one method to evade filtering. Users and
hackers can employ client-side encryption solutions that
encode the data before transmission or create unauthorized
encrypted encapsulation tunnels to prevent firewall filtering.
In this situation, your network security policy may stipulate
that the firewall needs to block encrypted transmission
initiated by clients, especially if the destination is on the
Internet. It’s important to remember that firewalls are
powerful, but they don’t have X-ray vision into encrypted
traffic.
A firewall is also not a malicious code scanner. Firewalls
are traditionally rule-based filtering products. These rule
sets usually have only a few dozen to at most a few
hundred rules. To filter malicious code, the rule list would
need millions of entries. As of December 2009, the AVG
Anti-Virus definition database #270.14.88/2538 was
tracking 24,303,360 malicious code infection definitions.
That number of entries is simply impractical to include in a
firewall rule set.
Some firewall products include an enhancement or add-
on module for malicious code scanning. Such an
enhancement is just an add-on component, not a core
feature of a firewall. In most cases, it’s more efficient and
more secure to use separate anti-malware scanners than to
add this function to your firewall.
Many firewall rules block traffic with spoofed addresses,
uncommon ports, unauthorized protocols, invalid header
constructions or values, etc. Such rules block a significant
amount of traffic caused by malicious code, but these rules
do not themselves directly block malware from entering or
leaving a network. Keep in mind that your firewall can do
many things, but it’s not a malicious code scanner.
A firewall is also not an intrusion detection system. An
intrusion detection system, or IDS, is a type of network
burglar or intruder alarm that detects and responds to
unauthorized activity inside your network. An IDS performs
this task by monitoring all network traffic. While an IDS can
be deployed on a network border or outside the network
against the Internet, most IDSs operate inside private
networks so that they can watch all internal network traffic.
A firewall can detect malicious traffic only when such
traffic enters one of the firewall’s interfaces. Firewalls
generally don’t watch over general interior network activity.
Either firewalls are border devices for networks and subnets,
or they are software products watching over a single host. In
either case, they cannot see the same traffic nor perform
the same tasks as an IDS. A firewall, therefore, is not
interchangeable with a good intrusion detection system.
A common misconception is that firewalls protect against
insider attacks. They cannot. A firewall can be a border
device or a firewall can be software on a host. A border
firewall can filter traffic entering or leaving a network or
subnet. So a border firewall is unable to see any interior
traffic (Figure 2-2). When an attacker from an inside client
attacks a target that is also an internal host, a border
firewall is not part of the communication and thus can
neither detect nor block the attack.
A host software firewall can only see the traffic entering
or leaving that one host. A host software firewall is unable to
see any other interior traffic Of course, if traffic does not
pass through its interfaces, a firewall cannot filter the traffic.
A firewall can filter only what it sees. If malicious or
unwanted traffic does not enter an interface of a firewall,
the firewall will not be able to filter that traffic (see Figure 2-
2). So you’ll want to place firewalls on each host, on every
border gateway or chokepoint, and between each significant
subnet or interior network division.
NOTE
IDSs can detect a plethora of unwanted activities, use
several methods of detection, and perform a wide
range of responses, both passive and active.
Another thing firewalls can’t do is protect against social
engineering. Social engineering is the category of attacks
that focus on the personnel of an organization. These
attacks get information from people just by asking for it in
clever ways or convincing someone to perform an action
that breaches network security. The only real protection
against social engineering is worker training and awareness.
A firewall cannot stop an attack stemming from social
engineering.
FIGURE 2-2
Border firewalls cannot filter internal communications.
A firewall can’t protect against the threat posed by
removable media. The widespread use of removable media
has been a significant threat to every computer in
existence, even those not connected to the Internet, an
external network, or even a single other computer through a
network link. Removable media include USB hard drives,
USB thumb drives, CDs, DVDs, Blu-ray discs, HD-DVD discs,
other optical discs, flash memory cards, FireWire storage
devices, tape media, e-mail attachments, and more.
Removable media can leak information out of an
organization or smuggle malicious code in. A firewall is not
involved in the use of removable media nor any of the
contents these devices may contain. A firewall cannot
protect your network against the ongoing threat posed by
removable media. Again, the best defense against this
threat is good company policy, worker training, and
awareness.
A firewall, of course, cannot protect against physical
incursions or attacks. Physical attacks bypass any and all
logical and electronic protection mechanisms. A firewall
does not protect against theft of devices, planting of
eavesdropping mechanisms, disconnection of cables,
connecting a rogue notebook to an open node, destruction
of equipment, dousing electronics with liquids, building fires,
or any other form of physical attack. Only effective physical
defenses can deter physical attacks. A firewall is not
designed or intended to thwart physical attacks.
Firewalls aren’t insurance against inept or ignorant
administrators. Computer equipment and software can do
only what it’s designed and programmed to do. If an
administrator misconfigures a security device, the device
doesn’t automatically compensate for that oversight. If a
security administrator fails to learn about all the features
and defaults of new equipment, the product cannot secure
itself autonomously. Security requires training, research,
careful planning, thoughtful implementation, and ongoing
review and maintenance. This process is known as security
management—and it takes work. The old expression was
never more true than today: “Garbage in, garbage out.”
What you put into network security is precisely what you will
get out of it. So remember that a firewall can’t compensate
for ineptitude or ignorance on the part of administrators.
In the same vein, firewalls can’t compensate for poor
security management. Proactive security management is
essential for the success of any security endeavor. Security
management is the process of reviewing, testing, tuning,
and updating an organization’s security policies and security
infrastructure. This is an ongoing effort that requires
knowledge, research, and vigilance. The threats and risks
facing an organization are constantly evolving to become
more persistent and virulent. Your security strategy should
be just as rigorous and purposeful in defense. Keeping up to
date on the most current threats to and trends in network
security is a big part of this job. Networking, conferencing,
and reading the latest industry literature are ways to keep
yourself and your security efforts sharp.
Keep in mind that a firewall is a focal point of security. It’s
an embodiment—a physical representation—of your
organization’s security policy. When you use them well and
wisely, firewalls provide reliable and consistent security
from external threats. However, firewalls have limitations
and are only part of the complete security strategy. By itself,
a firewall cannot protect a network against every threat. A
firewall cannot compensate for the lack of informed, state-
of-the-art security management.
Furthermore, and this follows from everything you have
read so far, firewalls are not a substitute for a solid written
security policy. A firewall is nothing but a reliable border
sentry. It is not the complete security infrastructure and
strategy. Even the decision to deploy a firewall is a
significant strategic undertaking that shouldn’t be taken for
granted. Thorough research and planning will help with the
design and deployment of an effective firewall. A firewall
policy ensures the success of your network’s firewall. A
company-wide security policy ensures the success of your
organization’s security infrastructure. Firewalls are in no way
a substitute for such a security policy.
Finally, firewalls are not a perfect solution. As noted, a
firewall is a border sentry, reliable but limited. A firewall can
filter only what it sees. It can perform filtering only
according to the rule sets defined by the security
administrator. It cannot self-adjust to changing conditions or
future threats. A firewall is only a part of a complete security
infrastructure. Firewalls are mostly software, even when
operating on dedicated hardware. They are software, written
by fallible humans; therefore, they can, and do, have bugs
and flaws. A firewall is never the perfect solution—but it is
part of the solution.
Fortunately, in spite of all the things a firewall is not, a
firewall is a solid filtering solution. A firewall can and should
protect the borders of networks and individual hosts. No
security strategy—or deployment—is complete without
properly installed firewalls.
Why Do You Need a Firewall?
Who needs a firewall? Anyone who uses a computer to
interact with and exchange resources with any other
computer! Your personal computer needs a firewall. Your
home network needs firewalls. Your company network needs
firewalls. Every network needs firewalls. They are a
fundamental of network communication.
High-speed Internet connectivity has become ubiquitous.
Most computer users now have high-speed access at home,
at work, and even on the go through mobile devices. Often,
these broadband connections are always-on connections.
This means computers and networks are online all the time
—and exposed to attacks. A drawbridge is easy to cross if
it’s always down. When a system is always connected, it can
be the focus of a concerted attempt to discover its
vulnerabilities and breach its security.
How likely is it that a computer will be discovered and
attacked over the Internet? Almost guaranteed. Most
systems are detected, scanned, and probed within minutes
of obtaining a public IP address. It is technical suicide to
connect your system to the Internet before installing a
firewall, as well as installing the latest vendor patches for
the hardware, OS, and installed applications.
Does this mean that there are armies of hackers just
waiting to find new targets to attack? Unfortunately, yes.
Not, however, in the way you might think. Malicious
programs perform most of the scanning and attacking
automatically. These are commonly known as agents,
robots, zombies, or just bots. Groups of malicious code,
known as botnets, scour the Internet for new victims
constantly.
Another wrinkle in being constantly online over a
broadband connection is the throughput speed. High-speed
links to the Internet enable high-speed attacks against your
system. On older, slower connections, the same risks
existed, but the attacks were slower or fewer simply
because the link to a targeted system throttled the speed of
the attack. With 10 Mbps and faster connections being
common, attacks can occur at near-lightning speed.
This is not to suggest that only slow-speed Internet links
are secure. On the contrary, you should take full advantage
of high-speed Internet connections. However, you need to
protect your systems with firewalls. A firewall will impose a
significant barrier to most attacks that originate from the
Internet.
With a firewall protecting your system from the Internet,
hacker scans will be nearly worthless. Responses to probing
packets will be filtered. An outsider will learn little about
your infrastructure. This, in turn, means they will discover
fewer vulnerabilities, thus wage fewer attacks. And even
then, those attacks will be more likely to fail.
Firewalls are not used only for Internet protection. Don’t
forget that significant levels of threat exist internally.
Firewalls stand guard against network segments inside your
private network (Figure 2-3). Think of a firewall as a tool to
prevent abuse or misuse of LAN resources. Each major
department, subnet, or other relevant distinction within an
organization should have firewall protection. This will ensure
that accidental compromises, as well as intentional abuses,
are minimized internally. All networks protect against both
internal threats and external ones.
FIGURE 2-3
An example of a private network using firewalls to securely
separate subnets.
Don’t overlook that, while a firewall has its origins in
routing, you still want to use a dedicated router for routing
and a dedicated firewall for filtering. In many cases, the
combination or multifunction devices offer lots of features,
but not necessarily best-of-breed performance and
efficiency. These may be money-savers for small networks,
but they are often cause for expense for larger networks. If
a device fails to perform at commercial levels when
necessary, the repercussions can cost more than deploying
the proper safeguards in the first place.
Firewalls should be used to protect a resource, no matter
where that resource resides on your network. A hardware
firewall can protect a single host or a network of hosts,
while a software firewall can protect only a single host.
Don’t limit your definition of a firewall to just a border sentry
device. Think of it, instead, as a sentry device in general,
able to protect anything placed behind its filtering service.
Host firewalls protect a host and protect a network
from the host. A host firewall’s job is to filter traffic entering
or leaving a single computer system. Attacks and malicious
traffic can come from the Internet or the local network. A
host firewall can protect the host against such threats.
However, the host itself could be compromised by malicious
code or be controlled by a malicious user. In this situation,
the host firewall protects the network from the threats
coming from the host.
Another way of looking at this is that a host firewall also
protects the network from a user in general. A user is the
most risky element in a network infrastructure. Even if every
other component, hardware or software, does what it was
programmed and configured to do, a user can decide to
violate security. Thus, the free will of human users is one of
the biggest risks to every computing environment.
Users can be ignorant, make mistakes, be tricked by a
Trojan horse, be the target of social engineering attacks, or
perform malicious actions on purpose. The security of a host
system, including general system hardening, anti-malware
scanning, Internet client restrictions, blocking of non-
approved software, and a host firewall, are all designed to
protect the network from the risk of human users.
Firewalls protect against Internet threats, protect against
internal network threats, protect resources generally, and
protect against the risk of users. These capabilities alone
might make installing a firewall on every host and on every
segment seem like the obvious follow through.
However, deploying firewalls everywhere has two
significant drawbacks: cost and over-dependence. Most
commercial-grade firewalls are costly. Even if they have no
purchase cost (due to promotions or being open source), the
ongoing maintenance costs of firewalls add up significantly
over time. With firewalls deployed on every host and on
every segment, the overhead of firewall management would
far exceed the total IT budget of most businesses.
A second drawback to ubiquitous deployment of firewalls
is over-dependence. Firewalls are only part of a complete
security solution, not a whole solution by themselves. By
deploying firewalls on every host and every segment, other
essential security endeavors might be overlooked or
deemed unnecessary. This would be a disastrous security
stance. Firewalls cannot compensate for poor security
policy, poor security management, or a lack of proper
system hardening.
With these concerns, how can your organization
determine how many firewalls to deploy and where to
deploy them? In most cases, this requires a process of risk
assessment and risk management. Risk assessment
involves examining values, threat levels, likelihoods, and
total cost of compromise versus the value of the resource
and the cost of the protection. While many other factors
affect risk assessment, this essential business and security
process is as follows: 1. Determine the overall value of the
resource or asset. Known as the asset value (AV), this
calculation should include both tangible and intangible
costs and value.
2. Determine the threats that face that asset. For
each threat, calculate the exposure factor (EF), or
the amount of potential harm expressed as a
percentage. This will create a list of asset-threat
pairs with a corresponding EF.
3. Calculate the single loss expectancy (SLE):
SLE = AV × EF. This is the amount of potential loss
that could be experienced due to a single
occurrence of compromise against this asset for a
specific threat. This will add an SLE value to each
asset-threat pair.
4. For each threat, calculate the potential number
of times the threat could be a realized attack within
a year’s time. This is known as the annualized rate
of occurrence (ARO).
5. Calculate the annualized loss expectancy
(ALE): ALE = SLE × ARO. This is the amount of
potential loss that can be experienced due to any
compromise of this asset for a specific threat within
a year. This will add an ALE value to each asset-
threat pair.
6. Sort the list of asset-threat pairs by the ALE.
The highest ALE is the biggest risk for this specific
asset/resource.
7. Take the asset-threat with the largest ALE and
determine the possible countermeasures that could
be used to protect against that threat. This creates
asset-threat-countermeasure triplets.
8. For each asset-threat-countermeasure triplet,
calculate a new ARO. The countermeasure should
reduce the ARO. A perfect countermeasure would
reduce the ARO to zero. There are few perfect
countermeasures.
9. With the new ARO, calculate a new ALE for each
asset-threat-countermeasure triplet.
10. For each asset-threat-countermeasure triplet, make
a cost/benefit analysis. The formula for this is:
(Original ALE – New ALE) – cost of the
countermeasure per year.
11. Sort the asset-threat-countermeasure triplets by
their potential cost/benefit. The triplet with the
greatest cost/benefit is the best choice.
In short, if the cost/benefit analysis for a particular asset-
threat suggests a firewall, then installing one is a good
business, security, and budget decision. If some other
countermeasure delivers greater benefit for less cost, then
that countermeasure is the better choice.
Performing detailed risk analysis is a complex task. Many
small companies or home network enthusiasts might not
want to spend the effort to perform a complex risk
assessment. This is understandable, but failing to perform a
full risk assessment doesn’t mean that you have no risk or
that you have no assets worth protecting.
At a minimum, you need to protect any and all data that
is personally identifiable. This includes personal
communications like e-mails; any custom crafted document,
picture, video, or other file type; all medical information; all
financial information; configuration settings; and passwords
and other credentials. Identity theft is one of the most
frequent and devastating crimes of the interconnected
world. Worrying only about your neighbors, the random
home burglary, or the pickpocket on the street is nothing
short of tunnel vision. Today, you must be concerned about
all would-be criminals across the globe attempting to gain
access to your electronic assets over the Internet.
Who needs a firewall? Everyone with a networked
computer needs a firewall. Why are firewalls necessary?
Firewalls are critical because threats and malicious entities
lurk on the Internet, on private networks, and possibly
within your own home!
What Are Zones of Risk?
A zone of risk is any segment, subnet, network, or
collection of networks that represents a certain level of risk.
The higher the risk, the more security you need to protect
against that risk. The less of a risk associated with a zone,
the less security is necessary because the threats of that
zone pose less chance of harm.
The flip side of zones of risk is zones of trust. Highly
trusted zones naturally require less security, while zones of
low trust require more security.
Each zone of risk needs to be clearly and distinctly
isolated from any other risk zone, especially if those zones
have different levels of risk. The primary tool used to isolate
zones from each other is the firewall.
Most networks have two to four zones of risk. These
include the private network, DMZ, extranet, and the
Internet. See Figure 2-4. The private network zone has the
lowest risk and is the zone of the highest trust. The Internet
zone has the highest risk and is the zone with the least
trust. A DMZ has less risk than the Internet, but is not as
trusted as the private network. A DMZ zone has medium-
high risk or medium-low trust. An extranet has more risk
than the private network and more trust than the Internet.
An extranet zone has medium-low risk or medium-high
trust. See Table 2-1.
FIGURE 2-4
An example of a private network with four risk or trust
zones.
TABLE 2-1 Risk and trust levels of common network
zones.
ZONE RISK LEVEL TRUST
LEVEL
LAN Low High
Extranet Medium–low Medium–
high
DMZ Medium–high Medium–
low
Internet High Low
Your organization’s written security policy should define
where these zones exist and dictate the security
requirements for each zone. Such requirements would
include traffic management, use of firewalls, use of VPNs to
cross the zone divisions, hardening of systems, malicious
code scanning, and so on. Firewalls are likely found at risk
zone divisions and may be the best cost/benefit security
countermeasure in some circumstances. The next step is to
understand what a firewall can do at these points and how it
performs these tasks.
How Firewalls Work and What
Firewalls Do
Firewalls work along a communication pathway. This can be
the gateway point of a network, a chokepoint within a
network, a point of zone transition, or on a host. In these
locations, the firewall interrupts the traffic flow to inspect
packets or sessions. If the traffic is authorized, it continues
to its destination. If the traffic is not authorized, it is blocked
and dropped.
When one thinks of a firewall, one generally pictures
some sort of hardware, when in fact it is more accurate to
think of the firewall as a function. There are really two broad
types of firewall implementations: bump-in-the-wire and
bump-in-the-stack. The bump-in-the-wire is a separate
hardware firewall implementation, and the bump-in-the-
stack is a firewall that is implemented via software.
Firewalls operate on a bastion host basis (Figure 2-5).
This is most obvious in the case of hardware firewalls, but
it’s true of host software firewalls as well. A bastion host
firewall stands guard along the pathway of potential attack,
positioned to take the brunt of any attack. A firewall acts as
the vanguard, as the front line of defense against any
attack. A bastion host can also be called a sacrificial host.
In the case of a host software firewall, the firewall will
attempt to prevent all malicious interactions to and from the
host. In the event that the firewall itself is compromised, it
usually disconnects the system from the network. While this
is a form of DoS, it’s often a preferred fail-safe/fail-secure
response over defaulting to an open unrestricted and
unfiltered connection. This is especially true if the
connection is directly to the Internet.
FIGURE 2-5
An example of a bastion host firewall deployment.
If the firewall is able to rebuff an attack, then the
resources are secure. If the firewall falls due to the attack, it
prevents any further communication with the resources
behind it. Think of a firewall as a dead-man switch. If the
firewall fails or goes offline, so does the connection it was
filtering.
The most common function of a firewall is to screen or
filter traffic. The firewall checks any packet received on its
interface against its rule set to determine whether to
forward or drop the packet. As you read earlier, firewalls
typically function on a deny-by-default/allow-by-exception
security policy.
The firewall performs most traffic filtering based on
information in a packet or segment header. This can include
the IP address of the source and destination, as well as the
source and destination port. Some firewalls can also filter or
block specific protocols or certain uses of protocols. For
example, a firewall could block all streaming media
protocols and block just the Internet Control Message
Protocol (ICMP) type 3 (destination unreachable) and 11
(timeout exceeded).
Firewalls differentiate between networks or subnets. A
firewall serves as a clear and distinct boundary between one
network area and another. By positioning a firewall between
network divisions or subnets, the network designer and
security administrators are using traffic management and
control for traffic attempting to cross that intersection.
Firewalls serve as boundary devices both on the edge of
networks facing the Internet as well as internally between
different divisions within an organization.
Open and unrestricted internal communications might
sound like a good idea, but in practice such traffic causes
severe degradation of overall infrastructure performance
and stability. By preventing or at least limiting
communications between certain divisions of an
organization, traffic efficiency increases. Additionally, traffic
control and management decrease risk.
For example, by blocking communications between the
programming group’s network and the production network,
unapproved versions of software cannot leak out.
Additionally, blocking general access to the accounting
subnet, the research and development subnet, the DMZ,
and the extranet from the production network protects
against data leakage, spread of malicious code, and other
forms of fraud and abuse.
Firewalls can act as a general filter for malicious activity
or as a one-way sieve. As a general filter, a firewall will allow
all normal benign traffic to pass through. This is the type of
firewall used to protect a DMZ or differentiate subnets
within a LAN. A general filter firewall works to stop malicious
activities.
A general filter firewall can allow communication using
any protocol on any port or limit communications to specific
protocols and ports (amongst other limitations). If only a few
specific resources hosted behind the firewall are to be
accessed by external users, the firewall can allow access to
those specific internal systems based on IP address and port
but block all other inbound requests.
A sieve firewall will only allow traffic to originate from the
private or trusted side. A sieve firewall will allow non-
malicious responses to return from the public or less-trusted
side, but it will generally block or prevent any initiation or
inbound communication request from the outside. A sieve
firewall typically protects a private LAN or an extranet.
Firewalls can support special inbound authorized
connections with the LAN, such as VPN links from
telecommuters. This is an important feature for an extranet,
as well, since VPN access is often the only method to reach
hosted resources through the Internet.
Firewalls can provide port-forwarding services. Port
forwarding is a form of static reversal of network
translation. In traditional or dynamic network address
translation (NAT), external entities cannot initiate
communications with internal systems because any packet
received by the outside interface of the NAT system will not
find a matching mapping in the translation table and will
therefore be considered invalid and dropped.
With port forwarding, a translation mapping is coded so
that an external IP address and port combination are fixed
and redirect traffic to a specific internal system, even if the
internal system uses a private IP address. The combination
of an IP address and a port number is known as a socket.
In Figure 2-6, the external port 208.40.235.38:8081 is
forwarded to an internal server’s port at 192.168.5.74:80.
Port forwarding can also be called static NAT, traffic
forwarding, service redirection, reverse proxy, and
“punching a hole through the firewall.”
The phrase “punching a hole through the firewall” points
out a very important concern: namely, that using port
forwarding reduces the effective security provided by the
firewall. Without port forwarding or other similar services, a
firewall can rebuff attempts to communicate with internal
systems. Using port forwarding, you create a pathway
across the primary border sentry. Several hacker exploits
can take advantage of port forwarding to reach other
internal systems on other ports than what was “allowed” by
the port forwarding settings. These attacks are usually
variations of fragmentation manipulation.
FIGURE 2-6
An example of port forwarding across a NAT system.
Managing and controlling traffic is a primary concern and
function of firewalls. Only authorized communications are
allowed; everything else is blocked. The act of determining
what to allow and what to block depends on the filtering
features of the firewall. These include packet inspection,
connection or state management, stateful inspection, and
others. (A state is a logical connection between a client and
a resource server.) These filtering concepts are defined later
in this chapter.
In addition, firewalls can block or filter outbound traffic.
This function can block spoofed traffic or anything with an
invalid IP address as the destination or source. Specific
protocols or ports can be blocked as well. And, of course,
specific domain names or destination addresses can be
blocked.
Firewalls can also filter based on content. The firewall can
intercept specific content in a packet leaving the network
before it reaches the outside. This could result in the packet
being discarded, an entire connection being dropped, or the
packet being edited to remove the blocked content and
replace it with something else. Content filtering can focus
on domain name, URL, filename, file extension, or keywords
in the content.
Another capability of firewalls is the ability to filter based
on encryption. A firewall can allow encryption without
restriction. Or, a firewall can be set to block encryption on
some ports and not others. Firewalls can also block
encryption from and to all internal IP addresses except for
servers, VPN devices, and RAS/NAS.
Firewalls can perform intermediary functions between
hosts where network administrators deem direct
communication too risky. This is the basic function of a
proxy. A proxy firewall positioned along a communication
path can hide the identity of one or both endpoints of a
communication from the participants. In most cases, proxy
services hide the identities of internal systems from external
entities.
Firewalls can perform address conservation through the
use of an address conversion or translation system. NAT is
the most common translation service supported by
networks. NAT translates between internal addresses and
public external addresses. NAT allows a private network to
use RFC 1918 private IP addresses. This, in turn, provides
additional security, since Internet hosts cannot address an
RFC 1918 system directly.
Through the combination of all their features, functions,
and capabilities, firewalls provide consistent, reliable
protection for an organization’s computer and electronic
resources. But firewalls are not perfect and should not be
the sole security component of a network infrastructure.
They are only one element—although an essential one—of a
network security strategy.
Firewalls can log events. Firewalls can be set to record
any action into a log file. In addition, they can record the
content of any malicious traffic into a log file. And they can
record any abnormal network activity, performance levels,
and traffic statistics into a log file. Logging events is an
invaluable feature of a firewall.
Since perfect security products don’t exist, you must rely
on monitoring to watch for attempts (and any successes) to
breach or violate security. Security is locking things down to
the best of your ability, and then watching for attempts to
breach your defenses. Lock, then watch. A successful
security strategy is not possible without both locking and
watching. Additionally, most security components should
include a locking and a watching aspect to them. Firewalls
are no exception. If a proposed firewall product is unable to
record a log of its actions and network activities, then you
need to seek out a different firewall product. Remember the
time-tested business adage: “You get what you inspect, not
what you expect.”
TCP/IP Basics
To fully understand the mechanisms of filtering employed by
firewalls, you need a solid understanding of the TCP/IP
protocol suite. Thorough knowledge of TCP/IP benefits a
security administrator not just in the area of firewall
management, but also in routing, switching, maintaining
availability, improving network performance, managing
network traffic, analyzing protocol, understanding
vulnerabilities and exploits, and even performing
penetration testing or ethical hacking.
Most networks, including the Internet, use the TCP/IP
protocol. The most prevalent version in use is IPv4.
However, IPv6 is gaining wider use across the globe. During
this transitional period, you should learn about both
versions of IP. If you need additional detailed information
regarding TCP/IP, please consult: Stevens, W. Richard, and
Gary R. Wright. TCP/IP Illustrated, Volumes 1–3. Addison-
Wesley Professional, 1994.
Kozierok, Charles. The TCP/IP Guide: A Comprehensive,
Illustrated Internet Protocols Reference. No Starch
Press, 2005.
Comer, Douglas E. Internetworking with TCP/IP, Vol 1
(5th Edition). Prentice Hall, 2005.
The ARIN IPv6 Wiki at http://www.getipv6.info.
OSI Reference Model
Most protocol discussions begin with the Open Systems
Interconnection (OSI) Reference Model. The OSI model is a
standard conceptual tool used to discuss protocols and their
functions. The OSI model has seven layers (Figure 2-7). Each
layer communicates with its peer layer on the other end of a
communication session. While the OSI model is helpful in
understanding protocols, most protocols are not in full
compliance with it.
Below is a brief description of the OSI model’s seven
layers. Each layer has unique responsibilities, functions, and
features. The OSI model defines what needs to take place at
each layer and leaves the actual process of accomplishing
those tasks to the protocols and, ultimately, to the protocol
programmers.
NOTE
The OSI model is the documented standard for
discussing and describing network protocols. However,
TCP/IP is the de facto or practical standard, as it was
actually in use before the OSI model was developed
into actual protocols. Few products can directly support
the OSI model or its derived protocols. Instead, most
products support TCP/IP, in spite of its not being the
official, documented standard from the International
Standards Organization.
Application Layer (Layer 7)—The Application
Layer (Layer 7) enables communications with the
host software, including the operating system. The
Application Layer is the interface between the host
software and the network protocol stack. The sub-
protocols of this layer support specific applications or
types of data.
Presentation Layer (Layer 6)—The Presentation
Layer (Layer 6) translates the data received from the
host software into a format acceptable to the network.
This layer also performs this task in reverse for data
going from the network to the host software.
Session Layer (Layer 5)—The Session Layer
(Layer 5) manages the communication channel,
known as a session, between the endpoints of the
network communication. A single Transport Layer
connection between two systems can support
multiple, simultaneous sessions.
Transport Layer (Layer 4)—The Transport Layer
(Layer 4) formats and handles data transportation.
This transportation is independent of and transparent
to the application.
Network Layer (Layer 3)—The Network layer
(Layer 3) handles logical addressing (IP addresses)
and routing traffic.
Data Link Layer (Layer 2)—The Data Link Layer
(Layer 2) manages physical addressing (MAC
addresses) and supports the network topology, such
as Ethernet.
Physical Layer (Layer 1)—The Physical Layer
(Layer 1) converts data into transmitted bits over the
physical network medium.
What You Should Know About Addresses
Logical addresses, such as IP addresses, create global
distinction. At least for public IP addresses, all
addresses used on the Internet are unique.
Assignment of a logical address is independent of
physical location. Logical addresses enable
communications between two hosts, regardless of
their physical proximity to each other.
Physical addresses, such as MAC addresses,
create local distinction. MAC addresses must be
unique only within the local subnet. This enables a
distinction between physically proximate systems that
are able to receive the same electronic signal. The
manufacturer usually performs physical address
assignment of the NIC and is thus dependent on the
physical hardware component itself.
MAC addresses are dependent on the physical NIC;
the manufacturer assigns these as a “permanent”
hardware address. However, modifying or spoofing
the effective MAC address is usually possible on most
systems. MAC changes are possible using native
commands, as with Linux, Unix, and Mac OS, or with
third-party utilities, such as required by Windows.
Tools for this include MAC Spoof, MAC Makup, and
MAC changer.
FIGURE 2-7
The process of encapsulation and the names of header and
payload sets at each OSI layer.
As data moves from a software application for transmission
over the network, it traverses the layers of the protocol
stack from top to bottom. As each layer receives data from
the layer above it, that data becomes the payload with a
layer-specific header (Figure 2-7). At the Data Link Layer
(Layer 2), where Ethernet resides, the data receives a
footer as well. This process is known as encapsulation. The
inverse, known as de-encapsulation, occurs when a
network communication is received. As this process takes
place, the data set being manipulated receives unique
names, depending on the layer it traverses. They are
Application Layer (Layer 7)—PDU (payload data unit)
(data obtained from the host software application)
Presentation Layer (Layer 6)—PDU
Session Layer (Layer 5)—PDU
Transport Layer (Layer 4)—Segment
Network Layer (Layer 3)—Packet
Data Link Layer (Layer 2)—Frame
Physical Layer (Layer 1)—Bits of data
The encapsulation process of adding headers (and a footer
at the Data Link Layer) enables data exchange between
layers on different systems. This is known as peer-to-peer
communications. The content of a header includes
information to be processed by the corresponding layer on
the receiving end of a network link.
The content of the headers, mainly from Layers 2–4, are
the greatest concern and focus of a firewall. Application
proxy firewalls and stateful inspection firewalls can also
examine the headers and the payload content of Layers 5–
7. You will learn more about the methods of filtering based
on this layer information later in this chapter.
Sub-Protocols
TCP/IP is not a single protocol, but a collection of protocols.
Often referred to as the TCP/IP suite, this collection includes
several core protocols, such as IP, Transmission Control
Protocol (TCP), and User Datagram Protocol (UDP), as
well as several commonly used protocols, such as ARP,
ICMP, HTTP, and TLS. In addition to these, tens of thousands
of other protocols can operate within the network
infrastructure created by TCP/IP.
A firm knowledge of the sub-protocols of TCP/IP is
assumed but not essential to grasping the scope of this text.
Headers and Payloads
Firewalls, specifically packet-filtering firewalls, inspect the
contents of headers to allow or deny frames, packets, or
segments. Depending on the type of filtering and the layer
or protocol focus of the filtering, the item examined and the
header it comes from can vary.
technical TIP
For a more complete list of the additional sub-
protocols, along with their port assignments, please
view the document hosted by Internet Assigned
Numbers Authority (IANA) at
http://www.iana.org/assignments/port-numbers. Nearly
every one of the 65,536 ports has one or more
protocols and applications associated with it.
For a list of ports used by malicious software, visit
http://www.glocksoft.com/trojan_port.htm or
http://www.neohapsis.com/neolabs/neo-ports/neo-
ports.html.
Packet filtering often focuses on four main headers:
The Ethernet header of the frame from the Data Link
Layer
The IP header of the packet from the Network Layer
The TCP header of the segment from the Transport
Layer
The UDP header of the segment from the Transport
Layer
Each of these four headers has numerous details that affect
a filtering action. These include MAC addresses, IP
addresses, TCP header flags, port numbers, and more.
Addressing
With regard to the basic differences in IPv4 and IPv6
addressing, the issues to focus on are not subnet masks or
the length of an address, both of which are important, but
rather the issues of source and destination, public and
private, known and unknown, and benign and malicious, as
well as real and spoofed addresses.
Many forms of filtering focus on the IP address and/or
port number to make an allow or deny decision. Such
decisions or rules can focus on either the source address or
the destination address found in the header of a segment,
packet, or frame. In other words, port number, IP address, or
MAC address can support filtering as a source and/or
destination concern.
Firewall filtering can focus on whether an address is
public or private in both the source or destination position in
the IP packet header. Generally, private addresses function
on the private network and do not reach the outside. NAT
will translate source-private addresses into a public address
if the packet is heading toward an external destination. On
the Internet, both routers and firewalls drop any IP packet
that has an RFC 1918 address in the header. Firewalls can
filter on whether an address is known or unknown. This
function filters against addresses used for the source and/or
the destination. Known addresses are usually trusted
addresses. Packets with only trusted and known addresses
are allowed to reach their destination. Unknown addresses
are potentially not trusted. Packets with unknown addresses
can be stopped in every case or further inspected before an
allow or deny decision is made.
Firewalls can filter on whether an address is known to be
benign or malicious, a variation of known and unknown
filtering. However, instead of known addresses being
trusted and unknowns not being trusted, this method twists
the idea. A benign address is a known, trusted address and
a malicious address is a known, not trusted address. But in
both cases here, the addresses are known. Any unknown
address encountered using this form of filtering will require
additional subsequent filtering that looks at other aspects of
the traffic.
Firewalls can also filter on whether an address is real or
spoofed. This form of filtering is not as clear and distinct as
the previous types. Whether a segment, packet, or frame’s
address is the real correct address or a spoofed falsified
address can be difficult to determine in every situation.
When an address is a real address, in the sense that it’s
within the subnet ranges of a network, the methods for
determining whether it’s a spoofed address are few.
One method is to compare against a use table, such as
that maintained by the DHCP, to see if the address is not
currently assigned to any authorized system. Another
method is to check the route, communication path, receipt
vector, or receiving interface of the source address against
what that aspect should be for a given address. For
example, if a source address typically arrives on port 4 but it
shows up on port 7, it’s likely a spoofed source address.
Spoofed addresses can also be detected at border sentry
points. When a source address comes from the opposite
side of the firewall, then it’s obviously a spoofed address.
One clear example is when an internal LAN address appears
as a source address in a packet on its way in to a network
from outside. This form of spoof filtering can be part of
ingress filtering.
Likewise, the same process can be used for packets
leaving a network. Any packet whose source address is from
the outside, such as an Internet address, but the packet is
received by a firewall from an interface in the private LAN,
must be from a spoofed address. This form of spoof filtering
can be part of egress filtering.
These are most of the mechanisms that a firewall can
use to filter or manage traffic based on addresses. The
following sections examine the various types of firewalls and
filtering methods.
Types of Firewalls
Listing the types of firewalls is almost like listing the
taxonomy of the animal kingdom in biology. The variations,
models, and versions are numerous. In addition, opinions
vary about what is and is not a firewall. Many experts begin
the discussion of firewall types by dividing the collective into
two simple, main groupings: personal and commercial.
A personal firewall is designed to provide protection to
a single system or a small network, such as a SOHO
network. To take full advantage of their features, most
personal firewalls do not require special training or
certification. Most personal firewalls offer user-friendly
interfaces that may be Web-based or graphical in nature
(that is, a graphical user interface, or GUI).
A commercial firewall is designed to provide protection
for a medium-to-large business network. Most commercial
firewalls are quite complex and often require special training
and certification to take full advantage of their features.
Most commercial firewalls use a Unix-like command line
interface (CLI) that, while powerful and efficient, is not
intuitive.
These two groupings do not, however, represent the
complete collective of firewalls, as several could easily fall
into either or both categories. Another common grouping
method, therefore, is to classify firewalls as either hardware
or software.
A hardware firewall is a dedicated hardware device
specifically built and hardened to support the functions of
the firewall software running on it. A hardware firewall is
also known as an appliance firewall. A hardware firewall
does not require any additional hardware or software for its
use. All it needs is one or more network connections and a
power source.
A software firewall is an application installed on a host.
A software firewall is also known as a host firewall. A
software firewall depends upon the host’s hardware and
operating system. If the host’s components are not properly
hardened, the software firewall will be less effective,
especially if there are other communication pathways or
attack points on the host. Software firewalls must compete
for resources among all other processes active on the host.
A software firewall is only able to protect a single host from
malicious network activity. A software firewall is only able to
filter traffic that reaches the network interface of its host.
With these two types of divisions, four potential
combinations exist:
Personal hardware firewall
Commercial hardware firewall
Personal software firewall
Commercial software firewall
A personal software firewall is a product used on individual
home systems, on SOHO systems, and even on client/server
network workstations and servers. Generally, a personal
software firewall is free or less expensive than commercial
software firewall products. A personal software firewall
operates on its own to protect a single host.
A commercial software firewall is a product used on
client/server network work--stations and servers. While they
can be installed on personal or SOHO systems, they are
usually expensive and are part of an overall security
management or NAC system. Most commercial software
firewalls can be used in an agent/console infrastructure
where each host’s firewall can be remotely administered
from a master management console.
A personal hardware firewall is part of an integrated
firewall product, such as a wireless access point or a
cable/DSL modem. Another variation of the personal
hardware firewall is the repurposing of a client or server
computer into a home-crafted open-source firewall. One
example of this is SmoothWall, a hardened bootable Linux-
based firewall.
A commercial hardware firewall is usually a device that
handles the complexity of larger organizational networks. A
commercial hardware firewall is often very expensive,
running in the range of $10,000 or more.
FYI
Two common but different dichotomies are free versus
paid and open source versus closed source. Free
means you do not need to pay for the firewall to use it.
Paid means you must pay a purchase price and/or a
licensing fee to use it. Many examples of both free and
paid firewall products are available. Open source
means the original source code is available for viewing
and modification. Closed source means the
distributed version is pre-compiled and the original
source code is undisclosed.
Firewall products, as well as any other form of IT
product, can be free and open sourced, free and closed
sourced, paid and open sourced, and paid and closed
sourced. You should not assume that, because
something is free, it is open sourced, or that because
something is commercial, it must be purchased.
The personal and commercial versions of software and
hardware firewalls might include different add-ons or
enhancements than their commercial equivalents. These
add-ons or enhancements include antivirus, password
management, registry protection, driver protection, VPN
gateways, remote access support, IDSs, IPSs, spam filtering,
and more. Usually these add-ons make the firewall products
more attractive to the potential buyer. However, most
commercial entities would generally avoid integrated
firewall solutions in favor of dedicated products to handle
their distinct security or management functions. An
integrated device might offer easier administration, but it
represents a single point of failure for multiple services.
Additionally, such bundled solutions are more difficult to
troubleshoot due to the complexity of the communications
they support.
Another variation of firewall, in fact the original variation,
is a screening router. Most appliance routers and many
software routers, such as the Routing and Remote Access
Service (RRAS) of Windows Server, are able to perform
firewall filtering services in addition to routing. Those
screening routers that perform firewall filtering might
provide enough sentry security for your needs. However, if
you want more advanced features, a screening router is
unlikely to be the best solution for your network.
Regardless of the type of firewall or implementation, it is
important to be certain that your firewall implements the
security and privacy policies that you want but, at the same
time, does not conflict with other security measures. If, for
instance, a remote system that you will access requires use
of a certain protocol or procedure that is blocked by your
local firewall, then you have a problem that must be solved
before you can access the remote system.
Ingress and Egress Filtering
Ingress and egress filtering is a common tool for spoof
filtering. A source address that comes from the opposite
side of the firewall than where it is assigned is obviously a
spoofed address. An example of this is when an internal LAN
address appears as a source address in a packet on its way
into a network from outside. This form of spoof filtering can
be part of ingress filtering.
Likewise, the same process can filter for packets leaving
a network. If a packet with a source address from the
outside such as an Internet address is received by a firewall
from an interface inside the private LAN, this is also a
spoofed address. This form of spoof filtering can be part of
egress filtering.
Ingress and egress filtering can expand beyond
protection against spoofing and include a variety of
investigations on inbound and outbound traffic. This can
include blacklist and whitelist filtering, protocol and port
blocking, and confirmation of authentication or authorization
before communications continue.
Unfortunately, if a packet’s spoofed addresses don’t
violate any of these concerns, the spoofed addresses might
not be as easy to detect. For example, if a client spoofs an
IP address to look like another client in the same subnet, the
rules just described to catch spoofing would fail to notice
this spoofed communication.
In addition to basic ingress and egress filtering, firewalls
can support additional forms of packet examination and
investigation.
Types of Filtering
Filtering is the primary function of a firewall. Through its
filtering services, most of the other benefits and capabilities
of firewalls apply. Firewalls can support many different forms
of filtering. Additionally, the terms for the type of filtering
and the type of firewall are often used interchangeably. For
example, a firewall that supports packet filtering is known
as a packet filtering firewall.
Static Packet Filtering
The most common form of filtering is static packet
filtering. Static packet filtering uses a static or fixed set of
rules to filter network traffic. The rules can focus on source
or destination IP address, source or destination port number,
IP header protocol field value, ICMP types, fragmentation
flags, and IP options. Static packet filtering is therefore
mainly focused on the Network Layer (Layer 3), but can also
include Transport Layer (Layer 4) elements. Static packet
filtering focuses on header contents and does not examine
the payload of packets or segments.
Static packet filtering is fast. Traffic matching a deny rule
gets dropped, while traffic matching an allow rule gets to
continue toward its destination. Static packet filters are
invisible or transparent to hosts and users unless their
traffic is blocked; then they will notice the actions of the
firewall on their communications. Static packet filtering
requires the firewall administrator to define and tune the
rule set. Most firewall rule sets, including static packet
filtering rule sets, are a first-match ordered system. Static
packet filtering can be problematic when the rule sets get
too large. If the rules are in the wrong order or in a chaotic
order, the rule set could create loopholes or unintentionally
discard authorized traffic.
The complexities of network communications, such as
accepting query responses and port shifts, can be difficult to
handle with static packet filtering. Static packet filtering
may allow the subsequent packets of a fragmented
message through, even though the lead packet was
dropped. This can result in a DoS on the destination system,
which would be waiting for the lead packet that never
arrives.
Additionally, static packet filters perform their analysis on
individual packets, regardless of the relationship or
correlation between previous or future packets in a
communication stream. This could allow complex
multipacket attacks to bypass the firewall if each individual
packet is not recognized as malicious on its own.
Static packet filtering should still be used as a first line of
defense in spite of its shortcomings. By using static packet
filtering as the first layer of defense, subsequent layers of
filtering will have less bulk to address and thus can operate
more efficiently.
Stateful Inspection and Dynamic Packet
Filtering
Stateful inspection addresses the issue of complex malicious
traffic. Stateful packet filtering determines whether or not a
current packet is part of an existing session, and allow/deny
decisions are made based on this determination. A state is a
session of communication. Often, state refers to the
Transport Layer (Layer 4) protocol TCP’s virtual circuits
established through the three-way handshake (using the
SYN, SYN/ACK, and ACK flagged segments). However,
stateful inspection systems can also track communications
in Layers 5–7. A stateful inspection firewall will keep track of
current sessions in a state table stored in memory.
As the firewall encounters each packet, it is analyzed to
determine whether the packet is part of an existing state or
not. If not, it’s likely to be dropped unless it’s a packet used
to help initiate a new authorized session. Such a stateful
investigation can be considered a dynamic packet filter as
well. With static packet filtering, rules had to be created to
allow the outbound requests and the inbound replies. With
dynamic packet filtering, once a session is established,
the filtering watches for packets that don’t belong to
authorized sessions. Using stateful inspection as dynamic
packet filtering allows for simpler rule sets. A rule allows an
outbound connection and the firewall’s state management
automatically allows the return traffic.
Unfortunately, stateful inspection can sometimes be
fooled through manipulation of header contents that makes
malicious traffic look like part of an existing valid session.
More advanced stateful inspection filters keep track of not
just the basic endpoints of a session, but also additional
details about the session, such as the sequencing and
acknowledgment numbers. This reduces the risk but does
not fully eliminate it, as a hacker can eavesdrop on a
session, learn the sequencing numbers, and predict future
valid sequences.
Another issue with stateful inspection is that not all
traffic uses states. Specifically, UDP and ICMP are
connectionless protocols. So, state management won’t
apply to them. For these protocols, the firewall acts as if a
state does exist and keeps track of the source and
destination from outbound packets. These are added to the
state table with a timeout value. If the timeout occurs
before a response is received, the state is removed from the
table. A hacker can fool this mechanism in the same way as
any stateful protocol like TCP.
NOTE
Stateful inspection is a form of dynamic packet
filtering. Dynamic packet filtering is the process of
automatically creating temporary filters. In most cases,
the filters allow inbound responses to previous
outbound requests, but on a limited timeout basis.
Both forms of state or session awareness, dynamic
packet filtering and stateful inspection are usually
interchangeable terms.
Network Address Translation (NAT)
Network address translation (NAT) is not exactly a form of
filtering, but is often included in lists of the filtering services
or options provided by firewalls. NAT translates internal
addresses into external addresses. NAT can perform this
service against IP addresses as well as port numbers. Any
firewall that supports NAT can be a NAT firewall. In most
cases, NAT is an additional translation service to the core
filtering functions of a firewall. NAT is a common, if not
standard, feature of modern firewalls.
Application Proxy
An application proxy, application firewall, or
application gateway is an application-specific version of a
packet filter. However, unlike a static packet filter that is
only able to inspect the header of a packet or segment, an
application proxy is able to inspect traffic fully at any layer,
including the application payload.
An application proxy, even if given the name firewall or
gateway, acts as the go-between or middleman between a
client and a server. All communications for the specific
application are proxied. This grants the application firewall
the ability to inspect application-specific elements of the
traffic. Application proxies are application-specific, so
specific products for e-mail, Web, file transfer, database
access, VoIP, and other TCP/IP sub-protocols are available.
When an application proxy is deployed, it usually requires
that all client software be reconfigured to point
communications to the proxy server rather than the actual
intended resource server. The application proxy will also
rebuild the request packet before sending it to the resource
server. This can include NAT services, but in most cases, it’s
just a process of proxying the communication. The
application proxy maintains two connections, one between
itself and the requesting client and a second between itself
and the resource server. Thus, application proxies are not
transparent filters because a client is aware the proxy is in
use. The client never establishes a direct connection
between itself and the resource server when a proxy is
involved.
Additionally, all other firewalls monitoring a network
border must deny access for the application protocols to be
managed by the application proxy. This prevents a user from
attempting to bypass the application proxy.
Application firewalls can filter on the content of the
application payload. This can include IP addresses, domain
names, URLs, sub-protocols, attachments, keywords, and
more. An application proxy can inspect every aspect of an
application’s communications. This is known as deep packet
inspection.
Application proxies can also perform caching services to
improve performance and reduce connection throughput
consumption.
The primary limitation of application proxy firewalls is
each unique application will need its own dedicated
application proxy. Generic proxy systems are usually
ineffective.
Circuit Proxy
A circuit proxy or circuit firewall focuses its filtering on
the initial setup process of a session, state, or circuit. This
form of filtering can focus on Layers 3–5. It functions
similarly to an application proxy, as it acts as a middleman
between a client and server. A circuit proxy prevents a
direct connection from existing between a client and server
to protect the network.
A circuit proxy makes an allow or deny decision on the
initiation of the session, state, or circuit. Once a circuit is
created, no further filtering takes place. If a client is allowed
to initiate communications with a resource server, then the
content of their communication is unfiltered and
unmonitored (at least by the circuit proxy).
The filtering rules of circuit proxies are similar to those of
static packet filtering in that a list of rules of IP addresses,
port numbers, domain names, networks, or even resource
providers determines what circuits or connections are
allowed and which are not. The filter set can be a deny all
but allow exceptions stance, or an allow all but deny
exceptions stance.
Content Filtering
Firewalls can also filter based on content. The firewall can
intercept specific content in a packet leaving the network
before it reaches the outside. This could result in the packet
being discarded, an entire connection being dropped, or the
packet being edited to remove the blocked content and
replace it with something else. Content filtering can focus
on domain name, URL, filename, file extension, or some
other form of keyword.
Content filtering is often a feature of application proxy
firewalls, stateful inspection firewalls, and dynamic packet
filtering firewalls.
Software Versus Hardware
Firewalls
A software firewall is an application installed on a host. A
hardware firewall is a dedicated hardware device specifically
built and hardened to support the functions of the firewall
software running on it.
A software firewall is also known as a host firewall. A
hardware firewall is also known as an appliance firewall.
A software firewall depends upon the host’s hardware
and operating system. If the host’s components are not
properly hardened, the software firewall will be less
effective if other communication pathways or attack points
on the host exist. A hardware firewall does not require any
additional hardware or software for its deployment. All it
needs is one or more network connections and a power
source.
Software firewalls must compete for resources among all
other processes active on the host. A hardware firewall has
dedicated hardware resources not shared with any other
service.
A software firewall is only able to protect a single host
from malicious network activity. A hardware firewall can
protect a single system or an entire network A software
firewall is only able to filter traffic that reaches the network
interface of its host. A hardware firewall can also only filter
traffic that reaches the network interfaces of its appliance.
However, a hardware firewall can be positioned on a
network at a choke-point or gateway to analyze and filter all
traffic.
A software firewall and a hardware firewall are both a
form of software, but the hardware firewall has a dedicated
appliance as its host, while the software firewall uses a
standard client or server as its host. In either case, software
flaws or bugs in programming can cause the firewall to fail.
A software firewall and a hardware firewall can both be
targets of attack. Exploits can compromise their software
component or physical attacks can harm their
host/appliance.
A software firewall is often less expensive than a
hardware firewall. A hardware firewall typically offers a
wider range of features and capabilities than a software
firewall.
Both software firewalls and hardware firewalls are options
you can use throughout a network infrastructure.
IPv4 Versus IPv6 Firewalls
No real distinction exists between a firewall designed for
IPv4 and one designed for IPv6. Many firewalls can already
support both versions of IP. If you are planning to migrate to
IPv6 or have already started the conversion process, be sure
your firewalls support IPv6.
A small issue affects filtering between IPv6 and IPv4
subnets. A protocol translation tool can support interaction
between networks using different versions of IP. This
translation tool is called Network Address Translation–
Protocol Translation (NAT-PT) and was defined in RFC 2766
by the IETF. Be sure your selected firewall supports NAT-PT if
you plan to communicate across an IP version barrier.
If you would like to read more on this translation issue or
gain further understanding about IPv6, please visit:
The ARIN IPv6 Wiki at http://www.getipv6.info
IPv6.com at http://www.ipv6.com
Dual-Homed and Triple-Homed
Firewalls
Firewalls, specifically hardware appliance firewalls, typically
have two or more network interfaces. A firewall with two
interfaces is known as a dual-homed firewall, while a
firewall with three interfaces is known as a triple-homed
firewall or a three-legged firewall.
The benefit of multiple interfaces is that the segments,
subnets, or networks connected to each firewall interface
are electronically isolated from each other. This prevents
unfiltered traffic from leaping from one segment to another
in an attempt to bypass firewall filtering.
However, for software firewalls using multiple interfaces,
you need to ensure that the TCP/IP protocol feature called IP
forwarding is disabled. IP forwarding is actually a router rule
that allows traffic from one interface to exit another
interface without needing to move any further up the
protocol static than where IP resides. In many cases, IP
forwarding allows packets to bypass filtering. If the system
is to be a firewall, you should disable this feature.
Software host firewalls are most often single-homed
firewalls since the host only has only a single NIC. This is
acceptable, since the software host firewall is not providing
sentry services between network segments, but between
the host and the network.
While firewalls with four or more interfaces are possible,
they are rarely deployed. Such a configuration requires
significantly more complex filtering and routing rules to
operate effectively. It’s also a significant single point of
failure and a bottleneck to traffic flow between multiple
network segments.
NOTE
If a system is to function as a router rather than a
firewall, IP forwarding might be a desirable function.
Placement of Firewalls
The placement of your network’s firewalls depends on
several key but subjective factors. No single correct answer
or deployment strategy is perfect for everyone. However,
several good general guidelines can be of help in planning
firewall placement.
First, understand the structure of your network. Where
are natural or organizational divisions on the network? Do
they correspond to distinct subnets or geographic/physical
locations? In many situations, placing a firewall between
each division or physical location (even different floors of a
building) can be beneficial. Do you have a DMZ or extranet?
You will need to isolate these from the private LAN and from
the Internet.
Second, know the traffic patterns of your network. What
are the common vectors and pathways of communication,
both between internal systems and between internal and
external systems? Consider positioning firewalls so that they
can filter all traffic. This may involve the creation of
chokepoints.
Third, is Internet connectivity essential to business tasks?
You should firewall-protect all Internet access points or
gateways. In fact, any external gateway or portal should
have a firewall.
Fourth, is any form of remote access in use, including
wireless? You should position a firewall between each RAS or
NAS and the private LAN. Assume all remote and wireless
connections are potentially malicious.
Fifth, based on previous compromises, what are the most
likely access pathways an internal or external hacker might
use to breach your network? Place firewalls along these
pathways.
Sixth, does any other unique aspect or feature of your IT
infrastructure warrant consideration for firewall protection?
Placing a firewall everywhere mentioned in these
guidelines may not be practical, cost effective, or secure. So
before any deployment, conduct a risk assessment to
determine whether a firewall is the best choice of
countermeasure. Review the section “Why Do You Need a
Firewall?” for more information on conducting risk
assessments.
CHAPTER SUMMARY
An essential element of network security, a firewall is
a filtering service used to protect your network and
hosts from a variety of threats, both internal and
external. Several types of firewalls are available,
including screening routers, hardware appliances, and
host software products. Each of these firewalls can
employ one or more features for ingress and egress
filtering. The common filtering features include static
packet filtering, stateful inspection or dynamic packet
filtering, NAT, application proxy, and circuit proxy.
KEY CONCEPTS AND TERMS
802.1x
Agent
Annualized loss expectancy (ALE)
Annualized rate of occurrence (ARO)
Appliance firewall
Application Layer (Layer 7)
Application firewall
Application gateway
Application proxy
Asset value (AV)
Bastion host
Border sentry
Botnet
Bots
Bump-in-the-stack
Bump-in-the-wire
Circuit
Circuit firewall
Circuit proxy
Closed source
Commercial firewall
Content filtering
Cost/benefit analysis
Data Link Layer (Layer 2)
Dead-man switch
De-encapsulation
Dual-homed firewall
Dynamic packet filtering
Exposure factor (EF)
Fail-safe/fail-secure
Frame
Gateway
Hardware address
Hardware firewall
Header
Host firewall
Intangible costs and value
Internet Control Message Protocol (ICMP)
IP address
Load balancer
Logical address
Network Layer (Layer 3)
Open source
Packet
Payload
Personal firewall
Physical address
Physical Layer (Layer 1)
Port forwarding
Port number
Presentation Layer (Layer 6)
Public key infrastructure (PKI)
Reverse proxy
Risk assessment
Risk management
Rule set
Rule
Sacrificial host
Screening router
Secure Sockets Layer (SSL)
Segment
Session
Session Layer (Layer 5)
Single loss expectancy (SLE)
Socket
Software firewall
Spoofing
State
Stateful inspection
Static NAT
Static packet filtering
Tangible costs and value
Transmission Control Protocol (TCP)
Transport Layer (Layer 4)
Transport Layer Security (TLS)
Transport mode encryption
Triple-homed firewall
Tunnel mode encryption
User Datagram Protocol (UDP)
Zombie
Zone of risk
Zone of trust
CHAPTER 2 ASSESSMENT
1. What is another term for the individual rules in a
firewall rule set?
A. States
B. Exceptions
C. Policies
D. Referrals
E. Sentries
2. Which of the following is not associated with a firewall?
A. Fail-secure
B. Sentry device
C. Fail-open
D. Chokepoint
E. Filtering service
3. A firewall is designed to allow what type of traffic to
traverse its interfaces?
A. Authorized
B. Non-benign
C. Unknown
D. Abnormal
E. Malicious
4. What is the first step in deploying a firewall?
A. Determining the filtering process
B. Defining rules
C. Selecting a security stance
D. Purchasing a license
E. Writing a security policy
5. Which of the following is the best description of a
firewall?
A. An authentication service
B. A remote access server
C. A resource host
D. A sentry device
E. A malicious code scanner
6. A border firewall cannot protect against which of the
following?
A. Flooding attacks
B. Insider attacking another internal target
C. Protocol abuses
D. Unauthorized inbound service requests
E. Port scans
7. All of the following are mistakes in firewall security
except:
A. Managing security poorly
B. Deploying too many firewalls
C. Using firewalls to provide filtering for networks and
hosts
D. Not writing a security policy
E. Failing to keep current with updates and patches
8. What is the primary reason a firewall is an essential
security product?
A. Low cost of deployment
B. Threats exist
C. High ROI
D. Native protocol encryption
E. Interoperability
9. What technique determines if a firewall is the best
countermeasure choice for a particular threat against a
specific asset?
A. Conducting a risk assessment
B. Reading blogs
C. Buying the least expensive option
D. Only using open-source products
E. Using products from a single vendor
10. Which of the following is not a common zone of risk?
A. An extranet
B. A DMZ
C. A private LAN
D. The Internet
E. Department subnets
11. Which of the following statements are true?
A. A firewall can be deployed as a bastion host.
B. Firewalls protect resources.
C. Firewalls are often the first line of defense for a
network.
D. Firewalls are part of an overall security strategy.
E. All of the above
12. When a one-way or sieve firewall protecting your
network allows external initiations of communications to
occur over a specific socket, this is known as: A. Static
NAT
B. Traffic forwarding
C. Port forwarding
D. Reverse proxy
E. All of the above
13. What is ingress filtering?
A. Restricting traffic to a specific subnet
B. Preventing traffic from leaving a network
C. Limiting host activities to that host
D. Monitoring traffic on its way inbound
E. Blocking access to external resource sockets
14. Content filtering can focus on the following aspects of
traffic except:
A. Source or destination IP address
B. Keywords in the payload
C. URLs
D. File extensions
E. Domain names
15. Which of the following will prevent firewall filtering from
blocking malicious content?
A. Speed of the network
B. User permissions
C. Not being positioned at a chokepoint
D. Encrypted traffic
E. Cable type
16. Which of the following is not a valid method for
determining whether a source address is spoofed?
A. Comparing against a use table
B. Verifying the route of reception
C. Checking the DHCP logs
D. Checking against RFC 1918
E. Performing ingress filtering
17. What form of filtering focuses on source or destination
IP address and requires separate rules for inbound and
outbound communications?
A. Stateful inspection
B. Static packet filtering
C. Application proxy
D. Circuit proxy
E. Dynamic packet filtering
18. Dynamic packet filtering is also known as:
A. Static packet filtering
B. Application proxy
C. Stateful inspection
D. Circuit proxy
E. Deep packet inspection
19. What method of filtering automatically keeps track of
sessions on a limited timeout basis to allow responses to
queries to reach internal clients?
A. Deep packet inspection
B. Static packet filtering
C. Application proxy
D. Dynamic packet filtering
E. Circuit proxy
20. What form of filtering allows communications
regardless of content once the session is established?
A. Dynamic packet filtering
B. Circuit proxy
C. Stateful inspection
D. Application proxy
E. Deep packet inspection
FIGURE 2-8
The seven domains of a typical IT infrastructure.
21. What type of firewall requires the presence of a host
operating system?
A. Appliance firewall
B. Personal firewall
C. Software firewall
D. Commercial firewall
E. Screening router
22. Based on the seven domains of a typical IT
infrastructure, all of the following locations (see Figure
2-8) are appropriate locations for firewall deployment
except: A. Between users and workstations
B. Between workstations and a LAN
C. Between a LAN and a WAN
D. Between remote access and a LAN
E. Between remote access and application servers
23. What activity performed by a triple-homed firewall
cannot be performed by a dual-homed firewall?
A. Filtering content
B. Physically isolating subnets
C. Supporting NAT proxy services
D. Deployment as an appliance
E. Deployment traffic from the Internet to either an
intranet or a DMZ
CHAPTER
3 VPN Fundamentals
VIRTUAL PRIVATE NETWORKS (VPNS) allow organizations to transmit private and sensitive data securely over public
intermediary networks. The Internet can serve as a cheap
long-distance carrier for WAN connections established using
VPNs. VPNs use native operating system features or third-
party software, as well as hardware devices, including edge
routers, firewalls, and VPN appliances. Remote access for
mobile users, linked multi-office intranets, and secured
access into an extranet are common VPN architecture
solutions.
The use of VPNs on networks ranging from small home
networks to corporate global networks has dramatically
expanded the ways people connect and do their work.
Through the use of VPNs, telecommuting employees,
business partners, traveling workers, suppliers, distributors,
and others can benefit from secured connectivity even while
geographically distant. With a basic understanding of VPNs,
you can begin designing and planning your own VPN
solution.
Chapter 3 Topics
This chapter covers the following topics and
concepts:
What a VPN is and what is it used for
What the benefits of a VPN are and why you
would deploy one What the limitations of a
VPN are
What the relationship between encryption
and VPNs is
What VPN authentication is and how is it
implemented
What VPN authorization is and why is it
necessary
Chapter 3 Goals
When you complete this chapter, you will be able
to:
Define VPNs
Explain the business and personal uses of
VPNs
Describe the pros and cons of VPNs
Illustrate deployment models or architectures
of VPNs, including an edge router, a
corporate firewall, a VPN appliance, a remote
access server, a site-to-site VPN and
supporting devices, and a host-to-host VPN
and supporting devices Differentiate
between a transport-mode VPN and a tunnel-
mode VPN
Describe the importance of encryption,
authentication, and authorization to VPNs
What Is a Virtual Private Network?
A short and direct definition is that a virtual private
network (VPN) is a mechanism to establish a secure
remote access connection across an intermediary
network, often the Internet. VPNs allow remote access,
remote control, and highly secured communications within a
private network. VPNs employ encryption and
authentication to provide confidentiality, integrity, and
privacy protection for network communications.
A more involved exploration of the phrase “virtual private
networks,” however, can reveal other import aspects that
such a succinct definition overlooks. The term VPN has its
origins in the telecommunications world. A telephone VPN
created a PBX-like system for businesses without the need
for deployment of true private branch exchange (PBX)
hardware. Instead, the system used a public telephone
service and the PBX services at the telco’s central offices.
This service/product sold under the name Centrex (a
combination of the terms central and exchange) in the
1960s through the 1980s.
After the proliferation of computer networks and Internet
connectivity, the term VPN evolved to refer to tunneling
connections across network links. Early computer VPNs
focused on the tunneling or encapsulation processes and
rarely included encryption services. Today, VPNs are almost
always secured using encryption. However, you should
never assume anything is totally secure, especially
connections over public networks. You should always
confirm that a product performs encryption properly before
depending on it for sensitive operations.
A VPN creates or simulates a network connection over an
intermediary network. But what makes a VPN private? At
least three possible mechanisms can work: When the
primary organization owns all of the network infrastructure
components, including switches, routers, and cables. A true
private VPN occurs when a single organization owns all of
the hardware supporting its VPN. However, few
organizations actually own all of the connections between
their locations, so this is usually impractical or prohibitively
expensive. This wholly owned and operated system
constitutes a trusted VPN.
When a dedicated set of channels is used across
leased telco connections. This method provides
physical isolation even on third-party equipment;
hence privacy is maintained. This type of system is
more practical, but is still expensive. This can also be
called a trusted VPN, since you must be able to trust
the owner of the hosting infrastructure to protect
network communications against eavesdropping.
When encryption ensures privacy even over public
networks, such as the Internet. This method is the
most reliable, as the other two options are still at risk
to eavesdropping. Additionally, encryption to provide
privacy is not only practical, it is the least expensive
option as well. This system can be called a secured
VPN.
A fourth type private VPN is possible, known as a hybrid
VPN. This form of VPN establishes a secure VPN over
trusted VPN connections. A trusted VPN allows an
organization to know and control the pathway of its
transmissions. However, a trusted VPN does not protect
against eavesdropping or alteration. A secure VPN protects
the confidentiality and integrity of data, but does not control
or ensure the transmission path. When you combine these
two VPN techniques, you create a potentially more secure
and practical solution. Two possible layouts of hybrid VPNs
are shown in Figures 3-1 and 3-2.
FIGURE 3-1
A hybrid VPN consisting of a secure VPN across an
intermediary trusted VPN.
FIGURE 3-2
A hybrid VPN consisting of a secure VPN segment within a
trusted VPN.
VPNs are often associated with remote access or remote
control. However, these associations need clarification to
have value. Remote control is the ability to use a local
computer system to remotely take over control of another
computer over a network connection. In a way, this process
is the application of the thin client concept on a fully
capable modern workstation to simulate working against a
mainframe or to virtualize your physical presence. This
application is generally the same as a VPN, which creates a
remote network connection rather than a remote control
session.
With a remote control connection in place, the local
monitor, keyboard, and mouse control a remote system.
This process looks and feels like you are physically present
at the keyboard of the remote system, which could be
located in another city or even on the other side of the
world. Every action you perform locally acts as if you were
physically present at that remote computer virtually via the
remote control connection. The only limitations are the
speed of the intermediary network link and the inability to
physically insert or remove media and peripherals.
You might think of remote control as a form of software-
based thin client or terminal client. In fact, many thin client
and terminal client products sell as remote control solutions.
Many modern operating systems include remote control
features, such as Remote Desktop found in most versions of
Windows. Once enabled, a Remote Desktop connection
remotely controls another Windows system from across the
network.
Remote access is different from remote control. A remote
access link enables access to network resources using a
WAN link to connect to the geographically distant network.
In effect, remote access creates a local network link for a
system not physically near the network. Over a remote
access connection, a client system can technically perform
all the same tasks as a locally connected client. Network
administrators can impose restrictions on what resources
and services a remote access VPN client can use.
Remote access and VPNs were originally supported over
dial-up telephone links using modems. Today, remote access
encompasses a variety of connection types including ISDN,
DSL, cable modem, satellite, mobile broadband, and more.
Due to the wide availability of high-speed Internet
connections, VPNs and other remote access solutions have
become very popular for both personal and business
purposes.
In many cases, a remote access connection is created
from a remote client back to a primary network. If the
remote client needs to connect directly to the LAN, such as
over a dial-up connection, a RAS server will host a modem
to accept the connection. If the remote client can use the
Internet to access the LAN, then a local Internet connection
is necessary. Once a normal LAN connection or Internet
connection runs from the client, the VPN link is possible.
Once the connection is established, the remote client can
interact with the network as if it were locally connected.
In Figure 3-3, a LAN and a remote client have a
connection to the Internet. These two connections are
independent of each other. The LAN’s connection is usually
a permanent or dedicated connection supporting both
inbound and outbound activities with the Internet. The
remote client can have a dedicated or non-dedicated
connection to the Internet. In the latter case, the
connection is established before a VPN can be created. Once
both endpoints have a connection to the intermediary
network, in this case the Internet, the VPN can be created.
In Figure 3-4, a new network connection is established from
the remote client to the LAN across the intermediary
network. This new network connection is the VPN.
VPNs can operate over standard Internet connections or
dedicated business communication circuits, such as ATM
and Frame Relay. However, the additional expense of a
dedicated, isolated, and even secured business circuit isn’t
necessary with a VPN. A VPN can operate securely over the
Internet and still provide high levels of security through solid
encryption. This allows inexpensive insecure links to replace
expensive business-leased lines without sacrificing security.
FIGURE 3-3
A corporate LAN and a remote client with Internet
connections.
FIGURE 3-4
A VPN established between a remote client and a LAN over
the Internet.
VPNs are one of the most efficient and cost-effective
means to provide secure remote connectivity. VPNs take
advantage of cheap long distance connections when
established over the Internet, since both endpoints need
only a local Internet link. The Internet itself serves as a
“free” long distance carrier. Because the speed of the VPN
depends on the speed of the local Internet link, you still
might want an optical carrier (OC) line (such as an OC-1
at 51.84 Mbps) for high-speed connectivity.
Connections from a LAN to an intermediary network can
support VPN traffic only or allow a combination of both VPN
and normal non-VPN traffic. The latter configuration is less
secure, but offers you flexibility as to whether all
communications must be VPN-secured or not. An Internet
connection reserved solely for VPN use, therefore, is not
necessary. An OC-1 line is more than capable of supporting
one or more VPN links in addition to numerous non-VPN
Internet sessions with no difficulty or latency.
Setting up VPNs can require extensive knowledge and
expertise on the part of the IT or security administrator. For
example, some important concerns of secure VPNs include:
All VPN traffic must be authenticated and encrypted. A VPN
without authentication is not private, and a VPN without
encryption is insecure.
All VPN endpoints must abide by the same security
parameters and algorithms. Each VPN tunnel must
have corresponding encryption key sets to securely
exchange encrypted content. Additionally, the same
security policy should govern all endpoints.
Proper encryption protocols must ensure that no
external third party can affect the security of the VPN.
Weak encryption makes a “secure” VPN worthless.
When you use a trusted VPN, you need to consider its own
unique concerns:
Only the trusted VPN provider should be able to modify
the channels or pathway of the VPN. A trusted VPN is
based on the provider’s ability to limit and control
access to the VPN’s content.
Only the trusted VPN provider can add, remove, or
change data in the trusted channel. Violating this
violates the trust the client places in the provider.
The addressing and routing performed within the
trusted VPN must be defined before the VPN goes
online. These services are usually pre-defined in the
SLA (service level agreement), but may be
dynamically modified for each VPN connection.
Even hybrid VPNs have an important focus for concern,
namely that the segments of the VPN that are trusted
versus secured need clear definition. Mistaking security for
trust—or vice versa—can have devastating results.
VPNs use tunneling or encapsulation protocols. Tunneling
protocols encase the original network protocol so that it can
traverse the intermediary network. In many cases, the
tunneling protocol employs encryption so that the original
data traverses the intermediary network securely. The
protocols that create VPNs include IPSec, PPTP, L2TP, SSL,
and TLS. The dominant forms of secure VPNs use IPSec or
SSL/TLS as the tunneling/encapsulation protocol.
Most VPNs use software that operates on top of the
operating system of a host. However, some VPN appliances
can support VPN connectivity without adding any software
to the host. In much the same way that a host firewall works
only on the host where it is installed, an appliance firewall
provides security services for the entire network. A host
VPN software product allows a single host access to VPN
services, while a VPN appliance allows an entire network
to access VPN services.
VPNs simplify many business networking problems by
providing an easy and efficient means to securely connect
headquarters, remote offices, traveling workers, and
telecommuters.
What Are the Benefits of Deploying a
VPN?
The reasons to deploy and use VPNs vary greatly among
organizations. Many of the obvious reasons are based on the
benefits of a VPN. Nevertheless, other reasons are based on
business or personal factors needing the solutions VPNs
readily provide.
Cost is always a significant factor in any business
decision. Budgets are never unlimited, so organizations
must shepherd their limited funds to accomplish their
missions and goals. One common goal is high productivity.
Granting workers the ability to access and use resources in
a timely and efficient manner assists in the completion of
work. When those resources are computer files or network
services, employees no longer need to be in the same
building as those resources. Remote access to resources,
therefore, is becoming more common than ever.
Secure remote access is essential. As the proliferation of
access and connectivity spreads from work to home to
portable/mobile devices, access to the Internet and private
LANs is becoming ubiquitous. Companies must use security
controls on resource access or suffer the consequences of
insecure access methods. With the removal of physical
limitations for access comes the loss of control over where
and how workers connect back into the private LAN.
Workers connect into the company LAN from mobile
phones, through Internet cafés, over hotel networks, and at
random Wi-Fi hotspots. Many use personally owned laptop
computers and hand-held mobile devices rather than
officially issued company systems. All of these are outside
the control of the company’s IT and security department.
The only option is to limit LAN connections to those that can
be secured. Thus, VPNs have become a necessity in the
brave new mobile and interconnected world.
VPNs support remote access from a wide variety of
complex devices, reduce risk caused by insecure access
locations, and enable interaction with all LAN resources.
Furthermore, flexibility, scalability, ease of administration,
reliability, and more make VPNs an obvious choice in the
face of modern connectivity risks and challenges.
FIGURE 3-5
A corporate network using dedicated leased lines versus
using VPNs over the Internet.
Does every worker and every organization need VPNs
and remote access? No. For many work situations, VPNs are
not the correct solution. These include any form of work that
requires special tools, physical access to equipment, or
close supervision by managers.
Remote access, mobile connectivity, and secured
communications are solid reasons to deploy and use a VPN.
But are these the only positive aspects of a VPN?
The most often touted benefit of VPNs is cost savings.
They are a great way to save on long distance charges for
telecommuters and traveling workers. They also create
huge savings for businesses that would need only local
Internet links for a VPN rather than a dedicated leased line
between each location (Figure 3-5). The farther away each
business location is and the more locations a company has,
the more of a cost savings a VPN can generate.
Additionally, to truly compare the connectivity that a VPN
offers to dedicated leased lines, you need a full mesh of
leased lines. A full mesh requires a line between each
business location. This allows for direct communication
between one site and another. Since a VPN across the
Internet would provide the equivalent site-to-site
communication capabilities, only a mesh network of
dedicated leased lines can truly compare. This solution is
obviously very expensive compared to a VPN’s significant
cost savings.
As corporations seek to reduce IT infrastructure costs, a
common technique is to allow employees to telecommute.
Telecommuting allows workers to access corporate
resources whether the employee works from home, while
traveling, or while on site with a customer. In the past,
telecommuting clearly implied the use of dial-up
connections to connect with the company LAN.
With the proliferation of high-speed broadband
connections and Wi-Fi, telecommuting has become more
plausible and realistic. Through the use of VPNs,
telecommuting enables a true remote office rather than just
a file exchange and communication system. VPNs make
telecommuting not only possible, but also practical and
secure. VPNs make expanding the workforce no longer a
geographically limited proposition.
Extranets are often deployed as businesses establish new
partnerships or seek more interaction with suppliers,
distributors, and other external entities. Extranets are
border networks, similar to a DMZ, where resources are
hosted for access by external entities. However, unlike a
DMZ, an extranet is not open for public use. Only a limited
and specific set of users is allowed to connect into an
extranet. Often, this limitation means that a specific VPN
configuration is necessary to access the extranet’s
resources. With VPNs, extranets are both possible and
practical.
VPNs allow system administrators to remotely manage
and control a network. VPNs allow employees to work from
anywhere. VPNs allow friends to create WAN links to support
multiplayer games. VPNs allow technical support to
remotely repair client systems. A VPN is the solution
anytime a network connection is needed between two
systems or two networks, but installing a direct cable
connection is unfeasible.
Often, the real benefits of a VPN are not from the VPN
itself, but from all the new possibilities for work, research,
learning, and play feasible because of a VPN. These benefits
include: Reduced equipment costs
Unlimited geographic connectivity
Increased flexibility and versatility of worker location
Improved privacy and confidentiality due to strong
encryption Verified transmission integrity
Fully scalable global infrastructure and architecture
Rapid deployment options
Flexible integration with existing networks and
technologies Faster return on investment (ROI) than
traditional WAN infrastructures Reduced dependence
on long-distance carrier solutions
Reduced support burden as ISP
Individuals and organizations that use VPNs and integrate
them in new and unique ways are sure to reap additional
benefits. History shows us that as new means of
communication are created, they often change and are used
in ways that were unpredictable at the beginning of their
adoption. However, VPNs are not perfect, and some very
real and challenging issues limit the use of VPNs.
What Are the Limitations of a VPN?
While the use of VPNs has many benefits, you need to
evaluate the very real and distinct limitations before you put
a VPN in place.
Although a VPN connection offers flexible secure
communication options, it does not ensure quality of
service. A VPN link is dependent upon the stability,
throughput, and availability of the ISP connection as well as
the intervening network connections between endpoints.
VPNs over the Internet can easily suffer from latency,
fragmentation, traffic congestion, and dropped packets.
This also results in a lack of dedicated bandwidth between
business sites because of the volatility of the Internet.
technical TIP
Encrypted traffic does not compress. Compression
reduces the size of a data set, removing redundancies
or repeated sections within the data set. Properly
encrypted data produces ciphertext that does not
contain redundancies or recognizable patterns. If
ciphertext did have these characteristics, it would not
be as secure. Thus, without these redundancies, it’s
not possible to compress encrypted data.
While VPNs are excellent solutions over nearly every
broadband connection option, a VPN can be difficult to
maintain over dial-up. VPN traffic is encrypted, and
encrypted traffic does not compress. Most dial-up modem
connections rely on compression—mainly hardware
compression—to improve connection speed. When
compression is not possible, a significant and noticeable
speed reduction occurs. Additionally, VPN tunnel
management can impose a significant increase in
management overhead because of changes in protocol
headers, potential authentication latency, and a prolonged
connection establishment negotiation.
Another area of concern is the minor risk or potential of
data exposure while in transit over the Internet. This is only
a real concern if the VPN does not use encryption, uses poor
encryption, or configures the encryption improperly. Proper
security management will eliminate this as a serious
concern.
Vulnerabilities exist at VPN endpoints. With a VPN, side
attacks against the encrypted link are nearly eliminated.
However, data entering or leaving the VPN is at risk. An end-
user computer could be infected by malicious code that can
traverse the VPN link into the company LAN. Also, private
and confidential data from the company LAN can be copied
across the VPN link to the end-user computer. On this
computer, that data is less secure and subject to a wider
range of threats.
You should also consider the increased difficulty in
providing technical support remotely. This is especially true
when the remote connection itself is not functioning. In
addition, it’s more difficult to keep remote systems in
compliance with security settings, conduct training, allow
supervisory oversight, enable HR management, and monitor
user activities.
Not every person is a good candidate for a remote user.
Those who are easily distracted, who are not motivated, or
whose home environment is not conducive to work are
prime examples of those who should stay in the office rather
than work from home.
technical TIP
The latest generation of traditional telephone modems
is often rated with a speed of 56 Kbps. Most of that
speed is the result of hardware compression. Without
compression, most modem speeds are significantly
slower—24 Kbps or less.
An even larger concern is granting open or blanket
unrestricted network-resource access to those connecting
via VPN. You must enforce stronger authentication and
authorization limitations on VPN users, especially on VPN
telecommuters. Remote users should have access only to
those resources necessary for their current tasks. Unlimited
access to network resources can quickly result in
exploitation and confidential data leakage if the remote user
or the remote computer is compromised.
If you understand these limitations and address them
properly, you can help to avoid catastrophic mistakes when
correctly installing and productively using VPNs. One of the
primary tools to accomplish this is the VPN policy.
What Are Effective VPN Policies?
Effective VPN policies are those that clearly define security
restrictions imposed on VPNs that align with the overall IT
mission and goals of your organization. VPNs can offer
numerous exciting possibilities of mobility and
interconnection. However, VPNs can also be a risk to the
confidentiality and stability of your organization’s
infrastructure.
Like all security policies, your VPN policy should derive
from a thorough risk assessment and analysis. Without fully
understanding the assets, processes, threats, and risks of
VPNs, you can’t effectively use or manage them.
Developing your VPN security policy is not a simple or
straightforward task. You need to plan for time and effort to
address a wide variety of issues and concerns. Some of the
aspects of design and planning of a VPN policy include (but
are not limited to): Considering the benefits and drawbacks
of software and hardware VPN solutions Imposing
stringent multifactor authentication on all VPN
connections Implementing strong access control
(authorization) restrictions on all VPN connections Defining
how the VPN will be managed, through what interfaces, and
by whom Exploring the complexities of patch management
over VPN
Defining the mechanisms of providing remote
technical support for VPN telecommuters Enabling
detailed auditing on all activities occurring across or
through a VPN
Defining distinct qualifications on granting user access
to telecommuting VPNs Prescribing the user training
requirements for all VPN activities VPN Deployment
Models and Architecture
One of the first decisions you face when deploying a VPN is,
which device will serve as the termination point of the
secured tunnel? You have several options, but often the
decision rests on where in the network infrastructure you
want to position the tunnel endpoint. Additionally, the
features the VPN device provides may be a factor in the
decision.
Such factors include deciding which devices have
sufficient processing power to maintain wirespeed even with
heavy traffic and complex encryption. Another concern is
whether NAT is present, as this can impose problems for
tunnel mode encryption.
The three primary VPN device models are edge router,
corporate firewall, and VPN appliance. In addition to the
selection of the VPN device, you have several architectural
decisions to make. These focus on the intended purpose,
function, or use of the VPN, such as remote access, host-to-
host, site-to-site, and extranet access.
Edge Router
With edge routers as the VPN termination point, the VPN link
exists only over the public intermediary networks, not within
the private LAN(s). This does require that the edge router
support VPN connectivity.
Edge router VPN termination ensures that a firewall can
filter the traffic exiting the VPN on its way into the LAN. This
method ensures that all traffic, regardless of transportation
means, complies with the firewall’s filtering rules. If the VPN
terminates inside the firewall, then traffic from the VPN
could potentially violate security because it was not firewall-
inspected.
VPN termination on edge routers is best suited for
controlled access into the DMZ. Such a configuration grants
business partners easy access to the DMZ without exposing
their traffic to the Internet or granting them unnecessary
access to the private LAN.
Corporate Firewall
Terminating the VPN at the corporate firewall is possible if
the firewall supports VPN services. Not all firewalls provide
this service, so this depends on your choice of make and
model of the firewall product. With a firewall-to-firewall VPN
across the public network, users from one network LAN can
access resources in another network LAN without additional
complexities. Primarily, this configuration treats the VPN link
between the firewall endpoints as just another route in the
LAN (actually WAN). The benefit here is that users don’t
need to re-authenticate or abide by additional firewall
restrictions when the VPN terminates at the corporate
firewall.
Corporate firewall termination of the VPN means that the
traffic entering or leaving the VPN does not pass through
the filtering restrictions of the firewall. Instead, the firewall
simply serves as a tethering point for the VPN tunnel
endpoint. Any traffic not associated with the VPN, however,
is subject to firewall investigation.
This configuration has a potential limitation. As the
number of VPN links or the traffic load of the VPNs
increases, the resulting increase in cryptographic
computations could interfere with the firewall’s wirespeed
filtering performance. In this case, perform a trend analysis
to monitor for this condition and improve firewall
performance before a bottleneck occurs.
VPN Appliance
A third device option is a dedicated VPN appliance. Unlike
an edge router or firewall termination point, a dedicated
VPN appliance specifically handles the load of a VPN instead
of VPN support being an add-on service.
You can position a VPN appliance outside the corporate
firewall, in a similar location to an edge router, so that all
VPN traffic passes through firewall filters. A VPN appliance
can also reside inside the corporate firewalls to prevent
firewall filtration. This deployment is similar to the corporate
firewall concept, at least in terms of not filtering VPN traffic.
This second deployment method also ensures that no
external entity can interfere with the endpoints of the VPN
tunnel.
FIGURE 3-6
A VPN used to connect a single LAN with remote mobile
users.
These techniques are useful when corporate firewalls
already exist that do not support the VPN technology or
architecture you want. So rather than replacing the firewalls,
you install an additional dedicated VPN appliance.
Remote Access
The first VPN architecture is basic remote access (Figure 3-
6). Remote access VPN is also known as host-to-site
VPN since it supports single-host VPN connections into a
LAN site. This design grants individual telecommuters or
traveling workers easy access into the private LAN. A single
LAN can support several remote users with any of the VPN
endpoint concepts: edge router, corporate firewall, or VPN
appliance.
Site-to-Site
A second VPN architecture is site-to-site (Figure 3-7). Site-
to-site VPNs are also known as LAN-to-LAN VPNs or
WAN VPN connections between LANs. Regardless of the
name, a site-to-site VPN supports secure connections
between LANs over intermediary public networks. When you
install it properly, a site-to-site VPN can be an inexpensive
mechanism to create a single distributed LAN (also known
as a WAN) for a multi-location organization. A site-to-site
VPN uses any of the VPN endpoint concepts: edge router,
corporate firewall, or VPN appliance.
FIGURE 3-7
A VPN used to connect multiple LANs.
A slight variation on the site-to-site VPN is the site-to-site
VPN with remote mobile users. This is a combination of the
site-to-site VPN concept with remote access VPNs (Figure 3-
8). The benefit of this architecture is the ability to add new
employees with secure connections to the LAN without
needing additional corporate facilities to provide on-site
workspaces.
FIGURE 3-8
A VPN used to connect a multiple LANs with remote mobile
users.
Host-to-Host
A third VPN architecture is host-to-host. Host-to-host VPNs
are also known as client-to-server, remote-to-office, or
remote-to-home VPNs. A host-to-host VPN is a direct VPN
connection between one host and another. This mechanism
operates over a public network or within a private network.
Over a public network, a host-to-host VPN provides a
connection that is secure from the public. Over a private
network, it provides an additional level of security for
mission-critical or highly sensitive transactions.
Host-to-host VPNs labeled as client-to-server VPNs
create secure client interaction with the services of a
resource host. This is similar to, but not exactly the same
as, a secure Web link between a Web browser and a Web
server. SSL can be used for application protocol security, as
it is with secure Web sessions, or as a VPN protocol. As a
VPN protocol, SSL operates at the Network Layer; as a Web
session security tool, it operates at the top of the Transport
Layer.
A remote-to-office VPN is a direct link between a
portable or home system and an office workstation. This
VPN link allows a user to work from home or while traveling
without sacrificing access to resources, services, or
applications that might only be installed (or licensed) for use
on the office workstation computer. This VPN can establish a
remote control session as commonly as a remote access
session.
A remote-to-home VPN connects a work computer or a
portable computer back to a home system, effectively the
opposite configuration of the remote-to-office. The remote-
to-home VPN grants you access to a home computer while
you are away from the house.
The host-to-host VPN variations usually depend on
software VPN solutions native to the operating system or
third-party applications installed on the host. However,
some VPN appliances are adaptable to these simpler host-
to-host connectivity architectures.
Extranet Access
A fourth VPN architecture is extranet access. With a VPN
tunnel endpoint positioned at or inside the perimeter of an
extranet, this option serves as a pathway for business
partners, distributors, suppliers, and so forth to gain access
to corporate resources without exposing their traffic to the
Internet or granting them unnecessary access to the private
LAN.
Additionally, a VPN linked into the extranet, as opposed
to the DMZ, provides greater security to the remote entities.
A VPN link to the DMZ exposes the remote entities to any
threats found in the DMZ. Since the DMZ is publicly
accessible, it’s risky. An extranet VPN grants the remote
entity secure communications without significant risks at
the VPN termination point.
VPNs commonly serve as a choke point to control which
external entities have access to the extranet. Only those
granted specific access, assigned user accounts, and
provided configuration details are able to configure and
establish a VPN link with an extranet.
Tunnel Versus Transport Mode
VPNs can use two main types of encapsulation encryption.
These are known as tunnel mode and transport mode
encryption.
Tunnel mode encryption protects the entire original IP
packet’s header and payload. This encrypted packet
becomes the payload of a new IP packet with a new IP
header. This form of encryption ensures that the identities of
the original endpoints of the communication are kept
confidential while the traffic traverses the secured link.
Tunnel mode encryption is commonly used by VPNs linking
network sites together or providing secure remote access.
Transport mode encryption protects only the original IP
packet’s payload. The encrypted payload retains its original
IP header. This form of encryption protects only the payload,
not the identities of the endpoints. Transport mode
encryption helps VPNs link individual computers together.
The Relationship Between Encryption
and VPNs
Encryption and a secure VPN are virtually inseparable. A
secure VPN exists only because its traffic is encrypted. But
some trusted VPNs may or may not use encryption. To fully
understand and appreciate the operations of VPNs, you
need a reasonable understanding of encryption.
Encryption is just one aspect of the larger topic of
cryptography. Cryptography is the art and science of
hiding information from unauthorized third parties.
Cryptography occurs through a complementary and
reversible process: encryption and decryption. Encryption is
the process of converting original usable form data, called
plaintext, into an unusable chaotic form, called ciphertext.
Decryption is the process of converting ciphertext back
into plaintext. A real-world communication product must
provide both encryption and decryption.
Modern cryptography is based on algorithms. An
algorithm is a set of rules and procedures, usually
mathematical in nature, that define how the encryption and
decryption processes operate. Algorithms are often very
complex. Many algorithms are publicly known and anyone
can investigate and analyze the strengths and weaknesses
of an algorithm.
technical TIP
Less than 10 years ago, 64 bits was considered strong
encryption. Today, 128 bits is the smallest symmetric
key length that can be considered strong. Is a key of
twice the size of the previous key length stronger?
Actually, while a 128-bit key is twice as long as a 64-bit
key in that it has twice as many digits, the former
creates a keyspace much more than twice the size of
the latter. Every time an additional bit is added to a key
length binary number, it doubles the size of the
possible keyspace. A 128-bit key creates a keyspace
that is doubled 64 times that of a 64-bit key. That is
2^64 or 1.8 × 10^19 times as large as that of a 64-bit
keyspace.
Encryption algorithms use a key. The key is a unique and
secret number that controls the encryption and decryption
processes performed by the algorithm. A key is a very large
binary number measured or defined in terms of its bit
length. The bit length of the key is the number of binary
digits that compose the key. For example, a key of 128 bits
is 128 binary digits long.
The bit length of an algorithm’s key defines that
algorithm’s keyspace. The keyspace is the range of keys
that are valid for use for that specific algorithm. Any key
created using the specific number of binary digits of the key
length is part of that algorithm’s keyspace. This keyspace
includes every number between a key of all zeros to a key of
all ones (remember this is binary code with only ones and
zeros as digits). This means that 2^128 number of keys are
available to an algorithm with a key length of 128 bits.
2^128 in decimal is over 3.4 × 10^38.
Three main types of algorithms operate within the realm
of cryptography: symmetric, asymmetric, and hashing.
Symmetric Cryptography
Symmetric cryptography is based on algorithms that use
a single, shared secret key. A common way to remember the
type of key used by symmetric is to remember a synonym
for symmetric: same. The same key must encrypt and
decrypt data and the same key must be shared with all
communication partners of the same session.
Symmetric cryptography is very fast in comparison to
asymmetric cryptography, typically 10,000 times as fast
with similar key length and message size. Generally, the
longer the length of a symmetric key, the stronger the
encryption produced. Most algorithms have one or only a
few key length options, so picking an algorithm with a
longer key often ensures stronger encryption. Keys shorter
than 128 bits are considered weak, keys of 128 to 256 bits
are considered strong, and keys longer than 256 bits are
considered very strong. That’s why when you select a
symmetric cryptography product, you should only use
solutions employing 128-bit or longer keys.
Selecting a strong algorithm is more involved than just
key length; you also need to consider other issues, such as
use of random numbers, use of the avalanche effect, and
resistance to reverse engineering attacks. Most weak
algorithms do not survive long once released to the public,
so most consumers do not need to focus as much on the
details of the algorithm as to look for algorithms that
support longer keys. The general rule (which does gloss
over some of the details) is that longer keys are better. For
more information on cryptography, selection of algorithms,
and the internal workings of algorithms, please consult
Schneier’s Cryptography Classics Library or Introduction to
Modern Cryptography.
NOTE
Hypothetical communication partners Bob and Alice
are commonly used to describe and discuss the
functions of cryptography.
FIGURE 3-9
The symmetric cryptography process.
Symmetric cryptography works as follows (Figure 3-9):
1. Bob and Alice exchange a symmetric key (K1).
(This process is normally performed by an
asymmetric process or out of band
communication.) 2. Bob encrypts a message with
the shared symmetric key.
3. Bob transmits the message to Alice.
4. Alice decrypts the message using the shared
symmetric key.
The security service provided by symmetric cryptography is
confidentiality. Symmetric encryption, with a reasonably
long key, prevents unauthorized third parties from accessing
or viewing the contents of communications or stored data
files. Symmetric cryptography protects files on storage
devices, as well as data in transit. In fact, due to its strength
and efficiency, symmetric cryptography is the preferred
method to secure data in storage or in transit of any size.
Some examples of symmetric cryptography algorithms or
systems include DES, 3DES, AES, CAST, RC4, RC5, RC6, RC7,
IDEA, Twofish, and Blowfish.
VPN solutions employ symmetric cryptography to protect
communications in transit. This protection prevents
unauthorized eavesdropping or midstream modifications.
Asymmetric Cryptography
Asymmetric cryptography is based on algorithms that
use either key pairs or some other special mathematical
mechanism. Asymmetric cryptography that uses key pairs is
commonly known as public key cryptography. All public
key cryptography is asymmetric, but some asymmetric
algorithms are not public key algorithms. A common way to
remember the types of keys or non-keys that are used by
asymmetric cryptography is to remember a synonym for
asymmetric: different. Different keys are used for different
purposes, different keys are used by different members of
the communication session, and some systems use
something different from keys altogether.
technical TIP
Keep in mind that an average 2,048-bit asymmetric
key is not just 8 times as long as a very strong 256
symmetric key; in fact, it has a keyspace that is
doubled 1,792 times that of the keyspace of a 256-bit
key, an astronomically large number: 2^1,792 or 2.79
× 10^539 times that of a 256-bit keyspace. Numbers
of this size are very hard to manage, much less run
through complex mathematical computations.
Asymmetric cryptography is very slow in comparison to
symmetric cryptography. This is due to the complexity of the
math used by these algorithms, as well as the length of
asymmetric keys (when there are keys). Public key
cryptography uses keys that are 1,024 to 8,192 bits long
(and sometimes longer).
Asymmetric cryptography also uses math based on a
concept known as one-way functions. A one-way function
is a mathematical operation performed in one direction
relatively easily, but impossible or nearly so to reverse. This
type of math was formalized into cryptographic algorithms
only in the late 1970s.
Asymmetric cryptography, therefore, is slow in
comparison to symmetric due to its extremely long keys and
its extraordinarily complex mathematical functions. Thus,
asymmetric is generally not suitable for encrypting bulk
data for storage or transmission; instead, this type of
encrypting is best suited for identity proofing and key
exchange.
The protections provided by asymmetric cryptography
are authenticity and nonrepudiation. Authenticity is a
term used to convey the combination of authentication and
access control. Based on usage, especially with public key
cryptography, asymmetric solutions can prove the identity
of the source of a message (authentication) or control the
destination or receiver of a message (access control).
Additionally, when used properly, asymmetric cryptography
may provide proof that a sender sent a message and
prevent that sender from being able to credibly deny
sending it. This is known as nonrepudiation.
Public key cryptography, a subset of asymmetric
cryptography, is based on key pairs. Each participant in a
communication or community has a discrete key pair set.
The key pair set consists of a private key and a public
key. The private key is kept secure and private at all times.
The public key is put out for open public access and use.
The key pairs work together as opposites. The encryption or
encoding that one of the keys performs can only be undone
by the opposite key of the pair.
One mechanism afforded by asymmetric cryptography is
a digital envelope. It works as follows (Figure 3-10):
FIGURE 3-10
The asymmetric cryptography process of digital envelope.
1. Bob obtains Alice’s public key.
2. Bob encodes a message with Alice’s public key.
3. Bob sends the message to Alice.
4. Alice decodes the message using her private
key.
The encoded message is readable only by Alice, who has
the corresponding private key. A digital envelope ensures
that the message is accessible only by the intended
recipient, namely the owner of the corresponding private
key. The mechanism of digital envelope exchanges
symmetric keys between communication partners. In this
mechanism, one side of the conversation performs key
generation, and then exchanges that key securely. This is
the mechanism VPNs use to exchange keys securely.
Another mechanism afforded by asymmetric
cryptography is a digital signature. A digital signature
proves the identity of the sender. It works as follows (Figure
3-11): 1. Alice uses her private key to encode a message.
2. Alice sends the encoded message to Bob.
3. Bob accesses Alice’s public key.
4. Bob uses Alice’s public key to unlock the
encoding.
This process proves to Bob that the message came from
Alice. This is authenticity. A digital signature does not
prevent others from viewing the message or confirming the
source of the message. A digital signature is not encryption;
it does not provide confidentiality protection. VPNs use
digital signatures, but they usually employ the version that
uses hashing as part of the process (see the next example).
FIGURE 3-11
The asymmetric cryptography process of digital signature.
This mechanism of digital signatures improves through
the addition of hashing. (Hashing is described in more detail
in the next section.) A digital signature using hashing is a bit
more complex, and uses the following procedure (Figure 3-
12): 1. Alice computes the hash value of a message.
2. Alice encodes the hash value with her private
key. This encoded hash is the digital signature.
3. Alice adds the encoded hash to the message.
4. Alice transmits the message.
5. Bob strips off Alice’s digital signature.
6. Bob hashes the original message to compute its
hash.
7. Bob obtains Alice’s public key.
8. Bob decodes Alice’s digital signature to reveal
Alice’s original hash.
9. Bob compares Alice’s original hash to the hash
Bob calculated.
If the hashes are the same, Bob accepts the message as
retaining its integrity. This has also proved that the message
was from Alice (authenticity). Furthermore, this process
ensures that Alice cannot deny having sent it
(nonrepudiation). VPNs commonly employ this form of
digital signature to prove the identity of the endpoints and
confirm the integrity of transmissions.
FIGURE 3-12
The asymmetric encryption process of digital signature with
hashing.
Some examples of asymmetric cryptography algorithms
or systems that are not public key cryptography are Diffie-
Hellmann, El Gamal, and elliptical curve cryptography (ECC).
The most common example of an asymmetric cryptography
algorithm or system that is public key cryptography is
Rivest-Shamir-Adleman (RSA).
VPN solutions employ asymmetric cryptography to
secure symmetric key exchange (via digital envelopes),
authenticate VPN link endpoints or users (via digital
signatures), and, when used in conjunction with hashing,
verify source and integrity of transmitted messages (also
digital signatures).
Hashing
Hashing is the cryptographic function that takes the input
of a file or message and creates a fixed length output. The
input can be of any size, but the output is a fixed length
based on the hashing algorithm used. Hashing does not
modify or alter the original data in any way; it simply uses
the original data to generate a hash value as a new data
item. Common hash value output lengths include 128 bits
(such as those produced by MD5), 160 bits (such as those
produced by SHA-1), and even 512 bits or more (such as
those produced by various members of the SHA-2 family).
The output of a hash algorithm can be called a hash, a
hash value, a message digest, a message authenticating
code, a fingerprint, a digital value, or a checksum.
Hashing checks integrity. Hashing computes a hash value
upon storage or transmission of a file or message, then
computes another hash value at the end of the storage
period or upon receipt of the transmission. If the before and
after hash values are the same, then the message has
retained its integrity. If the before and after hash values are
different, then the message has lost its integrity and is no
longer trustworthy or usable.
Hashing verifies integrity based on the complex
mathematical functions used in the hashing algorithm itself.
A central component or feature of these functions is the
avalanche effect. This effect ensures that small changes in
the input data produce large changes in the outputted hash
value. A single binary digit change in a file should produce a
clearly recognizable difference in the resultant hash value.
Hashes are a one-way function. A hash value cannot be
reversed directly back into the original data file from which
it was calculated. Thus, if an attack obtains a hash value,
the data is not at significant risk of being extracted from the
hash.
Some examples of hashing algorithms or systems include
MD5, HAVAL, SHA-1, and the SHA-2 variants (SHA-256, SHA-
384, SHA-512, etc.).
VPNs employ hashing, often as part of digital signatures,
as a method to confirm that transmitted data has retained
its integrity. Any mismatching of hash values discards the
received data and requests a retransmission. This ensures
that either end of a VPN connection accepts only fully valid
and true data.
Establishing VPN Connections with
Cryptography
Now that you know about symmetric cryptography,
asymmetric cryptography, and hashing, let’s take a look at
the overall process VPNs use to provide secure
communications. A basic VPN setup process occurs as
follows: 1. Bob computes the hash from a message (Figure
3-13).
2. Bob encodes the hash using his private key to
create a digital signature.
3. Bob generates a random symmetric key (K1).
4. Bob uses K1 to encrypt the message.
5. Bob obtains Alice’s public key.
6. Bob encodes K1 with Alice’s public key to create
a digital envelope.
7. Bob sends the digital signature, the encrypted
message, and the digital envelope to Alice.
8. Alice uses her private key to decode the digital
envelope to reveal K1 (Figure 3-14).
9. Alice uses K1 to decrypt the message.
10. Alice computes the hash of the message.
11. Alice obtains Bob’s public key.
12. Alice decodes the digital signature with Bob’s
public key to obtain Bob’s hash value.
Alice compares the pre- and post-hash values. If the hash
values are the same, then the message has retained its
integrity. Thus, the correct public key decoded the digital
signature. Bob’s identity is verified (authenticity and
nonrepudiation).
This exchange enables the symmetric key to secure
subsequent messages from Bob to Alice or from Alice to Bob
(Figure 3-15). Once a VPN has been established between
Bob and Alice, an exchanged session key (K1) exists at both
endpoints. Using this shared session key, Bob can encrypt
messages (envelope #1) to send to Alice and Alice can
encrypt messages (envelope #2) to send to Bob (Figure 3-
15).
FIGURE 3-13
The overall cryptographic process of establishing a VPN
connection (1/3).
FIGURE 3-14
The overall cryptographic process of establishing a VPN
connection (2/3).
Variations on this basic VPN session establishment are
possible. One variation would be to encrypt both the
message and the digital signature with K1. Another variation
would have Bob digitally sign K1 with his private key before
using Alice’s public key to encode it into a digital envelope.
This initial symmetric key exchange establishes the
encryption that will protect all subsequent messages for the
current communication session. When this session ends and
a new VPN session begins, a new symmetric key will initiate
the process. However, as long as the current session lasts,
the same symmetric key applies.
FIGURE 3-15
The overall cryptographic process of establishing a VPN
connection (3/3).
Reusing a symmetric key poses a slight risk, even for
multiple messages in the same session or conversation. To
minimize or reduce this risk, some VPNs use rekeying
processes. Rekeying discards the current in use key and
generates and exchanges a new symmetric key. Rekeying
comes in several types: Time rekeying—Rekeying
triggers at a specific time.
Idle rekeying (lag or delay)—Rekeying triggers
when a specific amount of idle, lag, or delay in the
conversation occurs.
Volume rekeying—Rekeying triggers when a specific
amount of traffic is transmitted.
Random rekeying—Rekeying triggers at random time
intervals.
Election rekeying—Either member of a VPN session
can elect to rekey at any time If a VPN solution
performs mid-session rekeying, you may or may not
have an administrative configuration option to manage
the rekeying processes. Rekeying may be embedded in
the encryption algorithms. One-time pad encryption
systems are also possible. A one-time pad system uses
a unique and random symmetric key for each segment
of a communication. This is a more complex system,
but offers greater security. Attempting to crack a
multi-random-key encryption scheme is one of the
most difficult attacks against encryption known.
NOTE
Technically, computers provide pseudo one-time pads,
as they are currently unable to produce true random
numbers. Instead, a pseudo random number
generator (PRNG) is used. A PRNG uses a complex
algorithm and the timing chip to produce seemingly
random numbers. The result is very good, but not truly
random.
Digital Certificates
You can increase the reliability of authenticity and
nonrepudiation by using digital certificates instead of
plain public and private keys. A digital certificate is a public
key and private key pair digitally signed by a trusted third
party. This third party is a certificate authority (CA). The
CA first verifies the identity of the person or company, then
crafts and issues the digital certificates.
In addition to improved reliability, certificates also
resolve a scalability issue with public key cryptography
systems. Without certificates, each system has to manage
an ever-expanding library of public keys. With a third-party
certificate-based system, each system no longer needs to
retain public keys. Instead, they are exchanged at the
beginning of each session with the assistance of the CA.
Each host stores only the trusted public keys of the CA.
The CA’s public keys are stored in the trusted roots list
(TRL). Any certificate issued by a trusted CA is accepted as
valid, providing the certificate has not expired and has not
been revoked.
The process is similar to the overall cryptographic
process to establish a VPN connection. The primary
difference is that instead of a sender’s generic private key,
the sender’s digital certificate encodes the message. Then,
the recipient uses the CA’s public key to start the unpacking
process. The CA’s public key decodes the CA’s private key
encoding around the sender’s public key. (This is the
sender’s digital certificate.) This confirms the identity of the
sender through the CA’s issued digital certificates. Then, the
recipient uses the sender’s public key to decode the
sender’s private key encoding on the message.
The use of digital certificates adds a few additional steps
to the overall process, but this improves the identity
verification of the participants in the secured
communication. Once a communication session ends, the
recipient can discard the sender’s public key. Each time a
new session starts, the sender’s public key will be re-
exchanged via the digital certificate process. This reduces
the burden of public key management and makes any
secure communication service, including VPNs, much more
scalable.
What Is VPN Authentication?
Authentication is the process of confirming or proving the
identity of a user and is of significant importance for VPNs.
Since VPNs allow external entities to connect to and interact
with a private network (or system), verifying the identity
before granting access is paramount. VPN authentication
takes place on two levels: connectivity and user.
When a VPN link starts, the hardware and software
components at each endpoint must authenticate to
establish the connection. Once the communication link
begins, the user performs a separate and distinct
authentication process. If either of these identity proofs fail,
the VPN is severed.
The actual mechanism of authentication used in either
case can vary. Options include username and password,
smart cards, token devices, digital certificates, and even
biometrics. As a rule of thumb, you should avoid username-
and password-only solutions and lean toward multifactor
authentication options. Password-only authentication is
notoriously exploitable and is not reliably secure enough for
a VPN.
The VPN services, whether software or hardware, may
support authentication directly or indirectly when offloaded
to dedicated authentication servers. Offloading can point to
any number of widely used authentication,
authorization, and accounting (AAA) services or
technologies, including RADIUS, TACACS, 802.1x, LDAP, and
Active Directory.
When selecting an authentication solution for a VPN,
consider the strengths and weaknesses of the
authentication factors independently of their VPN
integration. If an authentication factor has weaknesses on
its own, these are not relieved when used with a VPN.
VPN authentication should be scalable and support
interoperability among potential connecting hosts. Don’t use
authentication that cannot support more than a few dozen
users or hosts. Likewise, using a form of authentication that
is available on only one platform or operating system will
impose limitations difficult and expensive to resolve later.
VPN Authorization
Authorization is controlling what users are allowed and not
allowed to do. Authorization is also known as access control.
You must establish clearly defined policies as to what
activities will and will not be supported for VPN connections.
An initial concern is defining who is and who is not
allowed to establish a VPN connection. By considering VPN a
resource rather than just a method of connectivity, clearly
not all users should have access to all resources. If VPN
connectivity is neither essential to nor conducive of a
worker’s assigned tasks and responsibilities, he or she
should not be allowed to open or use VPN connections.
Authentication can help enforce this access control issue.
Whenever a user account that is not authorized to use VPN
attempts to authenticate across a VPN, that attempt should
fail. In fact, automatically locking such an account is a
reasonable security response. Users should have a clear
understanding of whether or not they have been granted
the privilege of VPN use. Any access of a non-VPN approved
user across a VPN, therefore, is either a sign of a policy-
violating employee or an outside intrusion attempt.
In addition to locking down use of the VPN itself, you
should restrict access to resources across a VPN, even for
authorized users. A VPN does establish a network
connection indistinguishable except for speed from a local
direct-wired connection, but that does not mean that the
same level of authorization is necessary, required, or even
recommended.
A stronger application of the principle of least privilege is
needed with VPN connectivity. Not all of the tasks and
resources employees use when on site are necessarily
required for activities they perform remotely. A user should
have one level or sphere of access when on site and a
different, smaller sphere of access when connecting through
a VPN. This, of course, will depend upon the assignments of
the worker and the sensitivity of the resources needed to
carry out those assignments, but thoroughly consider this
issue before granting default or wholesale access.
Mission-critical resources, processes, and information
may be at risk if they’re exposed to users connecting over a
VPN. Since a remote user’s computer is potentially less
secure than workstations on site, the additional risk may be
significant. Does a telecommuter or traveling worker
actually need access to a specific resource? If not, block
access.
Should a remote VPN user be able to transfer sensitive,
private, or valuable data to the remote host? This is the risk
of information leakage. Once data leaves the LAN, the
corporate security infrastructure loses its ability to fully
control and protect the information. On a remote host, once
the VPN disconnects, the LAN’s security protections
disappear. The only remaining security left is on the host
and practiced by the user.
Remote access is inappropriate or just impractical for
some resources. For example, consider preventing printer
access by remote VPN users. Do traveling workers need to
print documents they are unable to physically handle? Yes,
in some situations, remote printing makes sense. But should
you allow every local activity over a VPN just because it’s
possible?
Another authorization concern is whether or not to allow
Internet communication for VPN users. If local LAN users are
able to access the Internet, then technically so can VPN
users. But should they? Is this an additional risk or just an
additional bandwidth consumption burden?
If VPN users are unable to access the Internet from the
LAN through the VPN, can they access the Internet
simultaneously over the same ISP link as their VPN link to
the LAN? This configuration is known as a split tunnel.
Many organizations see this as a significant risk. This
scenario makes it possible for an Internet attack to breach
the remote host, and then use the VPN to access the private
LAN. This would be a nearly unrestricted pathway between
the Internet and the LAN. Most organizations employ VPN
connection solutions that prevent simultaneous local VPN
and Internet connectivity on remote hosts.
Even with these VPN authentication issues, the overall
process of enforcing access control is essentially the same
for both local and remote hosts. In most cases, access
control is defined on the resource itself, regardless of where
the users are. Keep this in mind as you craft policies
defining the parameters of VPN management and use.
CHAPTER SUMMARY
VPNs are mechanisms to remotely connect LANs and
mobile hosts. VPNs save money and offer worker
flexibility. VPNs secure communications over public
intermediary networks. VPNs should be used
whenever infrastructure costs are high or you need
mobile access and flexibility. VPNs can’t guarantee
quality of service over the Internet or protect against
endpoint device/host vulnerabilities. You should
deploy VPNs based on thoroughly researched VPN
policies.
VPNs offer many advantages, including a wide range
of implementation choices. Various devices and
software products support VPN connections. VPNs’
endpoints can be inside, on, or outside a firewall.
VPNs can support remote access for mobile hosts,
create links between individual systems, and support
channels between networks. VPNs can employ either
tunnel-mode or transport-mode encryption. They can
use the same authentication and authorization
techniques that you deploy elsewhere for general
network security.
KEY CONCEPTS AND TERMS
Algorithm
Asymmetric cryptography Authentication,
authorization, and accounting (AAA) services
Authenticity Avalanche effect
Certificate authority (CA)
Channel
Ciphertext
Client-to-server VPN
Compression
Corporate firewall
Cryptography
Decryption
Dedicated connection
Dedicated leased line
Digital certificate
Digital envelope
Digital signature
Distributed LAN
Eavesdropping
Edge router
Extranet VPN
Fragmentation
Hardware VPN
Hash
Hash algorithm
Hash value
Hashing
Host-to-host VPN
Host-to-site VPN
Host VPN
Hybrid VPN
Identity proofing
Intermediary network
Key or encryption key
Key exchange
Key pair
Keyspace
LAN-to-LAN VPN
Leased line
Multifactor authentication
Non-dedicated connection
Nonrepudiation
One-time pad
One-way function
Optical carrier (OC)
Out of band
Private branch exchange (PBX)
Private key
Pseudo random number generator (PRNG)
Public key
Public key cryptography
Public network
Rekeying
Remote access VPN
Remote-to-home VPN
Remote-to-office VPN
Scalability
Secured VPN
Site-to-site VPN
Software VPN
Split tunnel
Symmetric cryptography
Telecommuting
Traffic congestion
Trusted third party
Trusted VPN
Virtual private network (VPN)
VPN appliance
WAN VPN
CHAPTER 3 ASSESSMENT
1. Which of the following is not a valid example of a VPN?
A. A host links to another host over an intermediary
network.
B. A host connects to a network over an intermediary
network.
C. A network communicates with another network over
an intermediary network.
D. A host takes control of another remote host over an
intermediary network.
E. A mobile device interacts with a network over an
intermediary network.
2. Which of the following is not ensured or provided by a
secured VPN?
A. Confidentiality
B. Quality of service
C. Integrity
D. Privacy
E. Authentication
3. Which of the following techniques make(s) a VPN
private?
A. A single organization owning all the supporting
infrastructure components
B. Leasing dedicated WAN channels from a telco
C. Encrypting and encapsulating traffic
D. Both A and B
E. Items A, B, and C
4. What is the primary difference between a VPN
connection and a local network connection?
A. Speed
B. Resource access
C. Security
D. Access control models
E. Authentication factors
5. Which of the following is not a true statement?
A. VPN traffic should be authenticated and encrypted.
B. VPNs require dedicated leased lines.
C. Endpoints of a VPN should abide by the same security
policy.
D. VPNs perform tunneling and encapsulation.
E. VPNs can be implemented with software or hardware
solutions.
6. What is a hybrid VPN?
A. A VPN with a software endpoint and a hardware
endpoint
B. A VPN supporting remote connectivity and remote
control
C. A VPN consisting of trusted and secured segments
D. A VPN supporting both symmetric and asymmetric
cryptography
E. A VPN using both tunneling and encapsulation
7. What is the most commonly mentioned benefit of a
VPN?
A. Cost savings
B. Remote access
C. Secure transmissions
D. Split tunnels
E. Eavesdropping
8. Which of the following is a limitation or drawback of a
VPN?
A. Intermediary networks are insecure.
B. VPNs are not supported by Linux OSs.
C. VPNs are expensive.
D. VPNs reduce infrastructure costs.
E. Vulnerabilities exist at endpoints.
9. On what is an effective VPN policy based?
A. A thorough risk assessment
B. Proper patch management
C. Business finances
D. Flexibility of worker location
E. Training
10. What form of VPN deployment prevents VPN traffic from
being filtered?
A. Edge router
B. Extranet VPN
C. Corporate firewall
D. Appliance VPN
E. Host-to-site VPN
11. What form of VPN deployment requires additional
authentication for accessing resources across the VPN?
A. Site-to-site VPN
B. Corporate firewall
C. Host-to-site VPN
D. Edge router
E. Remote access VPN
12. Which of the following is not a name for a VPN between
individual systems?
A. Client-to-server
B. Host-to-host
C. Remote-to-home
D. Host-to-site
E. Remote-to-office
13. Which of the following is the primary distinction
between tunnel mode and transport mode VPNs?
A. Whether or not it can support network to network
links
B. Whether or not the payload is encrypted
C. Whether or not it can support host-to-host links
D. Whether or not the header is encrypted
E. Whether or not it supports integrity checking
14. What VPN implementation grants outside entities
access to secured resources?
A. Edge router VPN
B. Corporate firewall VPN
C. Site-to-site VPN
D. Extranet VPN
E. Remote control VPN
15. What form of cryptography encrypts the bulk of data
transmitted between VPN endpoints?
A. Symmetric
B. Hashing
C. Public key
D. Transport mode
E. Asymmetric
16. What components create a digital signature that
verifies authenticity and integrity?
A. Public key and session key
B. Private key and hashing
C. Hashing and shared key
D. Session key and public key
E. Shared key and hashing
17. By what mechanism do VPNs securely exchange
session keys between endpoints?
A. Digital envelope
B. Digital forensics
C. Digital encapsulation
D. Digital certificate
E. Digital signature
18. What are the two most important characteristics of VPN
authentication?
A. Single factor and replayable
B. Scalable and interoperable
C. Transparent and efficient
D. Interoperability and single factor
E. Replayable and scalable
19. What VPN access control issue can be enforced through
VPN authentication?
A. Blocking unauthorized VPN users
B. Restricting access to the Internet
C. Limiting access to files
D. Filtering access to network services
E. Controlling access to printers
20. When designing the authorization for VPNs and VPN
users, what should be the primary security guideline?
A. Scalability
B. Multifactor
C. Distributed trust
D. Principle of least privilege
E. Grant by default, deny by exception
21. All of the following statements about a host-to-host VPN
are true except:
A. A host-to-host VPN is commonly supported by the
host OS.
B. A host-to-host VPN must be implemented with VPN
appliances.
C. A host-to-host VPN can be interoperable between
different OS products.
D. A host-to-host VPN usually employs transport mode
encryption.
E. A host-to-host VPN can be established within a private
network.
FIGURE 3-16
The seven domains of a typical IT infrastructure.
22. All of the following are commonly used in supporting a
site-to-site VPN except:
A. VPN appliance
B. Commercial firewall
C. Client VPN software
D. Edge router
E. VPN gateway proxy
23. A VPN used to connect geographically distant users
with the private network is located within which domain
from the seven domains of a typical IT infrastructure
(Figure 3-16)?
A. LAN Domain
B. User Domain
C. System/Application Domain
D. Remote Access Domain
E. LAN-to-WAN Domain
24. What feature or function in tunnel mode encryption is
not supported in transport mode encryption?
A. The header is encrypted.
B. The payload is encrypted.
C. The source address is encrypted, but not the
destination address.
D. A footer is added to contain the hash value.
E. It provides encryption protection from the source of a
conversation to the destination.
25. All of the following statements are true except:
A. Encryption ensures VPN traffic remains confidential.
B. It is possible to have a private VPN without
encryption.
C. VPN authentication ensures only valid entities can
access the secured connection.
D. Authorization over a VPN consists exclusively of
granting or denying access to file resources.
E. VPN authentication can include multifactor options.
CHAPTER
4 Network Security
Threats and Issues
NETWORK SECURITY IS UNDER CONSTANT ATTACK by threats both internal and external, ranging from disgruntled
employees to worldwide hackers. There’s no perfect defense
because hackers are able to bypass, compromise, or evade
almost every safeguard, countermeasure, and security
control. Hackers are constantly developing new techniques
of attack, writing new exploits, and discovering new
vulnerabilities. Network security is a task of constant
vigilance, not a project to complete. It’s a job that’s never
done.
Why is understanding hacking, exploitation,
vulnerabilities, and attacks critically important? As the sixth
century B.C. Chinese military strategist and philosopher Sun
Tzu stated in his famous military text The Art of War: “If you
know the enemy and know yourself you need not fear the
results of a hundred battles.” Once you understand how
hackers think, the tools they use, their exploits, and their
attack techniques, you can then create effective defenses to
protect against them. Understanding hacking not only
improves network security; it also maintains security at a
high level of readiness.
Chapter 4 Topics
This chapter covers the following topics and
concepts:
What motivates hackers to attack computer
networks
Which assets attackers frequently target
Which internal or external threats networks
are vulnerable to
What common IT infrastructure threats are
What the various types of malicious code
(malware) are and what the security
concerns about them are
What fast growth and overuse are
What wireless and wired connections are
What the risk of eavesdropping is
What a replay attack is and how it is
performed
What an insertion attack is
What fragmentation attacks, buffer
overflows, and XSS attacks are
What man-in-the-middle, session hijacking,
and spoofing attacks are
What covert channels are and how a hacker
uses them
What threats to network and resource
availability are
How a denial of service (DoS) functions
What a distributed denial of service (DDoS) is
What some common hacker tools are
Who is at risk from social engineering
Chapter 4 Goals
When you complete this chapter, you will be able
to:
Describe the motivations of hackers and
other malicious computer network intruders
Compare and contrast threats from internal
and external sources
Describe how accidents, natural disasters,
and ignorance affect network security
Explain the risk posed by malicious code
Express the effects of wired and wireless
connectivity on network security
Describe common network security exploits
and attacks, including replay attacks,
insertion attacks, fragmentation attacks,
buffer overflow attacks, XSS attacks, man-in-
the-middle attacks, hijacking attacks,
spoofing attacks, covert channels, DoS,
DDoS, botnet attacks, and social engineering
attacks Demonstrate how hacker tools
exploit vulnerable targets
Hacker Motivation
What motivates hackers to attack computer networks? Why
does anyone get involved in illicit activity outside the
mainstream? The motives are as numerous as there are
ways of conducting the computer attacks: Many do it for the
sheer thrill of hacking, for the sport of it. Some hackers
consider hacking their hobby. Some love a challenge. Some
are victims of peer pressure or are seeking social validation.
To still others, hacking is a status trip. And finally, many
hackers pursue their exploits for power and financial gain.
Take a look at some of these motives in more detail to see if
you can begin to understand the hacker mentality.
Many criminal hackers are in it simply for the money.
There are many ways of gaining financially from attacking
computer networks. These range from theft of credit cards
and financial statements to blackmail and black markets.
Some monetary gain is immediate. Hackers might be able to
transfer funds out of a target account, for example. Other
methods are more involved, such as stealing corporate
documents and selling them to competitors or hijacking
data using encryption and holding it for ransom. Hackers
can become involved in selling their services, including
distributing spam, eavesdropping, cracking passwords, and
generating DoS events.
Demonstrating the ability to compromise a target,
especially if the target is reasonably secure, is a way for
hackers to prove they are more powerful than the
defenders. If you can control something, you have power
over it. If a hacker can control your computer remotely, then
the hacker has power over your computer, and in some
ways has power over you as well. Hackers sometimes hack
as an ego boost. If they can wage a successful attack, then
they are showing dominance over their target.
For many hackers, it’s an exciting challenge to find new
vulnerabilities, develop new attack code, or discover new
security breaches. Some hackers attack targets for the
same reasons some people climb mountains—because it’s
there, because they can, and because they want to beat it.
Some hackers continually seek out new, more difficult
targets to improve their skills and increase the level of the
challenge.
Some hackers enjoy the sheer risk of attacking a
network. As with any crime, the risk of being caught is
always a possibility. A target network might have
honeypots, IDSs, IPSs, firewalls, and other technical
defenses that the hacker will need to detect and evade.
Security professionals are always looking to discover new
attack techniques and learn the identity of hackers. With
every attack, therefore, the hacker is at risk of getting
caught and prosecuted.
Hacking can be thrilling. Think of the way a treasure
hunter on private property feels. The combination of power,
challenge, risk, and potential pursuit along with discovering
potentially valuable assets is a thrill for some hackers. The
thrill of getting away with it motivates many hackers to
continue their attacks once they figure out how to
successfully hack into a network.
Some hackers have few exciting or engaging aspects of
their life and they resort to hacking as an attempt to be
entertained or distracted from their boredom. A successful
system breach will usually initiate a response, often a cat-
and-mouse game that is more entertaining for hackers than
anything else they can think of at the moment.
Hackers have peers and social groups just like everyone
else. Peer pressure can be a powerful motivator to fit in,
show off, or demonstrate loyalty to a group. Peer pressure is
often a motivator for those in the lower levels or rankings of
hacker communities. New or inexperienced hackers feel
encouraged to perform attacks to maintain their
membership in their peer group.
Hacking can also be a mechanism to validate someone
socially, such as proving a qualification to join a group.
Some attacks are performed as an initiation or rite of
passage from a potential hacking group member to an
actual full member.
Hacking can help the hacker achieve or maintain status.
Hackers may be seeking to achieve status in the eyes of
hacking peers, in the judgment of other hacking groups, or
in the perspective of the world at large. Some hackers try to
cause a media story and to get their name in the news.
Other hacks are performed to instill fear and compliance in
current and future targets.
Hackers perform hacks for many reasons, and this list is
likely incomplete. These motivations drive them to do
unethical activities. You might or might not completely
understand the hacker mindset. It’s important for you to try,
however; the results, regardless of the motivation, can be
devastating for companies and individuals alike.
Favorite Targets of Hackers
In terms of security, the things you want to protect are
known as assets. An asset is anything used to conduct
business over a computer network. Any object, computer,
program, piece of data, or other logical or physical
component employees need to complete a task is an asset.
Among a hacker’s favorite targets are easy assets—ones
that pay off quickly. Easy targets are IT infrastructures and
elements not properly secured. Systems with well-known,
exploitable holes exposed to the world are “easy pickin’s”
for hackers.
Targets that pay off quickly are those that earn the
hacker some form of monetary or barter gain. Credit cards
and bank accounts can be a solid monetary score. In other
cases, gaining access and control of networks, especially
those with high-speed Internet links, is valuable. Such a
network could be saddled with malicious code that transmits
spam, eavesdropping, file exchange, encryption cracking,
and so on. The hacker can then trade or sell these services
to others.
Some hackers, however, do not seek the easy targets;
instead they look for unique targets, new challenges, and
complex infrastructures to test and improve their skills.
Expert and highly experienced hackers often want to
continue to improve their abilities rather than waste their
time on targets that any amateur hacker, or script kiddie,
could compromise.
What valuable assets do attackers most frequently
target? Every hacker is different, just as with any individual
member of any subculture. While many agree on what is
valuable, such as money and access, others might find
corporate finances, secret formulas, medical history, credit
reports, court records, accounting logs, and so on preferable
as their target of choice. For example, why do some people
collect toys while others collect cars, Coke bottles, or
pictures of Elvis?
To better understand possible targets hackers might
choose, review the seven domains of a typical IT
infrastructure (Figure 4-1): User Domain—Any user,
worker, employee, contractor, consultant, or individual can
be a target. Social engineering is a hacker attack against
people. This type of attack attempts to fool people through
clever wording, lying, misdirection, relationship
manipulation, fear, psychological tricks, and confidence
games. The results of social engineering attacks can include
users giving away private information or performing actions
on a computer that causes a reduction in network security.
Workstation Domain—The workstation, client, or
standalone home system can be a target. These types
of hosts are often less secure than LAN servers. This is
not on purpose, because most security focuses on core
components of the infrastructure, rather than those
seemingly on the periphery. Many times the security
measures on a workstation are old, out-of-date, or
improperly installed and configured.
LAN Domain—The private LAN, from SOHOs to large
corporations, is a common target. A LAN often consists
of dozens to thousands of hosts. The odds that all
individual systems are highly secure are unlikely. Once
a hacker gains access to one system on the network,
the rest of the LAN is vulnerable to attack. The
compromise of a single host can lead to the
compromise of the entire infrastructure.
LAN-to-WAN Domain—The WAN connections
between LAN locations, especially those controlled by
third-party entities, are targets. Transition interfaces
between a private LAN and a WAN connection can be
potential weak points. If a compromise is successful
against a WAN connection, the malicious traffic
inbound across the WAN/LAN interface is unlikely to be
filtered.
Remote Access Domain—Remote access is always a
popular target of hackers. Remote access removes the
need for the hacker to be physically present to access
and attack the LAN. Hackers anywhere in the world
with an Internet or telephone connection can still
reach out to attack any seemingly isolated target.
Remote access is an invitation to hackers to try to
breach your defenses.
WAN Domain—WAN domains are networks, such as
ATMs or Frame Relays, owned by a telco or a carrier
network company that leases access to corporations.
Often, the privacy of these WAN connections is
electronic isolation rather than encryption. Hackers
focusing on a specific target may attempt to breach
the electronic isolation of the carrier network rather
than focusing on the endpoint LANs themselves.
System/Application Domain—Collections of servers
hosting applications, virtualized systems, or databases
are valuable targets. Sometimes the data hosted is the
target. Sometimes the computing power of the servers
is the resource the hacker wishes to seize.
FIGURE 4-1
The seven domains of a typical IT infrastructure.
Assets do not have to be expensive, complicated, or large.
In fact, many assets are relatively inexpensive,
commonplace, and variable in size. For most organizations,
including SOHO (small office, home office) environments,
the assets of most concern include business and personal
data. If this information is lost, damaged, or stolen, serious
complications can result. Businesses can fail. Individuals can
lose money. Identities can be stolen. Even lives can be
ruined.
Valuable resources abound on individual computers as
well as on IT infrastructures comprised of interconnected
LANs. Hackers seek out targets based on a variety of goals
and motivations, as well as perceived value of a resource.
But who are the hackers?
Threats from Internal Personnel and
External Entities
What violates network security? The answer includes
accidents, ignorance, oversight, and hackers. Accidents
happen, including hardware failures and natural disasters.
Poor training promotes ignorance. Workers with the best of
intentions damage systems if they don’t know proper
procedures and lack the necessary skills. Overworked and
rushed personnel overlook issues that can result in asset
compromise or loss. Malicious hackers can launch attacks
and exploits against the network, seeking to gain access or
just to cause damage.
“Hacking” originally meant tinkering or modifying
systems to learn and explore. However, the term has come
to refer to malicious and possibly criminal intrusion into and
manipulation of computers. In either case, a malicious
hacker or criminal hacker is a serious threat. Every network
administrator should be concerned about hacking.
While historically two-thirds or more of security violations
have been the direct result of outsiders, the balance is
changing, and very dramatically. As a result of more
automated breaches, more hacking, and increased criminal
and terrorist activity, the percentage of “inside” computer
crime has shrunk as low as single digits, while even small
and medium-sized businesses and small government
agencies experience hundreds of thousands or more attacks
daily. This has markedly increased the need for trained
computer security professionals in organizations of all sizes.
According to the Verizon Data Breach Investigations Report
(http://www.verizonenterprise.com/DBIR/2012/), 98 percent
of data breaches stemmed from external agents.
Hackers are people. Misguided, unethical, ingenious, and
criminal, but still people. The major threat to network
security is mostly because of human intervention. While
designing security, keep in mind that the threat is ultimately
and mostly human. This awareness should lead to better
selections of deterrent, detection, and response.
Employees and external entities represent differing levels
of risk you need to address. An external entity does not start
off intrusion attempts with physical or logical access.
Initially, the risk from an external attacker is low. Outside
attackers must seek out and discover methods of gaining
logical or physical access. Without access, hackers must
resort to attacking external interfaces such as Web servers,
VPN devices, firewalls, and RAS. If these are secure, then
their default or fallback position is to wage a DoS attack,
attempt a burglary, or perform social engineering against
insiders.
FIGURE 4-2
Internal and external hackers.
An on-site employee has physical access to the facility
and logical access to the network. An employee may only
have a standard or normal user account, but some level of
logical access can be parlayed into greater levels of access
(known as privilege escalation). Threats from insiders,
whether physical or logical, are serious. You must address
such threats in your security policy, network design,
infrastructure deployment, and ongoing system and security
management.
The people who represent the most common threats to
an organization’s network security include disgruntled
employees, contract workers, recreational hackers,
opportunistic hackers, and professional hackers.
Disgruntled employees believe that they have been
wronged somehow by the organization. Whether the wrong
is real or perceived, their actions can cause severe
disruption of mission-critical operations. Disgruntled
employees may attempt to embezzle, steal supplies, waste
time, deposit malicious code, leak confidential data,
interrupt other workers, or derail projects.
Contract workers are outsiders brought in to perform
work on a temporary basis. Contract workers can be
consultants, temporary workers, seasonal workers,
contractors, even day-laborers. Outsiders do not necessarily
share the same loyalty to the organization that most full-
time employees exhibit. Thus, if the opportunity affords
itself to compromise the organization for personal gain,
contract workers are more likely to act unethically. Such
criminal outsiders don’t worry about long-term stability or
viability, or the fate of regular employees. Instead, they take
advantage at the expense of others.
Recreational hackers are those who enjoy learning and
exploring, especially with computing technology. However,
they might make poor choices as to when to use their
newfound skills. Bringing in unapproved software from
home, experimenting on the company network, or just
trying out an exploit to see if it works are all potential
actions of recreational hackers. Some hackers might not
fully consider that their hobby can be dangerous and their
actions are in violation of the company security policy.
Opportunistic hackers are hackers who are timid and not
likely to initiate an attack. For whatever reason, they are
unwilling to purposefully plan out and wage intrusions.
However, if the circumstance presents itself for an attack
that can be easily performed with little potential for
discovery or consequence, the opportunistic hacker may
take advantage of the fleeting moment. That moment could
arrive when someone happens to work late and ends up
being the only one left in the building. That moment could
be when a fire drill drives everyone else out of the facility.
Or it could be when a random power outage occurs and half
the workforce leaves for home. That moment could arrive
when he or she notices a certain office door is left open and
no one else is watching.
Professional hackers are criminals whose sole career
objective is to compromise IT infrastructures. Whether
operating as individuals, offering mercenary hacking
services, or functioning as a member of a criminal ring,
professional hackers focus all their time and energy on
conducting the best security assault possible. When people
spend years learning and practicing in one primary area of
interest, they can develop expertise and skills to rival all
defenses. The perfect unbreachable security solution does
not exist. Professional hackers have the time, stamina, skill,
patience, and backing to keep up an assault against a target
until they succeed. They are to a network what termites are
to a wooden building. You can deter them; you can keep
them out most of the time. But they will always be nearby
and eager to gnaw into the foundations if you drop your
guard for a moment.
These descriptions are not meant to imply that all
humans are by nature malicious. Instead, they offer a
realistic perspective on who might be an unethical person,
where potential human-based compromises exist, and what
precautions you should take to protect your organization
from both internal and external threats.
The Hacking Process
As much as IT professionals dislike the practice, hacking can
be a fascinating process. Hackers’ activities often appear
chaotic and random, at least when observed from the
mainstream IT industry. Hackers don’t have to follow any
fixed procedures or recognize any established boundaries.
Instead, they are seeking out vulnerabilities on a selected
target using any and all means at their disposal. For them,
chaos is both a methodology and a defense mechanism.
Generally, hacking falls into five main subgroups of
events or activities. This categorization can represent
hacking, but does not actually control or prevent hacking.
These five categories are (Figure 4-3): reconnaissance,
scanning, enumeration, attacking, and post-attack
activities. This order of phases occurs if an attack is
successful. If an attack is not successful, the hacker can
instead attempt a fallback position.
Reconnaissance
The initiation of the whole process of hacking is called
reconnaissance. Reconnaissance means the act of
inspecting or exploring and can also be called footprinting,
discovery, research, and information gathering. This phase
is the first of three pre-attack phases in which hackers learn
as much as possible about a target before attempting the
first actual attacks. Reconnaissance consists of collecting
data about the target from all possible sources online and
offline. The hacker is careful to avoid tipping off the target
that it’s being probed for information.
FIGURE 4-3
Five phases of hacking.
Reconnaissance can include:
Researching old versions of a target organization’s
Web site at archive.org
Examining search engine contents
Reviewing the live Web site
Investigating the background of personnel
Performing location mapping
Reading job postings
Checking insider information leak sites
Looking at newspaper and magazine articles or
mentions
Perusing press releases
Searching USENET newsgroups, chat archives,
blogs, and forums
Auditing financial records or reviewing public filings
Reviewing court cases and other public records
Querying whois, domain registrations, and public IP
assignments
Eavesdropping on e-mail and other conversations
Visiting a physical location
These are just a few of the possible reconnaissance
activities a hacker can perform. Information gathering is
limited only by the time, resources, and imagination of the
hacker. Once the hacker has built and organized a
reasonable portfolio of information about the target, the
next step is scanning.
Scanning
Scanning is the activity of using various tools to confirm
information learned during reconnaissance and to discover
new details. Scanning is aimed at discovering live and
active systems. Scanning can include wardialing,
wardriving, ping sweeps, and port scanning.
Wardialing is an older tactic that uses the telephone
system to locate any active and answering modems. Using a
modem, a hacker’s computer automatically dials target
phone numbers. The hacker obtains phone numbers during
reconnaissance or by dialing all the numbers in an area
code or prefix.
Wardriving, a term derived from wardialing, is the
technique of using a wireless detector to locate wireless
networks. Hackers used to drive around cities or
neighborhoods with laptop computers to discover wireless
networks. Today, driving is not necessary and smartphones
detect wireless networks automatically.
Ping sweeps are used to discover systems over network
connections that will respond to Internet Control Messaging
Protocol (ICMP) echo requests. Hackers commonly use ICMP
for network health and testing. The ping command or
network mapping utilities send ICMP echo requests to all
possible recipients within an IP address range or subnet.
ICMP echo responses from system indicate their IP address
and that they are up and running.
FIGURE 4-4
Basic TCP and UDP port scanning.
Hackers perform port scanning by sending various
constructions of TCP or UDP packets to ports (Figure 4-4). If
the system is not already known to exist, then a port scan
can determine the existence of a system at a specific IP
address as well as whether a port is open, closed, or filtered.
A TCP port is known to be open if a full TCP three-way
handshake can establish a virtual circuit. A UDP port cannot
be confirmed being open, since the default response from
an open port is always silence.
technical TIP
Ports exist at the Transport Layer (Layer 4) of the OSI
model. TCP and UDP use ports to support multiple
simultaneous communications, connections, or
sessions over a single Layer 3 IP address. There are
65,535 ports, but most systems can only support a few
hundred concurrent transactions.
A port is open if an active service is ready to process
data through the specific port. A port is closed if no
service is associated with a specific port.
When communications elicit error messages or
abnormal responses from a port, a firewall can filter out
these responses. This will result in a port being visible
for valid and normal communications. A firewall can
block any attempt to elicit errors or abnormal
responses.
Scanning is the process of sending out probes to elicit
responses. When a hacker performs scanning, it’s
detectable. Reconnaissance is generally silent, secretive,
and unobtrusive. You are also unlikely to detect scanning to
verify individual data items, such as a single open or closed
port. But when hackers scan to discover all possible IP
addresses in use and all possible open and closed ports, it’s
very noticeable. Scanning for confirmation is to scanning for
discovery as a sniper firing a single bullet is to a Gatling gun
destroying a forest. One activity might or might not draw
attention, but the other will be hard to ignore.
Hackers perform scanning until they discover one or
more targets. Since scanning uncovers only a system and
the open ports, hackers learn very little about the targets.
Hackers stop scanning and move on to enumeration, the
next step toward attacking, whenever they want, based on
the purpose of their attacks. Keep in mind that an attacker
needs only a single vulnerability to gain access. Once
hackers can access one machine, moving on toward
attacking it quickly is the most common escalation.
Enumeration
The enumeration phase is the third pre-attack phase.
Enumeration is the hackers’ process of discovering sufficient
details about a potential target to learn whether a
vulnerability exists that they can successfully attack.
Enumeration often starts with operating system
identification, followed by application identification, then
extraction of information from discovered services.
Enumeration, then, is the discovery and listing of potential
attack targets.
Hackers perform OS identification by probing an open
and closed port of a target. The responses from these ports
identify the OS. This ID is possible because of the
idiosyncrasies of different programmers writing
interoperable code. Each OS uses a different group of
programmers to write their network protocol stack. Even
though the resultant protocol stack may be in compliance
with IEEE standards, the defaults and reactions of the stack
often differ from one OS to the next. These differences are
known and maintained in a small database, which is coded
into most network scanning and probing tools, such as
nmap.
FIGURE 4-5
A banner grabbed from a Web server.
Each open port has a service running behind it. Banner
grabbing is the activity of probing those services to obtain
information (Figure 4-5). Once a connection has begun, a
service may send an announcement of connection or
communication confirmation. This announcement is called
the banner. The banner may contain additional details such
as the product name and version number of the service.
The information in the banner can be used by a hacker
for reconnaissance purposes—to gain the intelligence
needed to form the basis of an attack. One method of
protection that can be employed at low cost is to change
the banner in such a way as to mislead hackers. A little bit
of experimentation will allow banners to be created that
mislead hackers into using the wrong exploits against the
server but still allow the service on the given port to
perform its duties. In some cases, banners are not actually
used, so they may be greatly shortened; in other cases,
advanced features that are not used may be abandoned in a
trade-off that results in better security.
Once hackers have identified the service, they can
request additional information. The information request may
be secure and nothing goes out. But if insecure, the service
may return volumes of data to the hacker. Depending upon
the service and the queries the hacker performs, the
extracted information could include system name, network
name, user names, group names, share names, security
settings, resources available, access control settings, and
more.
Enumeration provides the hacker with identified,
potential attack points. After reviewing vulnerability
databases, such as MITRE (http://cve.mitre.org) or
National Institute of Standards and Technology
(NIST) (http://nvd.nist.gov), hackers evaluate the potential
vulnerabilities. Once the hacker selects an attack target, he
or she collects exploit tools and wages the attack.
One aspect that characterizes modern attacks is the
amount of time that passes before the reconnaissance
phase and the attack phase. In the past, a matter of
minutes may have separated the two, but the more modern
attack might go weeks, months, or longer before it is
unleashed. Such an attack, the highly targeted advanced
persistent threat (APT), will be discussed in more depth
later in this chapter.
Attacking
Attacking is the fourth phase of hacking. Although this
seems to be the phase that attracts most of the hype about
hackers, in fact, it’s the briefest phase of the overall hacking
process. A successful attack, based on solid research and
preparation, can take just seconds.
If an initial attack fails, hackers can modify their exploits,
tune their payloads, adjust their shell code, reset their
vectors, and relaunch the attack. Once hackers figure out
that an assumed vulnerability doesn’t exist or has been
secured, they return to their enumeration results to select a
new point of assault. Again, think of termites: If they can’t
get into the house structure through a doorjamb, they will
just as eagerly try to enter through a window sill. They are
relentless.
Repeated attacks will either lead to an eventual
successful breach or to the frustration of a successful
defense by the target. If successful, the attacker moves on
to post-attack activities. If unsuccessful, the attacker can
elect to move to alternative fallback attacks.
Post-Attack Activities
In a successful attack, the hacker usually has breached the
target’s security to gain some level of logical access. This
could be the credentials of a standard user account or a
command shell accessed through a buffer overflow
exploit. In any case, some common post-attack activities
usually take place. These include privilege escalation,
depositing additional hacker tools, pilfering data, and
removing evidence.
Privilege escalation is the action of attempting to gain
higher levels of access or privilege over the target. This can
occur using a keystroke logger, known OS exploits to steal
administrator or system access, manipulation of scheduled
tasks, social engineering, Trojan horses, remote control
programs, and other mechanisms. The result is that the
hacker gains access to a user account or a command shell
that operates as an administrator, root, or the system itself.
With privileged access, the remaining post-attack activities
are much easier.
Depositing additional hacker tools gives the hacker more
power over the compromised system. Tools may enable
additional abilities unavailable through the current
connection method. Tools may assist in pilfering data. Tools
may also assist in removing evidence. Or tools may assist in
maintaining or regaining access in the future.
Pilfering data is just that: scouring storage devices
looking for files of interest. Hackers look for anything they
can turn into cash immediately. They also look for things
that would be fun or interesting to disclose to the public.
They look for items they can use to blackmail or coerce
users. And, of course, they are on the lookout for potentially
valuable information for bartering or trading with other
hackers or criminals. Dumping the user account database
and password hashes is often a priority as well. Cracking the
passwords of other users will help if accessing the system
again in the future.
Removing evidence of the compromise and subsequent
activities is an important step for the hackers. Failing to
cover their tracks could lead to apprehension and
prosecution. Allowing the IT and security staff to discover
the intrusion will only lead to heightened levels security.
Discovery makes future returns more difficult, if not
impossible, depending on the hacker’s skill set.
Once the hacker performs evidence cleanup, the attacker
can claim to have owned (or pwned, in leetspeak,
hackers’ secret code language) a system. The hacker has
demonstrated his or her skills through the discovery,
tracking, and penetration of a target. This is often the goal
of a hacker: to successfully penetrate a target. However,
such successes are not always easy, or common. If the
attacks fail, the hacker always has fallback attack options.
Fallback Attacks
Fallback attacks are the other options for mayhem a hacker
can deploy after unsuccessful breach attempts against a
target. Common alternatives to intrusion include DoS,
eavesdropping, breaking and entering, social engineering,
malicious code, session hijacking, man-in-the-middle
attacks, wireless hacking, SQL injection, Web site attacks,
and more. The following sections of this chapter discuss
these and other attacks.
Common IT Infrastructure Threats
Some important aspects of security stem from
understanding the techniques, methods, and motivations of
hackers. Once you learn to think like a hacker, you may be
able to anticipate future attacks. This enables you to devise
new defenses before a hacker can successfully breach your
organization’s network.
So how do hackers think? Hackers think about
manipulation or change. They look into the rules to create
new ways of bending, breaking, or changing them. Many
successful security breaches have been little more than
slight variations or violations of network communication
rules.
Hackers look for easy targets or overlooked
vulnerabilities. They seek out targets that provide them the
most gain, often financial rewards. Hackers turn things over,
inside out, and in the wrong direction. They attempt to
perform tasks in different orders, with incorrect values,
outside the boundaries, and with a purpose to cause a
reaction. Hackers learn from and exploit mistakes and
anomalies, especially mistakes of network security
professionals who fail to properly protect an organization’s
assets.
The more you understand about the various threats and
risks to network security, the more defenses you can mount
against attacks. Threats to network security include hacker
exploits, as well as Mother Nature, device failures, and even
normal business activities.
Hardware Failures and Other Physical
Threats
Network security is not just about protection against
hacking. Many other threats face computer systems on an
ongoing basis. Computer equipment is complex and
sometimes fragile. Hardware failures are the most common
cause of unexpected downtime. Most equipment operates
well beyond its expected lifetime in normal environments.
Some forms of technology, however, are more prone to
failure than others.
One of the most commonly discussed causes of
unexpected downtime is hard drive failure. A hard drive is
one of the few common computer components that has
moving parts. While optical drives, tape drives, mice, and
keyboards have moving parts, these devices seem to outlast
hard drives by a significant margin. Hard drive failure can
occur unexpectedly or with reasonable warning. The
warning is usually a grinding, whining, or clicking noise
coming from the drive as it begins to fail. These noises are
clear signs that the end is near.
The best defense against hard drive failure, as well as
hardware failure in general, is to be prepared. Being
prepared includes consistent periodic backups, using
redundant array of independent disks (RAID),
performing general cleaning and maintenance, and having
spare parts on hand for the inevitable. Another method to
avoid downtime and a loss of availability is to replace
equipment before it fails. Most devices have a mean time
to failure (MTTF) or mean time between failures
(MTBF) that can determine the statistical likelihood of a
failure. It is a good practice to replace the device before that
period expires. While you will be replacing some devices
long before their actual failure, this technique keeps the
statistics on your side. Though planned downtime is costly,
it is less costly than unplanned downtime.
Another physical threat is heat. Too much heat damages
computer equipment. Systems that experience severe
temperature cycles, such as very hot to very cold, can have
incidents of chip creep or warping and cracking of materials.
Chip creep is caused by the expansion and contraction of
metal because of temperature changes. Severe temperature
cycling can even break soldered connections. The traditional
debate about turning computers off at night or over
weekends and leaving them in a running state speaks to the
effects of these temperature changes. A running computer
is at its optimum functioning temperature.
Static electricity discharge (SED) from dry conditions
can destroy most circuits. Frayed wires caused by rubbing
against sharp metal edges can cause a short circuit.
Moisture due to high humidity in the air or liquid spills is
always bad for electrical devices. Excessive vibration can be
damaging to computer equipment. Vibrations caused by
nearby heavy construction or regular passing of trains,
subways, and airplanes can cause damage over time. Any
obvious physical damage caused by devices falling, being
knocked over, having heavy objects dropped on them, and
so on can result in broken equipment.
You can eliminate or significantly reduce most physical
risks and threats with reasonable precautions and common
sense in proper handing, care, and storage of electronic
equipment.
One such risk is intentional electromagnetic
interference (IEMI), in which an intentional discharge is
made that damages or destroys electronic equipment from
cell phones and video surveillance to computers and
servers. IEMI discharges have been recorded up to two miles
away and pose no risk of damage to living creatures. While
IEMI and related technologies have been used by the
military for years, IEMI is just now becoming a threat to
computer security.
One final physical threat is theft. Physical facility
protections ensure that an IT infrastructure is not
threatened by unauthorized outsiders (or insiders) walking
away with storage devices or other critical components.
Natural Disasters
Mother Nature is unpredictable and quite powerful. All sorts
of serious weather events damage or destroy IT
infrastructures. Knowing the types of severe weather
common in your area will suggest the correct precautions,
such as special insurance, structural reinforcements,
lightning protection, surge protectors, bilge pumps, and so
on. No matter what the potential disaster, the best
protection for data is a reliable regular backup stored in a
secured, offsite facility.
Accidents and Intentional Concerns
Accidents happen. Whenever humans are involved, things
will go wrong. Murphy’s Law states, “Anything that can go
wrong will.”
An IT infrastructure is a large, complex, but fragile entity.
And it is completely at the mercy of human beings.
Accidental damage in the wrong location or at the wrong
time can have devastating results. Accidents include spilling
liquids on equipment, tripping over cables, pulling out the
wrong power cord, tripping the building’s circuit breaker,
setting off the water sprinklers, placing candles on top of
warm devices, knocking over a computer, turning off a
system prematurely, installing the wrong driver, removing
the wrong cable, and so on.
The best precautions and protections against accidents
are backups, configuration documentation, and training.
With some commonsense adjustments to worker activity,
paying closer attention to activities they perform, and
watching out for precarious circumstances, you can avoid
many “common” accidents.
Unfortunately, accidents are not the only concern when
humans are around. Another threat to network security is
intentional damage or sabotage. Disgruntled employees,
dismissed contract workers, opportunistic janitorial staff,
unhappy managers, and even careless visitors can wreak
havoc in moments if they have access to sensitive
equipment or information. Proper personnel screening,
perceptive supervisory oversight, escorts, background
checks, security cameras, training, paying attention to the
corporate culture, giving in on some indulgences (such as
an occasional long lunch or casual Fridays), and providing
competitive pay scales can go a long way toward preventing
intentional disruption or destruction of IT equipment and
resources.
Malicious Code (Malware)
Malware is the shortened term for malicious software.
Malware is unethical code hackers write to cause harm and
destruction. Malware gains access to a system in myriad
ways, usually without the consent or knowledge of the user.
The most common vectors of this computer contaminant are
portable storage devices and Internet communications. A
wide range of types of malware exist, including the virus,
the worm, the Trojan horse, keystroke loggers, spyware,
adware, the rootkit, the logic bomb, the trapdoor, the
backdoor, dialers, URL injectors, and exploits. The
number of unique malicious code examples is astounding. In
April 2012, Symantec reported that its virus definitions file
contained 17.7 million separate signatures—although as
ZDNet blogger Ed Bott noted, some of them are of more
concern than others.
Just like a biological virus, a computer virus needs a host
object to infect. Most viruses infect files, such as
executables, device drivers, DDLs, system files, and
sometimes even document, audio, video, and image files.
Some viruses infect the boot sector of a storage device,
including hard drives, floppies, optical discs, and USB drives.
Viruses spread through the actions of users. As users open
infected files, the virus spreads to other files. As users send
infected files to other systems, the virus spreads there, as
well.
Unlike viruses, which spread from file to file, worms
spread from system to system. Because human interaction
isn’t necessary for propagation, they can (and do) spread
much more quickly than viruses. Today, nearly every threat
described as a virus is really a worm. Hackers design worms
around specific system flaws. The worm scans other
systems for this flaw, and then exploits the flaw to gain
access to another victim. Once hosted on another system,
the worm spreads itself by repeating the process. Worms
can be carriers to deposit other forms of malicious code as
they multiply and spread across networked hosts.
A Trojan horse is actually a mechanism of distribution or
delivery more than a specific type of malware. During the
Trojan War, the Greeks built a huge, hollow wooden horse,
hid warriors inside, and seemingly departed the area. The
Trojans took the horse into their citadel and were massacred
overnight when the Greek warriors emerged from hiding.
The concept now embeds a malicious payload within a
seemingly benign carrier or host program. When the host
program runs, the malware is delivered.
The gimmick of a Trojan horse is the act of fooling
someone (a type of social engineering attack) into accepting
the Trojan program as safe. Any program can be converted
into a Trojan horse by embedding malware inside it, in the
same way that any food can be poisoned by adding a toxic
substance to it. In fact, hackers have specialized tools
designed for the express purpose of building Trojan horses
called wrappers or Trojan horse construction kits.
Keystroke loggers record the keyboard activity of a user.
Hackers can deposit software keystroke loggers onto a
victim’s system through a variety of techniques, including a
worm or a Trojan horse. Once a system is infected, the
keystroke logger periodically transmits key logs to the
originating hacker through e-mail, FTP, or instant message
(IM). Hardware keystroke logger attacks can come through
the keyboard cable. These are hard to detect because they
are so small and are a parasitic link to the keyboard cable.
Spyware is an advancement of keystroke logging to
monitor and record many other user activities. Spyware
varies greatly, but can collect a list of applications launched,
URLs visited, e-mail sent and received, chats sent and
received, names of all files opened, recording of network
activity, periodic screen captures, and even recordings from
a microphone or images from a Web cam.
Adware infiltrates advertisements. Spyware and adware
are often linked together in a symbiosis, since the
information learned about a target from spyware helps in
selecting materials the adware will push through. Adware
can push advertisements as pop-ups, as e-mail messages,
or by replacing existing legitimate ads on Web sites as they
display in the browser.
Rootkits are malicious camouflage that function as
invisibility shields for anything a hacker wants to hide on a
computer. A rootkit acts like a device driver and positions
itself between the kernel (the core program of an operating
system) and the hardware. From there, the rootkit can
selectively hide files on storage devices and active process
in memory from being viewable, accessible, or detectible by
the OS. Rootkits hide other forms of malware or hacker
tools. Rootkits can include other malware functions in
addition to their stealth abilities.
A logic bomb is an electronic land mine. Once a hacker
embeds a logic bomb in a system, it remains dormant until
a triggering event takes place. The trigger could be a
specific time and date, the launching of a program, the
typing of a specific keyword, or accessing a specific URL.
Once the trigger occurs, the logic bomb springs its malicious
event on the unsuspecting user.
Trapdoor and backdoor malware are two terms for the
same type of malware. A backdoor or trapdoor program
opens an access pathway for a hacker to gain easy access
into a compromised system. The access could be the
creation of a new user account with credentials the hacker
has defined; a rogue Web, telnet, or SSH server that gives
the hacker remote command prompt access; or a source
that enables full remote control over the victim’s machine
(sometimes just by turning on Remote Desktop on a
Windows host). Many other possible trapdoor or backdoor
manipulations can grant access to external hackers.
A dialer is a rogue program that automatically dials a
modem at a pre-defined number. Sometimes this process
auto-downloads additional malware to the victim or uploads
stolen data from the victim. In other cases, the dialer calls
premium rate telephone numbers to rack up massive long
distance charges. If the user normally connects to the
Internet over a dial-up link, the dialer to could dial a rogue
proxy site instead of the ISP. This site would act as a man-in-
the-middle and be able to eavesdrop on all communications.
URL injectors replace URLs in HTTP GET requests for
alternative addresses. These injected URLs cause a different
Web page to appear in the browser than the one requested
by the user’s click. These replaced Web pages could present
advertisement sites, generate traffic to falsify search engine
optimization (SEO), or lead to spoofed sites.
Exploits are any form of malware designed to take
advantage of a flaw in programming, timing,
communication, or storage. Hackers often embed exploits
into other forms of malware to assist in their infection and
distribution. Exploits also exist on their own, usually as tools
employed by hackers to wage attacks, cause damage, and
perform intrusions.
Spam is any unwanted and unsolicited message. Spam is
not technically malicious software, but spam can have a
series negative effect on IT infrastructures. Experts estimate
that 80 to 95 percent of e-mail Internet traffic is spam and
other forms of malicious messages. Hackers can easily use
spam to wage DoS attacks through flooding and commonly
use it to wage social engineering attacks such as phishing.
Malware is spread through the same communication
channels as legitimate, benign data. The difference is that
hackers design malware to cause distress and destruction. A
growing area of risk for the spread of malware is mobile
code. Mobile code is software that hackers write for easy
distribution over communications networks, such as the
Internet and mobile phone networks. Hackers design mobile
code to download to a host, then execute on the host.
Because of a lack of proper precautions and awareness by IT
professionals, malware under the guise of mobile code is
spreading more rapidly than ever.
Advanced Persistent Threat
For many years, it was common for the general public, and
even many knowledgeable security professionals, to call
every type of malware a virus. It has become just as
common for every type of malware to now be called an
advanced persistent threat (APT). And it is just as wrong.
While the occurrence of APTs has increased dramatically,
they still represent a small percentage of attacks. It is true
that APTs represent the next generation of malware in that
they sit quietly on a target machine until they are activated.
However, APTs are highly targeted, with the targeting
intelligence often gleaned from other types of attacks, from
phishing to social engineering. Historically, most attacks
have been opportunistic attacks seeking the lowest-hanging
fruit, the weakest systems to break in to. As we see a shift
from financially motivated attacks to state-sponsored
espionage and hacktivism, or politically motivated hacking,
it follows that we are likely to see the continued growth of
targeted attacks such as APTs.
Even with all the variations of malware that currently
exist and those that will exist in the future, you can choose
from only a few common defenses: antivirus software, anti-
malware scanners, integrity checking scanners, and user
awareness. Antivirus software actively searches for viruses,
worms, Trojan horses, and other similar destructive forms of
malware in memory and on storage devices. Anti-malware
scanners look for spyware, adware, dialers, and so forth that
an antivirus software might not address. An integrity
checker keeps a database of hash values for all system and
application files and reports when unauthorized changes
occur to those files. You can improve user awareness by
offering training that encourages responsible action with
regard to security. Training will also encourage users take
reasonable precautions against infection and attack both at
work and at home.
Fast Growth and Overuse
Granted, network security is not always an organizational
priority. Some organizations are more concerned with profits
and rapid growth than spending time on network security.
Security is sometimes viewed as an annoying overhead
expense that consumes resources without providing any
return to compensate for the outlay. While this mindset is
common among senior management, it’s a poor and
incorrect understanding of the return on investment
(ROI) of the crucial investment in network security.
Network security—in fact, most forms of security—
protects the organization so that its profit centers can
function without interruption or interference. Without
network security, the capability and availability of the IT
infrastructure would be unstable, especially during periods
of accident, infection, attack, or hardware failure. Network
security reduces the occurrences of downtime and damaged
or lost resources. What could be more important to an
organization’s bottom line?
Organizations that fail to address security issues as they
experience explosive growth are more likely to experience
catastrophic failure. By failing to protect assets
(communications, data stores, intellectual property,
customer data, financial records, and private personnel
data), any level of hacker breach could result in
organizational implosion.
Racing to get ahead, without proper planning and
preparation, usually ends in failure. When constructing a
skyscraper, the top of the structure isn’t built until each
floor below it is properly erected. Growing a company too
fast without adequate network security protections is like
attempting to build the penthouse before the lower floors
are completed. The rise to the top floor may be exhilarating,
but the subsequent crash will be unavoidable. What goes up
too fast will inevitably come down faster.
A slightly slower growth rate to build network security
concurrently with the expansion of the organization is a
much smarter plan. Such a deliberate approach is more
likely to provide sustained growth and longevity than one
based on an unbridled push for forward momentum without
considering the risks.
Another potential oversight is an organization’s pushing
equipment, software, and connectivity beyond a reasonable
load level. Trying to pull a yacht with a sports car comes to
mind. It looks sexy, but what’s at risk? Modern IT equipment
is able to perform at astounding levels. But even the best
equipment can do only so much before it exceeds its peak
operational limitations—and starts trending toward failure.
The growth of most organizations is predictable.
Predictable growth can help plan for expansion of
infrastructure before the infrastructure becomes a
bottleneck. As growth passes 60 percent capacity of the
current infrastructure, you should already be planning for
expansion. As growth passes 80 percent capacity, take
steps to implement expansion. As growth passes 90
percent, accelerate your efforts to complete the expansion.
If the company reaches 100 percent capacity before it
completes expansion, a bottleneck inhibiting growth will
result. This obstacle can create a bounce-back effect, in
which interrupted growth could shrink the organization,
making the return to growth more difficult. Equipment,
storage space, memory capacity, backup capabilities,
communication bandwidth, and processing capabilities
should never reach maximum use or consumption. You
should reserve sufficient overhead for the occasional spike
above normal maximum activity.
Wireless Versus Wired
The security implications of a wireless network compared to
a wired network are often exaggerated. The biggest
difference is the mechanism and proximity of the attack.
With wired networks, a hacker must gain physical proximity
to a target to make direct contact with it. Once connected to
the wired network, the hacker can attempt various attack
and exploits.
With wireless networks, the hacker doesn’t have to be
physically close. Hackers can attempt network breaches
from a mile or more away from the access point (Figure 4-6).
In most real-world situations, however, the range is often
under a thousand feet with a small but powerful directional
antenna.
In either case, wired or wireless, the hacker must first
obtain a network connection with the target network to
attack if the hacker’s goal is to gain access to user accounts
or data stored on the network. If the hacker is mainly
interested in destruction and DoS, then logical network
access isn’t necessary.
FIGURE 4-6
Wired networks require local attacks; wireless networks
allow for remote attacks.
Eavesdropping
Eavesdropping is listening in on communications.
Eavesdropping can be the recording of network traffic using
a packet capturing tool, generically known as a sniffer
(Figure 4-7). Hackers can eavesdrop against data packets or
against voice traffic. Eavesdropping can occur over wired or
wireless connections.
Any communication performed in plain and directly
usable data forms is subject to interception and recording.
You can prevent eavesdropping by using encrypted
protocols. Only cryptographically encoded messages are
safe from outsiders learning the content of the conversation.
Replay Attacks
Replay attacks are also known as playback attacks. A
replay attack is the retransmission of captured
communications. The goal of a replay attack is to gain
interactive or session access to a system. The traffic
captured and retransmitted for a replay attack is
authentication packets (Figure 4-8). In this type of attack,
the hacker captures traffic between a client and server, and
then later retransmits it against the same server as the
original communication.
FIGURE 4-7
Eavesdropping on an existing session between client and
server.
FIGURE 4-8
Replay attacks collect authentication packets, and then
retransmit them later.
The goal of this attack is to replay the credential packets
so that the hacker gains access to the user’s account on the
target host. Another type of replay attack is resending a
transaction, such as “Send a $10 refund check.”
Fortunately, you can thwart most replay attacks by using
one of several common communication improvements.
Many authentication transactions include a non-replayable
random challenge-response dialogue. This dialogue consists
of one endpoint generating a random seed value sent to the
other endpoint. The second endpoint uses a mutual secret
known by both endpoints to compute a response using a
one-way computation. The response returns to the original
endpoint, where the response was predicted. If the received
and predicted responses match, the user is authenticated.
Another defense against replay attacks is time stamps.
Some authentication exchanges have encoded time details
that are difficult to reproduce or modify without detection.
Additionally, the use of one-time pad or session-based
encryption can make replay attacks impossible.
Insertion Attacks
Insertion attacks come in many forms, but all of them
involve the introduction of unauthorized content or devices
to an otherwise secured infrastructure. Three common
insertion-based attacks include SQL injection, IDS
insertion, and rogue device insertion.
SQL injection is an attack that inserts a hacker’s code
into a script hosted on a Web site. SQL injection attacks can
give the hacker access to the back-end database of a Web
application. The technique exploits a weakness in common
Web communications that treats certain characters
differently because they are assigned a special meaning or
purpose rather than just treated as text. These are called
metacharacters and act as programming markup. If you
don’t write a script defensively to block out or ignore
metacharacters, then injection attacks can effectively
rewrite the script based on content a hacker submits. The
injected code can perform just about any possible command
line task imaginable.
IDS insertion is a form of attack that exploits the nature
of a network-focused IDS to collect and analyze every
packet to trick the IDS into thinking an attack took place
when it really hasn’t. The common purpose of IDS insertion
attacks is to trick signature- or pattern-matching detection
of malicious network events. By interspersing attack traffic
with packets that the target host will reject but the IDS will
view, the IDS fails to see the attack pattern, but the attack
still takes place. For example, suppose an attack is
composed of four packets, A, B, C, and D, and the IDS
signature is a packet stream of ABCD. If the hacker
transmits the attack as AXBCYD, where X and Y are invalid
packets rejected by the target, then the IDS doesn’t
recognize the pattern. After X and Y are discarded, the ABCD
attack occurs against the target.
Rogue device insertion is a physical form of insertion
attack where a hacker inserts an imposter device into an
infrastructure. The most common example of this is the
insertion of a rogue wireless access point configured
similarly to the real, authorized access point. Some users
might be fooled into connecting to the rogue access point.
This would constitute a man-in-the-middle attack where the
hacker would intercept all transactions from the
compromised system.
Each insertion attack method requires that you create a
unique defense. You can prevent SQL injection attacks by
defensive programming and filtering input. Squelch IDS
insertion attacks by using modern IDS techniques such as
anomaly, behavioral, and heuristic detection. You can derail
a rogue device insertion through encrypted
communications, pre-configured network access, prohibited
wireless networking, user training, and regular site surveys.
Fragmentation Attacks, Buffer
Overflows, and XSS Attacks
Fragmentation Attacks
Fragmentation attacks are an abuse of the fragmentation
offset feature of IP packets. Fragmentation occurs when
there are many different network links connected to
construct a global infrastructure. Some network segments
support smaller datagrams (another term for packet or
frame) than others, so larger datagrams are fragmented
into the smaller, more compatible size. When the
fragmented elements of the original datagram reassemble,
manipulations of fragmentation can cause several
potentially malicious reconstructions, such as overlapping
and overrun. Think of the transporter on Star Trek: If
anything gets in the way of the reassembly of the person
being transported, you might end up with an evil Mr. Spock
with a goatee.
Overlapping can cause full or partial overwriting of
datagram components creating new datagrams out of parts
of previous datagrams. Overrun can result in excessively
large datagrams. Other fragmentation attacks cause DoS or
confuse IDS detection and firewall filtering.
Protections against fragmentation attacks include
modern IDS detection and firewall filtering features, as well
as performing sender fragmentation. Sender fragmentation
queries the network route to determine the smallest
maximum transmission unit (MTU) or datagram size.
The sender then pre-fragments the data to ensure that no
fragmentation needs to occur en route. “Beam me up, Mr.
Scott—and make sure I get back all in one piece.”
Buffer Overflows
A buffer is an area of memory designated to receive input.
Buffers are of a specifically determined size set by the
programmer, since only a finite amount of memory resides
on a host. A buffer overflow is an attack against poor
programming techniques and a lack of quality control.
Hackers can inject more data into a buffer than it can hold,
which may result in the additional data into the next area of
memory.
This overflow could be totally ignored, could trigger an
overflowing crash or freeze, or could result in arbitrary
code execution. In the latter case, the hacker crafts the
input stream so the overflowed data is a command-line code
statement executed with system-level privileges.
Programmers can prevent buffer overflows. Using
defensive programming techniques, such as input limit
checks and avoiding programming language functions that
do not check boundary limitations, buffer overflows become
a useless form of attack.
XSS (Cross-Site Scripting) Attacks
Cross-site scripting (XSS) is similar to SQL injection, but
the results attack future visitors to a Web page rather than
grant the hacker access to the back-end database. An XSS
attack submits script code to a Web site. XSS can result in
persistent malicious modification of Web source files. This
causes all future visitors to the site to receive compromised
content.
XSS attacks can include e-mails to victims with falsified
hyperlinks that point the script injection to a target site
when the victim clicks on the e-mail’s embedded links. Such
an attack can grant the hacker access to the seemingly
secured Web transaction of the victim. This form of attack is
non-persistent since it affects only those who click on the
links in the malicious e-mail.
XSS attacks are generally preventable if you use
defensive coding techniques and metacharacter filtering.
For end users, defenses include cookie management and
disabling scripting support in browsers and e-mail clients.
Man-in-the-Middle, Session Hijacking,
and Spoofing Attacks
Man-in-the-Middle Attacks
Man-in-the-middle (MitM) attacks occur when a hacker
intervenes in a communication session between a client and
a server. The attack usually involves fooling or tricking the
client into initiating the session with the hacker’s computer
instead of with the intended server (Figure 4-9). This form of
attack is also called an interception attack, a proxy
attack, or a monkey-in-the-middle attack.
FIGURE 4-9
Man-in-the-middle attacks fool clients into initiating sessions
with the hacker instead of the target server.
MitM attacks involve a pre-attack element, in which the
client is given false information that leads the client to
request a session with the hacker’s computer rather than
the real server. The hacker can accomplish this using one of
several methods: ARP spoofing—Address Resolution
Protocol (ARP) is a non-authenticating broadcast query
service that requests the MAC address from a system using
a specific IP. If a hacker running an ARP spoofing tool
sends a false response to the requester before the real
response returns, then the sender will use the false MAC
address. Subsequent frames go to the rogue MAC address,
which the hacker’s computer uses. ARP spoofing must occur
within a subnet.
MAC spoofing—The hacker’s computer uses a
server’s MAC address; while the server is flooded, the
hacker’s system receives traffic instead of the
intended server. MAC spoofing must occur within a
subnet.
DNS poisoning—To perform DNS poisoning, a
hacker compromises a DNS server and plants false
FQDN-to-IP mapping records. The DNS source will feed
subsequent user queries false data.
DNS spoofing—DNS is a non-authenticating query
service that requests the resolution of a FQDN into its
related IP address. A hacker hosting a rogue DNS
spoofing tool can send back false DNS responses.
technical TIP
When a non-authenticating query service is in use,
it does not confirm the source or the validity of any
response received. Thus, if you receive a fake, spoofed,
or rogue response, the system accepts it as genuine
and the query session ends. If the real response
arrives, the system rejects it as an invalid or stray
packet because it will no longer correspond to any
open query session.
ICMP redirect—On subnets with multiple routers,
ICMP redirects can cause a host to alter its routing
table. This attack could redirect traffic along a different
route than the default, expected, or optimal one.
Proxy manipulation—To perform proxy
manipulation, a hacker reconfigures a client’s proxy
configuration. Requests for services go to the hacker’s
system that acts as a MitM proxy.
Rogue DHCP—A rogue DHCP is a false DHCP server
that can provide IP address configuration leases for a
unique subnet and define the default gateway since
the hacker’s computer acts as a MitM router/proxy.
Rogue access point—To create a rogue access
point, a hacker configures a rogue wireless access
point similarly to the real authorized access point that
can fool users into connecting, which then serves as a
MitM proxy.
Defenses against MitM attacks include IDS and IPS solutions
that monitor for common network abuses or abnormal
network activity. Additionally, strong multifactor
authentication and mutual authentication can reduce the
success of MitM attacks.
Session Hijacking
Session hijacking occurs when a hacker is able to take over
a connection after a client has authenticated with a server
(Figure 4-10). To perform this attack, a hacker must
eavesdrop on the session to learn details, such as the
addresses of the session endpoints and the sequencing
numbers. With this information, the hacker can
desynchronize the client, take on the client’s addresses, and
then inject crafted packets into the data stream. If the
server accepts the initial false packets as valid, then the
session has been hijacked.
FIGURE 4-10
Session hijacking steals a connection from a client.
In a session hijack, the attacker does not directly learn
the credentials of the client. If the hacker loses the
connection, he will have to look for another session to
hijack. The client who lost the session will be aware that the
connection was lost, but will not necessarily be aware that
the disconnect was a hijack attack.
Session hijacking sometimes employs DNS spoofing,
poisoning, ARP spoofing, ICMP redirects, and rogue DHCP to
alter the route or pathway of a session. The hacker uses this
pathway alteration to make the session hijacking attack
easier by forcing the target session to travel over a more
accessible network segment.
Any host that uses TCP/IP without encryption is
vulnerable to session hijacking. Even with complex or
pseudo-randomized packet sequence numbering, a little
eavesdropping is all that is necessary for hackers (or the
hackers’ tools) to predict future sequence values. The only
true protection against session hijacking is encryption, such
as a VPN.
Spoofing Attacks
Spoofing is falsification of information. Most spoofing is a
falsification of the identity of a source. E-mail addresses,
MAC addresses, and IP addresses are all easily spoofed.
Spoofing tricks a user or a host into believing a
communication originated from somewhere other than its
real source. This is a common tactic in the transmission of
spam. Spoofing impersonates an authorized entity, such as
MAC spoofing to bypass wireless access-point MAC filtering.
Spoofing is difficult to prevent and somewhat hard to
detect. Most spoofing detection occurs when you watch
normal traffic and look for addressing anomalies. For
example, if a switch sees that a specific MAC address is the
source address for frames received on switch port 6, and
that MAC address also appears as the source address for
frames received on switch port 9, that’s a symptom of MAC
spoofing (Figure 4-11). In another example, if a firewall
receives a packet on its external interface and the source IP
address is an internal LAN address, spoofing could be going
on.
FIGURE 4-11
Spoofing of a client’s MAC address by a hacker’s computer.
technical TIP
The alternate data streams (ADS) of NTFS are a
feature added to this file system to support files from
POSIX, OS/2, and Macintosh. This feature was added
to NTFS in the mid-1990s to drive government
purchase of Windows NT. However, even with POSIX
and OS/2 support now dropped from Windows and
Macintosh hierarchical file system (HFS) support no
longer needed, NTFS has retained this feature. ADS is
the ability of a file to contain multiple resource forks.
The result of NTFS support for ADS is that not just
additional resources, but complete additional files, can
hide below any normal file object.
A normal file object, including directories, can contain
numerous additional files underneath itself. The
number of additional files is limited only by the total
amount of free space on the drive and the size of the
hidden files. Once a file stores as an ADS, it’s no longer
visible or easily accessible by the OS itself. Several
hacking tools can create and manipulate ADS. Only a
few scanning tools, such as Streams from
sysinternals.com, and only a handful of malware
scanners can specifically explore a drive for ADS
hidden code.
Spoofing is something to watch and filter for, but no real
or direct prevention of spoofing exists. Additionally, hackers
can intercept and modify data already in transit from a real
source if it’s not encrypted. Thus, spoofed data does not
always originate as falsified communications.
Covert Channels
Covert channels are hidden, unknown, unique, atypical
pathways of information transfer. The channel is covert
because it is unknown and unseen. Hackers use covert
channels for secretive communications, often to leak data
out of a secured environment. Covert channels are insecure
pathways of transmission. If the pathway were known, it
would be an overt channel and likely blocked, filtered, or
otherwise secured.
Two main forms of covert channels exist: timing and
storage. A timing channel conveys information through
timed and synchronized activities. A few potential examples
of timing covert channels include: Blinking lights to
distribute information in Morse code
Manipulating a fan’s speed so the higher and lower
pitched noise creates binary transmission
Throttling the bandwidth consumption on an Internet
link so that at a specific interval a utilization
measurement reads a value below 60 percent as a
zero and a value above as a one for binary
communications A storage covert channel conveys
information through unseen or undiscovered storage
locations. A few potential examples of storage covert
channels include: Using the unpartitioned space
of a hard drive to store data written via a hex editor
Using a firmware flash memory on-board chip to store
data
Using the alternate data streams of new technology
file system (NTFS) to hide files
Using the slack space of a hard drive to store data
The best defenses against covert channels include IDS and
IPS, as well as thorough monitoring of all aspects of an IT
infrastructure for aberrant or abnormal events of any type.
Predicting covert channels is difficult because by their very
nature they are unknown and unseen.
How Hackers Hijack Slack Space
A hard drive contains segments known as sectors. A
sector is the smallest fixed-size block of storage space
of a drive and is 512 bytes. When a file system is
applied to a partition, clusters are created out of
one or more sectors. Slack space is the unused
portion of the last cluster only partially consumed by
a stored file. The cluster:sector ratio typically ranges
from 1:1 to 1:128 for clusters of 512 bytes to 64 KB.
A file system has a fixed maximum number of
addresses assigned to clusters. Larger drives have the
same number of clusters as smaller drives, but the
clusters are larger. It’s a little like shoes: kids’ shoes
are one pair to a box, just like adults’ shoes, but the
box containing adults’ shoes is bigger. A cluster is the
smallest consumable element of storage space and
can contain data from only a single file. No native
mechanism addresses sub-cluster divisions in
standard file system formats.
When a file writes to a drive, it consumes as many
clusters as necessary to contain all of the data of the
file. All clusters but the final or last cluster containing
the file are filled. The last cluster is fully consumed
only if the file happens to be an exact multiple of the
cluster size (which is not very common). The unused
portion of the last cluster is known as slack space
(Figure 4-12). Slack space is effectively unusable,
wasted storage space.
Hackers have developed special file manipulation
tools that can locate and hijack the slack space and
use it to create hidden volumes on a hard drive.
These volumes are nearly impossible to detect
because they are not contained, referenced, or
addressed by the file system of the storage device.
Instead, the slack space drive exists only because
special software can address sub-cluster storage
locations. The slack space drive software operates
independently of the OS and the file system.
FIGURE 4-12
Slack space is the unused portion of the last cluster only
partially consumed by a stored file.
technical TIP
Web servers, or at least Web sites, appear on the
Internet in a least four different architectural
deployment options: reverse proxy, DMZ, co-location,
and hosting. Reverse proxy uses a static NAT mapping
or port forwarding to allow outside visitors to initiate
communications with an internal server. This is the
poorest security choice because it could grant hackers
access to the entire intranet if the Web server is
compromised.
Hosting a Web server in a DMZ is a more secure
solution. However, if compromised, a DMZ Web server
gives the hacker a weapons platform just outside of the
private network’s front door. Co-location is placing a
Web server host directly on an ISP network within a
facility. Hosting is leasing access to space on an
existing Web server owned and managed by the
hosting entity (squarespace.com is a great example).
These last two options are the most secure; if the Web
server/site is compromised, the hacker gains no
location benefit to breach the private network.
Network and Resource Availability
Threats
To be successful, many exploits and attacks require special
access on a private network. Some exploits will function
against an Internet facing Web server, but such a server
might not directly connect to a private network. If a hacker
is unable to find an exploitable vulnerability that gains
access or control over the targeted systems, a fallback or
final resort option is to launch availability attacks.
An availability attack aims at preventing legitimate
access or use of resources to delay or interrupt business.
Generally, this is known as denial of service (DoS) attack.
Denial of Service (DoS)
A denial of service (DoS) attack interrupts the normal
patterns of traffic, communication, and response. A DoS
attack interferes with timely processing and reply to
legitimate requests for resources. A DoS attack can be of
two primary forms: flaw exploitation or traffic generation.
FIGURE 4-13
Denial of service flooding attack against a client.
Flaw exploitation DoS attacks take advantage of a
programming bug, flaw, or convention. The DoS exploit
results in the system freezing, crashing, rebooting, or failing
to respond to external communications. You can mitigate
flaw exploitation DoS attacks through the application of a
patch and the use of an IDS or IPS system. Once you apply a
patch, the DoS will no longer be effective. Flaw
exploitation attacks are usually specific to a software
version.
Traffic generation DoS attacks flood a target with traffic
(Figure 4-13). The traffic consumes available bandwidth and
processing, preventing legitimate communications. No
patches exist to mitigate traffic generation DoS attacks.
Instead, traffic filtering is the only effective response.
Upstream filtering, however, is more effective than edge
device filtering.
Upstream filtering occurs when a parent network, usually
the ISP, provides filtering for traffic before it enters the child
network to which individual and business customers
connect. Edge device filtering will prevent malicious traffic
from entering the private network, but not prevent a
successful DoS. Only upstream filtering will reduce or
eliminate the DoS traffic and allow legitimate
communications to continue.
Distributed Denial of Service (DDoS)
Distributed denial of service (DDoS) attacks advance
DoS attacks through massive distributed processing and
sourcing. The foundation of DDoS is the agent, bot, or
zombie. Agents, bots, and zombies are malicious code
implanted on victim systems across the Internet. These
mobile agents may create their own peer-network
interaction or connect into a public communication medium,
such as an Internet relay chat (IRC) channel. The
resultant network is known as a botnet army or zombie
army.
The hacker remotely controls the botnet and directs it to
perform various malicious activities, including flooding
attacks, against selected targets. Generally, the main
targets of the botnet are known as primary victims, while
the compromised systems hosting the botnet’s agents are
known as secondary victims. This form of DoS is distributed
because the bots are disseminated across numerous
secondary victims and the resulting attacks originate from a
plethora of source vectors.
A hacker distributes the bots, agents, or zombies to
many secondary victims located throughout the Internet.
The bots then connect back to some form of communication
server, commonly a chat service like IRC, where they can
receive instructions from the hacker. Once the hacker sends
attack instructions, the bots launch attacks against the
primary target (Figure 4-14).
A botnet can perform a wide range of malicious actions
including flooding, spamming, eavesdropping, intercepting,
MitM, session hijacking, spoofing, packet manipulating,
malware distributing, phishing site hosting, password
stealing, encryption cracking, and more.
Several botnets have appeared in the last few years,
such as Storm and Conficker, which had an estimated
secondary victim base of 75 to 100 million systems.
FIGURE 4-14
Distributed denial of service flooding attack against a
primary target.
Defenses against DDoS focus on either avoiding
becoming a secondary victim or protecting against primary
victim onslaughts. To avoid becoming a secondary victim,
you should use measures including current antivirus and
anti-malware scanning, user behavior modification, firewall
filtering, and IDS/IPS solutions. Protection against primary
victim onslaughts includes firewall filtering, honeypots, and
IDS/IPS solutions.
Hacker Tools
Hacker tools include a wide variety of software, from
mundane native OS utilities to commercial applications to
custom coded exploits. Generally, any software put to a
malicious or unauthorized (according to company security
policy) use is a hacking tool.
Hacking tools perform hacking activities. All of the exploit
concepts mentioned in this chapter are possible through a
wide variety of hacking tools and utilities.
No master list of hacker tools exists to search for or block
access to protect IT systems. Just about every legitimate
program can be put to some illicit task. To defend generally
against hacker tools, consider using a whitelist restriction
system.
A whitelist restriction system incorporates a list of
software executables authorized for use. A user can launch
any application on the list. You block from running all
executables not on the list. A whitelist cannot focus on just
authorized filenames; this process uses a hash value, as
well, to prevent easy bypassing of the limitation through
simple file renaming.
In addition to whitelisting, you can reduce the threat of
hacking tools through limiting Internet downloads and file
exchanges, controlling use of portable storage devices
(especially those used on external systems), filtering e-mail
attachments, installing IDS/IPS solutions, and providing user
education.
Social Engineering
Social engineering is the art of manipulating and exploiting
human nature. Social engineering is the craft of
manipulating people into performing tasks or releasing
information that violates security. Social engineering is an
exploit that can almost always be performed against a
target organization. This is due to the presence of humans.
Humans are the primary targets of social engineering.
Humans are the weakest link in most security solutions
because humans are the only element in an organization
with free will. Every other element can perform only within
its programming and design. In addition, humans can be
tricked or fooled, while hardware and software can perform
only in accordance with its design and programming.
Social engineering can take place over any
communication method, including face-to-face, telephone,
e-mail, IM, and Web sites. Social engineering may focus on
extracting information from a target or convincing the target
to take action that alters the security status of a host or
network.
Many social engineering attacks stem from some form of
relationship, from initial and casual to business professional
to long-term and highly developed. The more in-depth and
long-term the relationship, the more leverage the hacker
can exploit to turn, trick, or abuse the target.
Social engineering can involve a wide range of
techniques, including impersonating a position of authority,
reciprocating favors, using social validation, and creating
urgency through scarcity. Often these attacks become more
successful if the hacker can impersonate an insider.
Gaining access to inside information is often the first
element of a social engineering attack. Dumpster diving,
using reconnaissance, and cold calling are techniques to
learn about the internal culture of the target. As a hacker
learns more and more terminology, processes,
organizational hierarchy, policies, events, gossip, social
occurrences, calendars, project scheduling, and so on, the
more that hacker is able to simulate being an insider. Once
a hacker fools a target into believing that he or she is just
another employee, the initial attack is successful. With the
standing gained, the hacker manipulates the target into
revealing more internal information, reconfiguring systems,
or downloading tools from questionable Internet locations.
Social engineering may be the first wave of hacker
attacks or could be the last-resort fallback plan if attempts
to perform logical intrusion or physical burglary fail. Some
hackers are naturally gifted at social engineering, while
others must practice to obtain workable competency at the
craft. These skills of social engineering are not unique to
this unethical activity; instead, they are the same skills most
people use in normal social situations when trying to get
their way, convince someone to go out on a date, ask for
help, improve social status, get out of trouble, lead a group,
sell and market, create advertising, and so on. The
difference is that hackers have an unethical goal in their use
of these skills.
Social engineering, primarily attacks against people, is
invulnerable to typical IT countermeasures. Instead, the
best defense against social engineering is thorough user
training and awareness. Once personnel are aware that they
are, have been, and will be targets of attack, they can adopt
a slightly suspicious and cautious outlook. Employees
should skeptically evaluate any activity, question,
interaction, or relationship that seems odd or out of place.
You can help reduce the threat of social engineering by
using security policies that employ information classification
with related restrictions on communication methods. If you
limit the communication channels that specific classes of
information traverse, you will reduce information leakage
caused by social engineering. For example, if you restrict
the use of passwords over the telephone or by e-mail, then
anyone who requests a password will be obviously
attempting to violate security. Employees should be trained
to report all such requests to the network security staff.
CHAPTER SUMMARY
Hackers are consistently seeking to take advantage of
anyone or any system not prepared or properly
secured. Understanding the various means of attacks
hackers commonly employ directly improves
awareness and overall network security.
Hackers often seek monetary gain through attacks
against individuals and organizations. Hackers can be
employees or outsiders. Compromising situations are
not limited to hacker attacks, but can also include
accidents, oversights, hardware failure, rapid growth,
and severe weather. Hacker tools and techniques
include malicious software, exploiting wireless
connections, eavesdropping, replay, insertion,
fragmentation, buffer overflow, XSS, man-in-the-
middle, session hijacking, spoofing, covert channels,
and the availability attacks of DoS and DDoS. You
should take action to restrict or limit hacker tools and
use caution and training to avoid social engineering.
Other hacking attacks and techniques than those
listed here are exist. This chapter offers a generic
description of the hacking process, not a definitive or
exhaustive examination. However, from this
foundation, you can develop a greater understanding
of hacking and the threats posed by hackers (as well
as other sources of threat and risk), leading to
improved security design, policy, and
implementation.
KEY CONCEPTS AND TERMS
Advanced persistent threat (APT)
Adware
Alternate data stream (ADS)
Arbitrary code execution
ARP spoofing
Banner
Banner grabbing
Blog
Botnet army
Buffer overflow
Chip creep
Cluster
Cold calling
Command shell
Contract worker
Covert channel
Cross-site scripting (XSS)
Deterrent
Dialer
Disgruntled employee
Distributed denial of service (DDoS) attack
DNS poisoning
DNS spoofing
Domain registration
Dumpster diving
Enumeration
Flaw exploitation attack
Flooding
Footprinting
Hacktivism
Hierarchical file system (HFS)
Honeypot
ICMP redirect
IDS insertion
Insertion attack
Instant message (IM)
Intentional electromagnetic interference (IEMI)
Interception attack
Internet relay chat (IRC)
Keystroke logger
Leetspeak
Logic bomb
MAC spoofing
Maximum transmission unit (MTU)
Mean time between failures (MTBF)
Mean time to failure (MTTF)
Metacharacter
MITRE
Mobile code
Monkey-in-the-middle attack
National Institute of Standards and Technology
(NIST)
New technology file system (NTFS)
Nmap
Non-authenticating query service
Opportunistic hacker
OS/2
Partition
Phishing
Ping sweep
Playback attack
Port scanning
POSIX
Privilege escalation
Professional hacker
Proxy attack
Proxy manipulation
Pwned
Reconnaissance
Recreational hacker
Redundant array of independent disks (RAID)
Return on investment (ROI)
Rogue access point
Rogue DHCP
Rootkit
Scanning
Script kiddie
Sector
Session hijacking
Shell code
Slack space
Social engineering
Spam
Spyware
SQL injection
Static electricity discharge (SED)
Trapdoor
Trojan horse
Unpartitioned space
Upstream filtering
URL injector
USENET newsgroups
Virus
Wardialing
Wardriving
Whois
Worm
Wrapper
Zombie army
CHAPTER 4 ASSESSMENT
1. All of the following are common or likely motivations for
a hacker except which?
A. Ego boost
B. Social validation
C. College credit
D. Challenge
E. Adventure
2. Which of the following potential hackers represents the
greatest threat because they likely already have
physical and logical access to a target?
A. Consultant
B. Competitor
C. Overseas black hat for hire
D. Customer
E. Recreational hackers under 16 years old
3. Which of the following is not a significant threat to
availability?
A. Natural disasters
B. Hardware failure
C. Accidental spills
D. Stateful inspection filtering
E. Lack of proper training
4. Which of the following is not a potential consequence of
a malware infestation?
A. Corruption of data
B. Leaking of confidential information
C. Crashing of systems
D. Identity theft
E. Improved throughput
5. What is the primary difference in network security
between a wired connection and a wireless connection
to a private LAN?
A. Inability to access all network resources
B. Lack of realistic throughput
C. Needing to be inside the building to access the
network
D. Ability to support encrypted sessions
E. Support for multi-factor authentication
6. Most exploits are based on the existence of which?
A. Encryption
B. Filtering
C. Humans
D. System anomalies
E. Synchronization
7. What is the first stage or step in the hacking process?
A. Scanning
B. Penetration
C. Enumeration
D. Privilege escalation
E. Reconnaissance
8. Which form of attack captures authentication packets to
retransmit them later?
A. Insertion
B. Hijacking
C. Replay
D. Interruption
E. Spoofing
9. Which form of attack can potentially evade an IDS?
A. Virus
B. Insertion
C. Man-in-the-middle
D. ARP poisoning
E. Rogue DHCP
10. Which exploit takes advantage of variable MTUs?
A. Spoofing
B. Hijacking
C. Covert channels
D. DoS
E. Fragmentation
11. Which form of attack submits excessive data to a target
to cause arbitrary code execution?
A. Buffer overflow
B. DDoS
C. Insertion
D. Interruption
E. Fragmentation
12. Which attack exploits a Web site to poison its dataset
so future visitors receive corrupted content?
A. Cross-site scripting
B. Proxy manipulation
C. Rogue DHCP
D. SQL injection
E. Hijacking
13. Which attack uses rogue DHCP, ARP poisoning, or ICMP
redirect?
A. Fragmentation
B. Injection
C. Man-in-the-middle
D. Social engineering
E. Buffer overflow
14. Which attack is preceded by eavesdropping?
A. SQL injection
B. Hijacking
C. IDS insertion
D. Covert channel
E. XSS
15. Which attack is based on the impersonation of a
legitimate host?
A. DoS
B. Replay
C. Fragmentation
D. Spoofing
E. Hijacking
16. Which method of communication is unseen, unfiltered,
and based on timed manipulations?
A. Buffer overflow
B. Man-in-the-middle
C. DDoS
D. Covert channel
E. IDS insertion
17. Which form of attack is based on malware distributed
by Trojan horse or worm and can generate massive
levels of traffic toward a primary target from numerous
source vectors?
A. Fragmentation
B. Hijacking
C. DDoS
D. Playback
E. XSS
18. Which attack uses non-technical means to achieve
results?
A. Spoofing
B. SQL injection
C. Buffer overflow
D. Covert channels
E. Social engineering
19. A hacker writes an exploit to compromise targets due to
the presence of which?
A. A vulnerability
B. Multi-factor authentication
C. Sufficient throughput
D. A bot army
E. Traffic filtering
20. What is the primary benefit to network security of
knowing hacker attacks and exploits?
A. Training contract workers
B. Improved antivirus detection mechanisms
C. Defending against specific threats
D. Alterations of network subnet organization
E. Reduced infrastructure cost
PART TWO
Technical Overview of
Network Security,
Firewalls, and VPNs
CHAPTER
5
Network Security Implementation
CHAPTER
6
Network Security Management
CHAPTER
7
Firewall Basics
CHAPTER
8
Firewall Deployment
Considerations
CHAPTER
9
Firewall Management and Security
CHAPTER
10
Using Common Firewalls
VPN Management
CHAPTER
11
CHAPTER
12
VPN Technologies
CHAPTER
5 Network Security
Implementation
IMPLEMENTATION is the act of designing, installing, deploying, and configuring network security. This chapter
focuses on the foundations of network security essential to
every organization, from an individual computer at home to
a multinational corporation’s network. The foundations of
security apply universally no matter the size, purpose, or
function of computers and networking.
The foundations of network security include layered
defenses, proper use of protocols, communication
management, system hardening, and more. Based on some
common, often simple, principles, you can significantly
improve your organization’s computer systems. Following
the suggestions in this chapter will reduce the risk of system
compromise from accident, oversight, Mother Nature, or
malicious intent.
Chapter 5 Topics
This chapter covers the following topics and
concepts:
What the seven domains of a typical IT
infrastructure are
What network design and defense in depth
are
What protocols and topologies are
What common types of addressing are
How to control communication pathways
How to harden systems
Which method to use for selecting
equipment
What authentication, authorization, and
accounting are
What communication encryption is
What the best architecture is: local hosts
only or remote and mobile hosts
What redundancy is
What node security is
Chapter 5 Goals
When you complete of this chapter, you will be
able to:
Describe elements of network security
design
Compare and contrast public and private
addressing as well as static and dynamic
addressing
State the importance of system hardening
Describe why authentication, authorization,
accounting, and encryption are essential for
network security
Identify the security concerns of local hosts
as well as remote and mobile hosts
Define the elements of node security
Seven Domains of a Typical IT
Infrastructure
Seven domains are commonly found in the typical IT
infrastructure (Figure 5-1) of moderate-sized to large
organizations. These seven domains were introduced in the
first chapter, but in the context of network security
implementation, they require more detail and focus.
Hackers look for every opportunity to exploit a target. No
aspect of an IT infrastructure is without risk or immune to
the scrutiny of hackers. When designing and implementing
network security, you need to analyze every one of the
seven domains of a typical IT infrastructure for potential
vulnerabilities and weaknesses. Security measures must be
detailed, focused, and exhaustive. You must consider every
possible avenue of attack, assess risk, and if the risk is
sufficient, apply a countermeasure. Failing to do so will
leave an open pathway for a hacker. A hacker needs only
one crack in your defenses to begin chipping away at the
security of the entire network.
Each of the seven domains of a typical IT infrastructure
has unique aspects that need security improvements. A
quick list of important foundational network security issues
related to these seven domains is pertinent here:
User Domain—This domain refers to the actual users,
whether they be employees, consultants, contractors,
or other third parties. Any user who accesses and uses
the organization’s IT infrastructure should review and
sign an acceptable use policy (AUP) prior to being
granted access to the organization’s IT resources and
infrastructure. This domain should also be the focus of
training, strong authentication, granular authorization,
and detailed accounting. Additionally, many of the
protections added to other domains provide additional
protections for and against the user domain.
FIGURE 5-1
The seven domains of a typical IT infrastructure.
Workstation Domain—This domain refers to the end
user’s desktop devices such as a desktop computer,
laptop, VoIP telephone, or other endpoint device.
Workstation devices typically require security
countermeasures such as antivirus, anti-spyware, and
vulnerability software patch management to maintain
the integrity of the device. System hardening,
communication protection, and positioning of work
stations are critical to security.
Local Area Network (LAN) Domain—This domain
refers to the physical and logical local area network
technologies used to support workstation connectivity
to the organization’s network infrastructure. Protocols,
addressing, topology, and communication encryption
provide security for this domain.
LAN-to-Wide Area Network (WAN) Domain—This
domain refers to the organization’s internetworking
and inter-connectivity point between the LAN and the
WAN network infrastructures. Switches, routers,
firewalls, proxies, and communication encryption are
important aspects of security for this domain.
Remote Access Domain—This domain refers to the
authorized and authenticated remote access
procedures for users to remotely access the
organization’s IT infrastructure, systems, and data.
Remote access solutions typically involve SSL 128-bit
encrypted remote browser access or encrypted VPN
tunnels for secure remote communications. Knowing
where a host is located helps determine the types of
security necessary on that host.
WAN Domain—Organizations with remote locations
require a wide area network to interconnect them.
Protocol selection, addressing schemes, and
communication encryption are elements of securing
this domain.
System/Application Domain—This domain refers to
the hardware, operating system software, database
software, client-server applications, and data that are
typically housed in the organization’s data center
and/or computer rooms. Network design,
authentication, authorization, accounting, and node
security are important security concerns for this
domain.
Network administrators need to recognize that the potential
for compromise exists throughout an organization. This
recognition leads the need for adequate network security
throughout an organization. Starting from the knowledge
that risk exists and threats loom, network security
administrators can design and implement appropriate
countermeasures and safeguards.
Network Design and Defense in Depth
Every network is different. However, common security
principles apply to any network, regardless of its unique
elements. One of these common principles is secure
network design. Secure network design embeds core
protections and improvements into an IT infrastructure
before it is implemented. Design comes from planning.
Planning comes from sufficient knowledge and
understanding.
Common security goals include confidentiality, integrity,
availability, privacy, authentication, authorization,
nonrepudiation, and accounting. To efficiently accomplish
these goals, informed planning assists you in designing the
network before deployment.
An underlying fundamental of network security design is
that no security solution is perfect. Any single security
protection, countermeasure, and safeguard is insufficient.
Hackers will use some method, technique, or exploit to
bypass, evade, or render useless a security protection. The
potential concerns include placement, programming flaws,
default settings, maximum values, processing capabilities,
memory capacity, backdoors, malicious code, social
engineering, and physical attacks. This list is not
exhaustive, but represents the key issues. In theory, no
security solutions are sufficient and complete.
Thus, you need to use multiple security components. This
is known as defense in depth or multiple layers of defense
(Figure 5-2). If you follow a defense-in-depth design concept,
numerous safeguards will protect each asset. As one
defense tool interlocks with another, they overlap and
improve the overall security. The strengths and benefits of
one countermeasure supplement or compensate for the
weaknesses and limitations of another.
Defense in depth leads many security professionals to
two additional guidelines. First, avoid single points of failure.
Second, divide and conquer. A single point of failure is any
element, component, or aspect of a system that could lead
to failure or compromise of the entire system. Divide and
conquer is the process of separating a large project into
multiple smaller and more manageable pieces.
FIGURE 5-2
An example of defense in depth around an asset.
Avoiding single point of failure must take place on
multiple fronts. A hacker needs only a single flaw or
weakness to exploit a target. Efforts should focus on finding
and eliminating as many vulnerabilities as possible to
remove the single points hackers seek to exploit.
Good design filters every user interaction with an asset
multiple times. This filtering should include authentication,
authorization, content filtering, and context filtering. Only
relying upon a single filter or check system is a form of a
single point of failure. Always assume that any one service
or function is flawed or will fail.
Effective network design monitors and examines all
activities against an asset using multiple techniques. This
could include object auditing, server monitoring, client
monitoring, network monitoring, and so on. Only using a
single monitoring viewpoint could be a single point of
failure. Everyone has seen video footage from a single
perspective that guides the viewer into seeing or believing
one thing, but from another camera angle the truth, the
trick, or an alternate explanation becomes clear.
Divide and conquer is not just a tactic for waging actual
war; it is also a tactic in the war against network security
breaches. By dividing up a larger project or task into
manageable components, you can focus on and care for
each component to ensure accuracy and completeness in
addressing network security concerns. Attempting to tackle
the security of a network as a whole is often a recipe for
disaster. Evaluating the big picture is always a good idea,
but working exclusively on the whole may lead to
overlooking details or missing subtle nuances only
perceived upon close detailed inspection.
A layered security approach throughout the IT
infrastructure works best: slow, methodical,
compartmentalized, and thorough. Properly designed
network security should support timely delivery of
information and adequate response during transactions. A
properly secured network provides reliable and stable
communications. Well-designed security adapts to changing
conditions. Well-designed security anticipates future growth
and expansion.
Designing network security is neither a simple nor a
short-term task. Thorough network security design must
include adequate research, thorough planning, and
extensive modeling and testing. The process of security
design must evaluate a wide range of technologies
performing an astounding number of functions.
Ultimately, good network security design produces a
blueprint to guide the construction of a securely functioning
network infrastructure. The blueprint is the foundation for
your organization’s security policy. Most network designs
have limitations. These limitations include budget, internal
politics, regulations, standards, and industry practices.
Network design should focus on providing the best security
possible within prescribed budgetary boundaries.
One method to reduce compromise by hackers is to keep
them from finding your network as a target. By staying
offline and only using trusted communication pathways,
your organization can avoid significant levels of risk.
However, this form of technological hide and seek is not
perfect, nor does it eliminate all issues. External hackers
might not be able to hack a non-Internet-connected intranet
from the outside; however, the risk from disgruntled
employees and other internal users is still present.
The idea of hiding from danger is commonly known as
security through obscurity. While it’s true that if you are
not found, you cannot be attacked, the issue is often a false
hope if obscurity rather than actual countermeasures and
safeguards protect the network. Being obscure or difficult to
locate may be a good thing, but it’s not itself a form of
reliable security. Use only direct and real security defenses
when you are designing network security.
Security is essential to the long-term survival of any
modern organization. Without security, logical, physical, and
social breaches would render most companies vulnerable to
failure. But security cannot work without balance. You can
over-secure an infrastructure to the point where security
interferes with work tasks. Usability and security must be in
balance. Usability will not survive long without security, and
too much security can cripple usability. Good network
security design balances security and usability.
One goal of most organizations is to expand and grow.
They often seek to attract new customers, support more
clients, sell more products, offer more services, make more
money, and so forth. But growth can be a two-edged sword.
While growth can lead to a more reliable and assured future,
it can also cause growing pains. For any organization,
growing pains occur when the existing infrastructure,
facilities, and even personnel are pushed to the limit or
beyond to support the additional workload caused by
growth.
Growth can be expected, unexpected, gradual, or abrupt.
A proper network design process evaluates and predicts
potential growth scenarios and plans contingencies for each.
One contingency for growth is to build additional capacity
into the current infrastructure. If slow growth is expected,
then 20 percent additional capacity may be sufficient, while
rapid growth may consume 50 percent additional capacity in
a short time (Figure 5-3).
FIGURE 5-3
Rate of growth used to predict needed additional capacity.
Growing too fast is as much of a burden as shrinking. As
an organization stretches beyond its capacity to support,
sell, create, maintain, respond, produce, and so forth, small
problems quickly snowball into avalanches. Steady,
controlled, limited growth is often a method of ensuring
long-term viability and stability. This is true in general
business management and it’s true in network security
design.
During the network design phase, consider the scalability
of all technologies you select for deployment. Does a
component or system have a maximum value or limitation it
will quickly reach? Can the component or system expand
without compromising efficiency, cost effectiveness, and
security? Will the component or system need replacement
by a scalable solution once moderate growth occurs? If so,
why not use the scalable solution now? Planning for growth
will reduce problems associated with outgrowing function
and security capacity.
No security endeavor will succeed without the active
involvement of senior management. In fact, without its
explicit approval and support, any security effort is likely
doomed to fail. Senior management has the responsibility to
dictate the strategic goals and plans of the organizations
and, hence, its IT infrastructure and integrated security.
Senior management must approve budgetary funding,
encourage compliance, and support security, even when
problems occur.
Throughout the entire design and implementation
process for network security, senior management monitors
and approves progress reports. Senior management steers
the organization and its security planning through the
changing business environment. But secure network design
isn’t only about following the leader; it’s also about
integrating every employee into the overall security design
process. Security is the responsibility of everyone in the
organization, not just managers and executives.
The elements of secure network design touch on every
aspect of an IT infrastructure. This includes hosts, nodes,
communications, encryption, local and remote systems,
redundancy, and more. Often, the process of designing
security starts by focusing a central or core element found
throughout the infrastructure. Examples of distributed core
components are networking protocols and topologies.
Protocols
A significant portion of network security is about making the
right technology choices without falling into easy traps or
defaults. One common trap is to continue doing the same
thing or using the same product. You need to re-evaluate old
technologies and existing solutions on a regular basis. Most
organizations choose to perform a security design
evaluation annually. When performing a security evaluation,
rethink every aspect of the infrastructure, including network
protocols.
Most networks use Transmission Control Protocol/Internet
Protocol (TCP/IP) as their primary network protocol.
Specifically, most networks still use IPv4 as opposed to IPv6.
Using IPv4 is not an open invitation for hackers, but it does
have numerous commonly exploited weaknesses and
concerns. IPv4 typically defaults to a plaintext form of
transmission, while IPv6 can be set by default to encrypt
transmissions. IPv4 can be encrypted using IP Security
(IPSec) or other virtual private network (VPN) protocols.
Other issues to consider include:
Is the current protocol easy to compromise?
Are there numerous exploits for this protocol available
for novice hackers?
Can encryption be applied?
Is the process of adding encryption complex or costly?
Will encryption interfere with other technologies such
as IPSec and network address translation (NAT)?
Is there an alternative or replacement available?
Is the alternative backward compatible?
Is the alternative supported by all current hosts and
nodes?
This is only a partial list of questions you need to consider
when assessing the currently deployed networking protocol
for possible replacement. The point is to give serious
consideration to this issue on a regular basis. Most of the
elements of a network’s security are based on the protocol
in use. If the protocol has changed or improved, this could
cause sweeping changes throughout the production
environment—most importantly in the security of that
environment.
As a general rule of thumb, if most hosts and software
are less than five years old, then upgrading to IPv6 is likely
possible with minimal complication. However, if IPv4 with
IPSec or other forms of encryption are functioning well
within performance and security parameters, there’s no
strong need to upgrade to IPv6.
When you consider a protocol upgrade, you’ll need to
thoroughly research and test every aspect of the production
and security environment to confirm compatibility with IPv6.
Any transition is going to have some hurdles, and certainly
switching the main network protocol is a candidate for major
hurdles. Perform the rollout of a protocol change in stages,
only after piloting in a lab, and consider running dual
protocols for a transition period.
TCP/IP, or at least IP itself, is not the only protocol in use
on most networks. Every single protocol across every
theoretical layer of the OSI model network protocol stack
needs re-evaluation on a regular basis. Do you still want to
continue using Simple Mail Transfer Protocol (SMTP)
and Post Office Protocol (POP)? What about File
Transfer Protocol (FTP), Network News Transfer
Protocol (NNTP), and telnet? If a protocol operates in
plaintext, consider using a protocol with native encryption
or investigate the possibility of encapsulating it inside an
encrypting tunneling protocol, such as IPSec or SSL/TLS.
Are AppleTalk, Internetwork Packet
Exchange/Sequenced Packet Exchange (IPX/SPX),
Systems Network Architecture (SNA), NetBios
Extended User Interface (NetBEUI), or other protocols
still present on the network? Are they still necessary? Have
the older systems requiring them been replaced or
removed? Can newer secure alternatives replace these older
and insecure protocols? Can any system still using a legacy
protocol be replaced to gain host security and remove the
protocol?
Don’t let tradition, personal bias, or sunk cost get in the
way of making a smart security design decision. Just
because something has always been done a certain way
doesn’t mean it should continue to be done that way,
especially if the old way was insecure. Personal bias in
terms of likes, dislikes, comfort, and familiarity are not good
business reasons to avoid moving on to more secure
solutions.
Sunk cost is the money or investment already made in
the past, as opposed to prospective costs that are
investments likely in the future. Often, those managers
overly concerned with wasting resources already invested
will make poor decisions. Avoiding loss is a good principle of
business, but just because you have already spent some
money, time, and effort does not mean you should continue
on a set path. Often, throwing good money after bad is
compounding the loss due to sunk cost. If the future benefit
of an existing system, solution, or product is not assured,
then no amount of sunk cost justifies its continued use. In
most cases, you should analyze only future costs and
benefits in making a decision. Already incurred expense
(sunk cost) should not influence future choices.
Common Types of Addressing
Addressing is the assignment of a logical numbering system
to the hosts on a network for the purposes of efficient traffic
routing. Addressing is more than just a system imposed by a
network topology; it’s often a means to control traffic. Traffic
managing through routing and traffic filtering are possible
through the use of logical addresses.
The most common protocol in use worldwide is TCP/IP.
This network protocol dictates the most common addressing
scheme. The addressing schemes of IPv4 and IPv6 are quite
different. Some common elements, security concerns, and
management techniques remain consistent, however.
Internal IP addresses can be public addresses, private
addresses, or a mixture of both. A public address is an
address issued by the IANA, monitored by RIRs, and leased
directly through ISPs. The Internet Assigned Numbers
Authority (IANA) (http://www.iana.org/) is the entity
responsible for global coordination of IP addressing, DNS
root, and other Internet protocol resources. A Regional
Internet Registry (RIR) is one of five regional
organizations that oversee and monitor the use and
assignment of IP addresses (both IPv4 and IPv6). An Internet
service provider (ISP) may randomly assign or
semipermanently lease an IP address to an individual or
organization. Public addresses are those obtained from an
ISP.
A public address also implies that it communicates
directly with resources on the Internet. The Internet itself
uses only public addresses. Without a public address, it’s
impossible to communicate to or receive responses from an
Internet-hosted resource.
NOTE
In the past, it was possible to purchase or own IP
addresses, specifically large groups or an entire class
of addresses. However, this practice is mostly no
longer possible, not because ownership of IP addresses
is prohibited, but because of the lack of available IP
addresses to sell. Many of the original Class A and
Class B subnet owners still own, control, and use their
purchased address. Some of these are actually ISPs
that now lease out subsets of their owned IP address
ranges. Today, most public IP addresses are leased
rather than sold or owned.
Public addresses are assigned from Class A, B, and C
ranges of the IPv4 address spectrum (as Class D and E are
reserved for multicasting and experimentation,
respectively). Public addresses for IPv6 are most of the
2^128 addresses, except for the fc00::/7 address block.
In a technical specification called RFC 4193, IANA set
aside the fc00::/7 address block for use as private addresses
for IPv6, similar to RFC 1918 for IPv4. RFC 1918, which
provides for private IPv4 addresses, sets aside three class
ranges for private use:
Class A—10.0.0.0–10.255.255.255/8 (1 Class A
network)
Class B—172.16.0.0–172.31.255.255/12 (16 Class B
networks)
Class C—192.168.0.0–192.168.255.255/16 (256 Class
C networks)
technical TIP
A DHCP reservation is the pre-assignment of a specific
IP address to a host by reserving it using the target
host’s MAC address. Reservations ensure that the same
address is always issued to a specific host. It can also
simulate static addressing, but retain centralized
control of address assignment.
A private address is used only within a private network.
Individuals and organizations without approval or a fee from
an outside entity can use private addresses. However, using
private addresses requires NAT services to communicate
with Internet resources. All Internet routers automatically
drop any packet with a private address in its header.
Private addresses serve as a basic isolation security
measure, as external entities with public addresses cannot
directly communicate with internal privately addressed
hosts. But a NAT server allows communication with Internet
resources.
You should review your organization’s choice to use
private or public addresses internally. The issue is not only
about saving money. Private addresses are free, while public
addresses are usually leased. Private addresses require
translation, while public addresses do not. Private addresses
are natively isolated from the Internet, while public
addresses are not. It’s even possible to mix private and
public addresses on an intranet.
Another addressing concern is whether to employ static
or dynamic addressing. Static addressing pre-assigns a
specific IP address to each host, while dynamic addressing
hands out IP addresses to hosts from a pool. Dynamic
addressing does not guarantee that a host will always have
the same address assigned to it, unless a reservation is
created for the host.
Static addressing typically requires that the IP address be
configured on each individual host. This ensures that a host
always uses the same IP address. However, if changes to
the network configuration or topology occur, manual
changes to IP addresses on a host-by-host basis involve a
significant amount of additional administrative overhead.
Because of this, most organizations use dynamic
assignment, typically using a Dynamic Host Configuration
Protocol (DHCP) system. If static addressing is preferred,
then DHCP reservations can simulate static addressing while
maintaining centralized control. With reservation based
static addressing, changes can be made by editing the
reservations on the DHCP server, without needing to
manually adjust each host individually.
When addresses are assigned dynamically, it may be
possible for a rogue system to come online and receive a
valid IP address just by asking. If addresses are assigned
statically, then the attacker will need to discover a valid but
unused IP address and manually configure his or her system
to use it. Similarly, if DHCP reservations are used, the
attacker will either statically assign his or her own address
manually or spoof a Media Access Control (MAC) address to
“borrow” an IP address from another offline system.
IPv6
While only a small percentage of global Internet addressing
is done with IPv6 addresses, and an equally small
percentage of exploits take advantage of it, it is important
for the security professional to stay up-to-date, and a
familiarity with IPv6 is important. IPv6 varies from IPv4 in
two important ways. Their packet headers differ in structure,
and an IPv6 address has a different size and construction
from that of an IPv4 address. There are also a handful of
transition mechanisms that allow IPv4 to ride inside of IPv6
packets and vice versa. The transition mechanisms make
the job of going between IPv4 and IPv6 easier but can be a
nightmare for security and policy enforcement.
An IPv6 address consists of 128 bits, as compared to the
32 bits of the IPv4 address. Addresses are classified into
various types for applications in the major addressing and
routing methodologies: unicast, multicast, and anycast
networking. In each of these, various address formats are
recognized by logically dividing the 128 address bits into bit
groups and establishing rules for associating the values of
these bit groups with special addressing features. There is
no Class A, Class B, etc. in IPv6 as there is in IPv4.
A unicast address identifies a single network interface.
The Internet Protocol delivers packets sent to a unicast
address to that specific interface.
An anycast address is assigned to a group of
interfaces, usually belonging to different nodes. A
packet sent to an anycast address is delivered to just
one of the member interfaces, typically the nearest
host, according to the routing protocol’s definition of
distance. Anycast addresses cannot be identified
easily, they have the same format as unicast
addresses, and differ only by their presence in the
network at multiple points. Almost any unicast address
can be employed as an anycast address.
A multicast address is also used by multiple hosts,
which acquire the multicast address destination by
participating in the multicast distribution protocol
among the network routers. A packet that is sent to a
multicast address is delivered to all interfaces that
have joined the corresponding multicast group.
IPv6 does not implement broadcast addressing. Broadcast’s
traditional role is subsumed by multicast addressing to the
all-nodes link-local multicast group ff02::1. However, the use
of the all-nodes group is not recommended, and most IPv6
protocols use a dedicated link-local multicast group to avoid
disturbing every interface in the network.
Address management is an important concern of network
security. Another concern is the management of
communication pathways.
Controlling Communication Pathways
Controlling the flow of information is a key element of
network security. This involves ensuring that data travels
along pathways isolated, secured, and controlled, and not
along pathways that are public, insecure, and uncontrolled.
Part of communication pathway control is about topology
selection, but it’s also about router configuration, encrypted
protocols, physical access management, and filtering.
Routers are the primary network devices administrators
use to control the pathways that communications traverse.
Failing to design router configuration and deployment with
security in mind is a serious oversight. Routers make real-
time determinations of the best available path to a
destination. However, the information available to a router
to make those decisions can be true and accurate or
incorrect, falsified, and misleading.
Secure network design includes protections for routers,
routing protocols, and routing information. Physical isolation
of a router is important to ensure that only authorized router
administrators can access the device itself. Failing to protect
routers physically means that the logical activities and the
resulting routes selected will not be trustworthy.
Routers employ routing protocols to exchange
information about routes and connected pathways. This
information calculates the best path to guide a packet
toward its destination. Depending upon the make and model
of router, the routing protocol, and the related
configurations, a hacker can spoof or manipulate routing
data through false Internet Control Message Protocol (ICMP)
type 5 redirect messages. Configure routers to accept
routing information only from other known routers through
authentication of the source. Consider also encrypting all
communications between routers.
Encrypted protocols are another important aspect of
communication pathway security. Even the best design,
proper installation, and reasonable physical isolation are not
guarantees that a wired or wireless communication channel
will not be the target of an eavesdropping, interception, or
man-in-the-middle attack. Assuming that physical access is
under your control all the time is naïve. The possibility of an
internal malicious entity or of the planting of a socially
engineered listening device always exists.
To thwart eavesdropping and related attacks based on
eavesdropping, you should encrypt all traffic over a network
communication link. This especially applies to any traffic
traversing a network segment physically accessible from
outside your organization’s facilities. But it also applies to
physically isolated and internal connections, as well.
Compromise of every physical connection is always
possible, so the best defense against content eavesdropping
is encryption.
Physical access management should always be a part of
communication pathway security. Even with encrypted
protocols, hackers can gain significant information by
eavesdropping on a network segment. Even if you encrypt
every single packet (which is often not the case),
eavesdropping can still glean a wide variety of information
about the protected communications.
Such gleaned information can include a count of the
number and size of packets. This can estimate the size of
the payload delivered, which in turn can extrapolate the
likely type of data, such as e-mail transmission, Web surfing,
file exchange, or database synchronization.
Eavesdropping can also glean the identity of the
endpoints of the secured communication. If the transaction
is using transport mode encryption, then the endpoints are
the actual sending and receiving hosts. If the transaction is
using tunnel mode encryption, then the endpoints are either
both VPN gateways or one end is a remote host.
Eavesdropping can also glean the general identity or
purpose of each endpoint discovered, based on the timing
of and volume of traffic sent to and from each discovered
endpoint. This can allow an outside user to reliably predict
which endpoint is a server, a client, or a VPN gateway.
Generally, data gathering through eavesdropping on
communications, whether encrypted or not, is known as
traffic and trend analysis. Such analysis can reveal many
important details about internal processes and the
importance, value, or criticality of systems. Thus, even with
encryption, prevention of physical access to communication
cables and wireless signals is paramount.
Filtering is another important part of communication
pathway security. The movement of data between
departments, subnets, WAN-connected LANs, and the
Internet requires that you monitor and filter communications
to prevent violations of disclosure, intrusion, and malicious
code infection.
Covert channels are a risk for many organizations in
communication pathway security and control. Covert
channels are pathways of communication unknown to or
uncontrolled by security systems or personnel. Covert
channels, whether timing- or storage-based, can leak
information out or bring malicious content in.
The best defenses against covert channels include IDS
and intrusion prevention system (IPS), as well as thoroughly
watching all aspects of an IT infrastructure for aberrant or
abnormal events of any type. Uncovering covert channels is
difficult because their very nature is to remain unknown and
unseen.
While planning and designing communication pathway
security, evaluate the protections you’ll need for inbound
and outbound traffic and how to manage internal-only,
external-only, or border-crossing communications.
You’ll need to examine inbound traffic by asking several
key questions. Is the inbound communication a response to
a previous request from an internal entity or is it a
communication that originates from an outside source?
Responses are often allowed, unless the initial request itself
was for a resource that’s off limits. Restrictions along these
lines include blocked protocols, IP addresses or domain
names, unauthorized services and applications, or users
without sufficient or correct authorization.
If the communication has external origins, rather than
being a response, is the communication generally allowed or
not? If the communication is for a resource offered to the
public, then the communication could be allowed. However,
if no public resources exist, the communication is more
likely unauthorized.
Is the source address in the communication from a
known or unknown location, and if known is it known to be
malicious or questionable? If the latter, then blocking the
traffic is more likely the proper security stance. Is the traffic
obviously spoofed? Does the traffic match any known
malicious patterns, have any construction anomalies, or
have questionable content? Can it otherwise be classified as
abnormal or atypical? In most of these cases, the packet
should be dropped rather than allowed to continue on to its
claimed destination.
You should subject outbound traffic to the same
investigations and analysis as inbound. Does the outbound
communication take place over an abnormal protocol or
port? Does it attempt to communicate with a blocked or
prohibited host or service? Is the traffic spoofed, does it
have abnormal time stamps, is it a clone of another packet,
or is it part of a flood?
Fortunately, inbound and outbound traffic filtering is the
primary function and purpose of firewalls using ingress- and
egress-focused filters. Secure communications pathway
management often requires the use of firewalls. Firewalls
are an essential element in secure network design.
One final area of concern for communication pathway
security is the difference between traffic management
based on whether the traffic is internal-only, external-only,
or border-crossing. Generally, internal-only traffic is more
trustworthy than any other form of traffic. In most cases,
internal traffic originates from a trusted internal host and
terminates at a trusted internal host. However, because the
possibility always exists of a rogue internal host or a
malicious insider, blindly trusting traffic just because it
originates internally is a security blunder.
A good practice is to treat all traffic with caution. Trust
nothing until it’s proven to comply with security policy and
not to match any known malicious patterns. Monitoring and
filtering of internal communications is as important as
monitoring external and border crossing communications.
Naturally, external-only communications are more likely
to be malicious, but since they do not end or originate from
an internal source, there’s usually little need for concern.
Malicious activity that does not attempt to breach your
network borders is not really your problem. However, if
external only communications are defined as those that do
not interact with your intranet but which may interact with
your DMZ or extranet, then you should be concerned.
With this definition of external only communications, you
must filter, monitor, and block the most obvious malicious
packets and events, but still allow any conforming
communication request even if the origin or source is
unfamiliar.
Border-crossing communications are those that either
leave the intranet heading to the Internet or enter the
intranet from the Internet. In either case, an increased risk
of compromise exists. Inbound communications could be
carrying malicious code or an intrusion attempt. Outbound
communications could be revealing internal secrets or
distributing confidential files. While these are extreme
examples, they’re not uncommon. Most border-crossing
traffic is benign, but since the risk of malicious traffic is
greater at border crossings, you need additional filtering,
monitoring, and blocking.
Controlling communication pathways is an important part
of managing and designing network security. But another
important piece of the security puzzle is management of
hardened systems between which the secured
communications take place.
Hardening Systems
Hardening systems focuses on improving security of hosts
and nodes. Hardening is the process of reducing the attack
surface of a potential target by removing unnecessary
components and adding in protections. While each
organization usually creates its own custom and internal
hardening processes and procedures, most hardening
guidelines have common elements and components.
Some of the common recommendations to improve the
security or harden a host include:
Remove all unnecessary protocols.
Uninstall all unnecessary applications and services.
Define a complex password for all accounts; do not
leave any account with a default password or a blank
password.
Configure account lockout and define a logon warning
banner.
Install all available final release updates, patches,
fixes, service packs, and so on for the operating
system and every remaining application and service.
Update all hardware device firmware or BIOS with the
latest final release from the vendor.
Install the latest final releases of all device drivers.
Install and update antivirus and anti-malware
scanners.
Configure communication encryption.
Install and configure a host firewall.
Use a file system that supports file level permissions
and auditing.
Configure system monitoring and auditing.
Synchronize the clock.
Run vulnerability assessment tools against the host,
such as HFNetChkPro and Nessus.
Configure regular backups.
Impose any organization-specific security limitations,
such as blocking USB drives or using whitelist
execution management. This is often performed using
a security template file.
In Windows, disable the guest account, and rename
the Administrator account. In Unix, establish policies
whereby the root account is never used directly, but
administrators must use the su command to obtain
root access (thus creating a log of their events).
In addition to these hardening suggestions, organizations
add additional steps to their securing procedures based on
the purpose of the system, the criticality of the system, and
the risk present in the environment.
Once you’ve hardened your system, you must maintain it
over time. On a regular schedule, re-examine every host
against your organization’s hardening policies to ensure
compliance. Remove from service any system out of
compliance with hardening policies until you are able to
bring it into compliance. Then investigate the cause of the
security noncompliance and take countermeasures to
prevent a re-occurrence.
Equipment Selection
Equipment selection is a commonly overlooked aspect of
secure network design. The general belief that any
hardware capable of performing an IT function is suitable for
deployment is, unfortunately, not the case. Both cheap and
expensive products may have well-known or not-yet-
discovered security flaws.
Arbitrarily or automatically choosing the least expensive
or the most expensive products isn’t a winning security
strategy. You should carefully evaluate each piece of
computer equipment, from network device to host system,
for its native security defenses or lack thereof, regardless of
its cost.
As you select, purchase, and deploy equipment, consider
the vulnerabilities introduced and any protections or
improvements to the infrastructure’s security stance. Every
piece of equipment will either improve security or reduce it
in some way. Some equipment adds new weak points or
expands the organization’s attack surface, while other
equipment will act as a countermeasure, protecting weak
points of other components and reducing the attack surface.
Whenever possible, select equipment providing greater
improvement to security rather than acting as a detriment.
This seems an obvious guideline, but you can only follow it if
you are conscientious about evaluating the security profile
of each device. Failing to evaluate the security of a new
device properly could mean that you inadvertently introduce
new vulnerabilities into the organization’s network and
systems.
Some of the security concerns regarding equipment
include:
Electricity consumption—Excessive energy use can
cause not only increased electric bills, but also
increased temperature within the device and on
electrical distribution systems. A circuit drawing too
much power can cause a breaker overload. A tripped
breaker causes downtime and may cause data loss
and equipment damage.
Heat produced—The more heat a device produces,
the more the heating, ventilation, and cooling (HVAC)
system must work to keep the temperature of the
room within acceptable boundaries. Excessive heat-
producing devices can also increase the risk of fire.
Reset button—A reset button is used to return a
device to the default factory settings. Any defined
security configuration on the device is lost if someone
presses the reset button. When possible, select
equipment without a reset button or a button that can
be disabled to provide physical security for the device.
Easy-access power switch—If the power switch is
easily accessed or triggered, casual contact with the
device could cause power interruption. Additionally, an
easy-access power switch allows a malicious person to
power off equipment or trigger a reboot.
Easy-access management console port or
interface—If device can be reconfigured through an
LCD screen and a few buttons (such as a printer) or if
a console or terminal port allows quick access to a
configuration or management interface (such as a
wireless access point, router, or switch), then use
caution when deploying the device and assess the
level of physical access security.
Removable media—Equipment with removable
media bays (such as tapes, optical discs, floppies, and
so on) or external peripheral ports (such as universal
serial bus [USB], firewall, Ethernet, and so on) may be
easier to compromise than those with fewer or none of
these access points.
Removable case—The easier it is to remove or open
the case of a device, the easier it is to hack into the
device, plant a listener, or modify its functions.
Portability—Is the device small enough to fit into a
pocket, purse, or backpack, making it easy to steal?
Rack mountable—A rack-mounted device is less
likely to be stolen once screwed into a rack case,
which can be locked.
BIOS/firmware flashing—Being able to change the
embedded software of a device is both a benefit and a
problem. Flashing to an updated, more secure version
of firmware is a positive benefit. However, being able
to replace firmware with a third-party version or an
older version with flaws could be a problem if a hacker
can perform this easily.
Remote connection—If remote connectivity to a
device is possible, then risk increases. Limit, encrypt,
and monitor remote connections.
Plaintext protocols—The more a device defaults to
or only supports plaintext protocols, the less secure it
is. Choose equipment than supports encryption.
Many other aspects of equipment security are important
when evaluating the deployment of a new device. Whether
a high-end server, a user’s notebook, a smartphone, a
network router, or anything else, consider the security of
equipment thoroughly and don’t just make purchasing
recommendations based on equipment cost.
Keep in mind those devices that are cheap or free up-
front may cost considerably more to manage and secure
over time than a more expensive device. However, just
because something has a high cost doesn’t ensure that it
has a low security management requirement. Money alone
is rarely the true measure of the security of anything.
Authentication, Authorization, and
Accounting
Security ultimately is supported and enforced by
authentication, authorization, and accounting (AAA). AAA is
part of field of security commonly referred to as identity
and access management (IAM). Without all three of
these security fundamentals properly implemented, real
security cannot exist.
Authentication is the verification or proof of someone or
something’s identity. The most common form of
authentication is the use of a password. While passwords
are the most common, they are also one of the weakest
forms of authentication. People typically pick passwords that
are easy to guess or that are somehow predictable. They
often reuse the same passwords on multiple systems.
Passwords reside in account databases in hashed form,
which means the original password can’t be recovered from
the hash value. However, by hashing large numbers of
potential passwords, password-cracking techniques can
potentially match a password hash to the target hash.
Password-cracking techniques including dictionary
password attacks, brute-force password attacks, and
hybrid attacks can often reveal poorly constructed
passwords.
technical TIP
Password cracking typically focuses on generating and
hashing large numbers of passwords with the goal of
matching a stolen or captured password hash.
Dictionary password cracking uses a pre-created list of
potential passwords. Each password from the list is
hashed using the same hashing algorithm as the
target/stolen password. If a match is found before the
list is exhausted, the attack is successful.
A brute-force password attack builds potential
passwords out of a selected character set, creating
ever longer and longer passwords using every possible
valid combination of characters. The hacker hashes
each crafted password and compares it to the target
hash until a match is found or the attack is abandoned.
Given enough time and the right character set, a brute-
force attack will eventually be successful.
A hybrid attack uses a dictionary list as seed
passwords that are then brute-force-modified. First the
hacker makes all possible one-character modifications,
then two, then three. This technique is often more
successful, since many people pick an easy-to-
remember word and then make only a few character
modifications, such as changing an “a” to an “@” or an
“l” to a “1” or just adding one or two characters.
The best defense against password-cracking
techniques is to select a long password. For example,
using at least 15-character passwords on Windows
systems avoids the weakness of the backward-
compatible (and vulnerable to brute-force cracking)
LANMAN hash of passwords 14 character or less.
Adding complexity (mixing multiple character types:
uppercase, lowercase, numbers, and symbols) and
using multiple words or phrases instead of a single
base word also improve password strength.
A dynamic password token is a device with a display
screen that shows a seemingly random non-repeating
one-time use password. The password displayed on the
token must be included in the logon process, usually
with a separate Type 1 PIN or password. This two-part
mechanism is a form of multifactor authentication.
Multifactor authentication is significantly more secure
than any single factor form of authentication. Passwords are
but one example of the first type of authentication factor.
Three commonly recognized authentication factors are:
Type 1—Something you know
Type 2—Something you have
Type 3—Something you are or do
Something you know can be anything you memorize so that
you can type, write, or speak it when asked to authenticate.
Passwords are the most common example of a Type 1
authentication factor.
Something you have can be anything you must physically
carry with you, such as a device or token. These can include
metal keys, smart cards, radio-frequency identification
(RFID) chips, ID badges, or electronic devices known as
dynamic password tokens.
Something you are or do is commonly known as
biometrics. Some part of the human body is used as an
element in an authentication process. This can include
fingerprints, retina scans, facial geometry, palm scans,
signature dynamics, keystroke dynamics, and voice-pattern
analysis.
A mixture of two or more authentication factors is
multifactor authentication. Multifactor authentication is
much more secure than single-factor. With single-factor
authentication, an attacker only needs to have a single skill
or exploit to successfully log on with a compromised user
account. With multifactor authentication, an attacker needs
to have multiple skills or exploits to successfully log on with
a compromised user account.
Strong authentication prevents unauthorized entities
from gaining easy access to the internal workings of an
organization’s infrastructure. Apply strong authentication to
the logical environment as well as the physical environment.
Authorization, commonly known as access control,
defines what actions a user can and can’t perform. Proper
granular use of authorization ensures that authorized users
perform only authorized activities.
The principle of least privilege is often a good guideline
on which are the most appropriate authorization settings to
make. This principle states that you should grant users the
fewest capabilities, permissions, and privileges possible to
complete their assigned work, without additional
capabilities. In other words, you grant users enough power
and access to perform their assigned work, but no additional
capabilities beyond their job descriptions are necessary.
Accounting is the activity of logging, monitoring, and
auditing the environment, focusing both on users as well as
system activities, to check for security policy compliance.
Accounting is the process of holding users and systems
accountable for their actions and activities. Through the use
of thorough accounting and detailed auditing, you can
detect and respond to any violations, attempts to violate, or
trends towards violations.
Remember, security is locking things down, and then
watching for attempts to breach the lock. Authentication
and authorization are forms of locking, and accounting is
the watching. However, these are not the only forms of
locking and watching on a secure network. Another
important area of network security is communication
encryption.
Communication Encryption
Communication encryption is the use of encryption
protocols to secure the contents of communications. Use
encryption anytime a transaction occurs with an outside
entity. Use encryption when a communication crosses a
segment that is at risk of eavesdropping. You should also
use encryption internally whenever the potential for loss or
compromise, even by internal personnel, would cause
significant harm to the organization.
You can protect transactions by encryption in two main
ways. One is to use encapsulating intermediary protocols
that provide encryption, such as IPSec and SSL/TLS; another
is to encrypt data before it goes to a network protocol.
Protocol encryption ensures that all or most data sent
over the network is safe from eavesdropping, modification,
and other forms of compromise. A widely used mechanism
of protocol encryption is that of a VPN. VPNs can function
between individual systems or between entire networks or
any other combination of endpoints.
Data encryption, performed either by the client or server
software, ensures that even if the protocol encryption fails
or is compromised, the data itself is safe by its own
encryption. Software or data encryption is not as
interoperable as protocol or VPN encryption, but it can be a
viable option when both endpoints of the transaction are
using compatible software components.
When in doubt, always encrypt. While not a perfect
solution (indeed, no perfect security solution exists),
encryption offers significant protections from outside
eavesdropping and modification. However, encryption fails if
the selected algorithm is poor, if key management is
insecure, if either endpoint of the communication has been
compromised (such as by hacker intrusion or planting of
malicious code), or if intermediary network nodes that
decrypt and reencrypt fail.
Choosing to encrypt by default is an excellent network
security rule of thumb. This guideline does not imply that
the same encryption protects both internal-only
communications as well as those that cross the network’s
boundaries. In deciding what encryption to use, it’s
important to consider where the hosts are located.
Hosts: Local-Only or Remote and
Mobile
When designing network security, focus on the function of
each device as well as the physical and logical location of
the device. When a host is local and communicates only
with other local hosts, then you can use slightly less
stringent security on internal communications. However,
when a host is remote or mobile or otherwise outside of the
private network, use significant additional precautions.
Once you allow remote access, you lose the benefit of
the physical access controls. Once you support remote
connectivity, a hacker or intruder need no longer be
physically present in a facility to launch an attack. Thus,
remote access itself is a risk, and it lowers the overall
security of an environment. To compensate for this security
reduction, you should impose more rigid limitations in terms
of authentication, authorization, and accounting.
As security is designed and deployed, consider the
purpose or function of each device, especially clients and
servers, as well as its location in one (or more) of the seven
domains of a typical IT infrastructure (refer to Figure 5-1).
Then, consider what other devices will need to communicate
with it. The more vulnerable the communications pathways,
the more security you will need to impose.
If both endpoints are physically located in the same
facility, but the network pathway linking them involves any
exterior segments, then the transaction demands greater
security than a local-only communication. If the endpoints
are geographically distant, then you need to use encrypted
communications.
Remote and mobile devices are inherently more risky as
they are exposed to a greater number of potential threats.
Inside the office, most threats are known, controlled, and
monitored. But mobile and remote devices are potentially
exposed to unknown, uncontrolled, and unmonitored
situations, data, software, and users. Being outside of the
organization’s facility also means less strictly controlled
physical access to the device.
technical TIP
Location-aware anti-theft software periodically collects
IP information and any available location data and
uploads it to a centralized site. If the owner of a system
reports the item lost or stolen, this automatically
posted data might help recover the device. However, if
the thief reformats the hard drive, then the anti-theft
software might be removed.
These changes to security and potential exposure to risks
require additional protections on remote and mobile
devices. These devices should continue to host antivirus
scanners, anti-malware scanners, and host firewalls. But
they can also benefit from whole hard drive encryption,
multifactor authentication, and location-aware anti-theft
software.
Remote and mobile devices are most likely to be out of
compliance with security requirements, such as patch levels
or application of security templates. A Network Access
Control (NAC) system can isolate and quarantine devices
until they have installed all the necessary patches and
updates.
Even with good host management, whether local,
remote, or mobile, consider redundancy requirements. Is
one of something enough or just enough to cause a
significant problem when it goes offline?
Redundancy
Security is not complete without adequately addressing
preparedness. Redundancy is at the heart of preparedness.
Can your organization survive downtime, blackouts,
communication loss, server crashes, hard drive failure,
floods, building eviction, virus infection, or any other
potential threat? In most cases the ability to answer, “Yes,
the organization can survive,” depends on the level of
preparedness of that organization.
Preparedness is also known as business continuity
planning or disaster recovery planning. The purpose of such
planning is to ensure a plan exists to recover from any
realistic threat. Assess each serious threat to the stability
and function of the organization. Then, develop procedures
to respond to the threat. The procedure can focus on
prevention or recovery (or a combination of both).
A core element throughout this form of planning is
redundancy. Redundancy is the act of avoiding single points
of failure by building in multiple elements, pathways, or
methods of accomplishing each mission-critical task.
Redundancy works in many ways. Redundant Array of
Inexpensive Disks (RAID) is a form of redundancy for hard
drives. RAID protects against drive failure. Uninterruptible
Power Supply (UPS) is a form of redundancy for power. UPS
devices provide temporary power in the event of a brownout
or blackout. A UPS can trigger a graceful shutdown to
prevent loss of data if facility power is not restored
promptly.
Redundancy can apply to communication pathways.
Good network design requires at least two pathways to
every important resource. Redundant links to and from
clients may not be a strong need in most cases, but having
multiple pathways to reach resources is often essential.
Redundant communication links for voice and data are
also important considerations. Construction workers could
accidentally dig in the wrong location and sever the primary
wire bundle supporting the organization. Redundant lines to
service providers could make the difference between a
nuisance and a company-ending event. Do you want to
leave the power of terminating your organization in the
hands of outsiders?
Redundant firewalls, proxies, routers, switches, servers,
and databases begin to make security and financial sense
once they become an essential or mission-critical element
of the IT infrastructure. Don’t entrust the viability of an
organization to any single component. Always have a
secondary option or backup plan.
Failing to plan is planning to fail. Hardware failures,
mistakes, accidents, or intentional damage will occur in
every system in an organization at some point. No
organization is immune. The difference is whether an
organization is prepared for the problem with a ready-to-use
response solution, or will be caught off guard, scrambling to
recover in a panic.
Endpoint Security
Implementing network security is about both the big picture
and the granular details. Infrastructure design, topology,
and redundancy are all important big-picture items. But do
not overlook the details that need attention on a node-by-
node basis.
A node is any device on the network, even those without
an IP address. Node security focuses on the tasks for each
type of networking device to improve its security. Node
security or node hardening takes the generic
recommendations of system hardening and expands them
with additional node/host specific improvements.
Clients
Clients are the devices directly controlled by people. Thus,
clients must protect the network from the user and vice
versa. Thinking of clients as two-way interfaces can assist in
proper security design and implementation for this
command and essential IT infrastructure component.
Every client needs the following security elements:
Antivirus and anti-malware scanners
Host firewall
Secured Internet client software such as browser, e-
mail, file transfer, and chat
Password-protected screen saver with auto timeout
Ability to encrypt network communications
Ability to encrypt storage devices
Auditing of all user activity
An integrity checking system that monitors for
unauthorized file changes using hash value
comparison
Clients should be subject to NAC procedures to prevent an
insecure client from compromising the rest of the network.
Use multifactor authentication whenever possible to
minimize the risk of an unauthorized person gaining access
to the client and hence the entire network.
Another recent shift for organizations is to allow, even
encourage, employees and contractors to Bring Your Own
Device (BYOD). The use of an individual’s personal cell
phone, tablet, personal laptop, or similar device lowers the
cost to the organization but also raises many different
security questions, which range from policy to
implementation. For instance, who is responsible for the
applications that are run on the device and their security?
Who owns and is responsible for the content and protection
of the files created on the device? What if the specific
device is incapable of running specific organization-decreed
security software such as antivirus or even VPN software? Or
what if the owner of the device just doesn’t want to allow a
security scan or to run certain software? BYOD brings along
with it a yet-to-be understood array of security problems—
problems that are growing in importance each day,
especially because of the growing population of BYODs and
because those devices are wireless.
Servers
Servers are the backbone of any IT infrastructure. Whether
a file server, database host, e-mail server, proxy server, or
authentication server, a server is usually supporting an
essential or mission-critical function for the organization.
Servers need protection against downtime. This can include
redundancy in terms of RAID, duplicate servers, and/or
clustering.
Duplicate servers means having two identically
configured systems running side by side, but only one is
performing services live for the network. The second system
is acting as a backup and receives all data changes as they
occur. In the event of the primary server failure, the
secondary server can take over supporting the services for
the network.
Clustering is having two or more identically configured
systems running as a collective. All the systems share in
supporting the live service to the network. If any member of
the cluster goes offline, the remaining members continue
supporting the service. Clustering allows for a service to be
available consistently while still allowing for scheduled
maintenance and occasional individual server downtime.
Servers need strong multifactor authentication to ensure
that only administrators ever have the ability to log into
them at the keyboard. You should sequester servers in a
dedicated room or vault to prevent casual or intentional
access by unauthorized users. Lock and monitor the server
vault at all times.
Routers
Routers are an essential traffic-management device of any
network. Network router security is primarily about
preventing unauthorized access. First and foremost, a router
should be physically inaccessible to any non-administrator.
All router configuration or management interfaces must
require strong authentication. Some environments have
elected to eliminate local accounts on the routers
themselves and rely upon Terminal Access Controller
Access-Control System Plus (TACACS+) for router
authentication and access.
Limit management interface access to a direct console or
terminal cable connection only, rather than allowing in-
network access. Require that all management interface
communications and router-to-router communications be
encrypted.
If a password is stored in a configuration file for the
router, be sure to use an encoding scheme that is not easily
cracked or reverse engineered. For example, the Cisco IOS
password 7 hashing method uses a weak reversible
algorithm and can be cracked easily using software tools
dating back to 1997.
Generally, configure the following on the router:
Block all directed IP broadcasts.
Drop all packets from the Internet using an RFC 1918
source address or any other internal address.
Disable the TCP and UDP small services of echo,
chargen, discard, and daytime.
Enable a warning banner for all attempted connections
to the router, especially to the management interface.
If SNMP is used on the network, require the use of SNMP v3,
which allows for encrypted transactions and authentication
of SNMP sessions. Then, use custom community names
rather than the default public or private communities.
Consider the software or firmware of the router. Only
install full final releases, never beta or partial firmware. If
you are concerned that the latest release has not been
thoroughly tested in the real world, sticking with a previous
release is acceptable, provided there are no published
reports of critical security flaws.
Try to limit the use of a router as a filtering device. Keep
the router table focused on traffic routing and implement
firewalls to provide content filtering and blocking of
suspicious or malicious traffic. Protect any router considered
a border router with a firewall.
Switches
Switch security is similar to that of router security. Maintain
control over who can physically reach the switch. Limit
access to management consoles and require strong
authentication to access the management interface. If a
password is stored in a configuration file for the switch, be
sure to use an encoding scheme not easily cracked or
reverse engineered.
If SNMP is used on the network, require the use of SNMP
v3, which allows for encrypted transactions and
authentication of SNMP sessions. Then, use custom
community names rather than the default public or private
communities.
Consider the software or firmware of the switch. Only
install full final releases, never beta or partial firmware. If
you are concerned that the latest release has not been
thoroughly tested in the real world, sticking with a previous
release is acceptable, provided there are no published
reports of critical security flaws.
Consider deploying switches that support IDS-like
features such as watching for MAC spoofing and ARP
flooding. MAC spoofing tricks a switch into thinking a
hacker’s computer is actually a legitimate host. The hacker
steals or spoofs a legitimate MAC address. If a switch is
monitoring for MAC addresses that change ports, then MAC
spoofing ceases to be a serious threat unless a hacker can
physically access the port connection of the MAC he or she
is trying to spoof.
ARP flooding overloads a switch’s mapping table so that
instead of forwarding packets out the correct port, the
switch will default into flooding mode and transmit packets
out all ports. This type of attack is part of active sniffing.
Active sniffing is an attempt to eavesdrop on switched
networks.
Use switch features such as Virtual Local Area Network
(VLAN) support and auditing ports. VLANs are hardware-
imposed network segmentation. VLANs control traffic. Using
VLANs to manage traffic is often cost-effective, since it does
not require re-cabling or changing of IP addresses; all of the
VLAN configuration takes place within the switch.
The audit, mirror, or IDS port on a switch connects an IDS
or IPS to monitor all the traffic traversing the switch. Since a
switch only transmits data out the port where its intended
destination resides, attempting to monitor all traffic on a
switched network is not possible without the use of the
auditing port.
Also, disable all unused switch ports. This prevents the
easiest method of adding rogue devices to a network—
namely, plugging into an open port.
Firewalls and Proxies
Firewalls and proxies defend the network, but you need to
secure them as well. Otherwise, if a hacker can compromise
the firewall, then the security it provides is unreliable.
Firewalls and proxies, as with routers and switches, need
physical access protection. No non-administrative user
should be able to gain direct physical contact with a firewall
or proxy. Limit access to management consoles and require
strong authentication to access the management interface.
If a password is stored in a configuration file for the firewall
or proxy, be sure to use an encoding scheme not easily
cracked or reverse engineered.
If simple network management protocol (SNMP) is used
on the network, require the use of SNMP v3, which allows for
encrypted transactions and authentication of SNMP
sessions. Then, use custom community names rather than
the default public or private communities.
Consider the software or firmware of the firewall or proxy.
As noted earlier, only install full final releases, never beta or
partial firmware. If you are concerned that the latest release
has not been thoroughly tested in the real world, sticking
with a previous release is acceptable, provided there are no
published reports of critical security flaws.
A firewall should drop all packets addressed directly to
the firewall, as the firewall does not host traditional services
accessed in this manner. The same is generally true of a
proxy server, but some instances apply where the proxy
server is either directly communicated with or that hosts
additional accessible resources.
Make a final security evaluation of any device, including
firewalls, proxies, switches, routers, servers, and clients. You
can perform this evaluation using an automated
vulnerability scanning tool or a custom manual penetration
test. The goal is to find any remaining vulnerabilities in
these devices so they can be made as secure as possible, as
quickly as possible.
CHAPTER SUMMARY
Network security implementation relies on a thorough
understanding of your organization, its goals, its risks,
and the technologies employed within your IT
infrastructure. Before you can properly deploy
network security, you must first design it. Most
network security designs include layers of defense as
well as sufficient capacity for growth.
Network security includes an evaluation of the
protocols and topologies your organization uses. If
the current design is insufficient, replace it with a
design that addresses productivity and security. You
need to assess the addressing schemes in use,
whether public or private, static or dynamic, in light
of how they improve or detract from security.
Other important components of network security
design and deployment include controlling
communication pathways; hardening systems; and
selecting proper equipment, authentication,
authorization, accounting, communication encryption,
types of hosts, redundancy, and node security
specifics.
KEY CONCEPTS AND TERMS
AppleTalk
Attack surface
Bring Your Own Device (BYOD)
Brute-force password attack
Dictionary password attack
File Transfer Protocol (FTP)
Hybrid attack
Identity and access management (IAM)
Internet Assigned Numbers Authority (IANA)
Internetwork Packet Exchange/Sequenced
Packet Exchange (IPX/SPX)
Modeling
NetBIOS Extended User Interface (NetBEUI)
Network News Transfer Protocol (NNTP)
Piloting
Post Office Protocol (POP)
Regional Internet Registry (RIR)
Security through obscurity
Simple Mail Transfer Protocol (SMTP)
Sunk cost
Systems Network Architecture (SNA)
Telnet
CHAPTER 5 ASSESSMENT
1. Which of the following is not an important factor when
included as part of network design?
A. Usability
B. Capacity
C. Obscurity
D. Growth
E. Defense in depth
2. All of the following are elements of network design
except:
A. Satisfying security goals
B. Understanding of the seven domains of IT
infrastructure
C. Implementing multiple layers of defense
D. Thorough research and planning
E. Utilizing a single vendor
3. Which IT infrastructure domain does not require
firewalls to be included as part of its network design?
A. Workstation Domain
B. LAN Domain
C. User Domain
D. Remote Access Domain
E. System/Application Domain
4. Which of the following is a benefit of private addressing
that is not present in public addressing?
A. Isolation from the Internet
B. Subnetting
C. Use of IPv6
D. Routing traffic
E. Filtering by source and designation address
5. Why would a network implement public addresses
internally instead of private addresses?
A. To avoid the use of NAT
B. To be able to custom subnet
C. To maintain isolation from the Internet
D. To prevent external initiation of communications with
internal hosts
E. To reduce costs
6. How can static addresses be simulated with DHCP?
A. Round robin assignment
B. Manual configuration on each host
C. Duplicate MAC addresses
D. Reservations
E. DNS reverse lookup
7. Which of the following is a flaw or weakness that both
static and dynamic addressing share?
A. The assignment server can go offline.
B. Changes require manual modification on each host.
C. Public queries will fail.
D. Hackers can spoof valid addresses.
E. The first half of the address identifies the NIC vendor.
8. What is a primary benefit of system hardening?
A. It reduces user performance.
B. It increases network throughput.
C. It decreases the attack surface.
D. It improves host ROI.
E. It tracks attempted intrusions.
9. All of the following are elements of system hardening
except:
A. Removing unnecessary protocols, services, and
applications
B. Implement ingress and egress filtering against
spoofed addresses
C. Installing patches and updates
D. Configuring encryption for storage and
communication
E. Installing antivirus and a host firewall
10. All of the following are true statements about system
hardening except:
A. System hardening is a one-time process that does not
need to be repeated on the same host.
B. System hardening removes or reduces many known
vulnerabilities.
C. System hardening is different for each system with a
unique function.
D. System hardening is dependent on the location or
placement of a host within the seven common
domains of an IT infrastructure.
E. Any system discovered to be out of compliance with
system hardening guidelines should be quarantined
until it can be repaired.
11. System hardening should be applied to all of the
following except:
A. Clients
B. Servers
C. Switches
D. Routers
E. Cable adapters
12. Which of the following is not usually part of the system
hardening process?
A. Updating hardware firmware or BIOS
B. Installing additional RAM
C. Configuring a backup process
D. Configuring account lockout
E. Replacing outdated device drivers
13. What is the essential purpose or function of
authentication?
A. Controlling access to resources
B. Monitoring for security compliance
C. Watching levels of performance
D. Verifying entity identity
E. Preventing distribution of malware
14. What is the essential purpose or function of
authorization?
A. Granting or denying access to resources
B. Checking policy compliance
C. Identifying entities
D. Monitoring levels of utilization
E. Detecting spoofed content
15. What is the essential purpose or function of
accounting?
A. Detecting intrusions
B. Proving identity
C. Controlling access to assets
D. Recording the activities and events within a system
E. Throttling transactions
16. What is the essential purpose or function of encryption?
A. Verifying integrity
B. Proving the identity of endpoints
C. Protecting content from unauthorized third parties
D. Maintaining performance
E. Validating parking
17. A remote host has all of the following additional
security issues or concerns in comparison with a local
host except:
A. Potential exposure to unfiltered Internet
B. Poor end user training
C. Greater risk of physical theft
D. Possible lack of patches and updates
E. Additional interaction with external entities
18. Which of the following is a protection against a single
point of failure?
A. Encryption
B. Filtering
C. Auditing
D. Redundancy
E. VPNs
19. When performing node security on a router, all of the
following are important concerns, except:
A. Blocking all directed IP broadcasts
B. Disabling echo, chargen, discard, and daytime
C. Watching for MAC spoofing
D. Dropping RFC 1918 addressed packets from the
Internet
E. Enabling a warning banner for all attempted
connections
20. When configuring node security on a switch, all of the
following are important elements except:
A. Enabling keystroke logging
B. Limiting access to management interfaces
C. Monitoring for ARP flooding
D. Upgrading to SNMP v3
E. Using a final version of firmware
CHAPTER
6 Network Security
Management
COMPUTER NETWORK SECURITY is not a final solution or a task to be completed. Security is a continuous journey.
Safeguards and infrastructures that worked before might
offer little or no protection against future attacks. You must
constantly develop and deploy new defenses against new
exploits. This vigilance is the essence of network security
management.
Network security management strives to maintain
established security, adjust the infrastructure to future
threats, and respond to breaches in a timely manner. Using
a variety of techniques and tools, including incident
response, host security, backup and recovery, checklists,
and security assessment, network security management is a
complex, but essential component of long-term, reliable
security.
Chapter 6 Topics
This chapter covers the following topics and
concepts:
What best practices for network security
management are
What fail-secure, fail-open, and fail-close
options are
What the important elements of physical
security are
Why is it essential to watch for compromise
What incident response is
How to trap intruders and violators
What containment is
How to impose compartmentalization
How to use honeypots, honeynets, and
padded cells
What some essential host security controls
are
How to properly implement backup and
recovery
What the importance of user training and
awareness is
What some important network security
management tools are
How to create and use a security checklist
What the basics of network security
troubleshooting are
What compliance auditing is
What security assessment is
What a configuration scan is
What vulnerability scanning is
What the purpose of penetration testing is
Why post-mortem assessment review is
important
Chapter 6 Goals
When you complete this chapter, you will be able
to:
List examples of network security best
practices
Describe the importance of physical security
Compose a procedure for incident response
Enumerate key components of an effective
network security installation
Describe the methods of network security
assessment
Network Security Management Best
Practices
Network security management best practices are
recommendations, guidelines, or standard operating
procedures for obtaining reasonable security on a real-world
budget. Best practices are usually not specific
recommendations for products or tools; instead, they are
recommendations for philosophies, stances, or concepts to
use. The following items are suggested best practices.
These might not apply to every environment, although you
should consider, adapt, or adopt each when appropriate.
The foundation of any security endeavor and the start of
security best practices is having a written plan. A written
security policy has no substitute. Any other method, any
other process, and other attempted procedure for defining,
implementing, and managing security will fail. Only a
written security policy has the potential to succeed.
To have a plan, you must thoroughly understand your
organization’s infrastructure, its mission and goals, and the
processes necessary to produce its products and services.
This means understanding what technology your co-workers
need and use, what assets are involved, what resources are
consumed, where everything resides, and how users access
the infrastructure. Consider larger and more complex
environments in light of the typical IT infrastructure.
A written security policy establishes a documentation
trail that everyone in the organization can subscribe to. To
write a comprehensive security policy, you must first
thoroughly inventory and examine every component of the
IT infrastructure. Only when you fully understand the
environment can you create a comprehensive and effective
security policy.
To create a useful and relevant security policy, perform a
risk assessment. The process of understanding assets,
vulnerabilities, threats, and likelihoods is at the heart of risk
assessment.
Once you have designed and deployed a written security
policy, regularly review the policy. Investigate whether the
overall quality and reliability of the existing security is
sufficient or in need of improvement. Verify that assets are
still properly protected. Evaluate whether prevention,
deterrence, and response have been adequate and
effective. Wherever you discover a deficiency, act to
improve and rectify the situation immediately.
Security cannot succeed without the solid endorsement
and support of senior management. Executives should
support the security policy, follow the limitations
themselves, and stand behind the decisions made by you
and the IT staff. When the security staff and the executives
are focused on the same goal, solutions will follow. When
these two groups are not working in concert, time, money,
and effort go to waste, and network security fails.
Establish a no-exceptions policy. Every device connecting
to the company network must be in full compliance with the
security policy and current with approved patches and
updates. Block any device not in compliance with these
restrictions from interacting with the network. This
effectively is the function of a NAC (network
access/admission control) service. But it should also be a
written element of the security policy. Define “no
exceptions” in writing, and then use technology to enforce
this element of the plan.
Maintain physical control over all personnel access to IT
equipment. Block access to all servers or networking
equipment to all non-administrative users. Limit access to
client systems to authorized personnel within each
department. Ensure that departments are separated by
locked doors. Limit visitor, consultant, and other authorized
non-employee access primarily through a mandatory escort
system. More suggestions about physical security are
included in a later section in this chapter.
Limit and filter Internet connectivity. In spite of many
users’ desire for an unrestricted, unmonitored Internet
connection for personal use, the Internet poses a significant
risk for most organizations. An unrestricted or unfiltered
Internet connection is a pathway for malicious code, social
engineering attacks, and intrusion attempts. If an Internet
service, protocol, domain, or IP address is not essential to a
necessary business task, block it. Computer access to the
organization’s network and assets is for work tasks, not
personal activities.
Install antivirus scanners, anti-malware scanners, and
firewalls on every host. Every portable device, every
desktop workstation, and every server should have these
malicious code and malicious traffic protections. No system
is immune to malware and malicious communications; basic
filters and barriers to known issues prevent easily avoidable
compromises and downtime. Antivirus and other host
essentials are discussed further later in this chapter.
FIGURE 6-1
An example of defense in depth around an asset.
Do not rely upon single or individual defenses. Attempt to
interlock and layer defenses. Implement defense in depth or
a multiple-layered defense wherever possible (Figure 6-1).
By following a defense-in-depth design concept, you will
protect each asset with numerous safeguards. As one
defense tool interlocks with another, they overlap—like
medieval armor plate—and improve the overall security. The
strengths and benefits of one countermeasure can
supplement or compensate for the weaknesses and
limitations of another.
When possible, avoid remote access. Limit access to local
direct connections only. When remote access is necessary,
require a virtual private network (VPN). Once you allow
remote connectivity, you allow the possibility of remote
hacking. Remote hacking attempts to breach security
without the need to be physically at or within the target’s
facilities. Requiring VPNs for all remote connections reduces
this threat by preventing open connections or
communications vulnerable to eavesdropping.
Any device that is portable or easily accessible by a non-
employee should use whole hard drive encryption or at
least file encryption. While not absolutely foolproof,
encrypting an entire hard drive makes accessing the data on
a portable device much more complex. If a system is stolen
when powered off, the hard drive’s encryption typically
presents an insurmountable barrier. If the equipment is
running when stolen, a hacker might bypass the hard drive
encryption by hacking the encryption key out of active
memory. However, this is an unlikely attack.
Require encryption of all internal network
communications. Use Internet Protocol Security (IPSec) to
secure all intranet communications. This is often an easy
and cost-effective means to quickly reduce the risk of
eavesdropping, man-in-the-middle, replay, and many other
forms of network attacks. Well-encrypted data is much less
likely to fall into the hands of hackers, thieves, and
unauthorized personnel.
Harden internal hosts as well as border devices. Do not
focus exclusively on one area or issue of security to the
exclusion of all others. Provide consistent and thorough
security throughout the IT infrastructure. All networked
devices are at risk—perhaps from different threats, but still
at risk.
Always test new code before deployment onto a
production system. No matter what the source of new code,
you must test it. Even if an internal programmer wrote the
code, you must test it. Even if the code addresses a
mission-critical issue, you must test it. Test all new code
without exceptions. Any and all untested code is
unauthorized and should be blocked from all production
systems.
Implement multifactor authentication whenever possible.
Single-factor authentication, especially password-based
authentication, is no longer a truly secure or sufficient
method of protecting the logon process. Adding at least one
additional factor significantly increases the authentication
security of the environment. Once multifactor authentication
begins, allow no exceptions that fall back on single-factor
solutions. Otherwise, intrusion efforts will focus on the
single-factor pathway.
Back up, back up, back up: Backups are the best form of
insurance against data loss. Don’t store backups on the
same system or even in the same locale as your other
assets. Store backups on separate storage devices. While
you can store backups both onsite and offsite, offsite is the
preferred secure location in the event of natural or
manmade disasters. Backup and recovery are covered in
more detail later in this chapter.
If an asset is worth the time and effort to secure, then it’s
worth monitoring as well. Lock each asset as necessary, and
then watch for attempted breaches of that security. No
perfect security solutions exist; thus, to improve security,
prepare to respond immediately when you detect breaches.
Lock, then watch. Failing to watch a secured asset means
that when a compromise occurs, you won’t notice
immediately. Watching for compromise is discussed further
later in this chapter.
Have an intrusion and incident response plan. Bad
things and failures will happen. Breaches will take place. Be
prepared. Evaluate and examine the realistic threats facing
your assets. But plan for the worst. Define procedures to
respond to any situation. Incident response is addressed
further later in this chapter.
Do not overlook making a business continuity plan
and a disaster recovery plan. Above and beyond security
breaches are business-terminating events in the form of
natural and manmade disasters. Building collapse, flooding,
earthquakes, hurricanes, fire, sabotage, blackouts, malware
infection, criminal activities, and so on can end your
organization’s operations. If alternate means of
accomplishing mission-critical tasks are not available, your
organization will cease to exist. Plan to recover from
disasters and do business in the future.
KISS—Keep It Simple: Security. Security is complex
enough without purposefully imposing additional complexity.
Focus on designing security that the average user can
comply with easily and simply. The more arcane and cryptic
procedures become, the greater chance that users will
misunderstand, fail to comply, or purposefully subvert.
Simplicity encourages compliance.
Focus on balancing security and usability. Security does
not need to make all work difficult. Likewise, essential work
functions need not compromise security. Finding a balance
between these two extremes is important. The focus should
be on reducing risk to the infrastructure while enabling
users to perform authorized work with a minimum of hassle.
Prioritize. Security concerns can always overwhelm
available time, effort, or budget. Focus on the big impact
and big result issues first rather than attempting to swat
every minor annoyance that arises. Security is constantly
changing; the goal is to maintain reasonable rather than
perfect security. (Remember, this is an unattainable goal
anyway!)
Always be fully and truly aware of the state of the
organizational security. Don’t make assumptions. If you are
not positive that an aspect of the organization is secure, find
out. Assuming security exists leads to a false sense of
safety. A lack of knowledge about the security status can
lead to complacency. By assuming nothing is wrong, you
feel no urgency to investigate and rectify problems. Do not
fall into the “I thought it was protected” trap; if you do not
know or are not sure, take the time to investigate and be
sure.
Look for the weakest link. Every system or structure has
a weak point, and a security structure is no different. It
might be power, it could be humans, it might be a coding
issue, it could be processing capacity, or it could be any
number of other potential culprits. In any case, some
weakest link exists in the security chain. Think like a hacker
and look for it. Find it. Improve it. Then, go looking for the
next weakest link.
Focus on known, real, probable threats rather than on
unknown, imagined, or possible threats. You don’t have
enough time, energy, or budget to protect against
everything. Perform a risk assessment and focus on current,
significant issues.
Develop a standardized, procedural-based process for
hardening new systems. You should subject every new piece
of host equipment, including switches, routers, firewalls,
servers, and clients, to a rigorous and thorough hardening
process before it is deployed onto the production network.
In fact, having a dedicated, isolated, new system-testing
network will protect the existing production network from
new systems, as well as protect new systems from threats
from the existing production network.
Develop and implement an efficient patch
management system. You need to promptly analyze,
evaluate, and install every new patch released from your
vendors, whether for hardware or software. Never short-
circuit the test-all-code-before-deployment policy, and never
implement code based on fear. Instead, have a focused and
efficient process for testing and approving new updates so
that they can be rolled out to production systems quickly.
Keep every system current on patches; remember, however,
that pushing out a patch too soon and without proper
testing is just as bad as delaying patch approval because
you lack the time to examine it.
User training and behavior modification is essential.
Technology cannot solve or remedy all security concerns.
Technology cannot compensate for the human factor. Be
sure to train all authorized personnel on general security
concepts as well as task-specific security concerns. Train
users on what policy expects, define what policy prohibits,
and encourage buy-in and support of the overall
organizational security effort. User training is addressed
further later in this chapter.
FIGURE 6-2
National Institute of Standards and Technology (NIST):
National Vulnerability Database.
Stay current on security and vulnerability research. You
can’t protect against existing, new, and upcoming threats
unless you know what they are. You need to seek out this
information, because most general news sources, even
those focusing on technology, don’t address most of the
security vulnerabilities, exploits, or compromises that arise
daily. Find good resources-related security and vulnerability
research (Figure 6-2) and consult it religiously. Knowledge is
often one of the best weapons in the fight for security.
Develop a security checklist. Periodically review it for
completeness and accuracy, such as every quarter. Confirm
every element on the checklist on a regular and frequent
basis, such as once a week or once a day. You can automate
this to an extent, but checking often requires human effort
to test and confirm that every security mechanism is in
place, active, armed, and effective. Security checklists are
discussed further later in this chapter.
Perform regular self-assessments. Numerous security
groups and government/military agencies post security
implementation guidelines, manuals, and checklists. You can
use these documents, commonly known as Security
Technical Implementation Guides (STIGs), to review
and assess your organization’s status and state of security.
A self-assessment attempts to take an external, unique, or
independent viewpoint in evaluating security. This is why
using external security guidelines, standards, and
measurements can reveal oversights in an existing security
infrastructure.
Perform internal compliance audits. Thinking you are
secure isn’t enough; the laws in many industries, such as
finance and medicine, now require compliance. Ensuring
that you are in full compliance with all federal and state
laws and regulations is not only good security management;
it will keep your company officials out of jail. Using external
auditors is often a poor substitute for internal self-
verification.
Implement the principle of least privilege. All users,
including administrators, require only the privileges, access,
and permissions necessary to accomplish their assigned
work. Any abilities beyond this minimum increase the
potential for compromise and abuse.
Isolate and compartmentalize administrative privileges
through the implementation of separation of duties. This
is also known as split knowledge. Administrators are given
limited administrative power over a limited area of the IT
infrastructure. No single administrator has full or total power
over the entire environment. This limits the scope of
potential abuse and harm by disgruntled administrators, as
well as by hackers who compromise administrative
accounts.
Test all security measures for sufficiency. Perform
verification scans of all deployed countermeasures to
ensure their correct functioning. Improper installation or
misconfiguration can render a well-meaning safeguard
worthless. Test every new security control when you install it
and every time you reconfigure it.
Perform regular vulnerability assessments. Use
automated tools with updated databases of security tests
and exploit simulations. These tools should confirm patches
and updates, verify security configurations, and probe for
known vulnerabilities and exploit weaknesses. Quickly
resolve any issues discovered by the scans.
After you have improved and fine-tuned your security
infrastructure, put it to the ultimate test: Perform
penetration testing. Hire or develop an ethical hacking team
to test the strengths and weaknesses of the IT security as
well as the security of the facilities and the employees.
Ethical hackers use the same tools and attack techniques as
criminals, but without the intention to cause actual damage.
Professional security assessors can customize attacks,
modify exploits, and react in real time to fully stress security
defenses.
Focus on the core security services when designing
security: confidentiality, integrity, and availability. Failing to
properly and adequately buttress these essential security
services will result in damage, data loss, and downtime.
Confidentiality is the prevention of unauthorized access
while supporting authorized access. Integrity is the
protection against unauthorized modifications. Availability is
the assurance that resources are accessible in a timely
manner.
Consider designing security, especially physical security,
around three central functions: deterrence, detection, and
delay. Deterrence is the use of security to convince the
potential attacker that the efforts to compromise a system
are not worth it. The attack may be perceived as too hard or
too complex, the attempt too easy to detect, and the
consequences too severe. Detection is to watch for the
attempts at breaching security so as to respond promptly.
Delay is to slow down the attack so that even successful
breaches give the defenders time to respond in order to
apprehend the attacker or prevent further intrusion.
Another common trio of parameters for security design
and implementation is prevention, detection, and response.
Prevention is the use of safeguards to thwart exploitation or
compromise. It is usually more efficient, easier, and cost
effective to prevent intrusions and breaches than to react to
them. Immediate detection of attempted and successful
security breaches is important. The longer the time span
between a malicious action and an authoritative response,
the greater the likelihood the perpetrator will get away
without consequence. Response means being prepared to
contain damage, restrict further compromise, and effect
repairs to return the system to normal.
Don’t overlook the importance of authentication,
authorization, and accounting. These services are essential
to a secure infrastructure. You must control who is allowed
into a facility and onto the network. Place limitations on
what authorized users can do. Hold all entities—even upper-
level management—accountable for their actions, activities,
and results.
Focus on establishing a philosophy of default deny
rather than default allow. By blocking everything as a
starting point, only those features, services, protocols, ports,
applications, and users that you judge and deem safe and
appropriate can be enabled by exception. A default-permit
stance means you must create a never-ending stream of
explicit denials as you detect new compromises or malicious
events. Deny by default/allow by exception is always the
preferred security stance.
Implement whitelist application control. A whitelist is a
list of allowed exceptions against a background of default
deny. By configuring a system with a whitelist, you block all
executables unless they are on the list of allowed
exceptions. A whitelist consists of the application name, its
file name, and the file’s hash value. This prevents spoofing
by malicious or unapproved applications that simply rename
the executable.
This collection of network security management best
practices should serve as a starting point for the
development of your effective security endeavors. Other
valid and useful guidelines exist, so don’t assume this list of
recommendations—or any other list from any other source—
is exhaustive. You always have new lessons to learn, new
challenges to face, and new wisdom to obtain.
Fail-Secure, Fail-Open, and Fail-Close
Options
Failure is not an option; it’s a certainty. At some point in the
life of your organization, failure will happen. Will you be
prepared to handle it properly, and how much harm will the
failure cause?
A failure can be due to hardware ceasing to operate
properly because of an unknown flaw in materials or
construction. A failure can be due to the accidental
discharge of static that damages circuits. A failure can be
due to atypical weather that floods the building.
A failure can be due to a malware infection that crashes
a server. A failure can be due to a zero-day exploit that
compromises security from outside.
Failure means problems, downtime, loss, and
consequences. However, failures do not have to mean
bankruptcy, going out of business, jail time, or catastrophic
loss. The difference between calamity and mere
inconvenience is planning. As with most aspects of security,
proper and extensive planning can assist in designing an
infrastructure that can prevent or effectively survive any
issue or concern.
Planning for failure is planning how to respond to and
recover from failures. The goal is to fail into a state of
security or safety rather than into a state of insecurity or
chaos. This is known as fail-secure. A fail-secure state
reverts to a condition where little or no harm, or at least no
further harm, is likely to happen. Depending on the
situation, a fail-secure state could be fail-open or fail-close.
To fail-open is to revert to a state of being open,
available, or unlocked. In the case of the physical world, fail-
open is important for the safety of personnel. Fail-open
doors allow people to leave a building easily. However, such
easily opened doors might represent a weakness that an
intruder could exploit to access secured internal areas. In
the case of IT, fail-open is to revert to a state of unfiltered
communication or data access.
To fail-close is to revert to a state of being closed,
unavailable, or locked. In the case of the physical world, to
fail-close is to prevent a doorway or container from being
opened during an emergency or compromise. In the case of
IT, fail-close blocks access to communications and other
digital resources.
Either state, fail-open or fail-close, can be the fail-secure
or fail-safe option depending on the circumstances. In any
case, you should carefully consider and plan the type of
default response you will use, especially during an
emergency, intrusion, compromise, or system failure.
Physical Security
There is no security without physical security. Logical
protections can protect only against logical attacks. Physical
protections protect against physical attacks. With just a few
moments of physical contact, a hacker can overcome or
bypass most logical security.
Physical security is the prevention of direct physical
contact, access, or influence of an unauthorized person to a
sensitive component of an IT infrastructure. Any well-
designed network security solution will include physical
security components. If you fail to address physical security
adequately, you fail to understand the threats facing your
organization.
Physical security includes a facility that resists forcible
entry. Select, improve, or build facilities that prevent and
deter unauthorized physical intrusion. If physical breaking
and entering is possible and potentially profitable for a thief,
it’s more likely to take place.
Physical security should include the monitoring of all
personnel activity. Solid physical access control includes
keeping track of when an employee enters and exits every
secured or sensitive area. Good physical access control
blocks outsider access and enforces escorts for visitors.
Physical security should include card key entry, burglar
alarms, motion detectors, and security cameras. Use the
best available technology to both deter and detect physical
security violations.
Watching for Compromise
Everyone in your organization is part of the physical security
effort. All individuals are responsible for staying within the
security boundaries themselves. They are also responsible
for reporting violations or suspicious activity. Security is
about locking and watching. Not every employee can assist
in the process of locking things down, but all can and should
assist with watching for violations and suspicious behaviors.
Use all available technologies in addition to human eyes
to look for security violations. Use auditing, IDSs and IPSs,
security cameras, motion detectors, and so on when
appropriate. Proper network security management includes
proper design to watch for violations.
Violations can occur in the physical world as well as
within the logical world of computers, networking, and the
Internet. Don’t assume that just because a violation causes
no direct physical harm, the issue is not worth knowing
about or pursuing. A crime is still a crime whether it’s a
physical crime or a logical one. Design and implement
detection mechanisms to notice, log, and monitor suspicious
or abnormal activities.
Incident Response
Incident response is the planned reaction to negative
situations or events. Inevitably, security breaches, or at
least attempts to breach security, are going to occur. When
those events affect the organization or its abilities to
perform its tasks in any way, incident response is triggered.
The goals of incident response are to minimize downtime,
minimize loss, and restore the environment back to a
secured normal state as quickly as possible.
Most incident response solutions include six primary
steps or phases:
1. Preparation—Select and train security incident
response team (SIRT) members, allocate resources.
2. Detection—Confirm actual breaches.
3. Containment—Restrain further escalation.
4. Eradication—Resolve the compromise.
5. Recovery—Return to normal operation.
6. Follow-up—Review the process and improve
future responses.
An incident response plan is an important element of
network security management.
Trapping Intruders and Violators
Security often aims at prevention and deterrence. When an
intrusion or security violation takes place in spite of the
precautions, the next stage or level of security must
respond. The next stage of security is detection. Knowing if
and when a security violation occurs is essential to a timely
and adequate response to a breach.
Once you detect a breach, you must immediately initiate
a response. The first stage of response is containment. The
goal of containment is to prevent further spread of a known
malicious event. Containment is a mindset, a plan of action,
and an element of design. As a mindset, containment is the
focus of first responders or members of the SIRT. Their goal
is to prevent any expansion or spread of the compromise to
other systems.
Why Containment Is Important
Containment can be as simple as unplugging a network
cable from a compromised system. This effectively cuts off
any communication to and from the suspect host. You can
also impose containment by disabling user accounts,
stopping services, adding entries to filtering devices, and so
on. Whatever the vector or source of the malicious event, its
source or target should be cut off from causing continued
harm.
The act of containment should interrupt or interfere with
the continued spread or operation of the unwanted event.
This type of initial response is often effective against
malicious code, remote access, backdoor control, a
compromised user account, social engineering, and many
other forms of network or system compromise.
Containment is often considered a form of response.
Containment is the action taken by a first responder.
However, even before you experience a security breach, you
can employ another preventative measure similar to
containment known as compartmentalization.
Imposing Compartmentalization
Compartmentalization is the element of infrastructure
design that takes into account the likelihood of a security
breach by malicious code or some other intruder.
Compartmentalization distinctly separates a network into
areas or zones of access. Often, these zones are around
departments or entities that commonly interact over the
network. Any entity that does not commonly interact is
separated by default using network security access control
devices such as routers, switches, and firewalls.
The purpose of compartmentalization is to create small
collectives of systems that support work tasks while
minimizing risk. The typical risk is that if one system is
compromised, the breach can quickly lead to other systems
being compromised. This is especially true of malicious
code, which distributes rapidly. But it can also apply to
remote hacker intrusion as the hacker attempts to leap from
system to system, searching out valuable resources.
Network compartmentalization is similar to the
bulkheads on ships. In the event of a hull leak, the bulkhead
doors of the affected compartment close and seal. This
prevents the entire ship from being sunk by a single breach.
The same is true for computer network
compartmentalization. When you detect a breach, you can
sever the links between network compartments to prevent
any further malicious communication to or from the affected
sections.
Using Honeypots, Honeynets, and
Padded Cells
Another specific intruder trap you can add to a security
infrastructure is a honeypot. A honeypot is a hacker or
intruder trap. A honeypot is a system or network that
appears to contain valuable information, and appears to be
part of a legitimate organizational network, but in fact is a
specially designed trap. The purpose of a honeypot is to
trap hackers/intruders, detect new attacks, or simply serve
as a decoy to deflect attacks from reaching the actual
primary network.
A honeypot can be a single system or a network of many
systems constructed to look, act, and operate like a real
network environment, containing seemingly attractive but
actually fake resources. For a honeypot to be effective, it
must look and act just like a real target. Otherwise, hackers
will quickly uncover that it is fake and search harder to find
the real targets. A honeypot often includes extensive focus
auditing and recording capabilities to thoroughly capture all
activities that take place within it.
Honeypots can be single systems or multiple networked
systems. A network of honeypots is sometimes called a
honeynet. Both honeypots and honeynets are decoy
systems that are always operating in the hopes of attracting
would-be hackers and intruders. Another form of honeypot
is the padded cell. The padded cell is turned on only after
you detect an intruder; you then lure the intruder into
entering the padded cell.
Configure and situate honeypots so that they do not
interfere with authorized users performing authorized
activities. However, you need to position them along
common pathways of access that an outsider or intruder
might take, in much the same way a hunter will hide along a
game trail in the forest. A honeypot should be attractive and
interesting enough to persuade a hacker to attack it, but not
too attractive as to trigger that voice in the back of the
hacker’s mind that says, “It’s a trap.”
A honeypot has value in two primary circumstances.
First, if the organization’s primary goal is to learn about new
hacking exploits, then a honeypot can serve as a laboratory
for that purpose. Second, if the organization’s primary goal
is to prosecute criminals, then a honeypot may assist in the
discovery, identification, and apprehension of suspects.
However, if neither of these two purposes is a primary goal
of the organization, then deploying a honeypot is generally
not a worthwhile endeavor.
Essential Host Security Controls
Every host needs protections from its users as well as from
the network it communicates with. There are always risks,
even within a private network, from authorized users.
Precautions include equipping host devices with reasonable
defenses against known potential avenues of compromise.
Every host needs an antivirus scanner. While malicious
code is not as serious a threat in some operating systems as
in others, hackers create malware for every platform. You
can no longer safely claim immunity based on your
operating system selection alone.
An antivirus scanner needs to be current. The scanner
engine, the core mechanisms for malware detection, should
be less than a year old. Typically, a deployed antivirus
should have the current year in its name or as its build date.
Any antivirus scanner more than a year old is too out of
date with new and current scanning technologies, malicious
embedding techniques, and cleanup and removal
procedures.
An antivirus scanner needs to have its database of
definitions updated at least once per day. This should be an
automated process so that as soon as the vendor releases a
new update, it is downloaded and applied. Using a scanner
with an old database is just as bad as using an old scanner.
An antivirus product provides protection only against known
threats, so don’t allow your antivirus software to develop
amnesia from delayed updates.
An antivirus scanner must be configured to perform
constant, consistent, and automatic scans. Monitor the
memory, processing stack, and any other active element of
a computer system in real time for symptoms of malicious
code compromise. When malware reaches a host, it can
infect that host and distribute its spawn in moments.
Without real-time monitoring for infections, serious damage
can take place long before a periodic scan notices the
breach.
An antivirus scanner should be configured to perform
complete, systemwide, low-level scans across all memory
and storage devices on a periodic basis, every day or at
least once a week. By scanning the entire system on a
regular basis, you can detect and remove malware that was
able to gain access through some unmonitored or covert
channel.
In addition to an antivirus scanner, hosts should benefit
from an anti-malware scanner. An anti-malware scanner is
also known as a spyware or adware scanner. These are
companion scanning products to antivirus software in that
they find other forms of malicious, nuisance, or suspicious
code that might not qualify as a virus or worm. Their targets
include spyware, adware, keystroke loggers, rootkits, hacker
tools, backdoors, Trojan horses, malicious/abnormal cookies,
suspicious mobile code, bots, zombies, and so on. Don’t let
the names fool you. All of these things represent the
potential for real network damage.
Every host should be equipped with a software host
firewall. A host firewall provides filtering services for data
entering and leaving the local box. A host firewall can limit
network connectivity for local applications as well as allow
or deny access to resources from external entities.
Most hosts can benefit from the added security of whole
hard drive encryption. This ensures that all data on the drive
is secured. Depending on the product and technology you
employ, whole hard drive encryption can be unlocked
through a boot password or the use of a hardware device,
such as a USB drive or a Trusted Platform Module (TPM)
chip. Whole hard drive encryption essentially prevents a
hard drive from being read by another system if it is stolen.
Some forms of system and file damage occur from
activities that are not malware related. Using a hash
integrity checking mechanism to watch for unauthorized file
changes can assist in tracking down abnormal sources of
compromise. Monitor every system file and device driver.
Any change not associated with installation of a valid
update is likely a symptom of malicious activity.
You should configure and review auditing on all hosts, not
just servers. Malicious activities and communications can
take place on any system. Configure every host to audit,
monitor, and log local and network events. Then, using an
intrusion detection system (IDS) or other form of security
auditing tool, scan the log files for symptoms of concern.
What you do not know can harm you, so arm yourself with
as much knowledge as possible.
Backup and Recovery
Back up. Back up. Back up. There is no excuse for lacking a
backup solution. Backups are the only insurance against
data loss. Failing to make a backup is planning for failure
and data loss. A single data loss incident, such as a failed
hard drive, could be enough to cause the failure of an
organization. Do not lose data because of carelessness;
implement a backup process immediately.
Backups are not difficult. They just take a bit of planning.
First, plan where you want to store the backups. The three
main choices are online, offsite, or onsite.
Online or cloud backup storage is growing in popularity,
availability, and cost effectiveness. Online backups offer
access to your data from any Internet connection, making
recovery possible from anywhere. However, online backups
put your data on someone else’s hardware, making you
dependent on that party’s security, confidentiality
assurance, and reliability. Plus, backup transfer speeds are
dependent on the local Internet link speed, which is usually
much slower than most local media backup options.
Offsite and onsite storage employ the use of backup
media. Backup media can be tapes, optical disks, hard
drives, and solid state drives/cards. Physical media require
space for storage and are subject to physical threats,
namely theft, damage, and destruction. Offsite storage is
the better option when faced with major catastrophes. This
protects your backup media from damage by problems
occurring at your primary work location. Onsite storage
provides for quick recoveries around minor issues.
Midsize to large organizations often elect a multistage
backup solution that provides both onsite and offsite storage
benefits. One possible configuration is to use banks of
rewritable high-speed optical storage devices to host a live,
online, onsite backup. Then perform periodic backups from
the optical storage set to portable media, such as tapes, for
secure storage offsite.
This configuration provides for fast backup from the
original systems to the optical media, then provides a
convenient process for creating tape copies quickly. It also
allows for fast restoration of data from the online, onsite
optical backup, while providing major disaster protection
with the offsite secure storage of tapes.
As much as possible, automate the backup process to
ensure that it happens. If the act of backing up the
network’s data interferes with production, then install a
secondary network to exclusively support data transfer for
backups. This will require a second network interface in
every system protected through the backup process.
The offsite storage location for backup media should be
secure and reasonably protected from disasters, especially
severe weather. If your organization is large enough to have
multiple locations, rather than the same building or even
buildings within a few blocks of each other, then offsite
storage can switch from third-party storage to internal
storage at distant branch locations.
User Training and Awareness
User training is an essential part of any security endeavor.
Not every worker in an organization is automatically an IT or
technology expert, nor should you expect them to be.
Security training and awareness aims at providing all users
with basic security knowledge as well as job-specific
security information.
To hold users accountable for their actions, first clearly
define the network security policy boundaries and
limitations. Having a set of rules and restrictions without
informing personnel of their existence won’t enforce policy
and can lead to employee grievances. Training and
awareness is necessary to educate users on their
responsibilities and the consequences for violating
organizational policy.
Without adequate security education for users,
maintaining a secure environment is difficult, if not
impossible. However, many organizations fail to support end
user training adequately. This results in users not
understanding the importance, need, and benefits of
security. Additionally, it will result in an increase in
violations, most of which are benign and accidental, but
incidents that you will nonetheless need to investigate and
resolve.
A few common end user security mistakes or problems
caused by a lack of security training include:
Opening e-mail attachments from unknown sources or
from a known source with an unexpected or unusual
attachment
Preventing updates and patches from installing, even
when approved and recommended by the security
staff
Installing unapproved software on work computers,
including games, screensavers, utilities, instant
messaging clients, and browser plug-ins
Installing software on work computers that you have
not verified as safe and free from malicious code
Failing to make backups of personal data or work data
on work computers
Using a modem or wireless connection from a desktop
or notebook work computer while still connected to
the company LAN
Using a password storage/tracking utility that does not
encrypt its database
Walking away from computers while still logged in
Connecting unknown and unapproved devices to a
work computer
Using portable media and storage devices from an
external source on a work computer
Installing remote-control or remote-access software on
work computers without obtaining approval
Using the same password on multiple systems
Leaving portable devices in locations outside of work
where they could be easily stolen, such as in a car’s
backseat
These are just some examples of common security problems
caused by untutored users. You can avoid or at least
minimize most of these issues with reasonable user security
education. However, it’s also common for IT staff to make
security mistakes, even though they are much more
knowledgeable about technology. Just because someone is a
“tech guy” or might be considered a computer geek does
not necessarily imply he or she is security smart as well.
Some mistakes made by technology experts (who really
should know better) include:
Using the same password on multiple systems
Allowing new systems to go online before they are
properly hardened and/or tested
Failing to keep current with available patches and
upgrades, especially those related to security
Using remote system and device management
mechanisms that are convenient but not secure, such
as telnet, HTTP, and FTP
Discussing passwords over the phone, including
changing passwords based on over-the-phone requests
Failing to properly check identity, authority, and
permission before giving out information or access to
resources
Failing to implement a proper backup solution
Not verifying and testing that backups are working
properly
Assuming something is secured or properly configured
without specifically checking and verifying
Allowing unnecessary and potentially insecure
applications, services, and protocols to remain on a
system
Using security and network devices with their default
settings, such as firewalls, proxies, routers, and so on.
Failing to understand all of the security configuration
options on a new software or hardware product
Putting new software or hardware into production
before thoroughly testing and gaining approval
Allowing anti-malware defenses to become out of date
or go stale
Allowing sensitive information to be communicated
without an encrypted channel
Even a knowledgeable technical professional can learn how
to be more secure through proper training and awareness
education. Every single person throughout an organization
has security responsibilities. These need to be defined,
explained, and taught. Users will improve their behaviors
when they understand what the risks are, what is at stake,
and how their behavior will affect them if they fail to support
security.
The goal of security-related training is user behavior
modification. Users need to take steps to change their
regular activities from those that place themselves and their
workplace at risk to those that avoid risk. Risk is easy for
most people to understand, but they need to be made
aware of risk to trigger a change in their actions.
Good user training will cause an improvement in user
compliance with the standards, policies, procedures, and
guidelines of your organization. Often, the beginning of
security training is awareness. Awareness is introductory,
foundational, and ubiquitous security information that
applies to all employees. Awareness aims at establishing a
common baseline of security understanding for the entire
organization.
The principal means of awareness training is in a
classroom setting. It should, however, include a wide variety
of communications, including online videos, interactive Web
sites, posters, e-mail reminders, regular memos or
newsletters, wall banners, coffee mugs, sticky notes,
manager review meetings, loudspeaker announcements,
screensavers, mouse pads, and even voice mail messages.
The point is to inform users about basic security essentials,
then reinforce those basics while they are at work.
Awareness is important for all personnel, in all job
positions, at every level of access, from the top to the
bottom of an organization. Everyone should understand
basic security issues. These often focus on general
responsibilities, liability, seeking to avoid waste and fraud,
reduction of unauthorized activities, and looking out for
abnormal or suspicious events.
User Education
Every organization should have a written security
policy, but that is not enough. In order to ensure that
an individual knows the policy, the individual should
be made to read the policy and sign a statement that
he or she has read the policy and will abide by the
policy. The individual should also read and
acknowledge that he or she will abide by changes to
the policy as they are published. These requirements
apply not just to salaried and hourly employees, but
to anyone given electronic or physical access to the
premises of the organization and to the assets of the
organization in transit as the assets are transported
outside of the physical facility. This could include
contractors, suppliers, and others. And it requires
constant monitoring. It could even require a test or
security certification, background check, or other
means of determining ongoing compliance. One
means of encouraging users to comply with policies is
to ensure they are aware of the consequences of
noncompliance. No one given permission to access
assets of the organization is exempt from the security
policy.
It’s important for employees to see through both words
and deeds that security is important. This means that even
top executives must be held accountable to the same basic
principles enforced throughout the general employee
population. If employees see evidence of compromise or
compliance avoidance by senior management, then they
get the impression that the rules are not important enough
for anyone to follow. You don’t want employees to be
frustrated and confused by a “Do as I say, not as I do”
management model.
After awareness comes training. Training focuses on
security issues and topics more closely related to specific
job tasks. Training consists, therefore, of job-specific
security information. Security training of this type assists
users in accomplishing their individual work tasks while
staying within the boundaries of the security infrastructure.
Most organizations offer in-house awareness and
training. This is common because such training directly
reduces incidents and the associated costs of handling and
responding to internal accidental and ignorance-based
breaches.
Beyond training is security education. This form of
learning has a broader scope than just a job description or
even the organization as a whole. The purpose of security
education is to obtain extensive knowledge about security
and related subjects, even if they don’t directly apply to
current work responsibilities or tasks. Education is for the
advancement of the individual, perhaps to improve his or
her career outlook.
Education is usually obtained outside of an organization.
A company might perceive education as either a threat to
employee retention or a benefit to keep employees happy.
Most organizations want to improve the skills of their
personnel. Either way, security education improves the
knowledge and skill of the individual.
Security awareness, training, and education are
beneficial for any security endeavor. Including and funding it
in your organization’s overall security solution will improve
your odds of success.
Network Security Management Tools
The best network security management tools are neither
commercial nor open-source products or solutions. Instead,
the best network security management tools are quite
simple and obvious. The best tools are:
A written security policy
A complete inventory of all hardware and software
A physical cabling layout and device location map
A logical organization, addressing, and subnetting map
Complete configuration documentation for every
device
Change documentation and log
Backup and restoration procedures
A business continuity and disaster recovery strategy
Troubleshooting guidelines
Hardware and software documentation
Personal knowledge and skill
Access to online resources
Security management is not about having the most
expensive products or the most automated configuration.
Instead, good security management is rooted in a solid
understanding of the infrastructure and having the tools to
improve, respond, and repair as necessary. Focusing on the
glitz of shiny products can even distract from the basics of
security management.
Security management should always center on
protecting assets, supporting authorized activities, and
responding to threats as you discover them. It may be more
efficient or cost-effective to use off-the-shelf security
management products, but using them is no substitute for
addressing the organization’s core security concerns.
Security Checklist
Security is fragile. Hackers need discover only a single flaw
in your defenses to mount an attack. Changes to the
infrastructure, whether physical or logical, could open new
holes not previously present. Additionally, users and
personnel may intentionally or accidentally breach security.
One method to maintain the efficacy of security is
through regular verification and validation checks of every
single countermeasure, safeguard, security control,
deterrent, prevention, and defense. This requires an
inventory of all security measures. This inventory can then
become a checklist.
Physical security and logical security each need a
separate list focusing on their respective areas of concern. A
security guard or a security tech investigates every physical
security measure to ensure that it is still in effect, active,
and unmodified. Such tasks at the level of logical security
are best left to security techs with proper administrative
access.
A security checklist shakedown should occur regularly
and often, once a day at most to once a week at least. Every
single item on the checklist should be physically visited and
inspected. If any issues or concerns arise, document them
and immediately bring them to the attention of the security
team. Employ remedial measures promptly and investigate
to track down the root cause of the concern.
A physical security checklist should include every
security control deployed for facility control. These include:
Checking every window lock
Checking every door lock
Checking every external wall
Inspecting access points to raised floor areas
Inspecting access points to drop ceilings
Ensuring that cabinets or containers are locked
Verifying that security cameras are pointed in the
correct direction
Verifying that all light bulbs are of the correct type and
are functioning
Checking motion detectors
Testing alarm systems
Interviewing security guards and confirming
compliance with procedures
Depending on the industry and specialization, many more
components can make up the physical security of an
organization. This list is just a sample of what the typical
physical security checklist should contain. Look for any
modification, destruction, or general failure of every
element of physical security. A single bad window lock or a
door that does not fully close automatically can result in
easy access for a burglar intent on computer mischief.
A logical security checklist should include every security
control deployed for computer and network control. These
include:
Checking authentication
Checking authorization and access control
Auditing systems
Verifying firewalls and other filters
Checking proxies and other communication
management solutions
Verifying encryption, including key management
Updating antivirus software and scanners
Backing up and storing archival information securely
Many more elements exist in a well-designed security
infrastructure for an exhaustive logical security checklist.
Again, this list is just a sample of some common elements
found in most secure organizations. Poor configurations,
overlooked defaults, and out-of-date systems can leave
gaps that a probing hacker will discover and exploit.
Never assume you are secure. Check and verify
everything regularly. No one else will do it for you.
Use the security checklist with the intention of
maintaining effective security over time, in spite of change,
accidents, and human nature. However, even a complete
checklist cannot resolve problems caused by poor design
and implementation. To ensure that your checklist is truly a
benefit and not just reorganizing deck chairs on a sinking
ship, consider the following common oversights or issues:
Do not assume that a service or protocol is secured by
some other layer or service. Verify that the data
traversing a network segment is encrypted or
otherwise secured.
Know the limitations of security products. Each
security mechanism addresses a single or small set of
issues within a specific context. The presence of
security in one location does not cause a magical
blanket of security to exist in other locations. Be sure
specific and relevant security solutions are in place
where necessary. For example, use of IPSec for
network encryption does not imply that data stored on
clients is encrypted.
Do not rely on authentication at session initiation
alone. Session hijacking is a serious threat on most
commonly used protocols. Use solutions that support
periodic midstream reauthentication, as well as
communications encryption.
Assume programs are inherently insecure. Security is
not often a priority or a requirement in programming.
When possible, use secure programming quality
assurance.
Plan for handling failures, errors, intrusions, and
downtime. Focus on what to do when bad things occur.
The goal should be a fast and efficient recovery. Failing
to plan is planning to fail.
Assume you may become a victim of a denial of
service (DoS) attack. Every communications system is
vulnerable to DoS. Do not forget that physical damage
can be an effective DoS.
Learn from your mistakes. When a problem is
uncovered, when a design flaw is revealed, when a
process is shown to be ineffective, lean in, take the hit,
own up to the responsibility, and then deal with it.
Improve the environment to resolve the issue. Review
the process and learn from it.
A security checklist can be an effective tool in managing
and maintaining network security. Make it a point to start
your list now and use it in real-world review immediately.
Network Security Troubleshooting
Security troubleshooting aims at recovering from problems
related to the countermeasures. Problems will occur with the
defense mechanisms themselves. Downtime of a security
control is as critical as downtime of a core business process
or asset. Troubleshooting failures of security controls is an
important part of network security management.
As with most concerns, prevention is always preferable to
repair or response. By working to ensure that failures do not
occur, or at least do not occur as often, maintaining
effective security will be easier and less costly in terms of
both budget and manpower.
Network security troubleshooting is often about triage—
deciding which issues or problems are of the most imminent
concern. The more a security component affects a mission-
critical process, the more important rapid response and
repair becomes. When security is down, the previously
protected assets are put at greater risk for compromise.
Minimizing the length of time consumed by the response is
important to minimizing long-term losses.
One of the most effective preventative techniques in
network security troubleshooting is installing patches and
updates. As with patches and updates to production
systems, always test the new code thoroughly before
deployment. Once tested and approved for application,
apply updates when downtime would cause the least
number of problems. Always be prepared with a redundant
option if the updating process itself causes further security
control problems.
Possible complications from the application of patches
and updates include resetting to factory defaults, loss of
some but not all configuration settings, and “bricking” (that
is, making it non-functional) the control. If the security
control resets back to factory defaults, then it will need to
be fully reconfigured. If a recent configuration backup is
available, restoration might be a swift repair. Otherwise,
manual resetting will be necessary. To facilitate this process,
always have complete documentation of all settings of all
security controls.
If you lose some but not all configuration settings, then
the security control is unlikely to operate as you expect.
Restore or reconfigure the settings promptly. The update
itself may have added or modified settings that need testing
and verification for function and compatibility. If a new
feature interferes with a business task, you might find it
necessary to disable the feature or roll back the update.
If the update process causes a complete failure of the
security control, the real possibility exists that the product is
useless. This is known as bricking—turning a useful device
into a worthless brick. In some cases, a hard reset can
revive a seemingly bricked device, while there may be more
esoteric repair and recovery options for other devices. If the
vendor does not provide an unbricking solution, search the
Internet for user groups or discussion forums for a home-
grown solution.
Configuration errors might be the cause of a security
control malfunction. Configuration errors may be caused by
human error, oversight, or ignorance, as well as by updates,
power fluctuations, and physical damage. When a security
control is improperly configured, it does not provide the
expected security. Troubleshooting this situation can be as
simple as reverting to a previously saved configuration or
manually reapplying the settings.
However, a more serious concern arises when
configuration errors are not easily fixed. A recent patch or
update may have rendered the product unstable, or a patch
or update might be needed to stabilize it. If the
configuration error reappears after every power cycle, then
the device might be defective, it might need additional
memory (or need defective memory replaced), or it might
need to be attached to an uninterruptible power supply
(UPS) to reduce the number of unplanned power
fluctuations.
Physical damage should be repaired expeditiously. If
unrepairable, you may need to replace the device. Install
preventative measures that will prevent the reoccurrence of
the physical damage.
In some situations, the problems with security are not
with the security components themselves, but with the
overall infrastructure design. Perform a reassessment of the
design on a periodic basis, such as once a year, to judge
whether the current infrastructure continues to meet the
security needs of your organization. Since security changes
over time, the security design might need to evolve to meet
the demands of new risks, threats, and concerns.
Power faults can take place for many reasons. If the
building’s power grid is not reliable, if sags and spikes occur
on a regular basis, the focus of the long-term repair should
be on improving the building’s power distribution systems.
Short-term responses can include surge protectors, UPSs,
and generators.
If a device encounters a power fluctuation due to
overheating, investigate whether the room where the device
is operating has adequate HVAC service. The average
temperature for a room dedicated to housing computer
equipment should be at or below 70 degrees Fahrenheit with
moderate relative humidity to avoid generating static
electricity. In rooms where people work with computers, the
temperature should remain below 80 degrees Fahrenheit.
Also, check the device to see if it has sufficient internal
airflow to maintain appropriate internal operating
temperatures. Don’t forget to check filters and vents for
accumulation of dirt or dust.
Power faults can include power supply or power grid
variances. In this situation, the only responses are surge
protectors, UPSs, and generators, as customers are unable
to affect the quality of the power company’s electricity by
themselves. If switching power suppliers is an option,
investigate this to determine the reliability of other
providers, as well as the expense and hassle of switching.
Sometimes actively and publicly “shopping” power suppliers
can result in improved service from your present supplier.
Static electricity is also a concern. Electrostatic discharge
(ESD) or static-electric discharge (SED) can easily damage
equipment, including security equipment. The amount of
electricity discharged between someone’s finger and a
doorknob when you can see the spark jump is more than
enough voltage to destroy most computer chips. Take
precautions to prevent static damage.
Physical damage can be a concern requiring
troubleshooting. Damage might be caused through
intentional destruction, accidents, or Mother Nature. If the
damage is superficial or cosmetic, the device can be
returned to service. However, if the damage prevents the
security device from operating properly, then in most cases
you need to replace it. Address the cause of the physical
damage to reduce the likelihood of a reoccurrence.
Network security troubleshooting focuses on whether an
intruder can bypass a security defense or restriction. A
security control that can be bypassed is worthless. Once you
discover that a security control can be bypassed, you need
to investigate the method or mechanism of the bypass.
Then, if possible, remove or block the method of bypass. If
the flaw is a design or infrastructure concern, consider
revising the design to remove the loophole.
From time to time, hackers find flaws in the programming
of a security control. Once an exploit is written, the security
control can be rendered useless through taking advantage
of the flawed code. Vigilance in reviewing vulnerability
databases and research, paying attention to vendor
information, and watching the log files of the organization’s
network should alert you when an exploit succeeds.
Defending against an exploitation focusing on a security
control is the same as when one focuses on any other
aspect of a network. If possible, reconfigure the control to
minimize the effectiveness of the exploitation. Consider
removing the component until you can implement a new
defense. Apply a patch or update from the vendor as soon
as it becomes available.
A final concern in relation to network security
troubleshooting is hardware failure. While not a common
occurrence, hardware can fail. Over the life of an
organization, you are almost guaranteed downtime caused
by hardware failure. When that hardware is a security
control, the downtime is more severe in that it places the
rest of the environment at greater risk.
Manage hardware failure by having replacements on
hand or being able to obtain them quickly. Reduce downtime
through redundant infrastructure design. Monitoring
ongoing performance metrics might enable the detection of
a future hardware failure as performance degrades.
However, abrupt hardware failures are difficult to predict.
Thus, being prepared with alternatives and replacement
parts is often the best troubleshooting solution.
Compliance Auditing
Compliance auditing is a type of assessment that judges
how well an organization is accomplishing set goals or
requirements. These goals and requirements can be internal
or set by government, industry, and other regulatory
agencies. Compliance auditing is an important part of
maintaining a business, especially growing businesses, as it
ensures that the organization is following all necessary
security guidelines.
Compliance auditing may be a legal requirement for
some industries, such as finance and medicine. Independent
external auditors perform compliance audits to ensure that
a target organization is fully abiding by the rules and
regulations imposed by the government. This audit is a
comprehensive investigation and review of the ongoing
business processes. The audit requires a review of the
security policy, access controls, risk management
processes, and historical log files.
The focus of compliance audits varies based on industry,
information type, and whether the organization is public or
private. Auditors investigate an organization through
documentation analysis, interviewing personnel, and
combing through audit logs. Compliance auditing can
examine recent security breaches, evaluate incident
response, interview ex-employees, judge user access levels,
interview executives over critical security concerns, and
more.
Organizations are usually distinctly aware when
compliance auditing is a mandated periodic occurrence. In
those cases, companies should prepare for audits by
collecting the various types of information and creating the
appropriate records as needed by the auditor. In fact,
establishing a standard practice of producing and archiving
the necessary information is prudent. The goals of these
actions are not to manipulate the data, but to provide
adequate access to the facts and historical activities.
Organizations that do not have mandated compliance
audits should consider self-imposed audits. The process of
thoroughly investigating the compliance level with the
stated security policy can improve the long-term stability
and security of every organization. The act of self-
assessment and improvement is a common characteristic of
most successful IT organizations.
Security Assessment
Security assessment is the judging, testing, and evaluation
of a deployed security solution. The state of the world, in
terms of security, is constantly changing. The hacking
community is actively developing new techniques,
methodologies, and exploits to compromise targets. The
defenses and strategies that worked yesterday might not be
as effective tomorrow.
Security assessment is the ongoing process of evaluating
security so that you can improve it. Security is established
through the act of performing a risk assessment. The results
of the assessment are formulated into a policy that guides
the implementation of the initial security infrastructure.
From that point forward, security management takes over.
Security management is the process of watching for
breaches, tuning existing security, and evaluating the need
for improvements to security. It is this latter area of concern
that is the focus of security assessment. Security
assessment employs several techniques to appraise the
effectiveness of deployed security.
Configuration Scans
A configuration scan probes a system to determine the
current state of configuration and settings. This scan
determines which available vendor patches are installed or
missing. This scan also evaluates numerous system
configuration settings against a database of
recommendations. Depending on the tool you use to
perform the configuration scan, you may find different levels
of recommendations based on the function of the system or
the general level of desired security.
One well-known example of a configuration scan tool is
Microsoft Baseline Security Analyzer (MBSA). MBSA scans a
Windows system and produces an easy-to-read report
(Figure 6-3). This tool provides a fast evaluation of the
overall security stance of a single system. To download the
MBSA tool, go here: http://www.microsoft.com/en-
us/download/details.aspx?id=7558.
MBSA is a great tool for small offices and end users to
employ to quickly check their systems for well-known patch
and security setting configuration compliance. However, this
is just a first step; it should not be the only tool you employ.
You’ll need other tools, especially non-Microsoft software,
that focus on broader issues to obtain a complete and
thorough configuration scan.
FIGURE 6-3
An MBSA scan report.
FIGURE 6-4
A Nessus scan report.
Vulnerability Scanning
The next step or stage in security assessment is
vulnerability scanning. Vulnerability scanning focuses on
locating known exploitable weaknesses or vulnerabilities in
deployed systems. You perform this type of scanning by
using an automated tool with an updatable database of
exploitations and test scripts. A vulnerability scan will reveal
problems with configuration, installation, and product code.
A scan of this type is only as reliable as the product itself
and how current its testing database is.
A popular and well-known vulnerability scanning product
is Tenable Network Security’s Nessus. Nessus is available in
a free version for home use and a paid version for
commercial use. Nessus is a powerful scanning engine with
a massive database of exploitation plug-ins that offers
excellent reporting capabilities (Figure 6-4).
NOTE
Nessus can be found online at http://www.nessus.org/.
Penetration Testing
The third and final step or stage in security assessment is
penetration testing. Also known as ethical hacking, this
process is the application of hacking techniques,
methodology, and tools in the hands of trusted ethical
security experts. The purpose of penetration testing is to
evaluate the resiliency of current security infrastructure and
recommend improvements. Penetration testing is performed
by a team of professionals who can customize and adapt
exploits on the fly.
Penetration testing typically consists of five main phases
or steps: reconnaissance, scanning, enumeration, attacking,
and post-attack activities. The steps or components of
criminal hacking and ethical hacking are the same. The
difference is the goal and abiding by ethical restrictions and
contractual boundaries.
Post-Mortem Assessment Review
Even with adequate security assessment using the three
main techniques (configuration scans, vulnerability scans,
and penetration tests), you may still have a need for one
additional form of security assessment. This additional form
is the port-mortem assessment review.
A port-mortem assessment review is the self-evaluation
performed by individuals and organizations after each
security assessment task. The purpose of a port-mortem is
to learn from mistakes. This will improve the process in
future events and avoid the reoccurrence of the same
mistakes. It’s true that practice makes perfect. If you
practice the same tasks repeatedly, each time improving
upon the previous performance, you’ll eventually master the
task.
Port-mortem reviews provide incremental improvements
on a consistent basis along with the rare revolutionary
improvement. A review of this type can include numerous
elements of appraisal focus, including:
The process as a whole
Each performed step
The order of the steps
Whether steps might be missing
What other actions could be taken
Whether participants were properly trained
Whether additional resources were needed
Whether resources were wasted
Whether additional people were needed
Whether too many people were involved
Whether reporting was sufficient or insufficient
What was missing
What could be improved next time
Many other queries could be posed as long as the goal is
to improve future applications of the assessment processes
and tools. A post-mortem review is a beneficial process
when used consistently.
CHAPTER SUMMARY
Network security management focuses on vigilance.
Vigilance to remain current in terms of technology.
Vigilance to remain knowledgeable about new threats
and exploits. Vigilance to respond promptly to
downtime and compromise. Vigilance to restore,
repair, and update security on a regular, consistent
basis.
A wide number of activities make up the realm of
network security management, including fail-secure
responses, maintaining physical security, detecting
compromise, preparing for incident response,
trapping intruders, host security components, backup
procedures, user training, management tools,
checklists, troubleshooting, compliance auditing, and
security assessment.
KEY CONCEPTS AND TERMS
Awareness
Backup
Business continuity plan
Compliance audit
Default deny
Default allow
Disaster recovery plan
Education
Fail-open
File encryption
Honeynet
Incident response plan
Mission-critical
Padded cell
Patch management
Principle of least privilege
Security Technical Implementation Guides
(STIGS)
Separation of duties
Single-factor authentication
Training
Trusted Platform Module (TPM)
Vulnerability scanning
Whole hard drive encryption
CHAPTER 6 ASSESSMENT
1. All of the following are examples of network security
management best practices except:
A. Writing a security policy
B. Obtaining senior management endorsement
C. Filtering Internet connectivity
D. Providing fast response time to customers
E. Implementing defense in depth
2. All of the following are examples of network security
management best practices except:
A. Avoiding remote access
B. Purchasing equipment from a single vendor
C. Using whole hard drive encryption
D. Implementing IPSec
E. Hardening internal and border devices
3. All of the following are examples of network security
management best practices except:
A. Using multifactor authentication
B. Backing up
C. HavBacking up a business continuity plan
D. Prioritizing
E. Spending each year’s budget in full
4. A firewall host that fails and reverts to a state where all
communication between the Internet and the DMZ is cut
off displays a type of defense known as:
A. Default permit
B. Explicit deny
C. Fail-close
D. Egress filtering
E. Security through obscurity
5. The purpose of physical security access control is to:
A. Grant access to external entities.
B. Prevent external attacks from coming through the
firewall.
C. Provide teachable scenarios for training.
D. Limit interaction between people and devices.
E. Protect against authorized communications over
external devices.
6. A complete and comprehensive security approach
needs to address or perform two main functions. The
first is to secure assets and the second is:
A. Watch for violation attempts.
B. Prevent downtime.
C. Verify identity.
D. Control access to resources.
E. Design the infrastructure based on the organization’s
mission.
7. Incident response is the planned reaction to negative
situations or events. Which of the following is not a
common step or phase in an incident response?
A. Containment
B. Recovery
C. Eradication
D. Detection
E. Assessment
8. All of the following are elements of an effective network
security installation except:
A. Backup and restoration
B. User training and awareness
C. Compliance auditing
D. Security checklist
E. Unplanned downtime
9. The task of compartmentalization is focused on
assisting with what overarching security concern?
A. Limiting damage caused by intruders
B. Filtering traffic based on volume
C. Controlling access based on location
D. Supporting transactions through utilization
E. Assessing security
10. Which of the following types of security components are
important to install on all hosts?
A. Firewall
B. Antivirus
C. Whole hard drive encryption
D. Spyware defenses
E. All of the above
11. What is the only protection against data loss?
A. Integrity checking
B. Encryption
C. Traffic filtering
D. Backup and recovery
E. Auditing
12. All of the following are common mistakes or security
problems that should be addressed in awareness
training except:
A. Opening e-mail attachments from unknown sources
B. Using resources from other subnets of which the host
is not a member
C. Installing unapproved software on work computers
D. Failing to make backups of personal data
E. Walking away from a computer while still logged in
13. The best network security management tools include all
of the following except:
A. Complete inventory of equipment
B. Written security policy
C. Expensive commercial products
D. Logical organization map
E. Change documentation
14. The purpose of a security checklist is:
A. To keep an inventory of equipment in the event of a
disaster
B. To create a shopping list for replacement parts
C. To ensure that all security elements are still effective
D. To complete the security documentation for the
organization
E. To assess the completeness of the infrastructure
15. Which of the following is not a potential hazard when
installing patches or updates?
A. Resetting configuration back to factory defaults
B. Reducing security
C. Bricking the device
D. Installing untested code
E. Improving resiliency against exploits
16. Which of the following is a true statement with regard
to compliance auditing?
A. Compliance auditing is a legally mandated task for
every organization.
B. Compliance auditing ensures that all best practices
are followed.
C. Compliance auditing creates a security policy.
D. Compliance auditing is an optional function for the
financial and medical industries.
E. Compliance auditing verifies that industry specific
regulations and laws are followed.
17. Which of the following is not typically considered a form
of network security assessment in terms of how well
existing security stands up to current threats?
A. Configuration scan
B. Compliance audit
C. Vulnerability assessment
D. Ethical hacking
E. Penetration testing
18. Which of the following cannot be performed adequately
using an automated tool?
A. Checking for current patches
B. Confirming configuration settings
C. Vulnerability assessment
D. Scanning for known weaknesses
E. Ethical hacking
19. What is the key factor that determines how valuable
and relevant a vulnerability assessment’s report is?
A. Timeliness of the database
B. Whether the product is open sourced
C. The platform hosting the scanning engine
D. The time of day the scan is performed
E. The available bandwidth on the network
20. What is the primary purpose of a post-mortem
assessment review?
A. Reducing costs
B. Adding new tools and resources
C. Placing blame on an individual
D. Learning from mistakes
E. Extending the length of time consumed by a task
CHAPTER
7 Firewall Basics
A FIREWALL IS A KEY COMPONENT of a complete security infrastructure. And while common, a firewall is by far not a
simple security measure. You must understand the
complexities of a firewall to design a firewall’s security
policy, build the firewall, and configure it properly.
This chapter discusses the foundations of firewall rules,
authentication, and authorization. You will learn how these
relate to monitoring and logging, interpreting firewall logs
and alerts, intrusion detection, firewall limitations,
improving firewall performance; how encryption relates to
firewalls; how to evaluate various firewall enhancements;
and how to think about security concerns related to firewall
management interfaces.
Chapter 7 Topics
This chapter covers the following topics and
concepts:
What constitutes good firewall rules
What authentication and authorization are
What monitoring and logging are
How to understand and interpret firewall logs
and alerts
What intrusion detection is
What the limitations of firewalls are
How to improve firewall performance
What the downside of encryption with
firewalls is
What firewall enhancements are
How to use firewall management interfaces
Chapter 7 Goals
When you complete of this chapter, you will be
able to:
Construct examples of common firewall rules
Design a policy to guide effective firewall
monitoring and logging
Discuss the limitations and weaknesses of
firewalls
Describe methods to manage firewall
performance
Define the concerns of encryption related to
firewalls
Evaluate the benefits and drawbacks of
firewall enhancements
Demonstrate how to access and use firewall
management interfaces
Firewall Rules
Firewalls filter traffic using rules or filters. All firewalls, of
whatever type—static packet filtering, stateful inspection,
application proxy, circuit proxy, or content filtering—use
rules to filter traffic. Rules are instructions that evaluate and
take action on traffic traversing the network.
Generally, two main philosophies or security stances
govern the use of rules: default deny or default allow.
Default deny is also known as deny by default or deny all.
Default allow is also known as allow by default or allow all.
These two rules define the foundation for rules governing
traffic crossing the firewall.
A default-deny stance assumes that all traffic is
potentially malicious or at least unwanted or unauthorized.
Thus, everything is prohibited by default. Then, as benign,
desired, and authorized traffic is identified, an exception
rule grants it access. This is known as deny by default/allow
by exception. This method of rule creation allows security
administrators to focus on what is wanted or needed rather
than watching out for all possible forms of unwanted or
malicious activity.
A default-allow stance assumes that most traffic is
benign. Thus, everything is allowed by default. Then, as
malicious, unwanted, or unauthorized traffic is identified, an
exception rule blocks it. This is known as allow by default,
deny by exception. This method of rule creation forces the
security administrator to be on constant watch for new and
different forms of unwanted, unauthorized, and malicious
activity.
Most security experts agree that deny by default/allow
by exception is the more secure stance to adopt. This
stance automatically prevents most malicious
communications by default, while the opposite allow-by-
default stance allows most malicious communications by
default. In most situations, fewer exceptions are required for
a default-deny solution than for a default-allow system.
Firewall rules are used to control what traffic enters or
leaves a secured network area. Depending on where the
firewall is positioned, this mechanism can protect the
private network from the public Internet or filter traffic
between internal subnets or departments. The security
administrator or the dedicated firewall administrator
configures firewall rules in accordance with the
organization’s security policy.
Most firewalls, both hardware and software varieties,
usually come pre-configured with rules above and beyond
their default rule. Firewalls are normally factory-configured
in a deny-by-default stance with some common exception
rules thrown in for end user/customer convenience (Figure
7-1). Often, these rules allow the most common forms of
communication to occur across a new firewall without
requiring you to fully configure the firewall upon initial
installation. Some of the more common factory default rules
allow for Web, e-mail, IM, and file transfer through common
Internet services on default ports.
While this can be a convenience, it’s never in your best
interest to rely upon a third party’s assumptions about your
environment or guesses as to what types of traffic you do or
do not want to cross your firewalled boundaries. Always take
the time to review any factory-installed rules before
deploying them in the production environment. Delete or
disable any rule that you do not need or want. With regard
to any rules that you do want or need, you should double-
check to make sure they are in line with your security policy.
If you need rules that are not present by default, add them
carefully and double-check your work as you go.
FIGURE 7-1
SonicWall’s default rule configuration interface, showing a
default deny as the last rule (rule 11).
Your organization will need to decide which rules to
define; this is an essential part of its security policy. If the
appropriate sections related to firewalls do not pre-define
what rules to define on a new firewall, then perform the
following procedure:
1. Inventory all essential business processes and
communications that will cross the checkpoint.
2. Determine the protocols, ports, and IP
addresses of valid traffic for both internal and
external hosts.
3. Write out the rules on paper or using a firewall
rule designer/simulator.
4. Test the rules in a laboratory environment.
5. Obtain written approval for the rule sets from a
change approval board.
6. Document the rules into a security policy
procedure amendment and submit the amendment
to the security policy management team for
inclusion in the official document.
Ultimately, this is the basic process for creating any new
element of security. The goal always is to have a written
security policy for every security component. If no current
policy or procedure defining the steps to take for the
deployment of a new security element exists, then you must
write, test, and get approval for a new policy or procedure.
Once a procedure exists, use it to judge successful
deployment.
The exact rules to add to a new firewall are completely
dependent upon the business processes that are unique to
every organization. However, some common types of rules
are found on most firewalls. These include:
Access to insecure Internet Web sites (HTTP)
Access to secure Internet Web sites (HTTP over SSL or
TLS)
Access to other Internet Web site protocols (SQL, Java,
and so on)
Inbound Internet e-mail
Outbound Internet e-mail
If other Internet services are essential to a business task,
rules allowing or enabling such communications would be
needed. Try to keep the number of rules to a minimum,
however. Grant access only to traffic that is essential. For
each rule added to a firewall, you are increasing its attack
surface—and therefore its security vulnerability.
Keep in mind that most network communications are
two-way transactions, exchanges, or sessions. Often, an
internal client makes an initiation request to an external
server. The server responds and sets up a communication
channel, often called a virtual circuit (at the Transport Layer
based on TCP) or, more generically, a session. Traffic can
traverse the session in either direction. Thus, most rules
should allow inbound responses to initial outbound requests.
Depending upon the firewall, a single rule can sometimes
define both the outbound and inbound communication
parameters. Other firewalls need two separate rules—one
rule for the initial outbound request and a second rule to
handle the resultant inbound response. In either case, each
desired session-based communication service must be
supported or allowed through proper two-way rule
construction.
In addition to rules that allow traffic based on internal
user initiation, consider rules that manage inbound
communications for externally initiated communications.
When a firewall is to allow an external host to request
access to internal resources, you need to create an inbound
rule or ingress filter. Define rules that allow inbound
initiations only if external entities need to access services
and resources hosted internally.
Otherwise, allow the firewall to serve its primary purpose
and prevent outsiders from gaining easy access to internal
systems. Most firewalls deny by default all access to internal
resources from external entities. This is done either by
ignoring all requests received on a specific interface (such
as on dual-homed or triple-homed firewalls) or by having a
specific rule (or a set of rules) that filter out all traffic
originating from non-internal IP addresses.
A firewall rule can also be called a filter or an access
control list (ACL). These terms are often used
interchangeably in documentation, in books, and in the
firewall’s own configuration or management interfaces.
Don’t be confused by this. A rule is a written expression of
an item of concern (protocol, port, service, application, user,
IP address) and one or more actions to take when the item
of concern appears in traffic. A filter is the same thing as a
rule, but the point or purpose of using this term is to stress
the intention to block or deny unwanted items of concern.
The use of the term ACL stresses the intention to grant or
deny traffic on an access control/authentication basis. An
ACL focuses on controlling a specific user or client’s access
to a protocol or port.
Rules allow traffic to pass unhindered or block or deny
traffic to prevent it from reaching its intended destination. A
rule can also include a logging element so the traffic can be
logged whether allowed or denied. The concept of firewall
logging and monitoring is discussed later in this chapter.
technical TIP
Use your firewall to ensure that only properly
originated communications are authorized. Unless you
are running internal services (such as a Web server),
external entities should never be able to initiate a
connection.
technical TIP
Most session-based communications will use a well-
known default port for the destination port where the
service or resource resides. They will use a randomly
selected higher order port (any port above 1,023) for
the client source port. Most firewalls, especially those
capable of stateful inspection, will automatically handle
and adjust for the random source port when
establishing a session. If this is not the case with a
specific firewall, you may need to create a custom rule
or consider replacing the firewall with a better product.
Setting up or defining rules for a home, portable host, or
SOHO environment can be fairly easy if the number of
different types of access is minimal. But, as the number of
controls, limitations, restrictions, and exceptions increases,
defining rules properly can become more complex.
Obviously, larger networks with more advanced
infrastructures and communications require more intricate
sets of rules.
The basics of defining or crafting rules are the same (or
at least similar) across all firewall products. However, some
firewalls support editing or writing the rules directly while
others employ a graphical interface or use a design wizard
to accomplish this task. Software host firewalls, especially
those designed for end users, typically use a graphical
wizard–based system, while hardware firewalls typically
expose the raw rule itself.
Most rules have six main elements or components (Figure
7-2):
Base protocol—Set as TCP, UDP, ICMP, and
potentially other Layer 2, 3, or 4 protocols.
Source Address—Set as a specific IP address, a
subnet, a range of addresses, or ANY for all possible
addresses.
Source port—Set as a specific port, a set of ports, a
range of ports, ports less or greater than, or ANY for all
possible ports.
Target address—Set as a specific IP address, a
subnet, a range of addresses, or ANY for all possible
addresses.
Target port—Set as a specific port, a set of ports, a
range of ports, or ANY for all possible ports.
Action—The two standard actions are Allow and Deny.
Some firewalls include Log and Alert actions that allow
additional actions in a single rule.
FYI
Some firewall rule systems include application protocol
designations in the rule set. This is usually a human-
friendly naming convention pointing out the Application
Layer protocol rather than an element of the filter used
to select traffic. However, some firewall interfaces will
substitute a common protocol name for the destination
port. For example, port 80 would be displayed as HTTP
and port 25 as SMTP. However, these are usually for
human viewing; the port number itself is still used in
the actual protocol-level filtering activity.
FIGURE 7-2
SmoothWall’s rule configuration interface.
Depending upon the firewall, TCP and UDP rules (as well as
ICMP, IGMP, ARP, and other OSI Layer 2, 3, or 4 protocols)
may be defined in the same place or within different
interfaces, pages, or rule sets. When all rules are defined in
the same place, use an additional rule element designating
TCP, UDP, ICMP, and so on. All of the following examples of
rules assume TCP-based communications, unless otherwise
noted.
The common rule structure is:
When defining outbound rules, the source address and
port are often set as ANY unless the rule is to apply to a
specific system(s) or port(s). For example, a rule that allows
any internal client on the 192.168.42.0/24 subnet to access
any insecure Internet Web site would be:
A rule to allow access to any secured Internet Web site
would change the destination port 80 to 443:
A rule to block internal clients from accessing Internet
based FTP sites would be:
FYI
Keep in mind that firewall vendors may have crafted
unique management interfaces that display firewall
rules differently than the basic line form discussed
here. For example, some firewalls have a configuration
page for allow rules and a separate page for deny
rules. In that example, the rules on each page would
not include an Allow or Deny action, as the page they
are defined on implies the action.
When defining inbound rules, the source address and
port address are often ANY unless the rule is to apply to a
specific system(s) or port(s). For example, a rule that allows
any external host client to access an insecure Web site
hosted on the 192.168.42.98 would be:
An inbound rule to deny external hosts access to a telnet
server hosted on the same internal system as the Web
server would be:
Generally, inbound rules are needed only when an
internal resource is specifically hosted for the purposes of
being accessed by external entities. This type of rule is
commonly found on DMZ and extranet firewalls, but
shouldn’t be used on intranet border firewalls. The only
common inbound rule that might be required is one that
allows responses to previous internal client requests to
resources outside of the network. A stateful inspection
firewall usually allows response traffic automatically, but
static filtering firewalls might require a specific respond rule
set, such as:
When a UDP rule set needs to be defined, you must
either switch to a different rule set interface on the firewall,
or change the protocol designation from TCP to UDP.
Assuming a firewall interface with a leading protocol
designation for each rule, a rule set allowing user queries
with an internal DNS server at 192.168.42.104 by external
entities, but blocking attempts to perform DNS zone
transfers, could be:
To write a firewall rule controlling ICMP, change the
protocol designation to ICMP (or change interfaces) and
define an ICMP type. The port designations are dropped
completely (as they are not used by ICMP at OSI Layer 2).
Multiple ICMP rules can be defined for various sub-types to
allow some ICMP traffic and a deny-all catchall rule for
everything else. For example, to block only inbound ICMP
Echo_request packets, use the following filter:
technical TIP
The ICMP protocol’s header defines the purpose of the
protocol’s control message through the use of
numbered types. There are dozens of defined types.
The most commonly used are Type 8 Echo Request,
Type 0 Echo Reply, Type 3 Destination Unreachable,
and Type 11 Time Exceeded. Many types are further
specified with the use of a numbered code. For
example, Type 3 Code 3 is destination port
unreachable.
For a more exhaustive presentation of the ICMP types
and codes, please read RFC 2939 at
http://www.iana.org/assignments/icmp-parameters.
When defining firewall rules, keep a few basic guidelines
in mind:
Keep the rule set as simple as possible.
Document every rule.
Use a change control mechanism to track rule
modifications.
Always confirm the default deny before using
changed/updated rule sets.
A simple rule set is a set with as few rules as possible.
Fewer rules mean fewer complications. Fewer rules mean
less chance for a loophole. Fewer rules are easier to test.
Fewer rules are harder to attack and compromise.
Every rule enforced by a firewall should be written in the
security policy. Only rules in the written security policy
should be enforced by a firewall. Anytime you need to
change a firewall rule, first update the security policy, then
reconfigure the firewall to match the settings defined in the
security policy. Always fully document the rules actively
filtering traffic.
Do not just document that a rule exists and what the
basic rule structure is; also include a description of the
intention or purpose of the rule. Sometimes, a rule written in
a way that appears straightforward may not perform the
intended purpose. When other security administrators
review the documentation and examine the rules, they may
see the discrepancy and correct it. Get in the habit of
making notes about intentions, thoughts, and concerns.
Often, these stray comments will lead to solutions or assist
in future troubleshooting.
A change control mechanism tracks and monitors the
changes to a system. It does this by recording every
change, modification, or adjustment. Often, a change
management solution requires manual change logging;
thus, it must be enforced and followed by a written
component of the security policy. The change control
process produces historical documentation of the state of
security components. Change documentation is often
essential in troubleshooting and repair.
Most firewalls operate on a default-deny stance, but it
may be possible to modify this stance. Stance modification
may be a general setting in the overall configuration of the
firewall, or it might just be the last rule in the rule set. If it’s
just a rule, be sure that the final rule is always default deny
and that the default-deny rule is never edited or modified. A
default-deny rule should look like or enforce filtering as
follows:
Since a firewall is a first-match-apply rule-based system,
rules are ordered on the firewall. Traffic is compared with
each rule starting from the top rule. If a rule matches the
traffic, the rule’s action is applied. Once a matching rule’s
action is applied to the traffic, no further rule matching is
attempted. If the traffic does not match any rule except the
final rule, then it will be denied by default. All rules previous
to the default deny can be either exceptional Allow actions
or specific Deny actions. No matter what the structure of the
rules or the number of rules in the set, always ensure that
there is a default rule.
Here is an example of a basic TCP rule set:
FYI
All of the firewall rule examples are using the default
common port for common services as defined by
http://www.iana.org/assignments/port-numbers.
This collection of seven rules performs the following
filtering functions:
Allow response to TCP connections to internal hosts.
Prevent the firewall (192.168.42.1) from directly
connecting to anything.
Prevent external hosts from directly accessing the
firewall.
Allow internal hosts to access external resources.
Allow external hosts to send e-mail inbound to the e-
mail server at 192.168.42.55.
Allow external hosts to access an internal Web server
at 192.168.42.98.
Apply a default-deny rule to all traffic not matching a
previous exception.
Building a rule set is not complex, but it does take focus on
the details. Be sure to use a single IP address for a single
host and the correct subnet or range designation for a
collection of hosts. Specify the port when possible;
otherwise, use a valid port range. Include specific Deny
rules when needed. Remember that in the first-match-apply
system that is a firewall, order matters.
To grant every system but a few specific ones access to a
resource, you need a rule to block the few and allow the
rest. Position the Deny rule of this set before the Allow rule
of the rest since the Allow rule will likely be an ANY-based
rule instead of naming all of the many that are granted
access.
When the wrong rule is positioned first, this creates a
potential loophole. A loophole is a flaw in the logic of
filtering that will allow an unwanted action to occur. A
firewall can perform only the operations for which it is
programmed, and the specifics of and the order of the rules
are a form of programming. Take the time to evaluate, test,
and verify that you have defined all firewall rules correctly
and placed them in the best order.
If getting the rules in the right order seems daunting, the
following general rule of thumb usually results in less access
rather than greater access: List specific Deny rules first,
then the Allow exceptions, and always keep the default-
deny rule last. At best, this will result in exactly what you
want and expect. At worst, more things will be blocked than
you intended, but that is usually a better security stance
than allowing more things than you intended.
As rule sets get larger, they become more complex.
Often, the complexity stems from having explicit Allow rules
with additional Deny specifications. This results in rules that
overlap. Overlapping is acceptable when you understand it
and use it on purpose. When overlapping occurs
accidentally, it can result in undesired loopholes. Again, the
solution is to keep the rule set as simple as possible,
document every rule with its intentions, and test the rule
thoroughly before deployment.
With this basic understanding of rules, your next step in
understanding and deploying firewalls is to consider the
options for authentication and authorization across the
firewall.
Authentication, Authorization, and
Accounting
Authentication is the process of verifying the digital identity
of an entity—for example, an employee, a customer, a
server, an application, a Web site, a smart meter, a cell
phone, or a security guard. Authentication is also commonly
called logging on. Authorization is the process of defining
which resources can be accessed by an electronic entity and
what level or type of access is granted. Authorization is also
commonly called access management or privilege
management
Authentication can take place at the firewall itself or be
passed through the firewall to take place beyond the
firewall. Authentication at the firewall takes place when the
allow/deny decision is dependent upon the identity of the
host or user. Authentication beyond the firewall happens
when the allow/deny decision is not dependent upon the
identity of the host or user; instead, the firewall filters for
traffic characteristics and leaves authentication up to the
internal host receiving the connection.
When authentication takes place at the firewall, the
firewall itself serves as the gatekeeper, allowing
communication beyond the firewall (or not). Whenever
different types or levels of port, protocol, or circuit access
are granted based on individual user identity or membership
in specific groups, authentication at the firewall takes place.
When authentication takes place at the firewall, the
firewall itself can perform the logon process or it can
forward the task to a dedicated authentication service.
Native firewall authentication methods can be basic, such as
supporting a username and password online, or complex,
such as supporting credit card payments or the use of smart
cards. However, most firewalls have a limited number of
authentication options.
Generally, authentication on or at a firewall supports only
one—or at best a few—options. At-firewall authentication
often requires defining credentials on the firewall separately
and distinctly from any identity on the network. Thus, most
at-firewall authentication solutions do not integrate into a
network’s single sign-on system. For this reason, large
organizations rarely employ at-firewall authentication.
FIGURE 7-3
A firewall handing off authentication tasks via 802.1x to a
dedicated authentication server.
When a firewall hands off the authentication task to a
dedicated authentication service that performs the logon
process on behalf of the firewall (Figure 7-3), a much wider
assortment of authentication options becomes available. A
common use of this mechanism is IEEE 802.1x. IEEE 802.1x
is known as port-based network access (admission)
control (PNAC). In this term, port is not referring to a port
number in OSI Layer 4; instead, it refers to a more generic
reference of a connection point to a network infrastructure.
IEEE 802.1x is commonly found on many network
devices, including firewalls, switches, routers, and wireless
access points. It also has the nickname of “portal
authentication.” An 802.1x device establishes the initial
electronic connection or virtual circuit between the
requesting host and itself, but before communication to a
host beyond the portal device takes place, authentication
must occur. 802.1x can support RADIUS, TACACS, Kerberos,
certificates, passwords, smart cards, biometrics, special
access codes, and even credit cards as means of
authentication.
Handoff authentication, such as when 802.1x is used, is a
fully scalable architecture. You can use it to manage at-
firewall authentication for any number of users or hosts. The
only limitation to 802.1x is the scalability of the
authentication server that takes over the responsibility of
managing logons on behalf of the firewall.
When authentication takes place beyond the firewall, the
firewall makes allow/deny decisions based on traffic factors
rather than user- or host-identification factors. In this
configuration, the firewall is not involved in the
authentication process. Instead, the host beyond the firewall
that receives the communication handles any necessary
authentication.
For example, a firewall can protect a DMZ. Most DMZ
firewalls do not perform at-firewall authentication. Instead,
the Web servers hosted in the DMZ can provide both
anonymous content and authenticated content to visitors.
Visitors log on using any means of authentication supported
by the Web server, the protocols in use, and the visiting
client. Commonly, this is forms-based authentication
secured through an SSL or TLS encrypted session.
When any form of authentication takes place, whether at
or through the firewall, you should always encrypt all
authentication-related communications. Non-encrypted or
plaintext authentication traffic is subject to eavesdropping
and thus theft of credentials. Encrypted authentication
traffic is resistant to eavesdropping as well as replay attacks
and in some circumstances even man-in-the-middle attacks.
Many different authentication protocols, both encrypted
and plaintext, can be employed by at-firewall or beyond-
firewall authentication. Whatever the solution, evaluate all
authentication options in light of their native security and
inherent risks. If you are using authentication encryption,
realize this does not ensure that subsequent data
exchanges are automatically encrypted. Select solutions
that provide protection for authentication traffic as well as
data traffic.
You can avoid authentication completely with anonymous
connectivity. In an anonymous connection, the user and/or
host identity is unknown and access is granted or denied
based exclusively on the traffic content and the proper
formation of resource requests. For example, public Web site
access can be anonymous, such as at Wikipedia
(http://www.wikipedia.org), which supports mostly
anonymous connections to its online community
encyclopedia.
Authorization takes place after authentication.
Authentication determines, within established parameters,
who you are. Once that is known, it is possible to determine
whether you are allowed to do what is requested.
Authorization, like authentication, can take place either at
the firewall or beyond the firewall. When authorization takes
place at the firewall, the firewall itself makes a decision on
allowing subsequent communications across the firewall.
This is sometimes known as controlling the circuit. If the
authenticated user does not have access to a resource, the
firewall will block or drop the connection. If the
authenticated user does have access to a resource, then the
firewall allows and supports the connection.
Usually, the firewall is involved only in authorization of
the connection or circuit. Any content within the subsequent
communication might be subject to content filtering, but
that’s a distinct and separate service and function of the
firewall. This form of authorization control is the same as a
circuit proxy.
When authorization takes place beyond a firewall, just as
with beyond-firewall authentication, the destination host
controls what is and is not accessible to users. The firewall is
involved only in monitoring for abuses or potentially filtering
content. When the firewall performs content filtering on a
communication not managed by the at-firewall
authorization, this is the same as an application proxy.
While authentication and authorization are commonly
used together to control users’ access based on their
identity, they can be employed independently. For example,
a firewall performing at-firewall authentication does not
need to also provide separate authorization. If users
authenticate, then they have access to whatever is beyond
the firewall. If users fail to authenticate, then they do not
have access. In this example, the authentication process
itself is a form of authorization.
Similarly, a firewall can perform at-firewall authorization
without authentication. This is the basic or normal function
of firewall rules. Authentication is assumed when addresses
and ports in traffic headers “identify” the communications;
the rule sets themselves provide authorization restrictions.
If a port is closed, access is denied. If a source address is
blocked, access is denied.
Authentication and authorization are important
components of a complete network security structure. Use
these services on a firewall or beyond the firewall as
necessary. Additional important services related to firewall
security are monitoring and logging of traffic and events
that occur on or across a firewall.
The third A in AAA is accounting. It is different from
financial accounting in that it logs what a user has done on
the system. In other words it keeps track of who did what to
which assets via one or more log files.
NOTE
One example of a device able to record all traffic within
a sliding period is the Solera DS series of network
forensic appliances. For more information on this type
of advanced network monitoring product, visit Solera’s
Web site at http://www.soleranetworks.com/.
Monitoring and Logging
Monitoring and logging are the watching and recording of
events and traffic that take place on or across a firewall.
While in theory you can record every packet traversing a
firewall, this is usually impractical because the storage
space required would be immense. Certain products can
maintain a sliding window of recorded traffic encompassing
hours of communications using multiple terabytes of
storage. However, these devices are for advanced security
management and beyond the scope of this chapter.
FIGURE 7-4
An example of SmoothWall’s firewall logging display
interface.
Firewall monitoring and logging are about recording
events that take place on or across a firewall (Figure 7-4).
You can use various approaches to logging. You can log
everything, or you can log only events of seeming
importance. Generally, you will fine-tune logging through
real-world experience over time. Most security professionals
recommend capturing everything initially. Later, you can
tune logging and reduce it once you’ve identified specific
types of information, traffic, or events as having no forensic,
evidentiary, or historical value.
Firewall logging ensures that the defined filters or rules
are sufficient and functioning as you expect. By watching
traffic coming through a firewall’s filtering scheme, you can
discover traffic the firewall should have blocked, but for
which an effective rule was not defined (or properly
defined). Firewall logging helps to confirm that the
restrictions imposed by the firewall are functioning as you
expect and the security you assumed the firewall would
provide is actually present.
Generally, record every connection allowed by the
firewall as well as every packet dropped or blocked. This
stance of “log and monitor everything” ensures that nothing
goes unnoticed and that future investigations of log file
contents will reveal complete data. You can always throw
out extra and unnecessary data later, but you can’t recover
important data not recorded during the actual event.
Firewall logging can take place on the firewall itself or
offload to a dedicated logging system. In either case, the
firewall itself collects the event and/or packet you want to
record. The difference is whether the information goes into a
log file stored locally on the firewall or moves across a
network connection to a dedicated logging server.
One well-known and widely used centralized logging
system is syslog. Syslog is a standard for forwarding log
messages from a client device (the firewall in this situation)
to a centralized server. Linux and Unix systems have
supported syslog capabilities for decades. Windows systems
prior to Windows 7 required third-party products to interact
with syslog services. Most network devices, including
firewalls, switches, proxies, and so on, natively support
syslog.
Firewall logging:
Creates a historical record of activity for traffic and
trend analysis as well as growth prediction
Tracks usage levels and times for load balancing,
accounting, or even back-charging users
Discovers new methods or techniques of attack,
especially those based on network packet
manipulation
Detects intrusions or attempts to breach security
Creates legally admissible evidence for use in
prosecution
Having a firewall log of all events produces a significant
amount of recorded information. Always track available
remaining storage capacity to ensure sufficient space
remains to store new logged events. As a current storage
device reaches capacity, back up and move the records into
long-term archival storage. In a future investigation, you can
never know how far back you’ll need to look to discover
evidence of a security breach. Your organization’s written
retention policy should define how long you will retain logs.
In addition to juggling the storage requirements, you will
need to be able to analyze logged data. Log file analysis is
not usually an exciting proposition for most people. Long
and tedious, it can be mind-bendingly boring. Fortunately, a
growing field of automated analysis tools can reduce the
time and burden of log file investigation. Firsthand
knowledge, understanding, and experience are always the
best tools for interpreting and understanding firewall log
contents.
Upon infiltrating your network, one of the first steps most
experienced hackers take is to remove all evidence of their
activities. They normally do this by deleting log files or
surgically editing log files with specialized tools. For
example, WinZapper is a tool that edits Windows log files
and removes only those entries matching a keyword such as
an IP address or username. To combat this potential threat,
use a write-once read-many (WORM) storage device to
save all log files. Intruders cannot edit data written to a
WORM device.
If you make the decision not to record everything taking
place across the firewall, here’s a short list of essential
things to log:
All connection attempts rejected by the firewall
All traffic directed at the firewall
Any access to internal resources by external hosts
Any access to external resources by internal hosts
Any modification or disabling of firewall rules and
filters
All firewall reboots, storage device shortages, or other
abnormal operational events
Every firewall management interface is different. Thus, the
methods and mechanisms you employ to configure your
specific logging and monitoring will be different as well.
Always be sure to consult the firewall’s documentation
about the type of logging and what types of events are
logged before deploying a firewall.
Define firewall logging in the firewall security policy
included in your organization’s written network security
policy. The logging and monitoring features of a firewall are
as essential as the rule and filter mechanism you use to
allow or deny traffic. Configuring and recording logs is
important, but understanding how to interpret firewall logs
is more important.
Understanding and Interpreting
Firewall Logs and Alerts
Enabling firewall logging is often a fairly simple task.
Recording traffic and events into a file is not really a
complex task. But deciding which events warrant the
triggering of an alert and what the contents of a log file
actually mean is not always so straightforward.
An alert is the automated notification of an
administrator when a specific event affects the firewall.
Some software host firewalls are preconfigured with a wide
number of pop-up messages triggered each time one of the
all-too-common activities occurs. For example, each time a
new application attempts to communicate with the network,
a firewall pop-up alert might notify the user of this event
and prompt an action (Figure 7-5).
FIGURE 7-5
An example of a Windows Firewall pop-up alert.
Appliance firewalls and those generally designed to
protect a network rather than a single host are not as
commonly configured with pre-set default alerts. Instead,
the firewall administrator makes choices about what events
actually need alerts. Some common events that usually
warrant alerts include:
A firewall reboot
A connection attempt with the firewall host itself.
Communications to or from a pre-identified IP address
or subnet
Detection of some or all attack attempts
Detection of any successful intrusion or security
breach
Ultimately, the organization’s security stance and the level
of risk determine which events require alerts as opposed to
simply recording them in a log file. A common
recommendation is to alert only on those events likely to
require an administrator’s immediate response or action.
Everything, or nearly everything, should go into a log, but
not everything warrants an alert.
With or without alerts, a firewall’s logging system creates
a massive amount of raw data that isn’t useful. You can
perform analysis of a log file either in real-time or in periodic
batches. You can hire a large staff of professionals whose
primary task is to perform real-time log file analysis, or you
can use an automated analysis or IDS/IPS tool. In most
cases, automated log file analysis tools both reduce the
strain on manpower and leverage the power of high-speed
computing against the massive volumes of information
collected by network firewalls.
Through careful analysis of firewall logs, you can detect
several different types of unwanted or malicious activities,
including worms, Trojan horses, remote control tools, port
scans, and directed intrusion attempts. When you perform
manual log analysis, the first hurdle is to gain access to the
log file content.
Many firewalls record their log files in binary or
obfuscated form so that they are difficult for external or
unauthorized users to access. Such log files require
administrators to access the log contents through a log
reading interface. Some third-party products function as
alternative management interfaces and can also interpret
the log file format for viewing.
Once you obtain access to the log contents, either
directly or through an interpretation interface, the next
hurdle is to ensure you are viewing the correct log. Several
different types of log files can operate on your system,
including traffic logs, audit logs, alert logs, console logs, and
even a host device’s OS logs for software host firewalls.
Another nuance is that the firewall device itself, a
management host, or a centralized logging server might
store its own logs. Finally, several dated versions of a log
might exist. Be sure to open or access the most recent log—
or whatever date range is of relevance to a specific
investigation.
Of course, the key to interpreting and understanding the
contents of a firewall log lies in understanding how network
communications function. Every communication session
involves two hosts, each with its own IP address and port
number. Some forms of communications have less
information, such as blocked connection attempts,
connectionless traffic, and Layer 3 protocols such as ICMP
and IGMP.
By examining each established session to evaluate the
source and destination IP addresses and the port numbers
in use, you can quickly determine whether the transaction
was valid or invalid. If the addresses are known—or at least
not known to be malicious—and the ports are for acceptable
services, then the communication is most likely benign.
However, if an address is a known malicious host or an
invalid address (such as an unassigned internal address) or
you discover a known malware port, these are signs of
unwanted and potentially malicious communications (or at
least attempts to communicate).
IANA and some security vendors maintain a list of well-
known port numbers and the associated applications. They
often list known malicious software and their commonly
used port numbers. Search for “malicious ports” or “Trojan
ports” to find current lists.
To examine and interpret firewall logs, you might:
Identify and discard all packets involved in benign
sessions between valid hosts and valid ports.
Identify and discard all valid UDP transmissions from
and to valid hosts and ports.
Identify and discard all valid ICMP (and other
authorized protocols) to and from valid hosts.
Identify any communication from known malicious
addresses. (This is a symptom of communications from
known malicious hosts).
Identify any communication from unauthorized or
unassigned internal addresses. (This is a symptom of
rogue internal hosts.)
Identify any communication to an unknown or
unauthorized port on an internal host. (This is a
symptom of rogue internal services.)
Identify any patterns of serial communication attempts
across a sequential or randomized set of addresses
and/or ports. (This is a symptom of scanning or
probing.)
Identify significant volumes of non-session traffic of
the same or similar construction to one or a small
group of internal addresses. (This is a symptom of
flooding.)
Identify any packet of invalid size or invalid header
construction. (This is a symptom of scanning, probing,
or an exploitation attempt.)
Identify any packet with configured source routing.
(This is a symptom of attempted intrusion or traffic
shaping.)
Identify packets destined to non-resource-sharing
systems, such as firewalls or routers. (This is a
symptom of probing, network scanning, or an
exploitation attempt.)
This is just the start of a firewall log file analysis procedure.
For each and every threat, exploit, attack, or concern that
an organization wishes to identify, add a step to search log
contents for the appropriate symptoms. Remember that
many symptoms are shared across a wide variety of
malicious activities.
Keep in mind that hackers can perform malicious
activities within seemingly benign traffic. This is especially
true when the payload of traffic is the malicious content
itself. Firewalls can detect malicious or abnormal
characteristics based on header information and packet
construction oddities, but many types of malicious payloads
are not firewall filterable. For example, password guessing
against a logon prompt is typically not a filterable activity.
An intrusion detection system (IDS) or an intrusion
prevention system (IPS) could potentially detect online
password guessing, but a firewall cannot.
This brings up an important issue discussed previously,
but it bears repeating: Firewalls are not perfect. Firewalls are
only part of a security infrastructure; they are not the
totality of security in and of themselves. Even when you use
them properly, firewalls have limitations. For example, they
are of no help in protecting against an insider attack.
Firewall limitations are discussed further later in this
chapter.
The best tool for interpreting the contents of a firewall
log is solid and thorough familiarity with the normal and
expected traffic that occurs across a network. By knowing
what is normal and expected, you are much better prepared
to detect and identify the abnormal and unexpected. Keep
complete configuration documentation and actively seek
direct, hands-on knowledge and experience to improve your
ability as a firewall administrator to examine, interpret, and
take action on the contents of log files.
Intrusion Detection
A firewall is a border sentry device. A controlled network
border sentry device filters any traffic attempting to cross.
However, not all traffic that needs monitoring crosses a
network border guarded by a firewall. That’s where an
intrusion detection system comes into play. An IDS or an IPS
monitors internal hosts or networks, watching for symptoms
of compromise or intrusion. Effectively, an IDS is a form of
burglar alarm that detects when an attack is occurring
within the network.
An IDS serves as a companion mechanism to a firewall.
Once an IDS detects an intruder, it can send commands or
requests to the firewall to break a connection, block an IP
address, or block a port or protocol. You must configure the
firewall to receive these commands and authorize the IDS to
send them. However, not all IDSs and firewalls are
compatible in this manner.
Eventually, security professionals developed the IPS
concept. The IPS strives to detect the attempt to attack or
intrude before it can be successful. Once detected, the IPS
can respond, preventing the success of the attempt, rather
than waiting until after a successful breach to respond. IPSs
do not replace IDSs. Instead, they are often used as an
initial layer of proactive defense, relegating the IDS to a
reactive measure against those events that the IPS misses
or that internal personnel perform.
IDS and IPS are important components of a complete
network security solution. However, they are not without
fault. IDS/IPS solutions can create a false sense of security
under certain conditions. Two commonly discussed
conditions include unknown zero day attacks and false
positives.
When unknown zero-day attacks threaten the network,
an IDS or IPS might not have the mechanism to detect
them. Thus, the lack of an alarm could cause administrators
to assume that no attacks are occurring. In most cases, the
lack of an alarm does mean that nothing malicious is
happening. So this assumption is not completely
unwarranted. But if an IDS never triggers an alarm, you
probably have a poor detection system rather than the
complete lack of compromise attempts or attacks.
When an IDS fails to detect an attack, whether it’s a zero
day or a known attack that was simply overlooked, this is
called a false negative. A false negative is one of the most
problematic issues with an IDS, as it can lull the
organization into a false sense of security. When alarms are
not going off, it’s common to assume that no malicious
events are taking place. If that’s a false assumption, then
real attacks are occurring and the security staff is unaware.
This is the worst type of security breach.
False positives may create a false sense of security for
the opposite reason—namely too many alarms from benign
occurrences. Remember the story of the little boy who cried
wolf? After the initial alarms turn out to be benign activity,
the urgency of responding to alarms diminishes. After
additional false positives, an administrator might put off
investigating the alarms. Eventually, you ignore the alarms
altogether. Once this situation arises, you treat even alarms
for malicious events as false positives, once again
reinforcing a false sense of security.
IDS and IPS can use rule-based detection mechanisms
similar to those of a firewall, but they can also employ
detection mechanisms borrowed from antivirus technology.
For example, some IDSs and IPSs have a database of
signatures or patterns of known malicious activity. This is
known as signature-based detection, database-based
detection, or knowledge-based detection. Any attack
within the database can be detected in live activity by the
IDS.
Another form of detection is anomaly based. Anomaly-
based detection systems look for abnormalities. To do
that, you have to first define “normal.” Normal can be
defined by rules or filters that prescribe all of the valid
packet constructions and header contents. Then, anything
that fails to match the definition of normal is an anomaly.
Since mistakes, errors, and poor network application
programming can occur, an anomaly is not necessarily
malicious or an intentional attack.
Yet another detection mechanism is behavioral based.
Behavioral-based detection looks for differences from
normal based on a recording of real-world traffic that
establishes a baseline. A normal baseline can be recorded
over hours or days. Once recorded, it’s the yardstick to
measure all future activities. Any future event not similar to
behaviors in the baseline set represents a possible violation.
As with anomaly detection, behavioral-based detection
has its own limitations. For example, all forms of benign
behavior may not have occurred during the behavior
recording time. Or, during the recording period, malicious
events might have taken place. In either case, future
situations can generate false positives (mistaking benign
behavior as malicious) or false negatives (mistaking
malicious behavior as benign).
Some IDSs and IPSs can import and interpret firewall logs
as another source of information in their efforts to detect
unwanted activity. Thus, in addition to reviewing log files
manually or with separate investigation tools, they can also
benefit IDSs and IPSs and improve their scope and
effectiveness.
IDS and IPS are not substitutes for firewalls, but are
potential supplemental or companion solutions that might
expand the effective detection methods already available.
When you are considering an IDS and/or IPS to improve the
filtering already provided by a firewall, carefully consider
deployment options and thoroughly plan out the improved
infrastructure. Compare the plan to a typical IT
infrastructure and consider where the placement of an IDS
and/or IPS makes the most sense for your organization.
Limitations of Firewalls
Firewalls are essential components of security. Systems
ranging from standalone home systems to global IT
infrastructures all need firewalls as part of their overall
security solution. However, firewalls are not perfect
solutions. In fact, when it comes to firewalls, you need to
account for several well-known limitations in their design
and management.
Firewalls are ultimately software code written by humans.
In either a host firewall or an appliance firewall, the logic
and controlling mechanisms of the firewall are software
code. Software code is designed and written by people.
Whenever people are involved, the possibility exists that
they will make mistakes or oversights. Fortunately, most
firewall products are rigorously and thoroughly tested as a
counterbalance to this threat. But nobody should assume
that the firewall software code is inherently perfect.
It doesn’t happen often, but it has happened—and will
happen again—that administrators and hackers discover
software coding bugs or flaws in real-time use. Hackers are
constantly using scanning, testing, and probing tools to
discover exploitable weaknesses. Once a vulnerability
appears, a hacker will create an exploit that takes
advantage of the flaw. Some exploits have caused firewalls
to freeze or crash, while others have given hackers the
ability to read or adjust filtering rules.
Some exploits are based on buffer overflows. A buffer
overflow is a condition whereby a memory buffer exceeds
its capacity and extends its contents into adjacent memory.
Hackers often use this as an attack against poor
programming techniques or poor software quality control.
Hackers can inject more data into a memory buffer than it
can hold, which may result in the additional data
overflowing into the next area of memory. If the overflow
extends to the next memory segment designated for code
execution, a skilled attacker can insert arbitrary code that
will execute with the same privileges as the current
program. Improperly formatted overflow data may also
result in a system crash.
Once the firewall vendors become aware of an exploit in
the field, they quickly develop and release a patch. By
having an effective security management and patch
management system, you can quickly test and install such
new updates for the firewalls protecting your production
environment. If the release of a patch or the application of a
patch is delayed, the window of opportunity for hackers to
compromise your environment remains open.
Firewalls can sometimes be vulnerable to fragmentation
attacks. Fragmentation attacks are an abuse of the
fragmentation-offset feature of IP packets. Fragmentation
may occur in a network where many different network links
join to construct a global infrastructure. Some network
segments support smaller datagrams (another term for
packet or frame) than others, so larger datagrams fragment
into the smaller size. When the fragmented elements of the
original datagram reassemble, reassembly of the fragments
can cause several potentially malicious reconstructions,
such as overlapping and an overrun.
Overlapping can cause full or partial overwriting of
datagram components, creating new datagrams out of parts
of previous datagrams (Figure 7-6). An overrun can cause
excessively large datagrams to be constructed. Other
fragmentation attacks are designed to cause DoS or attempt
to confuse IDS detection or firewall filtering.
Protections against fragmentation attacks include using
modern IDS and firewall filtering features, as well as
performing sender fragmentation. Sender fragmentation
queries the network route to determine the smallest
maximum transmission unit (MTU) or datagram size. Then
the sender pre-fragments the data to ensure that no en-
route fragmentation will occur.
Firewalking is another known firewall limitation.
Firewalking is a technique to learn the configuration of a
firewall from the outside. The technique uses a valid IP
address of an internal host. Then, from an external system,
a hacker attempts to establish a communication session
with the internal host over a multitude of different ports.
Effectively, this is a form of port scanning, but with the
addition of the known internal host, the hacker can learn not
only which ports are open, but also which ports actually
allow communications with an internal system. Effectively,
firewalking discovers the rules or filters on a basic packet
filtering firewall. Modern stateful inspection firewalls are
usually not as vulnerable to firewalking, as they can detect
this mechanistic activity.
FIGURE 7-6
Fragmentation and overlapping
Internal code planting is another known firewall
limitation. Firewalls are often deployed as border sentries.
They are intended to protect internal systems from
communications that originate from external entities.
Unfortunately, some security administrators use only
inbound firewall filtering, leaving outbound traffic
uncontrolled and unfiltered.
In this situation, if a hacker can plant code internally or
trick a user into running code, or an employee brings in
code of his or her own, the possibility exists that outbound
connections to malicious external entities could occur. Many
hacker tools are based on this technique, such as Loki, Back
Orifice, NetBus, and event netcat. A hacker creates a server
of sorts that is hosted on an external host. The automatic
connection client utility executes on an internal host. The
client utility establishes the connection, and then the
external host is able to send data or commands back to the
internal client. Often, this form of attack results in a hacker
gaining modest to complete remote control over the
compromised internal host.
Denial of service (DoS) is another common problem that
reveals a limitation of a firewall. A DoS attack, specifically a
flooding- or traffic-based DoS, sends massive amounts of
data to a target victim. If that victim has a firewall, then the
firewall can detect and discard the potential DoS traffic. The
firewall’s filtering service can usually prevent the DoS traffic
from breaching the network’s perimeter and affecting
internal systems.
However, since the firewall has to collect, analyze, and
respond to every packet received on its interfaces, a well-
organized DoS can consume all available bandwidth of the
connecting segment to the firewall as well as consume all of
the processing capabilities of the firewall. This in turn
prevents any legitimate traffic from reaching the network.
Thus, even with a firewall protecting the internal network, a
DoS flooding attack can still successfully disconnect or
interfere with external communications.
The vulnerability to DoS flooding is the one limitation or
weakness of firewalls that you cannot fix, improve, or repair
by either upgrading the firewall or applying a patch.
Upgrading to a stateful inspection firewall addresses
fragmentation, firewalking, and even internal planting of
code. Patching will address programming bugs and buffer
overflows. Upstream filtering is one possible
countermeasure to prevent flooding attacks from reaching
an Internet-facing firewall, but this technology requires
cooperation from Internet service providers (ISPs) and other
third parties.
Knowing these limitations, as well as recognizing the
likelihood of there being others, brings the security
administrator back to basics. Security management is
mandatory to maintain any semblance of security in any
environment. Keep systems current with patches, use a
hardened configuration, stay knowledgeable about new
exploits, and monitor the environment for successful and
attempted compromise. These are the essential, long-term
strategies for maintaining security.
Improving Performance
Using a firewall is mainly about establishing and maintaining
border security, but security managers must also look into
other areas of importance and concern beyond just security.
One of these additional non-security areas is performance.
Since the goal of security is to protect the production
environment, installing security measures that severely
hinder capabilities necessary to accomplish work is
counterproductive.
One of the most common concerns with the use of
firewalls is network communication speed. When selected
and installed properly, a firewall should function at
wirespeed. Functioning at wirespeed means the firewall
does not introduce any delay or latency in communications
because it operates at the same speed as the network. If
there is a 1,000 Mbps network, then a 100 Mbps–capable
firewall is too slow.
Two primary means can help you to improve firewall
performance above and beyond purchasing a firewall
suitable for the network’s known transmission speed. These
two means are caching and load balancing.
Caching is a technique to seemingly improve
performance by borrowing from proxy servers. In fact,
adding caching to a firewall effectively transforms it into a
proxy server for whatever service you configure the caching
to supplement. Caching is the holding of often-accessed
content in storage or memory on the firewall. Then, when a
future request for the same content is received, the cached
copy goes into service rather than the original external
source. This does require that the content be relatively
static and that a staleness value be used to trigger a
content refresh.
technical TIP
Router load balancing traffic management can use a
variety of scheduling algorithms, such as round robin
or fair queuing. Round robin simply hands out tasks in
a non-priority sequence. For example, with three
firewalls and five transactions, transaction one is sent
to firewall one, transaction two to firewall two,
transaction three to firewall three, transaction four to
firewall one, and transaction five to firewall two. Fair
queuing operates by sending the next transaction to
the firewall with the least current workload.
Unfortunately, caching is beneficial only on two main
services: Web and file transfer. If the potential or actual
bottlenecks to performance across a firewall are not due to
these two types of communication, then caching is not a
good solution.
Load balancing is the distribution of the firewall filtering
workload across multiple parallel firewalls. You can use this
as shown in Figure 7-7 with a phalanx of two or more
firewalls deployed in parallel between routers that perform
load balancing traffic management on both inbound and
outbound communications. Load balancing allows for
deeper packet inspection while maintaining wirespeed
performance using parallel-distributed firewall processing.
The use of load balancing often has additional benefits,
such as redundancy and fault tolerance. Both of these
improve the availability of the firewall filtering service for
network communications. Having a fail-safe or fail-secure
plan to disconnect communications if the firewall is
compromised is essential. However, a more secure and
productivity-friendly solution is to maintain continued
communication with filtering by having redundant pathways
with duplicate firewalls.
FIGURE 7-7
Firewalls deployed in a load-balancing configuration.
The Downside of Encryption with
Firewalls
Encryption is a common security mechanism you can
employ to protect data in storage and in transit. When used
properly, encryption provides confidentiality protection.
Encryption prevents unauthorized third parties from gaining
access to secured content. With the risk of eavesdropping
and data theft constantly increasing, the use of encryption
is becoming not just a good idea, but also an essential
element of storage and transaction security.
However, encryption does have a downside relative to
firewalls. A firewall is typically not the intended destination
or direct communication partner of a communication,
especially an encrypted communication. Thus, any
encrypted data cannot be filtered by a firewall. However,
just because packets are encrypted does not automatically
mean that nothing about the packet remains in plaintext.
Transaction or communication encryption takes two main
forms: tunnel mode and transport mode. Tunnel mode
encrypts the entire original payload and header, while
transport mode encrypts only the payload. In tunnel mode,
a temporary header goes with the encrypted packet to
guide its path across the VPN tunnel. In transport mode, the
original header remains in plain text.
A firewall can still view and filter on the contents of the
tunnel mode header or the transport mode header.
However, the tunnel mode header contains details only
about the endpoints of the tunnel, not the endpoints of the
actual communication itself. So, tunnel mode header
filtering is not very useful as a filter against malicious traffic.
Filtering on the transport mode header is a viable option,
because the header in the packet in transport mode is not
encrypted. Thus, any header-only filtering rules could still
apply to transport mode–encrypted communications.
However, any filtering that required an examination of the
payload will be rendered null.
When building or designing firewall filtering rules, you
must make a choice about how to handle encrypted
content. Consider both the valid and invalid reasons for
content encryption. The organization can choose to support
or allow encryption of specific types over specific protocols
or ports, but disallow and prevent encrypted
communications elsewhere. Encryption for Web
communications and e-mail exchanges are often
acceptable, while other transactions with the Internet might
not be encrypted.
When designing the firewall rules, the management of
encrypted traffic can range from full allowance to full denial.
Whether to allow encryption over a specific port but not
another and whether to allow encryption all the time, for
only certain users, or for no one are common issues your
organization needs to address and plan for.
No ultimate right or wrong decision about whether to
allow encryption across a network border is possible. Decide
based on the security stance of your organization, the risk
presented by both encrypted and plaintext transactions, and
the types of communications essential for your particular
business tasks.
A growing trend in secure deployments, especially for
DMZ or other hosted resources designated for public access,
is to support encrypted communications but have the
encrypted tunnel end at or on a firewall. This allows you to
examine the contents of the communications before they
reach the actual destination. This is becoming a common
infrastructure design component for public facing Web sites.
Figure 7-8 shows an example of a configuration where SSL
or TLS links from external Internet clients end at the firewall;
then, they traverse the last segment in the clear to reach
the destination Web server.
FIGURE 7-8
A firewall deployed as an SSL/TLS endpoint to allow for Web
traffic filtering.
Another concern is that when encrypted traffic crosses a
firewall, the firewall is usually unable to perform NAT. This is
dependent on the encryption system in use, but it’s worth
investigating before deployment. If the encryption
mechanism hashes the header, even if it remains in
plaintext, the modification to the header by NAT will cause
the hash verification process to fail, thus rendering the
transmission void. With an encrypted header, NAT will be
unable to modify the addresses. Be sure to select encryption
protocols that are NAT-compatible if this is a necessary
function of the network’s infrastructure.
Firewall Enhancements
Firewalls emerged from basic router traffic control systems
into full-featured content filters. However, throughout this
evolution, firewalls have remained focused on their primary
purpose—namely, detecting unwanted, unknown, or
malicious traffic and blocking it. The filtering mechanisms
have typically been identification-based. Whether IP
address, port, protocol service, MAC address, content
keyword, or even user authentication, the Allow and Deny
decisions relied directly on easily definable elements.
Modern firewalls now offer a variety of enhancements,
improvements, or add-on features that some organizations
might find attractive. You should consider the value of these
enhancements in light of the ability of the device to
continue to perform the essential services of firewall
filtering. Do not let the snazzy up-sell add-ons distract you
from obtaining and deploying a reliable filtering device.
It seems that all vendors dream up new enhancements to
add to their product line each time they refresh, update, or
make a product revision. So, be sure to thoroughly research
any newly offered enhancement before making a purchase.
Just because the bumpers are shiny does not mean the
engine runs.
A common or popular firewall enhancement is malware
scanning. Adding an antivirus, anti-spyware, anti-Trojan,
anti-whatever scanner to a firewall is not a significant
stretch of the core firewall’s capabilities, especially for
application proxies and stateful inspection firewalls. The
main concerns should be whether such an enhancement can
maintain wirespeed performance and whether the firewall’s
anti-malware abilities are on par with existing standalone
malware protections.
If you are considering a firewall malware scanning
enhancement, pay attention to the details. Important
considerations are the detection engine and the mechanism
of periodically updating virus signature definitions.
Firewalls can also offer IDS and IPS features. In fact, the
merging of intrusion detection and prevention is a logical
combination. The ability of a single device that can filter
traffic as well as watch for and defend against intrusions is
attractive. But the question remains: Does the combination
device perform both tasks at the same level of exellence as
common independent products? If not, then the combination
is more of a detriment than a benefit. Also, does the firewall
maintain its ability to operate at wirespeed?
Some firewalls are equipped to function as a VPN
endpoint. When designing a firewall and VPN architecture,
this might be an attractive option, but as with every firewall
enhancement, you should evaluate its features and
performance against that of standalone solutions.
Unified threat management (UTM) is the deployment
of a firewall as an all-encompassing primary gateway
security solution. The idea behind UTM is that you can use a
single device to perform firewall filtering, IPS, antivirus
scanning, anti-spam filtering, VPN endpoint hosting, content
filtering, load balancing, detailed logging, and potentially
other security services, performance enhancements, or
extended capabilities. UTM has its advantages, mainly in the
ability to deploy a single product and manage multiple
security services from a single interface.
Any given UTM can be a jack-of-all-trades product and a
master of none. With many of the larger firewall and
security product vendors developing product lines
supporting UTM, however, it’s possible to deploy a reliable
single-device solution. But even a reliable UTM product
remains a single point of failure.
UTMs are obvious improvements to environments that
use simple or outdated firewalls and those that lack
independent coverage in the non-firewall security
categories. An all-in-one UTM device can quickly and
effectively improve your organization’s security.
As the trend toward virtualized networks, hosts, and
applications continues, the need for security within
virtualized networking environments increases as well. Just
because the virtual hosts exist in memory alone does not
imply that they are immune to hacking or exploitation. In
fact, they may be at even greater risk. Include firewalls in
the construction of virtualized networks.
You can still use a hardware firewall when traffic between
virtual hosts crosses a physical network segment. However,
when virtual host communications occur within memory
alone, a virtualized firewall is necessary. A virtualized
firewall is really the same as a virtualized host; it’s a
software construct of a hardware environment that hosts
the operating system so it can function in memory rather
than on actual physical devices. You can install a software
firewall into a virtual host to act as a firewall for virtual
network connections. When designing and using a
virtualized network, make the effort to include virtual
firewalls as part of the infrastructure.
Management Interfaces
You must configure firewalls for them to perform the
security functions you expect of them. Every firewall has a
management interface used to configure its functions and
features. Through the management interface, you can
control and define all aspects of a firewall.
A firewall’s management interface may be command-line
based (Figure 7-9) or graphical based (Figure 7-10). A
graphical user interface (GUI) might be a standalone client
application you must install onto a host, or it may be a Web
interface hosted on the firewall’s own internal mini-Web
server.
FIGURE 7-9
Examples of accessing a firewall (SmoothWall) via command
line (SSH).
FIGURE 7-10
An example of a GUI firewall interface (SmoothWall).
A firewall’s management interface may or may not offer
encrypted access by default. If the firewall does not offer
encryption of the management interface, then you should
replace it with a firewall that does. Always enable the
encryption so that all future access to the management
interface is protected from eavesdropping, interception, and
session hijacking. Encryption of the session accessing a
firewall’s management interface is the most important and
critical aspect of management interface configuration.
Secure a firewall’s management interface both physically
and logically. This implies that direct physical contact with
the firewall device (or firewall host) will be limited and
restricted to authorized administrative personnel only.
Prohibit any physical contact or proximity to external or
unauthorized entities.
Secure all logical access to the firewall’s management
interface through a strong authentication process. If
multifactor authentication is supported, use it. If not, require
long and complex passwords. Ensure that administrators do
not reuse the same password on any other system.
Administrators, as well as all users, should never reuse an
old password on any system once it expires. Passwords are
like milk—they last only so long, even with proper care and
storage, and once expired, they can never be reused.
Limit the methods to access a firewall’s management
interface. Manufacturers often enable all possible avenues
of access to ensure ease of installation upon initial
deployment. However, you should disable all methods of
accessing the management interface except for the sole
secure mechanism selected for use by your organization.
Potentially available avenues of access include telnet,
encrypted telnet, Web, encrypted Web, SSH, and other
proprietary options. Select one of the secure options and
disable the rest.
Also, consider the communication pathways for
accessing the management interface. Usually, the physical
cable connection port, often labeled as CON for console, TER
for terminal, or ADM for administration, cannot be disabled
through software. This port is a dedicated port used for
direct physical connection management and not for any
other purpose (in most cases). A crossover cable or a
special console cable (often RS-232 based) is necessary to
connect a computer directly to the firewall to gain access to
the management interface.
However, most in-network or over-the-network logical
access pathways can be disabled. Be sure to disable access
to the management interface on every physical network
interface or port that faces outward. In other words, the
less-secure NIC ports should not support access to the
management interface.
If more than one NIC port exists on the secure side, then
limit access to only one of those two ports. If the firewall is a
multifunctional device that also supports wireless
connectivity, disable management interface access over a
wireless connection. The resulting configuration should
allow management interface access only via the physical
CON connection and one logical pathway. Disable all other
methods of access.
Configure the firewall to record every attempted and
successful connection to the management interface into a
log file. It might also be a good idea to record all subsequent
configuration changes made via the management interface.
This log can serve as a component of change
documentation and will assist with future troubleshooting,
investigations, and reconfiguration.
CHAPTER SUMMARY
Firewalls are essential to maintaining security, such
as supporting valid communications and blocking
malicious traffic. However, firewalls are often more
than just simple filtering tools. The standard and
enhanced features of firewall products require
knowledge and skill if you are to properly employ
them.
This chapter discussed building firewall rules,
ordering rule sets, configuring authentication and
authorization based on the presence of a firewall,
configuring firewall logging, making sense of the
contents of firewall logs, expanding firewall functions
with intrusion detection, dealing with the limitations
of firewalls, maintaining high-speed network
performance with a firewall, managing encryption
across a firewall, evaluating firewall enhancements,
and handling firewall management interfaces.
KEY CONCEPTS AND TERMS
Access control list (ACL)
Alert
Anomaly-based detection
Behavioral-based detection
Centralized logging system
Database-based detection
Deny by default/allow by exception
Fair queuing
False negative
False positive
Filter
Firewalking
Knowledge-based detection
Load balancing
Management interface
Port-based network access (admission) control
(PNAC)
Round robin
Signature-based detection
Unified threat management (UTM)
Wirespeed Write-once read-many (WORM)
CHAPTER 7 ASSESSMENT
1. Which of the following is a firewall rule that prevents
internal users from accessing public FTP sites?
A. TCP ANY ANY ANY FTP Deny
B. TCP 192.168.42.0/24 ANY ANY 21 Deny
C. TCP 21 192.168.42.0/24 ANY ANY Deny
D. TCP ANY ANY 192.168.42.0/24 21 Deny
E. TCP FTP ANY ANY Deny
2. Which of the following is a default-deny rule?
A. TCP ANY ANY ANY ANY Deny
B. TCP 192.168.42.0/24 ANY ANY ANY Deny
C. TCP ANY 192.168.42.0/24 ANY ANY Deny
D. TCP ANY ANY 192.168.42.0/24 ANY Deny
E. DENY TCP ANY ANY ANY ANY
3. The default-deny rule appears where in the rule set?
A. First
B. After any explicit Allow rules
C. Anywhere
D. Last
E. After any explicit Deny rules
4. What mechanism allows a firewall to hand off
authentication to a dedicated service hosted on a
different system?
A. IEEE 802.11
B. RFC 1918
C. IEEE 802.1x
D. RFC 1492
E. IEE 802.3
5. When an organization first deploys a firewall and
chooses to begin logging activity, what should you
include in the log file?
A. Only malicious traffic
B. Only DoS traffic
C. Only dropped packets
D. Only allowed packets
E. All events
6. You can use firewall logging to perform all of the
following activities except:
A. Discovering new methods or techniques of attack
B. Creating a historical record of activity used for traffic
and trend analysis
C. Tracking usage levels and times for load balancing
D. Stopping intrusions
E. Creating legally admissible evidence for use in
prosecution
7. All of the following events appearing in a firewall log
warrant investigation by an administrator except:
A. Firewall host reboot
B. A connection attempt to the firewall host
C. Detection of an attack attempt
D. Inbound packets with spoofed internal source
addresses
E. An internal user accessing a public Web site
8. Which of the following is a highly recommended
method or technique for keeping firewall logs secure
and uncorrupted?
A. Storing them in binary form
B. Using 15,000 RPM hard drives
C. Recording only important events
D. Centralized logging
E. Using timestamps
9. Which of the following is an event found in a firewall log
file that is a symptom of a rogue host operating within
the private network?
A. Packets from a known malicious address
B. Packets from an unassigned internal address
C. Packets to an unknown port on an internal host
D. Packets in a serial grouping that attempt to access a
sequential series of ports
E. Packets in a very large grouping that are all exactly
the same directed toward a single target
10. What is the biggest issue or problem with an IDS?
A. False positives
B. Failing to operate at wirespeed
C. False negatives
D. Keeping the pattern database current
E. Using anomaly detection
11. Which of the following is not a limitation or potential
weakness of a firewall?
A. Firewalking
B. Software bugs or flaws
C. Using first match apply rule systems
D. Fragmentation attacks
E. Internal code connecting to an external service
12. When a firewall is able to process packets, filter
malicious code, and transmit authorized
communications onward to their destination without
introducing latency or lag, this is known as operating at
________ .
13. Which of the following is not related to improving or
maintaining the performance of a firewall?
A. Native antivirus scanning
B. Round-robin task assignment
C. Caching
D. Fair queuing session management
E. Load balancing
14. What form of encryption allows a firewall to filter based
on the original source and destination address? (Assume
the firewall is located along the path between session
endpoints.)
A. Tunnel mode
B. VPN remote access encryption
C. Transport mode
D. VPN LAN-to-LAN encryption
E. Header encryption
15. The performance of what type of communication
session can be improved using caching on a firewall?
A. Instant messaging
B. Remote access
C. E-mail
D. Time synchronization
E. Web
16. Which of the following limitations or potential
weaknesses of a firewall cannot be fixed or corrected
with the application of an update or patch?
A. Programming bug or flaw
B. Firewalking
C. Buffer overflow vulnerability
D. Fragmentation
E. Denial of service due to traffic from external sources
17. What is the primary factor used to distinguish a great
firewall enhancement from a marketing gimmick used to
drive up sales?
A. Does the enhanced firewall cost the same or less than
separate products?
B. Does the enhancement affect the operating speed of
the firewall?
C. Does the enhancement operate as well as or better
than the original firewall?
D. Does the enhancement require the purchase of a new
firewall, or can it be added to existing products
already deployed?
E. Does the enhancement have a reoccurring license or
subscription fee?
18. What is the name of a single device that is based on a
firewall but that has been expanded and improved to
perform a wide variety of services, such as filtering, IPS,
antivirus scanning, anti-spam filtering, VPN endpoint
hosting, content filtering, load-balancing, and detailed
logging?
A. Load balanced filtering
B. Port based network access (admission) control
C. Unified threat management
D. Multifactor authentication
E. IEEE 802.1x
19. The most important configuration element related to a
firewall’s management interface is:
A. Access over wireless is prevented.
B. Access through a network interface is enabled.
C. Access is encrypted.
D. Access through a CON port is allowed.
E. Physical access to the device is controlled.
20. All of the following avenues of accessing a firewall’s
management interface should be limited, restricted, or
disabled except:
A. Wireless
B. Telnet
C. Public facing NIC interface
D. Port 80 Web
E. Private network NIC interface
CHAPTER
8 Firewall Deployment
Considerations
FIREWALLS CAN BE COMPLEX security solutions. You should plan the deployment of a firewall carefully, whether
it’s for a small home office or a large corporation. Evaluate
as many firewall deployment considerations as possible
before ramping up.
Make a clear determination as to what types of traffic
you will allow to cross the network border and which types
you want to block. Evaluate common security strategies.
They include security through obscurity, principle of least
privilege, simplicity, defense in depth, defense diversity,
chokepoint, weakest link, fail-safe, and forced universal
participation. Determine which strategies you want to use
and integrate them into the organization’s security policy
and its firewall deployment.
Evaluate the purpose and content of the firewall policy.
Clearly define the software and hardware firewall options
you will use when adopting the firewall policy. Determine
whether features such as reverse proxy and port forwarding
are necessary to the infrastructure’s network
communications. Weigh the benefits of bastion host OSs
before using new firewalls. Make sure to order firewall rules
properly and use the least number of rules possible to
enforce security goals.
Every organization is different and must evaluate its own
business and security needs. Determine which tasks are
essential, which are optional, which are personal, and which
are malicious. Use firewalls and other controls to support
what’s necessary and block everything else. Security
administrators are responsible for evaluating needs and
solutions and for preparing a response when security and
business interfere with each other.
Chapter 8 Topics
This chapter covers the following topics and
concepts:
What should you allow and what you should
block when using a firewall
What common security strategies for firewall
deployments are
What essential elements of a firewall policy
are
What the software and hardware options for
firewalls are
What the benefit and purpose of reverse
proxy are
What the use and benefit of port forwarding
are
Which considerations aid in selecting a
bastion host operating system (OS)
How to construct and order firewall rules
How to evaluate needs and solutions in
designing security
What happens when security gets in the way
of doing business
Chapter 8 Goals
When you complete this chapter, you will be able
to:
Compose a firewall policy defining what to
allow and what to block
Describe various firewall security strategies
Define the pros and cons of reverse proxy
and port forwarding
Explain the importance of a bastion host
Assess the business impact of security over
availability and performance
What Should You Allow and What
Should You Block?
The most commonly asked question when installing a
firewall is, “What should be allowed and what should be
blocked?” This question assumes a distinct and definitive
answer. The answer, however, is subjective and variable.
A single security stance or filtering configuration that
works for every situation, every organization, and every
system doesn’t exist. Network security managers must
investigate the needs and threats to make informed
decisions about what traffic to allow and what traffic to
block.
The first stage in making this determination is to perform
a complete inventory of all needed or desired
communications. This should include every transaction
between internal systems, as well as any interaction with
external systems. As part of this inventory, indicate the
protocol in use, the port(s) in use, and the likely source and
destination addresses.
A possible inventory of network communications could
look like Table 8-1.
This is not an exhaustive table, but it shows the basic
idea of an inventory of network communications. Notice that
some communications are internal only, while others cross
the network boundary. Based on a complete and exhaustive
inventory of your network’s communications, you can
establish a potential rule base.
From the inventory, block from crossing the network
border all communications that should only be internal. In
most cases, the default-deny rule of a rule set will block
those communications from doing so. However, when a port
or protocol is in common, it’s possible that an Allow rule for
a valid external communication would also allow external
entities access to an internal-only communication.
In Table 8-1, an example of this issue is the e-mail
protocol SMTP operating over port 25. By defining an allow-
exception rule, you could create a loophole that threatens
the internal communication on this same port. Reduce or
eliminate this risk by using a very specific rule or by adding
an additional Deny exception.
A very specific rule in this example would allow external
communication over port 25 only if it originated from the
internal e-mail server at 192.168.42.115. With this rule
defined, if any other internal host attempted an external
SMTP communication on port 25, it would not be allowed
because the IP address would not match this specific rule.
The communication would instead be blocked by the default
deny.
TABLE 8-1 A partial list of communications occurring on
a network.
If an allow-exception rule for external communications
also applies to internal communications, you can add a
specific deny-exception rule just prior to the Allow rule. The
Deny exception can specifically block internal
communications from crossing the network border, but still
allow the subsequent Allow exception to grant access to the
valid transactions.
After you complete a thorough inventory of network
communications, you should determine which
communications are mission-critical, important, optional, for
personal recreational use, or actually malicious. Block any
traffic you deem malicious or just unwanted, whether
through an explicit Deny or via the catchall default deny.
Evaluate all other forms or types of traffic against several
factors, including policy. If it’s not in support of the business,
is it really needed? Are communications for personal
entertainment or nonbusiness functions permitted by policy
or considered a waste of resources? Are any
communications duplicated or redundant? Is this a waste of
resources, an expansion of the attack surface, a valid
redundancy, or avoidance of a single point of failure? Are
any of the communications no longer necessary? If so,
should you disable or remove them?
Base your evaluation of the many other possible
questions or issues on your organization’s policy
statements, including mission and goals. Take the time to
understand the communication needs of your network, then
design the filtering rule set accordingly. Remember that the
firewall is often the front sentry or the first line of defense
against malicious communications originating from outside
networks. Leaning toward caution and locking things down
is a more effective security stance than leaving
communications open and hoping detection mechanisms
will notice malicious events.
Traffic Inventory
A common, and free, network protocol analyzer (or
sniffer) for doing a traffic inventory is Wireshark
(www.wireshark.org). Wireshark can be used in the
absence of a firewall, with a firewall set to allow all
traffic, or even in the presence of a firewall to
inventory all traffic on the network. Traffic can then be
partitioned into traffic that needs to cross the firewall
and traffic that should not cross the firewall. Use of a
sniffer tool in general, or Wireshark specifically, for
traffic inventory is done to highlight all traffic and
make sure that the firewall rules have a better chance
of being accurate. During the traffic inventory, you
can uncover a lot of previously hidden information
about the network. You can find out which
applications and users are the top consumers of
bandwidth. You can find out which protocols are
actually in use on the network. And you can surface
malicious uses that you haven’t known about before.
Some of the more advanced firewalls also have this
functionality built-in.
While some exceptions to these suggestions will arise
from your organization’s business model or strategies, the
following items are commonly considered communications
to block in most, if not all, circumstances:
All Internet control message protocol (ICMP) traffic
originating from the Internet
Any traffic directed specifically to the firewall
Any traffic to known closed ports
Any traffic to known ports of known malware, such as
31337, used by Back Orifice
Inbound Transmission Control Protocol (TCP) 53 to
block external domain name system (DNS) zone
transfer requests
Inbound User Datagram Protocol (UDP) 53 to block
external DNS user queries
Any traffic from IP addresses on a blacklist
Any traffic from internal IP addresses that are not
assigned
As an organization manages its security over time,
especially as it reacts to intrusion attempts, experiences
scanning, and becomes the target of hacking and flooding,
it must create additional communication filtering rules to
respond to real-world conditions. Security does not stand
still. Hacker attacks are constantly changing. Thus, the
filtering rules that work well today may be insufficient in the
near future.
Networks can be very large and very complex. Be fully
aware of the communications taking place across your
network to know what to allow and what to block. In
addition to this knowledge, having established a security
strategy through a written security policy will direct and
guide the deployment of firewall rules, as well as other
aspects of your security infrastructure.
Common Security Strategies for
Firewall Deployments
A security strategy is a guideline, philosophy, or approach to
using security for firewalls, as well as the entire
organizational security infrastructure. Many different
strategies are available. Some organizations focus on a
single strategy, while others combine several strategies into
a custom policy.
Security Through Obscurity
Security through obscurity is the idea of gaining protection
by using abnormal configurations. This is both a positive
security action and a poor one. It simply depends on the
type of obscurity involved. A poor choice for security
through obscurity would be to use alternative configurations
for standard products.
With a network environment based on standard products,
whether operating systems, network services, or security
solution, just modifying basic configuration settings does
not actually provide true security. For example, a service
typically operating on one port that’s reconfigured to use a
different port is not good security. Also, changing names,
addresses, network size, subnetting, bandwidth
consumption, or even spoofing banners, headers, or identity
does not provide true security but may provide some
protection against elementary attacks.
Some common mistaken examples of obscurity-based
security include:
Hiding your front door key under a rock in a flower bed
Connecting to the Internet with the assumption that
your system is one in 300 million and therefore won’t
be noticed
Hiding money in a mattress
Keeping an encryption algorithm secret
Hiding your car keys behind your bumper while at the
park or beach
Changing the default service port of a network service
Hiding your financial records among the audio files on
your MP3 player
All attempts to provide network security based on hide-and-
seek can be overcome or bypassed with basic network
scanning techniques. When a hacker can discover or breach
a host, service, or network just by looking hard enough, no
real security exists. Hiding might work for keeping colored
eggs and candy secure, but a security solution employed by
bunnies has no place in a modern IT environment.
Security through obscurity is problematic for several
reasons. First, if it’s the only form of security employed, no
real security exists. Second, the obscurity method employed
might not actually be as obscure as you think. Hiding a key
under a flowerpot is not as obscure as burying it in an
unmarked location in the middle of a field. Third, it often
distracts from accurately assessing the true state of security
provided by other measures. Fourth, obscurity can instill a
false sense of confidence.
True security through obscurity relies on using obscure
and nonstandard technologies. If everyone knows the most
common or most popular operating system or software
product is insecure, it can be a security improvement to use
a more obscure product instead. This doesn’t guarantee that
other flaws or vulnerabilities won’t be present on the
alternative system, but usually the exact same exploit or
compromise won’t be a risk.
However, switching to an alternative technology is a
security improvement only if the same flaw does not also
exist there. It must provide actual security in and of itself.
Switching technologies, such as changing operating
systems, does not eliminate the need for security
management. It simply moves the security concerns to
other areas.
Generally, security is obtained through obscurity only
when hackers are unable to determine which technologies
you are using. The less hackers know about your software,
configuration, deployment, addressing, infrastructure
design, patching schemes, and so on, the less successful
their attempts to compromise security will be. Obscuring
information about the internal IT environment itself is a
primary defense against their hide-and-seek mentality.
Least Privilege
The principle of least privilege is one of the basic concepts
of network security. The idea behind the principle of least
privilege is that users should have the minimum level of
access to resources needed to complete assigned tasks. Any
abilities, access, or privileges beyond that necessary
minimum increase the risk of compromise and lead to
wasted time, effort, and focus.
In most environments, most users need not access every
host, every system, every resource, every file, every
network service, and every Internet resource. Within a
default-deny environment, you block all access to all
resources, internal and external, by default. You use the
principle of least privilege by adding explicit and specific
allow-exceptions only when necessary based on job
descriptions.
However, the drawback to least privilege is the need to
control every user’s access individually. Each worker will
need individually defined resource and activity permissions.
This represents a significant increase in user administration.
Because of this extra overhead, many organizations only
partially use least privilege.
A common practice is to group users into collections of
similar job functions or security levels, granting permissions
to the group as a whole. This gives users additional
privileges beyond what is strictly necessary for their work,
but not enough to present a serious risk to the
organization’s security, stability, or confidentiality. Instead,
this small security tradeoff considerably cuts down on
administrative overhead.
An extension of the principle of least privilege known as
separation of duties specifically addresses administrative
users. A lazy and insecure approach to network security is
to grant some high-end users full administrative privileges
across the entire IT infrastructure. This is a recipe for
disaster. If an administrator makes a mistake, then he or she
can accidentally harm the entire organization. If an
administrator becomes disgruntled, feels wronged by the
company, or is marked for layoff or forced retirement, he or
she can deliberately harm the organization and would have
the systemwide power to do it. If another user or an
external intruder compromised such an administrator’s
account, a hacker could use the administrator’s advanced
access to cause significant havoc.
A safer approach is to apply the principle of least
privilege to all users, especially administrators. Under the
label of separation of duties, divide the collection of all
administrative tasks into small sets of privileges, focusing
on a single task, system, service, or issue. Then, assign
administrators subtasks within one of these focused areas
and permissions only within the scope of their assigned
tasks. This compartmentalizes administrative functions and
provides a type of firewall or blockage against accidents,
sabotage, and intrusion.
The result of applying separation of duties is that you
eliminate godlike systemwide administrators. Instead, each
administrator has sufficient privileges only within a limited
scope of responsibility. Some areas may have multiple
administrators and some administrators may have powers
in multiple areas, but overall the compartmentalization of
administrative privileges significantly increases security and
decreases risk.
Keep in mind that the principle of least privilege applies
to both users and systems alike. Controlling which resources
and communication pathways a service or device can touch
will directly reduce the potential for abnormalities, abuse,
and compromise.
Simplicity
Keeping things simple is an important part of security. It
makes them easier to understand, manage, and
troubleshoot. When things are too complex, they are much
more difficult to understand, much harder to manage, and
much more complicated to troubleshoot. Furthermore, it’s
harder to verify that a complex system is providing
adequate security.
The more complex a solution, the more room for
mistakes, bugs, flaws, or oversights to creep in undetected
by security administrators. The more complex the system,
the more likely a hacker can find a vulnerability unseen by
the system designers and network managers.
Simple is not always possible, however, especially when
it comes to software and network infrastructures. But when
you have a choice between a simpler solution and a more
complex one, the simpler option may provide a more
realistic and verifiable level of security. As someone once
said, “Keep things as simple as possible, but no simpler.”
Keep in mind that too simple has the same flaws as too
complex. Avoid sacrificing security for the sake of simplicity.
Defense in Depth
Installing a security infrastructure requires numerous
systems to interact and interlock. The goal of any security
solution is to prevent unwanted events while supporting
authorized and necessary ones. A reliable security
infrastructure is typically not a single control, a single
defense, or a single countermeasure. Instead, multiple
security safeguards provide complete and exhaustive
coverage.
One aspect of infrastructure security design is to think of
the defenses as multiple layers or barriers to access secured
resources. This is known as layered defenses or defense in
depth. When designing security, consider the net result if
any component of the security system were to fail. If a
single component failing results in a compromise or
intrusion, the environment has a single layer of protection.
When defense in depth is used, a single component failure
does not result in compromise or intrusion. Instead, each
component has a backup, an alternative, or a supplemental
component. Depending on a single security product as the
sole component of a security solution is a bad idea. Firewalls
are great products, but firewalls alone cannot provide
complete security. They are only one component, one piece
of a complete security infrastructure. A proper security
infrastructure has numerous components interlocked and
deployed in layers or levels.
Another aspect of defense in depth is to deploy multiple
subnets in series to separate private resources from public.
This is known as an N-tier deployment. N represents the
number of subnets under private control. Figure 8-1 shows a
common construction of a three-tiered deployment using a
demilitarized zone (DMZ), a database subnet, and the
private local area network (LAN).
When properly implemented, defense in depth ensures
that multiple security controls are involved in every
communication, connection, and transaction, regardless of
its source or destination. Through the use of multiple or
redundant security systems, any attempt to compromise or
breach security becomes substantially more difficult, not
only for the external intruder, but for the internal saboteur
as well.
FIGURE 8-1
An example of an N-tier deployment.
Diversity of Defense
Diversity of defense is similar to defense in depth—it
supports multiple layers of security. The difference is that
each (or at least most) of the layers uses a different security
mechanism. Thus, the diversity of defense comes from
using a collection of diverse security solutions.
Multiple firewalls in a series is defense in depth, but not
defense diversity. Adding tools such as an intrusion
detection system (IDS), antivirus, strong authentication,
virtual private network (VPN) support, and granular access
control converts a monolithic defense in depth to a more
substantial, multilayered, diverse type of security.
It might be tempting to claim that having multiple
firewalls from different vendors (or any security mechanism
from different vendors) constitutes diversity of defense.
While using different products from different vendors will
reduce some forms of risk, it’s not as beneficial as true
diversity—not just of vendors but also of security
component types.
Using a variety of vendors will reduce the likelihood that
a single flaw in one product is present in every other
product from different vendors. For example, using three
different vendor antivirus products is a reasonable idea.
Having one vendor for clients, one vendor for internal
servers, and a third vendor for border devices will increase
the likelihood of detecting malicious code and decrease the
threat from undetected malware. However, relying
exclusively on antivirus and using no other type of security
mechanism is a poor security solution.
Proper defense in depth will include diversity in both
vendor selection and security component types. Be aware,
though, that focusing too heavily on vendor diversity can
increase management and administration complexity. It’s
difficult enough to manage single-vendor solutions, but
when two, three, or more different vendor products of the
same product type are involved, the complexity of
management increases significantly.
When selecting products, whether by type or vendor,
keep in mind the overall infrastructure design, such as
parallel versus serial connections, as well as redundancy
options. In some circumstances, using two different
defenses can result in a larger rather than reduced attack
surface. For example, if two different products each have a
different vulnerability when they are deployed in parallel,
then both weaknesses are vulnerable simultaneously, giving
the hacker the option of one or the other. Were they to be
deployed in series, the hacker would have to compromise
the first layer of defense successfully before attempting to
breach the second. Consider whether the planned diversity
is truly a security improvement, since poor design can lead
to reduced security when you employ diversity improperly.
When investigating and designing an infrastructure to
include diversity of defense elements, keep the following
concerns in mind:
Some companies resell their products, technology, or
intellectual property through other vendors. Private-
label or relabeled products from company B might be
the same product from company A with a different
name or packaging.
Security systems configured by the same security
administrator can potentially have the same
misconfiguration or design weakness. Consider using a
team of security administrators, or at least have
several security experts review and check all
configurations.
Many products come from a single original code base
or standard. Product version 2.0 from company A and
product version 5.0 from company B might both
include the same protocol stack code borrowed from
an open-source or creative commons–licensed code
base. Don’t automatically assume that products from
different vendors, even with different build versions,
represent 100 percent different programming.
Many systems of the same type will all have the same
inherent weaknesses in the underlying technology,
design, and security concept.
When implementing diversity, ensure that you are using
actual diversity-improving security rather than false or
misguided diversity that reduces security. All security
designs and perceptions should withstand the scrutiny of
evaluation and testing.
Chokepoint
A chokepoint forces all traffic, communications, and
activities through a single pathway or channel. This pathway
can be used to control bandwidth consumption, filter
content, provide authentication services, or enforce
authorization. The purpose of a chokepoint is to ensure that
the security device at the control location controls
everything. No traffic, user, or data passes unchecked.
Other names for a chokepoint include checkpoint, filter
pathway, or bottleneck. A chokepoint can be used to force
network traffic along a single pathway monitored or filtered
using security devices, including routers, switches, firewalls,
IDS/intrusion prevention system (IPS), antivirus, network
access control (NAC), and so on. A choke-point can also
control user activity, such as requiring authentication and
enforcing access control.
As a security measure, a chokepoint has value only if it’s
hard to bypass or avoid the bottleneck itself. If a hacker can
interact with a target without going through a chokepoint’s
filtering system, then the chokepoint is worthless.
If the security of a network has chokepoint infrastructure
components as a central part of the infrastructure, be sure
to evaluate and consider all possible alternative pathways a
hacker might employ. For example, a firewall is less effective
as a chokepoint if outsiders can access wireless access
points, physical connection ports, or dial-up modems.
In many cases, a single chokepoint won’t be enough.
Using multiple chokepoints may be the only effective means
of ensuring that your network evaluates and filters all
traffic. Some potential chokepoints can include any crossing
of a network domain boundary into another. By using
chokepoints across the boundaries of a typical IT
infrastructure, you filter most pathways of communications
that could host malicious interactions.
Consider potential indirect routes that might bypass
“standard” chokepoints. For example, if a VPN link is
established between two sites, whether branch offices or
business partners, the Internet connection of one site could
be an alternate pathway into the second site. This breach is
possible if one site uses strong chokepoint security while the
other does not. And even though it may be old fashioned,
don’t forget to check for dial-up access to a LAN’s servers or
other components. Dial-up access can serve as a backdoor
for hackers to circumvent the security protections prepared
to block them at the front door.
Weakest Link
Any chain is only as strong as its weakest link. A security
infrastructure is only as strong as its weakest component.
You must know your security infrastructure thoroughly to
have an understanding of where the weakest point lies.
Once you’ve identified the weakest link, replace or remove
it.
The weakest link security stance is an ongoing process
of locating the least secure element of an infrastructure and
securing it. Once you’ve secured the current weakest link,
it’s no longer the weakest link, and therefore a new weakest
link exists. Repeat the cycle by seeking out the next weak
point and improving it.
The idea behind this security stance or process is that
hackers are performing this exact task as they seek out
vulnerabilities to compromise. Ultimately, hackers discover
and break the weakest links to gain access and entry into a
secured environment. By actively and consistently seeking
out vulnerabilities and weak points to secure them, you
reduce the potential of a hacker finding and exploiting a
weak link.
Weakest links are inevitable. But a strong weakest link is
always better than a frail weakest link. Using a find-it-then-
secure-it mentality helps build security that can withstand
most common exploitation and intrusion attempts.
Fail-Safe
Fail-safe, fail-secure, fail-open, and fail-closed are not only
design elements of firewalls and other security controls. Fail-
safe is also an overarching security stance to drive an
organization’s security. The fail-safe security stance is not
just about using fail-safe security devices, but about
designing the overall infrastructure with fail-safe as a core
focus.
When any aspect of security fails, the best result of that
failure is to fail into a state that supports or maintains
essential security protections. Generally, this means to
maintain confidentiality and integrity protections. However,
most fail-safe solutions will sacrifice availability protection
to retain confidentiality and integrity.
Fail-safe does not need to be a standalone security
stance. You can integrate fail-safe notions into any security
perspective. Keep in mind the ultimate goals and policies of
your organization. If availability is the top priority, then fail-
safe may not be as viable an option as for environments
where you can sacrifice availability to support other security
protections.
Forced Universal Participation
It almost goes without saying that for security to be
effective, everyone must work within the limitations
established by your organization’s written security policy. If
you make exceptions—for upper level managers, for
instance, who see themselves as being above the rules,
able to do whatever they want without consequences—then
you have only an assumption of security. No true security is
present. Security works only when you employ forced
universal participation.
Every worker, every manager, every senior executive,
every temporary worker, every consultant, every vendor,
every customer, every business partner, and every outsider
must be forced to work within the security policy’s
limitations. Yes, exceptions often are necessary in the real
world, but when exceptions become the norm, security is
lost. When it’s easy to bypass, avoid, or even ignore
security controls, an attacker can use that same pathway to
compromise the entire security environment.
Universal participation is not just about official
configurations and designs. Every enterprise that cares
enough about security to write a security policy has official
configurations and designs that assume everyone follows
the same rules. When it’s unwritten policy to violate security
to accomplish work tasks, an obvious disconnect exists
between security and productivity. In this situation,
reexamine both security and productivity goals. Security
should support productivity, not impede it.
Universal participation is not just about paying lip service
to the rules, however. It’s also about ensuring that everyone
abides by security limitations. Potentially, users have many
ways to purposefully violate security. This often occurs in
environments where workers perceive the security
limitations as too restrictive or when newly imposed rules
strongly limit freedoms they enjoyed previously. The less
workers believe in and buy into the organization’s security
policy, the more likely they are to violate rules they perceive
as unfair.
Examples of users purposefully avoiding or violating
security—that is, not actively supporting and participating in
security—include:
Choosing poor passwords
Sharing accounts with others
Using personal computer equipment on the company
LAN
Installing an unauthorized wireless access point
Using personal removable media on company
equipment
Using proxy tools to bypass firewall filtering
Configuring a dial-out modem connection to establish
unfiltered Internet access
Using Internet based remote-access/remote-control
tools to access their workstation from an external
system without authorization
Installing unapproved software
To achieve universal participation in the security efforts,
either workers must believe that compliance is in their best
interests, or you must force compliance through
consequences for violations. In most cases, voluntary
compliance is better, because it causes workers to support
the security effort rather than setting up employees to be
adversaries pitted against the security infrastructure.
Essential Elements of a Firewall
Policy
A firewall policy is a security policy that focuses on the
deployment of firewalls within the organization’s IT
infrastructure. The first step in deploying a firewall is
constructing a firewall policy. Once you’ve established a
firewall policy, deploy subsequently installed firewalls in full
compliance with the firewall.
A written firewall policy provides several benefits and
serves several purposes, such as:
A guide for installation
A guide for configuration
A tool to assist in troubleshooting
A guideline to detect changes and differences
A mechanism to ensure consistent filtering across all
firewalls
A firewall policy should address several specific issues and
contain specific configuration details. One of the first
important elements of a firewall policy is defining and
designating security zones. Every network has different
zones of risk and zones of trust. Often, zones are
differentiated along the same lines as a typical IT
infrastructure. Create clear descriptions of what each subnet
does, its level of risk, and its level of trust. Based on this
information, you can formulate a basic firewall deployment
strategy.
A firewall policy should define specifically what type of
firewall you need. It may even prescribe the specific vendor,
make, and model of firewalls at each zone transition or
interface. Firewall types include static packet filtering,
proxy, and stateful inspection.
For each prescribed firewall, define a complete firewall
rule set. Define each rule in full detail, not just the
configuration settings to make on the firewall’s interface.
Support each rule with justifications and reasons why you
defined or selected it. Give a clear indication of the orders of
the rules.
A firewall policy should also prescribe host software
firewalls for deployment on clients and servers. This should
include configuration settings and rule sets as well. Design
and configure host firewalls to complement appliance
firewall security.
The firewall policy should also address:
What to log
How logging happens
Where to store log files
How often to review log files
What add-ons or enhancements to use
Who is responsible for firewall administration
How to access firewall configuration interfaces
Where to physically and logically locate the firewall
What level of physical access control is necessary
What form of backup or redundancy is present
How to manage encryption and where to use or
disallow it
How to deploy and configure IDS/IPS to interact with
firewalls
As with every security policy, the firewall policy must be as
exhaustive as possible. It should address and define every
aspect of firewall design, deployment, implementation,
management, tuning, repairing, recovery, troubleshooting,
and monitoring. A firewall policy should be the first and last
authority on all things firewall within the organization.
The first draft of a firewall policy will probably not be
exhaustive or accurate. So, review and improve your firewall
policy periodically, just as you do with the rest of your
organization’s security policy. Each review period should
assess whether the firewall is meeting the security needs
and how to improve it so it continues to provide sufficient
security. Work all improvements into the written security
policy. Then adjust the deployed infrastructure to comply
with the written security policy.
Software and Hardware Options for
Firewalls
Remember that most real-world solutions include a
combination of software and hardware firewall options.
Since technology changes and advances so swiftly, it’s
not wise to make specific product recommendations here.
Many products can go through significant upgrade or
generational change in as little as six months. So, this
discussion will focus on software and hardware options in
more generic terms.
Many operating systems include host software firewalls
as part of their standard installation build. Microsoft
Windows XP is one well-known example. Beginning with
Service Pack 2, Windows XP has included the Windows
Firewall as a standard security component. Other operating
systems may offer optional firewall products. A software
host-based firewall has benefits on both client systems and
servers.
You can usually replace a native or default software
firewall product found within a general-purpose operating
system (OS) with a third-party option. Many open source,
free, and commercial host software firewalls are easily
available. When considering third-party options, especially
when replacing the native firewall, consider whether
investing time, effort, or money in an alternative host
software firewall is as effective an investment as using an
appliance firewall to enhance or supplement a host firewall.
Home users, SOHO environments, and small companies
may benefit from a firewall on their Internet connection
devices. Most DSL and cable modem devices include basic
to moderately capable firewall options. Evaluate the
included firewall in an Internet connection device rather
than automatically discarding it as insufficient or inferior.
Many current Internet service provider (ISP) devices include
firewalls that are more than adequate for small network
environments.
Most wireless access points, both consumer and
commercial grade, include some form of firewall to provide
filtering services for wireless clients and physical cable
connections as well. Many wireless access points could be
accurately labeled as routers and/or switches, especially
when they include two to six extra-wired connection ports.
If a separate dedicated firewall device is necessary in
addition to an ISP device or a wireless access point, consider
building a firewall using leftover hardware. Building your
own hardware firewall can be a way to obtain firewall
appliance control and security on a shoestring budget.
technical TIP
It’s often possible to replace an appliance or device
firewall’s OS with a third-party alternative. This can
apply even to ISP devices and wireless access points.
Some of the better-known device firmware
replacement options are DD-WRT, Open WRT, and
Tomato.
The final step up in terms of firewall options is the
appliance firewall, which is a dedicated hardware device
functioning as a black-box sentry. Appliance firewalls can
range from low-end consumer-grade to very expensive high-
end, commercial-grade solutions. In most mid-sized and
larger organizations, a dedicated hardware firewall is a
necessity. Whether you buy that firewall as a pre-built
component or build it depends on your organization’s
knowledge, skill, and budget.
Keep in mind that security is not about always
purchasing the most expensive, the best-known, the most
efficient, or even the most secure option. Budgets are not
infinite. Your goal should be to deploy security that is
adequate and effective for the environment within the
confines and limitations of your budget, knowledge, and
skill. Getting sufficient security at the best price possible is
usually everyone’s priority.
Benefit and Purpose of Reverse Proxy
Reverse proxy is a firewall service that allows external users
access to internally hosted Web resources. This service
takes the traditional proxy function and inverts it. Instead of
hiding the identity of the client reaching out to the Internet,
reverse proxy hides the identity of the Web server accessed
by the Internet (or external) client.
External users direct their queries to a public Internet IP
address and a default or assigned port number as when
accessing any service. However, the IP address is the
address of a proxy server, not the actual Web server hosting
the requested resource. The proxy server then performs
network address translation (NAT) on the request to convert
the destination address to the internal (likely private)
address of the resource host.
You can deploy reverse proxy to support load balancing
or load distribution across multiple internal resource hosts.
This allows clients to use a single public address to access a
cluster of internal Web servers.
Other common reasons to deploy reverse proxy include:
Reverse caching—Reverse caching allows static
content to be cached and served by the proxy rather
than requiring that each request for the same content
be served by the Web server itself.
Security—Using a reverse proxy adds an additional
layer of protection and control between Internet-based
users and internally hosted servers. Proxying allows
the real identities of the internal servers to remain
unknown or at least obfuscated.
Encryption—The proxy server itself can serve as the
endpoint for Secure Sockets Layer (SSL) or Transport
Layer Security (TLS) encryption tunnels. This can allow
a firewall or IDS to monitor and filter the contents of
the traffic before it reaches the Web servers. Proxy-
based encryption can also benefit from hardware and
software acceleration to maintain high-performance
communications.
Reverse proxy does not have to function solely on the
private network’s borders. It can also operate internally
between subnets or departments, especially within IT
infrastructures of very large corporations. Reverse proxy is
also useful in an extranet or a DMZ. Just because a Web site
is hosted for public access does not mean security
precautions should vanish. Indirect access by reverse proxy
can often be a significant security benefit when you deploy
and manage it properly.
Use and Benefit of Port Forwarding
Port forwarding is a firewall, proxy, and routing service that
can receive a resource request on an interface at one port,
then forward the request to another address on the same or
different port. Port forwarding is used in reverse proxy, but
only for Web traffic. Port forwarding itself can support any
service on any port.
Port forwarding is a variation or enhancement of NAT.
When a request reaches an outward-facing interface to a
specific port, the request goes to an internal host. The
routing is controlled by a static NAT mapping that defines
which internal IP address and port will receive
communications sent to an external IP address and port.
Port forwarding does not support caching, encryption
endpoint, or load balancing. Only a single internal machine
can use a forwarded port at a time. The internal receiving
(destination) host will perceive the source of the
communications as the port-forwarding device because the
translation service will rewrite the source address as its
own. Thus, the destination system will not know the real
originator of a communication.
You can find port forwarding services on almost any
service or device that supports NAT. This includes most
firewalls (hardware and software), wireless access points,
and Internet connection devices (such as DSL and cable
modems). Port forwarding is also an essential element in the
Internet Connection Sharing (ICS) service of Windows that
allows multiple systems to share a single Internet
connection through the primary connected computer.
Considerations for Selecting a
Bastion Host OS
A bastion host OS is a system designed, built, and
deployed specifically to serve as a front-line defense for a
network. A bastion host is the first (or nearly so) host
accessed by external entities on their way to access DMZ,
extranet, or private network resources. The bastion host
withstands the brunt of any attack attempt to provide
protection for hosts behind it.
Bastions were the highly fortified sections of medieval
castles designed to assist with defense. The bastion was
located along the castle perimeter wherever access
attempts were likely, such as around the main gateway or
entrance, any side or back entrances, or natural landscape
pathways of approach. The bastion areas usually had
thicker, stronger walls, room for additional warriors, and
special defensive features. These special defensive features
might have included slits for shooting arrows, holes for
ramming spears or pushing away ladders, and pots of
boiling oil to pour on attackers.
On modern computer networks, a bastion is a fortified
computer device—possibly a host, firewall, or router—placed
in the line of fire between privately owned and controlled
networks and the public Internet. The purpose of a bastion
host is to provide frontline filtering and defense against
typical attacks. Most firewalls, especially appliance,
hardware, or device firewalls, operate as bastion hosts.
Software firewalls can also be bastion hosts if the host is
properly locked down and hardened.
Knowing that firewalls are commonly deployed as bastion
hosts raises the question of what type of operating system
(OS) you should use as the host OS on a bastion host
firewall. Two main categories or divisions of bastion host OSs
are proprietary OSs and general purpose OSs.
Proprietary OSs are operating systems built exclusively to
run on a bastion host device. Most appliance firewalls
employ a proprietary operating system. This includes
commercial firewall devices as well as many ISP connection
devices and wireless access points. These proprietary
bastion host OSs support the functions or services critical to
security (or their other primary purposes) and little else. An
example of a proprietary bastion host OS is Cisco IOS.
A firewall device’s bastion host OS supports only firewall
functions. An ISP connection device’s bastion host OS
supports firewall services and connectivity services. A
wireless access point’s bastion host OS supports firewall
services, wired connectivity services, wireless connectivity
services, and possibly other services, such as 802.1x.
General purpose OSs include Windows, Linux, Mac OS,
UNIX, and others. These are operating systems that support
a wide variety of purposes and functions, including serving
as client or server host OSs. When used as a bastion host
OS, they must be hardened and locked down. Otherwise, an
insecure host OS can render the security provided by a
firewall worthless. If an attacker can crash the firewall host
or bypass the firewall filtering, then the firewall is not
providing effective security.
It’s possible to reasonably harden a general purpose OS
for use as a bastion host OS, but this takes specific and
detailed modifications. Most software firewall products
include a guide to perform OS hardening to improve the
security of the bastion host and reduce the vulnerabilities
and backdoors that might permit firewall compromise.
Some firewalls include a prehardened version of a
general purpose OS as the bastion host OS. This is the case
for many Linux-based firewalls, such as SmoothWall.
The benefit of using a general purpose OS as a bastion
host OS is that such OSs are widely available. Some are free
—mostly Linux variations. Also, you can leverage your
current knowledge and skill with a general purpose OS when
you are using it as a bastion host OS. Keep in mind,
however, that general purpose OSs are much more widely
attacked and the risk of new exploits is high.
The benefits of a proprietary OS as a bastion host OS are
fewer known attacks and less risk of future exploits.
However, proprietary OSs might be significantly different
from other OSs in the environment and may require learning
a completely new system to properly and securely
administer the firewall. Also, most proprietary OSs are
officially released only on the bastion host hardware. This
makes them more difficult to obtain and more expensive in
most cases (at least in comparison to free and open source
alternatives).
Constructing and Ordering Firewall
Rules
As you begin to seriously consider the options for firewall
deployment, a close examination of firewall rules is critical
to success. The most important aspect of a firewall rule set
is its order.
Getting rules out of order causes unexpected and
unwanted consequences. This can include traffic you want
to block and other unwanted traffic crossing the checkpoint.
Rule-set ordering is critical to the successful operation of
firewall security.
The first and most basic rule-set-ordering convention is
that the universal Deny rule should be the last and final
rule. The use of deny by default or default denial rests on
the premise that the last rule is the catchall rule to block all
traffic not allowed access due to a previous rule-based
exception.
Another common guideline to rule-set ordering is to place
critical Deny exceptions first or early in the rule set. When
specific internal or external IP addresses or ports, or even
entire protocols, are to be absolutely blocked, you may need
a Deny exception rather than relying upon the default-deny
final rule. Some of the previous Allow exceptions might
inadvertently permit communications due to universal
application (with the use of ANY). By using a preemptive
specific enforced denial before any of the Allow exceptions,
you eliminate the possibility of accidentally allowing a
known malicious or unwanted communication.
Whenever possible, use fewer rules rather than more
rules. Even with proper ordering, the more rules you have,
the greater the likelihood of configuring something
incorrectly or creating a loophole. One issue that causes
more rules rather than fewer is infrastructure design
specifically related to addressing. A need for more rules
arises if a range of IP addresses is allowed access, but
within that range, some addresses are refused access. For
example, compare two scenarios.
First, a network has a host address range of
192.168.42.140–190. All hosts except for 188, 189, and 190
are allowed access to a certain port. A single rule allowing
hosts 140–187 is all that is necessary because the default-
deny rule takes care of blocking the remaining non-included
hosts.
Second, a network has a host address range of
192.168.42.140–190. All hosts except for 165, 171, and 188
are allowed access to a certain port. You need multiple rules
to use this configuration. One or more rules must define
Deny exceptions for 165, 171, and 188, followed by the
Allow rule of the 140–190 range. If the firewall allows only a
single address or a range of addresses per rule rather than
allowing a list of nonsequential addresses, then three Deny
rules would be necessary in this scenario.
In this example, network design and addressing can be
used to make firewall rule-set construction either larger and
more complex or shorter and more distinct and compact.
The latter is preferred for administrative purposes as well as
security and efficiency. If the process of creating rules
requires a significant number of special exceptions to
modify or adjust ranges of addresses or ports, consider
reconfiguring the network rather than using a too complex
or too long rule set. When designing or writing firewall rules,
especially when writing pairs or sets of rules, consider using
a single rule or a simpler rule set if the network’s addressing
scheme, infrastructure design, or subnet layout is adjusted.
As another guideline to ordering rule sets, consider
placing rules related to more common traffic earlier in the
set rather than later. Comparing traffic to the rule sets takes
time; each check of each rule takes some finite amount of
time. The fewer rules you need to check before you grant an
Allow, the less delay to the traffic stream. Prioritize in the
rule-set list the more commonly used forms of traffic,
whether by
IP address, port, or protocol. Put the less commonly used
forms of traffic further down in the rule-set list.
Ultimately, rule sets are about enforcing security relevant
to the organization. The rule set should reflect the
guidelines prescribed in your written security policy,
specifically the firewall policy. The goal of designing, writing,
and ordering rules for a firewall should be to focus on
obtaining the necessary security. Elegance and speed are
dividends, but not as essential as blocking the bad and
allowing the good. Never lose focus on the primary goal:
filtering traffic in accordance with your security policy.
Evaluating Needs and Solutions in
Designing Security
Any organization larger than a single person will generate
multiple opinions about what should and should not be
allowed across the firewall. Almost everyone would agree on
allowing (at some level) the necessary protocols,
applications, and services essential for mission-critical or at
least operationally necessary business tasks to cross the
firewall-secured network boundaries.
Opinions may differ about what constitutes a necessary
business task, but if it’s a necessary task, the organization’s
security solution should make the task possible.
Restrictions, limitations, filtering, and logging of even
necessary business communications must occur. The point,
however, is making a determination about what should and
should not cross a firewall.
Generally, four main types of communications take place
within a business environment: business-essential, business-
wanted, personal, and malicious. Business-essential
communications must take place or the business itself will
suffer. Blocking critical transactions will directly cause
problems for the business by impeding the production and
distribution of products, inhibiting customer service,
reducing profits, and so on. The security infrastructure must
support business-essential communications.
Business-wanted communications are not essential to the
core function or purpose of the organization. The failure of
these business communications might be inconvenient or
reduce quantity or quality, but the essential business
functions will go on. Business-wanted communications help
the business do what it does better, faster, cheaper,
cleaner, more efficiently, or in a flashier way. But when
those wants are not available for whatever reason, the
business’s core activities still function sufficiently.
Personal communications are those transactions between
individuals inside the company and with external entities
not directly related to business tasks. If you eliminated
personal communications, all business functions would
continue unhindered. However, that’s in a perfect world. In
the real world, stifling human communications can lead to
low job satisfaction, feelings of isolation, and even worker
disaffection. This, in turn, causes a reduction in productivity
and quality.
Most organizations must strike a balance between
allowing only business communications and allowing all
communications. Obviously, allowing every communication
is a bad idea from a security standpoint as well as a
productivity one. Often, a modest level of Web site access,
filtered e-mail access, and potentially other nonthreatening
services as forms of personal communications can travel on
and over company equipment during work hours with a
reasonable amount of security.
But no clear or distinct boundaries define what level of
personal communication will maintain worker morale and
job satisfaction. It’s often fairly obvious when restrictions
are too tight because job performance suffers or breaches of
security increase. Part of the solution to this problem is
educating users or workers about what is acceptable and
unacceptable behavior on the company’s network. This
includes defining what types of communications to allow or
block, whether for business or personal use.
Malicious traffic, the fourth common type of network
traffic, should always be blocked. This is a widely held
security stance and the whole point of using security in the
first place. However, it’s not easy to identify all malicious
traffic, and it can sometimes appear to be one of the other
three common forms of communications. Improving security
over time is essential to maximizing protections against
malicious communications while at the same time
supporting necessary, desired, or benign personal
communications.
Every organization must define its own parameters and
justifications for each type of transaction allowed across any
security perimeter, whether network traffic or physical
access. Whatever the determination, clearly spell out the
designations for valid versus invalid transactions in your
organization’s written security policy, and then implement
them in the security infrastructure.
Once you’ve defined necessary transactions and
prescribed the desired security, use these concepts in actual
security-enforcing software and hardware solutions. This is
where your understanding of the goals of security, the
organization’s mission, and the budget is critical. There is
always a product that costs more, but more expensive does
not always mean better security. In fact, in many cases,
cheap or free solutions can offer equivalent or better
security than the most expensive product available.
Using security is an essential part of the risk assessment
and management process. Part of evaluating security is
understanding the threats, attacks, and risks as well as the
available countermeasures. One aspect of understanding
countermeasures is performing a cost/benefit analysis to
obtain the best security solution for the invested dollar.
Don’t just purchase the most expensive solution; that’s
never a reliable measure of security quality.
Also, don’t automatically purchase the product your
cost/benefit analysis says is the best option. You must also
evaluate each proposed solution in light of all other
elements of the security infrastructure as well as the size of
your budget. It’s usually not the right choice to spend 50
percent or more of the budget on a single security
component. Instead, devise a spending plan or ratio tool to
guide the procurement of security solutions.
One possible method is to allocate 10 percent of the
budget to each of the 10 major sections or divisions of
security addressed. This assumes you can divide the overall
security of your organization into just 10 compartments—
you might need 30 sections or maybe you can get by with
just four. Whatever the number of divisions you use, grant
each an equal or weighted portion of the budget based on
risk. When a solution costs more than is available within a
certain section, you can then shift funds between sections
as needed.
The purpose of this system is to make security
administrators and designers more aware of the cost of
security and to prevent overspending in one area and
underspending in another. You should spend security funds
somewhat evenly to secure the overall organization, rather
than over-securing one area and neglecting another. If a
hacker or intruder encounters a highly fortified defense, he
or she is likely to go looking for a less secure backdoor.
Ultimately, you should treat your security budget just like
any other budget. Categorize and prioritize expenses.
Outline spending on paper before writing the first check or
swiping the plastic. Allocating funds based on needs and
importance, then adjusting those allocations based on
market conditions or changing threats, is all part of proper
security management (as well as security budget
management).
What Happens When Security Gets in
the Way of Doing Business?
Organizations exist to perform tasks such as producing
products or providing services. When the security
infrastructure interferes with essential business tasks,
something has to change. Security should prevent
compromise while supporting and allowing business
functions. When security changes or when business tasks
change, the security policy and the business should adjust.
Absent this adjustment, security can interfere with
business operations. Many organizations will never face this
situation, but every business must have a response plan in
place in case it does. When business tasks are at odds with
security protections, what should you do?
A few short-term options are available, none of them
optimal. One short-term option is disabling security so the
business tasks go forward. Whether the security is disabled
for a short period or permanently, you provide the
opportunity for compromise, intrusion, or sabotage. Using
this shortsighted solution might not immediately cause
harm to the infrastructure, but it establishes a pattern and
mindset that security is not important.
Organizations might get away with turning off security
defenses. Hackers might not ever notice the reduction of
defense or might not happen to time their probing or
attacks to correspond to the period of disabled security.
However, even if no actual attacks occur due to the security
reduction, the real damage is done.
The real damage is the change in mentality toward
security, a shift from viewing security as essential and
mandatory to optional and nonessential. Once an
organization believes that security can be turned off when
inconvenient, then security suffers, and it’s only a matter of
time before a catastrophic compromise occurs. Security
depends on vigilance. Once the commitment to vigilance is
lost, so is real security.
Another short-term option is not to perform the task that
security is blocking. If the task is not essential, it might be
possible to move forward as an organization without
performing that specific task again. However, if it’s an
essential or critical task, failing to support it will negatively
affect the organization.
There is another way. The preferred and secure long-term
response is to reevaluate the business task in the light of
the security infrastructure. Design a new security solution or
modify how the task is accomplished. Support both security
and business functions. They are both essential to the long-
term stability and vitality of an organization.
CHAPTER SUMMARY
Never deploy firewalls hastily. Instead, use careful
investigation and planning in the design and use of
firewalls. Consider numerous firewall deployment
issues.
Some important concerns include deciding:
What to allow and block
Which security strategies to integrate
Whether the firewall policy is sufficient
Which hardware or software options to use
Whether you need reverse proxy
Whether to configure port forwarding
Which bastion host OS to use
How to order the firewall rule sets
What the essential firewall needs are
How the firewall will interact or interfere with
business processes
KEY CONCEPTS AND TERMS
Bastion host OS
Diversity of defense
General purpose OS
Proprietary OS
Reverse caching
Security stance
Universal participation
Weakest link
CHAPTER 7 SUMMARY
1. When crafting firewall rules, determining what to allow
versus what to block is primarily dependent on what
factor?
A. Traffic levels
B. Business tasks
C. Bandwidth
D. User preferences
E. Timing
2. The first step in determining what to allow and what to
block in a firewall’s rule set is:
A. Reviewing vulnerability watch lists
B. Polling users for what services they want
C. Reading blogs about best practices for firewall rules
D. Recording traffic for 24 hours
E. Creating an inventory of business communications
3. What is the purpose of including rules that block ports,
such as 31337?
A. To prevent users from accessing social networking
sites
B. To prevent DNS zone transfers
C. To stop ICMP traffic
D. To block known remote-access and remote-control
malware
E. To allow users to employ cloud backup solutions
4. What security strategy is based on the concept of
locking the environment down so users can perform
their assigned tasks but little else?
A. Simplicity
B. Principle of least privilege
C. Diversity of defense
D. Chokepoint
E. Weakest link
5. What security strategy reverts to a secure position in
the event of a compromise?
A. Fail-safe
B. Universal participation
C. Defense in depth
D. Security through obscurity
E. N-tier deployment
6. Which security stance most directly focuses on the use
of firewalls or other filtering devices as its primary
means of controlling communications?
A. Universal participation
B. Weakest link
C. Fail-safe
D. Chokepoint
E. Simplicity
7. A firewall policy performs all of the following functions
except:
A. Assisting in troubleshooting
B. Placing blame for intrusions
C. Guiding installation
D. Ensuring consistent filtering across the infrastructure
E. Detecting changes in deployed settings
8. Which of the following is not a viable option for an
enterprise network that needs to control and filter
network traffic?
A. Virtual firewall
B. Appliance firewall
C. Physical firewall
D. Host firewall
E. Software firewall
9. A reverse proxy is useful in which of the following
scenarios?
A. To grant outside users access to internal e-mail
servers
B. To support internal users accessing the public Internet
C. To allow private hosts to access external Web servers
D. To offer external entities access to an internal Web
server
E. To cache file transfers for peer-to-peer exchange
protocols
10. All of the following are true statements with regard to
port forwarding except:
A. It is a variation of NAT.
B. It is limited to Web traffic only.
C. It hides the identity of internal hosts.
D. It allows the use of nonstandard ports for publicly
accessed services.
E. Internal servers do not see the identity of the real
source of a communication.
11. Which of the following statements is true with respect
to reverse proxy?
A. Reverse proxy cannot be used in conjunction with
secured Web sites.
B. Reverse proxy can be used with tunnel mode IPSec
VPNs.
C. Reverse proxy can only support SSL tunnels.
D. Reverse proxy caches client requests and archives
them for load balancing purposes.
E. The reverse proxy server can act as the endpoint for a
TLS tunnel.
12. Which of the following is not a true statement with
regard to port forwarding?
A. Port forwarding services can be found on almost any
service or device that supports NAT.
B. Port forwarding is an essential element in the Internet
Connection Sharing (ICS) service of Windows.
C. Port forwarding is used in reverse proxy, but only for
Web traffic.
D. Port forwarding supports caching, encryption
endpoint, and load balancing.
E. Port forwarding is a variation or enhancement of NAT.
13. Which of the following is not considered a viable option
as a bastion host OS?
A. UNIX
B. Linux
C. Android
D. Mac OS
E. Windows 7
14. You are selecting a new appliance firewall for
deployment in the company network. You are concerned
with OS flaws and exploits appearing not only on your
hosts but also on the firewall. To minimize that risk,
what bastion host OS should you choose?
A. Cisco IOS
B. Windows 7
C. UNIX
D. Mac OS
E. Linux
15. What is the most important aspect or feature of a
bastion host OS?
A. Leveraging existing OS administrative knowledge
B. Ease of use
C. Remote administration
D. Resistance to attacks and compromise attempts
E. Support of a wide range of services
16. What is always the most important element within a
firewall rule set?
A. Using specific addresses instead of ANY
B. Listing Deny exceptions after Allow exceptions
C. Listing inbound exceptions before outbound
exceptions
D. Having a final rule of default-deny
E. Blocking every known malicious port
17. Which of the following examples of complete firewall
rule sets is the most valid?
A.
B.
C.
D.
E.
18. Which of the following guidelines is most important?
A. Include all specific denials for known malicious
remote-control tools after explicit Allow rules.
B. Include every possible address and port in a rule
within the set to ensure an explicit callout exists for
every type of communication.
C. There should be more inbound rules than outbound
rules.
D. Place explicit Deny rules for individual systems before
explicit Allow rules for ranges that include those
individual systems.
E. Place universal Allow rules before universal Deny
rules.
19. When considering the security response triggered by a
firewall detecting unwanted traffic, what is the main
factor in choosing between a response that protects
confidentiality and integrity and a response that
protects availability?
A. Traffic load
B. Number of external clients
C. Port in use
D. Business mission and goals
E. Whether the breach takes place during non-business
hours
20. When security mechanisms and business
communications are at odds, what is the best and most
secure response?
A. Disable security to allow the business communication.
B. Modify the security policy to protect the business
communication.
C. Disable both security and the offending business
communication.
D. Disable business communication to maintain security.
E. Do nothing.
CHAPTER
9 Firewall Management
and Security
FIREWALL MANAGEMENT is about focusing on the essential security goals of the environment and making sure the
deployed firewalls assist in fulfilling those goals. Following
general best practices with care and due diligence will help
ensure compliance. Realize that while a firewall is very
important, even essential, firewalls are not the totality of
security; you’ll need other security safeguards to create a
complete solution.
When selecting a firewall, focus on the purpose and
needs of your organization. Find a product that meets the
real needs of your organization’s network environment, not
the most popular or cheapest solution. Consider whether
building your own firewall device rather than purchasing a
ready-made appliance makes better sense.
But even with an appropriate, properly configured
firewall, ongoing security concerns will invariably arise. Plan
on the inevitable attacks, exploits, and threats to the
security provided by a firewall. Hackers might attempt to
use tunneling or virtual private network (VPN) services as a
mechanism to bypass firewall filters. Be aware of these
issues and be prepared to deal with them. Have an incident
response plan in place.
Firewall management also includes testing, monitoring,
and troubleshooting. Many excellent tools can help simplify
or automate these processes. But even the best tools
require solid information and a working knowledge of your
environment. Detailed implementation plans can also be a
significant benefit to maintaining reliable security.
Chapter 9 Topics
This chapter covers the following topics and
concepts:
What best practices for firewall management
are
What some security measures in addition to
a firewall are
How to select the right firewall for your
needs
What the difference is between buying and
building a firewall
How to mitigate firewall threats and exploits
What the concerns related to tunneling
through or across a firewall are
How to test a firewall’s security
What some important tools are for managing
and monitoring a firewall
How to troubleshoot firewalls
What the procedure is for proper firewall
implementation
How to respond to incidents
Chapter 9 Goals
When you complete this chapter, you will be able
to:
Describe firewall management best practices
Select the best firewall for a given network
scenario
Demonstrate the use of tools for managing
and monitoring a firewall
Troubleshoot common firewall problems
Write a firewall installation plan
Best Practices for Firewall
Management
Firewall management best practices are recommendations,
guidelines, or standard operating procedures for obtaining
reliable firewall security on a real-world budget. Best
practices are usually not specific recommendations for
products or tools. Rather, they are recommendations for
philosophies, stances, or concepts on how to proceed. The
following items are suggested best practices. These might
not apply to every environment, although you should
consider each and adapt or adopt when appropriate.
A written firewall policy establishes a documentation trail
that everyone in the organization can read, consider, and
follow. To write a firewall policy, learn about and thoroughly
examine every communication, transaction, and service
within, across, and through the IT infrastructure. You can
write a comprehensive and effective firewall policy only
when you know and understand your operating
environment.
NOTE
The foundation of every firewall implementation is to
have a plan. There is no substitute for a written firewall
policy. Any other method, process, or procedure for
configuring, using, and managing a firewall will fail.
Only a written firewall policy can guide you toward a
successful and reliable firewall deployment.
To have a plan, you must thoroughly understand your
organization’s infrastructure, its mission and goals, and the
processes necessary to produce its products and services.
This means understanding your organization’s technology
use, assets availability, and resources consumption, in
addition to where everything resides and how users work
with the infrastructure. Consider larger and more complex
needs in light of the typical IT infrastructure.
Once you understand your operating environment
thoroughly, you can then decide where a firewall is
necessary. In most cases, every host should have a local
software firewall, every border communication point should
have a firewall, and every transition between subnets of
different trust, risk, or purpose should have a firewall.
Firewalls provide communications control; deploy them
liberally.
To create a useful and relevant firewall policy, perform a
risk assessment. The process of understanding assets,
vulnerabilities, threats, and likelihoods is risk assessment.
Only through a proper risk assessment can you determine
the threats and risks facing your environment and its
communications. This in turn will guide the configuration of
a firewall for maximum benefit.
Once a firewall policy is in place, regularly review the
policy. Investigate whether the overall quality and reliability
of the existing firewall security is sufficient or needs
improving. Verify that all services are still properly
protected. Evaluate whether prevention, deterrence, and
response have been adequate and effective. Wherever you
discover deficiencies, strive to improve and rectify the
situation immediately.
Establish a no-exceptions policy. Every service, every
transaction, every communication must pass through one or
more firewalls, filtered according to the guidelines of the
firewall policy. Terminate any communication found to take
place without firewall filtering immediately.
Maintain physical security over all personnel access to
firewalls. No one except the firewall administrator should
have physical access to the firewall devices. Firewalls are
concentrations of security and often the main embodiment
of communications security. The risk of compromise from
unauthorized access is significant.
Limit and filter Internet connectivity. In spite of a user’s
desire for an unrestricted, unmonitored Internet connection
for personal use, the Internet is a significant risk for most
organizations. An unrestricted or unfiltered Internet
connection is a highway for malicious code, social
engineering attacks, and intrusion attempts. If an Internet
service, protocol, domain, or IP address is not essential to a
necessary business task, block it. Work assets are for work
tasks, not personal activities. Configure the firewall
accordingly.
Install antivirus scanners, anti-malware scanners, and
firewalls on every host. Every portable device, every
desktop workstation, and every server should have these
malicious code and malicious traffic protections. No system
is immune to malware and malicious communications;
prevent easily avoidable compromises and downtime with
basic filters and barriers to known issues.
Don’t rely upon a single or individual firewall. Attempt to
interlock and layer firewalls along the pathways of
communication and transactions. Use defense in depth or a
multiple-layered defense wherever possible. If you do,
numerous filtering events will shield each asset.
When possible, avoid remote access. Limit access to local
direct connections only. When remote access is necessary,
require a VPN. Remote connectivity enables remote hacking.
Remote hacking attempts to breach security without the
need to be physically at or within the target’s facilities.
Requiring VPNs for all remote connections reduces this
threat somewhat by preventing open connections or
communications vulnerable to eavesdropping. All
communications crossing the firewall are potential
vulnerabilities.
Require encryption of all internal network
communications. Use Internet Protocol Security (IPSec) to
secure all intranet communications. This is often an easy
and cost-effective means to quickly reduce the risk of
eavesdropping, man-in-the-middle, replay, and many other
forms of network attacks. Well-encrypted data is much less
likely to fall into the hands of hackers, thieves, and
unauthorized personnel. Configure firewalls to allow IPSec,
VPNs, and other forms of encrypted communications where
appropriate, but don’t universally allow encrypted
communications. Encryption can obfuscate malicious
activities. Strongly authenticated endpoints are less likely to
be sources of malicious actions.
Harden both internal firewall hosts and border firewalls.
Use hardened firewalls against compromise regardless of
their network location. Provide consistent and thorough
security throughout the IT infrastructure. Protecting the
stability and reliability of firewalls will, in turn, protect the
security of the network as a whole.
Always test new code before you deploy it onto a firewall.
No matter who the source of new code is, test it. Even if the
code addresses a mission-critical issue, test it. Test all new
code without exception. All untested code is unauthorized
and you should block it from all production firewalls.
Back up, back up, back up. Security includes the
guarantee of availability. Failing to have a backup increases
the risk that if data is lost, damaged, or corrupted, it will
never be available. Backups are the best form of insurance
against data loss. Don’t store the backups for any given
system on the same system or even in the same locale.
Store them on separate storage devices, both onsite and
offsite. Remember that offsite is more secure in the face of
larger disasters. Don’t allow the only copy of a firewall
configuration to be in memory on the firewall. Always make
a backup.
If an asset is worth the time and effort to secure, then it’s
worth monitoring as well. Configure each firewall as you
deem necessary, and then watch for attempted breaches of
that security. Perfect security doesn’t exist. To improve
security, be prepared to respond when breaches happen—
and they will. Lock, then watch. Failing to watch a secured
asset just means that when the compromise occurs, you
won’t notice it immediately. Firewalls can be the focus of an
attack, just as much as any other host. Being aware of and
prepared for such an attack gives you the edge to respond
promptly.
Have an intrusion and incident response plan. Bad things
will occur. Failures will happen. Breaches will take place.
Firewalls can fail. Malicious traffic goes overlooked. But be
prepared, nevertheless. Evaluate and examine the realistic
threats facing your environment. Plan for the worst. Define
procedures to respond to any and all situations.
Don’t overlook business continuity planning and disaster
recovery planning. The greatest threats to organizations are
not necessarily security breaches, but threats that represent
business-terminating events. Building collapse, flooding,
fire, sabotage, blackouts, malware infection, criminal
activities, and so on shut down an organization’s operations.
If alternate means of accomplishing mission-critical tasks
aren’t available, then the organization will soon cease to
exist. Plan to recover from disasters so that your
organization survives to do business in the future.
Recovering a business process does not mean leaving it
unprotected; redeploying firewalls is just as essential as
restarting business processes themselves.
Keep it simple: security (KISS). Firewalls are complex
enough without purposefully imposing additional complexity.
Focus on designing and configuring firewalls that use simple
and direct rule sets. The greater the complexity involved,
the greater the chance for misconfiguring, incorrectly
ordering rules, or creating loopholes in protection.
Focus on balancing security and usability. Firewall
filtering does not need to make all work tasks difficult.
Likewise, essential work functions need not compromise
security. Finding a balance between these two extremes is
important. Focus on reducing the risk to the infrastructure
while enabling users to perform authorized tasks with
minimal hassle.
Prioritize. Security concerns always threaten to
overwhelm available time, effort, and budget. Focus on the
big impact and big result issues first rather than attempting
to swat at every minor annoyance that arises. Security is
constantly changing; the goal is to maintain reasonable
security rather than keep perfect security. (Remember, this
is unattainable anyway!) The deny-by-default/allow-by-
exception philosophy should keep minor nuisances to a
minimum.
Always be fully and truly aware of the state of the
organizational security, especially in regard to firewall
performance and function. Don’t make assumptions. If you
are not positive that an aspect of the organization is secure,
find out. Assuming security exists is a false sense of safety.
A lack of knowledge about the security status could lead to
complacency. Assuming nothing is wrong removes the
urgency to investigate and rectify problems. Don’t fall into
the “I thought it was protected” trap; if you don’t know or
are not sure, take the time to investigate and know. Testing
is relatively cheap; recovering from intrusion damage can
be disastrously expensive.
Develop a firewall checklist. Review it for completeness
and accuracy on a periodic basis, such as every quarter.
Confirm every element on the checklist on a frequent
regular basis, such as once a week or once a day. You can
automate this to an extent, but it often requires human
effort to test and confirm that every security mechanism is
in place, active, armed, and effective.
Perform regular self-assessments. Numerous security
groups, government, and military agencies post security
implementation guidelines, manuals, and checklists.
Commonly known as STIGs (Security Technical
Implementation Guides), these documents can help you to
review and assess your organization’s status and state of
security. A self-assessment attempts to take an external,
unique, or independent viewpoint in evaluating security.
This is why using external guidelines, standards, and
measurements of security can reveal oversights in an
existing security infrastructure.
Perform internal compliance audits. It’s no longer
sufficient to think you are secure; compliance audits are
now the law in many industries, such as the financial and
medical sectors. Ensuring that you are in full compliance
with all federal and state laws and regulations is not only
good security management; it also keeps company officials
out of jail. Using external auditors is often a poor substitute
for internal self-verification.
Test all uses of the firewall for sufficiency. Perform
verification scans of all deployed firewall settings to ensure
they are functioning. Improper installation or
misconfiguration can render even well-meaning safeguards
worthless. Test every new security setting or rule on
installation and at every reconfiguration.
Perform regular vulnerability assessments. Use
automated tools with updated databases of security tests
and exploit simulations. These tools should confirm patches
and updates, verify security configurations, and probe for
known vulnerabilities to exploits and weaknesses. Quickly
resolve any issues the scans uncover.
After you’ve improved and tuned firewall security, put it
to the ultimate test: Perform penetration testing. Hire or
develop an ethical hacking team to test the strengths and
weaknesses of the firewalls. Ethical hackers use the same
tools and attack techniques as criminals, but without the
intent to cause actual damage. Professional security
assessment teams can customize attacks, modify exploits,
and react in real time to fully stress security defenses.
Focus on establishing a philosophy of default deny rather
than default allow. By blocking everything as a starting
point, only those features, services, protocols, ports,
applications, and users you deem safe and appropriate can
proceed by an exception. Using a default-allow stance forces
a never-ending stream of explicit denials as new
compromises or malicious events arise. Deny by
default/allow by exception is always the preferred security
stance.
This collection of firewall management best practices
should serve as a starting point for the development of an
effective firewall deployment. Other valid and useful
guidelines deserve consideration, so don’t assume this list
of recommendations, or any other list from any other
source, is exhaustive. There are always new lessons to
learn, new challenges to face, and new wisdom to obtain.
Security Measures in Addition to a
Firewall
A firewall is an essential part of any security infrastructure.
Every single host needs a firewall. Every single network
needs border firewalls. Firewalls are concentrations of
security, and are easily recognizable embodiments of an
organization’s security policy. A firewall is an incomplete
security solution on its own, however.
FIGURE 9-1
Firewalls: Only part of the security puzzle.
A complete security solution requires many more
components (Figure 9-1) than just a firewall. Proper
understanding of the organization’s essential processes,
threats, and goals will guide you toward the creation an
effective security plan. Without a proper risk assessment,
however, recommendations for safeguards and
countermeasures are just guesses.
Several common elements characterize most properly
designed security systems. These include:
Multifactor authentication
Anti-malware scanning
Full hard drive encryption
Communications encryption
Detailed logging and auditing of events
Intrusion detection and prevention systems
Network segmentation and traffic management
Private IP addresses and NAT proxies
VPNs for remote access
Network access control
While these are often excellent security components, they
are not all necessarily applicable and required in every
environment. Addressing your environment’s specific risks is
always more preferable than deploying a security product
just because it seems like a good idea.
Selecting the Right Firewall for Your
Needs
Choosing the best firewall for your specific environment
requires knowledge of firewall options and understanding of
the security needs of your network environment.
Automatically selecting the most expensive option, the
cheapest one, or an open source solution fails to properly
assess the situation. Firewalls are essential elements of
security. They are concentrated security. It would be
careless to select a product without due diligence.
NOTE
Selecting and purchasing the right firewall for your
organization’s situation requires careful evaluation. As
with any big decision, first find the longest poles in the
tent: Always resolve important aspects of the process
sooner rather than later. For example, first familiarize
yourself with the budget for the purchase.
Knowing the amount of money available for firewall
protection helps you quickly eliminate those products
clearly outside your price range. Don’t automatically discard
every product above the budget limit, but realize that
anything more than about 15 percent of your maximum
allowance is probably out of reach.
Next, consider whether an open-source solution is a
viable option for your corporate culture. Some organizations
are philosophically opposed to open-source solutions, while
others embrace and encourage such endeavors.
Do you want to include the option to build your own or
focus on only off-the-shelf, ready-to-deploy options? Making
this decision early will help guide you toward a viable
choice.
Familiarize yourself with the wirespeed of the network,
general traffic levels, the types of filtering desired, types or
forms of recent attacks, and future growth and expansion
plans. Armed with these pieces of information, you can
begin a serious hunt for the most appropriate firewall
solutions.
The firewall technology advances quickly. Often, new
attacks and exploits crafted by hackers drive these
advancements and upgrades. A specific recommendation
for a specific model, product line, or even vendor has a
finite life. Suggestions you hear today are likely to be out of
date, superseded, or compromised in a few short months.
Products at the top of the market one year might not even
place in the next.
Seek out current firewall reviews both online and in
technical publications and trade journals. Find firewall
options that fall within the parameters you laid out based on
your understanding of the network and known threats.
Some general guidelines will assist you in this process:
If speed, flexibility, and simplicity are priorities, then
select a packet filtering firewall or a stateful inspection
firewall.
If real-time applications and high-bandwidth
communications are priorities, then select a dedicated
application-specific proxy firewall.
If strong authentication is a priority, then select an
application gateway firewall or a dedicated
application-specific proxy firewall.
If detailed logging is a priority, then select an
application proxy firewall.
If customized, unique, or complicated filtering options
are a priority, then select a dedicated application-
specific proxy firewall or a stateful inspection firewall.
If stopping internal attacks is a priority, then select a
dedicated application-specific proxy firewall or a
personal host firewall.
A single firewall product rarely satisfies every need.
However, you should be able to find one or more firewall
solutions that address the primary security concerns of your
organization.
The Difference Between Buying and
Building a Firewall
Carefully consider the choice of whether to buy a ready-to-
deploy firewall versus building it yourself. An off-the-shelf
firewall that you simply plug in can be an attractive solution.
However, an out-of-the-box product will generally cost more
than an equivalent do-it-yourself system. In addition, most
pre-configured systems are not as flexible or expandable as
a custom-built version.
That’s not to say that a do-it-yourself firewall is always
the best answer, either. A self-constructed firewall can be
less expensive and provide a wider variety of features and
options. However, when an in-house, custom firewall
experiences a problem, you can usually find little formal
technical support beyond a user-community discussion
forum.
If you are prepared to fully research and understand a
firewall product to install, configure, and manage it yourself,
then a do-it-yourself firewall can be a great cost-saving
solution. However, if your organization’s IT staff is already
stretched and overworked, then home-built solutions will
likely cause more problems than they solve.
A pre-built, off-the-shelf firewall is more likely to work
right out the box, requiring only that you plug it in, set the
configuration, and connect the network cables. A build-it-
yourself firewall may require additional hardware
manipulation, juggling of device drivers, hardening of a host
OS, and so on. Ask yourself: Is custom-built worth the
hassle?
Don’t automatically reject either buy or build firewall
options before you research and assess the options. You
might be surprised at the low cost and feature richness of a
boxed product or caught off guard by the complexity,
instability, or high-cost of a do-it-yourself product. Always
look for the best firewall solution for your specific needs and
current threats.
NOTE
Build-it-yourself firewalls are usually less costly
because they usually don’t include dedicated hardware
and often use open-source (free) source code.
However, the tradeoff for the savings to successfully
deploy a reliable border sentry solution is that you
need to know more about firewalls generally and your
specific software and/or hardware.
Mitigating Firewall Threats and
Exploits
Firewalls are one of the most important components of a
complete security solution. However, they are not without
their own issues, threats, and concerns. Exploits will cause a
firewall to fail. Remember that a firewall is software that
sometimes includes dedicated hardware and a host
operating system. Any software product is prone to flaws
and errors in programming. Simply calling it a firewall does
not eliminate this concern.
Ultimately, firewalls are software code written by human
beings. In either a host firewall or an appliance firewall, the
logic and controlling mechanisms of the firewall are software
code. Software code is designed and written by people. And
whenever people are involved, mistakes or oversights are
possible.
Coding errors are not as common in firewall products as
in operating systems or other forms of software. But don’t
think they don’t occur. Most firewall programmers and
vendors take extra care to comb through and test every line
of code to exacting quality control and security standards.
Standard industry practice requires considerable pilot
testing of firewall code before release into the commercial
environment.
In spite of these precautions, firewalls have in the past
been released to market with software coding errors later
discovered and exploited. Hackers are constantly using
scanning, testing, and probing tools to discover exploitable
weaknesses. When a vulnerability appears, hackers take
advantage of the flaw. Some firewall exploits have caused
firewalls to freeze or crash, while others have given the
hacker the ability to read or adjust filtering rules. In most
cases, vendors quickly release updates and patches to
correct these problems. When selecting a firewall, check the
version and patching history. Firewall products with lots of
patches might not be as reliable in the future as a product
with fewer patches.
How long does the vendor typically take to release a
patch once a flaw or exploit for the product becomes public
knowledge? The longer the vendor takes to release a fix, the
longer you will be left insecure waiting for the update.
Some exploits cause buffer overflows. In a buffer
overflow, a memory buffer exceeds its capacity and extends
its contents into adjacent memory. Hackers often use this
attack against poor programming techniques or poor
software quality control. Hackers inject more data into a
memory buffer than it can hold, which results in the
additional data flowing over into the next area of memory. If
the overflow extends to the next memory segment
designated for code execution, a skilled attacker can insert
arbitrary code that will execute with the same privileges as
the current program. Improperly formatted overflow data
may also cause a system crash.
When the firewall vendor becomes aware of an exploit in
the wild, it quickly develops and releases a patch. An
effective security- and patch-management system will
enable you to quickly test and update the firewalls
protecting your production environment. A delay in the
release of a patch or its application keeps the window of
opportunity for hackers to compromise your environment
wide open.
A good rule of thumb is to avoid the first generation or
first release of a firewall product. Version 1.0 is bound to be
more prone to programming errors than later releases. If the
first version of a product seems better than any other
product from any other vendor, then wait at least six
months after its initial release before deployment. This gives
other people, good and bad, a reasonable time to find flaws,
test exploits, and trigger release updates by the vendor.
Once you’ve chosen a firewall product, always install
every available patch and update from the vendor. Always
test updates first—no exceptions—but then get them
installed as quickly as your testing process will allow. Install
only full and final releases of a firewall patch. Never deploy
alpha, beta, pre-release, release candidate, or test-build
patches on a production firewall.
Another potential concern of firewall security is the
filtering it uses. Understand that no perfect security
measures exist. Each form of firewall filtering or traffic
management is vulnerable in some way. The easiest is basic
packet filtering.
Basic packet filtering uses a simple and static rule set.
Numerous allow- and deny-explicit exceptions compromise
the rule set’s final deny-all rule. Rules can focus on the IP
address and port number of the source and/or destination,
as well as the protocol in use. A firewall testing and probing
technique known as firewalking can potentially discover
some or all of the rules on a static packet filtering firewall.
Firewalking sends basic Transmission Control Protocol
(TCP) virtual circuit initiation packets (synchronization-
flagged packets) to a known internal target system. The
firewalking tool manipulates the parameters of the IP and
TCP headers using a brute force technique. This process
sends a wide variety of packets toward the internal target in
the hopes of discovering a packet configuration that
succeeds in passing the restrictions of the firewall rule set.
Once a hacker knows the packet constructions that make
it past the firewall, he or she can use that knowledge to
attack the known internal target or discover and attack
other internal targets.
Other forms of firewall filtering are vulnerable if they do
not perform content filtering or deep packet inspection.
Non-content-filtering firewalls do not examine the contents
of packet payloads. Thus, once an attack establishes what
seems like a benign connection to an internal target,
subsequent communications can contain malicious
payloads.
Even when stateful inspection, content inspection, and
deep packet inspection are present, hackers can employ
fragmentation and overlapping attacks. These attacks use
packets crafted to seem benign when analyzed individually,
but once received by the destination, the fragmentation
offset values cause an abnormal reassembly that overlaps
packets to craft new payload and/or new header content.
Such attacks can change target ports or deliver a malicious
payload past a filtering sentry.
Fragmentation attacks are an abuse of the fragmentation
offset feature of IP packets. Fragmentation may occur in a
network where many different network links join to
construct a global infrastructure. Some network segments
support smaller datagrams (another term for packets or
frames) than others, so larger datagrams fragment into the
smaller size. When the fragmented elements of the original
datagram reassemble, manipulations of fragmentation can
cause several potentially malicious reconstructions such as
overlapping and an overrun.
FIGURE 9-2
Fragmentation and overlapping.
Overlapping can cause full or partial overwriting of
datagram components creating new datagrams out parts of
previous datagrams (Figure 9-2). An overrun can create
excessively large datagrams. These and other forms of
fragmentation attacks cause DoS or attempt to confuse IDS
detection or firewall filtering.
Fragmentation is a supported function of IP packets.
Packets fragment when they encounter network segments
that support a smaller maximum transmission unit (MTU).
When packets reassemble, the fragments usually return the
data to its original configuration. However, overlapping
attacks can abuse the fragmentation offset value in the IP
header causing reassembly overlap. Reassembly overlap
can create new payloads or headers. For example, if a
payload of “EVIL PAYS BLUE LOAD” fragments into “EVIL
PAYS BLUE” and “LOAD,” an overlap reassembly could result
in the creation of “EVIL PAYLOAD.”
Protections against fragmentation attacks include using
modern IDS detection and firewall filtering features as well
as performing sender fragmentation. Sender fragmentation
queries the network route to determine the smallest MTU or
datagram size. Then the sender pre-fragments the data to
ensure that no fragmentation needs to occur en route.
The only reliable method of stopping these attacks is to
deploy a dynamic filtering system that performs virtual
reassembly. Virtual reassembly will piece together both
fragmented packets and the original payload. The
reassembled payload is analyzed, and then only if it is
deemed non-malicious are the original packets transmitted
to the internal network. Virtual reassembly is not a
completely foolproof technique, but it does greatly reduce
the risk of these exploits.
The most common method of exploiting and/or bypassing
a firewall is internal code planting. Firewalls are often border
sentries. They protect internal systems from
communications that originate from external entities.
Unfortunately, some security administrators use only
inbound firewall filtering, which leaves outbound traffic
uncontrolled and unfiltered.
In this situation, if a hacker can plant code internally or
trick a user into running code, or if an employee brings in
code of his or her own, outbound connections to malicious
external entities might be possible. Frequently, laptops that
pick up malware connect to the internal network, placing
the malware behind the firewall. Many hacker tools rely on
this technique, such as Loki, Back Orifice, NetBus, and even
Netcat. A server of sorts is hosted on an external host and
the automatic connection client utility runs on an internal
host. The client utility establishes the initial connection as
an outbound connection (thus allowed by the firewall), and
then the external host is able to send data or commands
back to the internal client through this connection. Often,
this form of attack results in a hacker gaining modest to
complete remote control over the compromised internal
host.
Denial of service (DoS) is another common threat to
firewalls and networks as a whole. A DoS attack, specifically
a flooding or traffic based DoS, sends massive amounts of
data to a target victim. If that victim has a firewall, then it
will detect and discard the DoS. The firewall’s filtering
service can usually prevent the DoS traffic from breaching
the network’s perimeter and affecting internal systems.
However, since the firewall has to collect, analyze, and
respond to each and every packet received on its interfaces,
a well-managed DoS attack can consume all available
bandwidth of the connecting segment to the firewall, as well
as consume all of the processing capabilities of the firewall.
This, in turn, prevents any legitimate traffic from reaching
the network. Thus, even with a firewall protecting the
internal network, a DoS flooding attack can still successfully
disconnect or interfere with external communications.
A firewall’s vulnerability to DoS flooding is the one
limitation or weakness that you can’t fix, improve, or repair
by either upgrading the firewall or applying a patch.
Upgrading to a stateful inspection firewall addresses
fragmentation, firewalking, and even internal planting of
code. Patching will address programming bugs and buffer
overflows. Although highly specialized tools are available
that can perform partial upstream DoS detection and
filtering, in general, no fixes to prevent flooding attacks
from reaching an Internet-facing firewall exist.
Knowing these threats and exploits, as well as realizing
the probability of others, should remind security
administrators to be proficient at the basics. Security
management is mandatory to maintain any semblance of
security in any environment. Your essential long-term
strategies for maintaining security include keeping systems
current with patches, using a hardened configuration,
staying knowledgeable about new exploitations, and
monitoring the environment for successful and attempted
compromise.
Concerns Related to Tunneling
Through or Across a Firewall
Hackers tunneling through or across your firewall
deployments are a serious threat to your organization’s
network security. Tunneling is the creation of a
communication channel similar to the creation of a VPN. In
some cases, it uses actual VPN solutions and protocols.
Tunneling can create either a covert channel or a known
channel that’s unfiltered.
Tunneling uses two techniques. One method is installing
a server component on an internal system, and then an
external client component initiates the connection. This
technique requires the firewall to allow inbound initiation
connections to internal systems. A second method is to
install a server component on an external system, then use
an internal client component to initiate the connection. This
technique requires the firewall to allow outbound
connections.
Most firewall deployments strictly limit or restrict inbound
initiation of communications to specific ports and services.
Thus, a tunneling setup using an inbound connection must
“hijack” an existing open port or reconfigure the firewall to
open another port for use by the tunnel. If the perpetrator of
this security violation has the ability to reconfigure the
firewall, you have much more serious security concerns to
address than tunneling.
Firewalls commonly allow most outbound
communications with little or no restrictions. While not the
best security stance, it is convenient and easy. Proper use of
a deny-by-default stance should limit both inbound and
outbound connections to those explicitly allowed. If the
firewall freely allows outbound connections, then internally
initiated tunnels are extremely easy to establish.
Tunnels can potentially use almost any protocol,
including IP, ICMP, TCP, UDP, and most application protocols.
Specialized tunneling server/client applications can replace
traditional payload content with whatever content the
hacker wishes. Effectively, this can convert almost any
protocol at any layer of the OSI model into an encapsulation
or tunneling protocol (Figure 9-3).
Tunneling is an obvious abuse and violation of protocol
rules. However, if a firewall is not investigating the payload
of a frame, packet, segment, and so on, then a hacker can
set up a tunnel using a protocol not designed to perform
encapsulation.
FYI
Once a tunnel is open, data can move in either
direction. The directionality of the connection has little
to do with which end of the tunnel is the controller and
which is the ultimate target or victim.
FIGURE 9-3
A tunnel across a firewall.
The problem gets worse when the tunneling system
employs encryption. This makes payload investigations
more difficult because the firewall will be unable to decipher
the content or purpose of the encoded payload. To combat
this complexity, set the firewall to either block all
encryption, allow only encryption that originates or
terminates at the firewall, or allow encryption only on
certain ports (potentially limiting communications to and
from specific IP addresses as well).
Encrypted tunnels across a firewall are not inherently or
automatically malicious in nature. VPNs are encrypted
tunnels that commonly and widely create security for
personal and business communications across the Internet
and within private networks. However, most VPNs use well-
known VPN protocols, such as IPSec and SSL, on
standardized ports, with predictable header constructions
and characteristics. Unauthorized or rogue tunneling
mechanisms often use odd protocols for encapsulation and
can operate on any port, use invalid packet constructions,
and violate communication standards.
In addition to the standard VPN protocols used for this
purpose, such as IPSec, SSL, TLS, OpenVPN, PPTP, L2F,
L2TP, and so on, several other legitimate and subversive
services, products, and protocols can configure
unauthorized tunnels. These include:
Loki—Loki uses ICMP as a tunneling protocol.
Netcat—Netcat can create TCP and UDP network
connections to or from any port.
Cryptcat—Cryptcat is a version of netcat that creates
encrypted connections.
NetBus—NetBus is a malicious remote control tool.
Back Orifice—Back Orifice is a malicious remote
control tool.
SubSeven—Subseven is a malicious remote control
tool.
Remote Desktop Protocol (RDP) and Remote
Assistance—These are native features of Windows
OS. RDP is disabled by default, and Remote Assistance
requires an invitation.
TOR (The Onion Router)—This is a double-blind
encapsulation system that enables anonymous, but
not encrypted, Internet communications.
JanusVM—This is Linux software powered by VMware
that creates SSH encrypted tunnels used in
combination with TOR.
PacketiX VPN—This is an encrypted Web proxy
service.
HotSpotShield—This is an encrypted Web proxy
service.
HTTP Proxy—This is a Web proxy service.
GoToMyPC, GoToAssist, LogMeIn, and other
similar services—These are third-party remote
desktop control services.
This list of products, services, solutions, and protocols used
to create illicit tunnels across a firewall is not exhaustive.
Several of these are legitimate services with valid uses, but
when a hacker employs them without permission, especially
across nonstandard ports, they represent a serious threat.
Any ability to breach a firewall to allow unfiltered, full-duplex
communications is cause for concern and response.
The best defense against these tunneling exploitations is
to strictly enforce deny by default for both inbound and
outbound communications. Clearly define in the acceptable
use policy (AUP) which tools are unauthorized and which are
considered security breaches. Use network and host IDS/IPS
monitoring. Deploy whitelist controls to prevent the
installation of unapproved software. Limit mobile code such
as ActiveX, Java, Flash, Silverlight, and JavaScript in
browsers to minimize the possibility that a Web-only form of
tunneling might use an authorized Web client.
Testing Firewall Security
Firewall tests are an important and integral part of the build
and management process. Standard security management
practice is to test security to confirm proper configuration,
performance, and strength against attacks and exploits.
Failing to test a firewall is a serious breach of this best
practice.
Because a firewall is one of the most important parts of
your security infrastructure, is a concentration of security
controls, and is your first line of defense against inbound
attacks, failing to test a firewall thoroughly practically
ensures you will have a breach or intrusion.
Every update, change, or alteration to any aspect of your
firewall or the network segments connecting to a firewall
should trigger another round of firewall testing. Test a
firewall as if you were practicing for the Olympics. Repeat
the testing again and again, striving to push the limits and
improve with each drill. Strive to ensure your firewall
deployment is the best it can possibly be.
technical TIP
Testing a firewall involves the use of several tools and
techniques. These include automated vulnerability
assessment tools, exploitation frameworks, and rogue
hacker attack tools.
One tool you can use is a simulated firewall test. Such a
test uses an attack simulator to transmit attack packets to
the firewall. You can locate the attack simulator inside or
outside the firewall to simulate an internal attack or an
external attack. An attack simulator can verify that a
specific weakness is present on a firewall, without actually
causing damage or interrupting production. Most simulator
tests are secure by design.
Creating a virtualized network environment using a
virtualization tool, such as VMware, performs virtual firewall
tests. A virtual intranet is created, a virtual firewall bastion
host goes up, and virtual external systems become active.
The administrator then works through a variety of scenarios
of attack, both from internal attackers and external ones.
Logically, the virtualized environment functions like the real
one, but you can test it using techniques that might
otherwise damage or interrupt the production network.
Laboratory tests run in non-production subnets where
you’ve configured a duplicate of the production
environment. The laboratory setup mirrors each system,
including the firewall. Test-run in the lab environment
anything that might interfere with production or might
cause data loss or system damage.
Laboratory tests and virtualized testing are similar, but
both are useful mechanisms; use them both rather than
forgoing laboratory tests in favor of using virtual testing
exclusively. The actual physical devices of firewalls and
systems might reveal weaknesses not present in the
virtualized versions.
Any of these testing configurations can benefit from the
use of fuzzing tools. Fuzzing tools use a brute-force
technique to craft packets and other forms of input directed
toward the target. Fuzzing tools stress a system to
determine whether it will react improperly, fail, or reveal
unknown vulnerabilities. Fuzzing tools can discover coding
errors, buffer overflows, race conditions, remote exploit
flaws, injection weaknesses, and so on. The downside to
using fuzzing tools is that they can take a significant amount
of time to discover anything interesting.
Using a variety of testing methods to put a firewall
thoroughly through its paces is an important part of security
management. To maximize your network’s security
effectiveness, plan, design, deploy, test, and then fine-tune.
Important Tools for Managing and
Monitoring a Firewall
Proper security management requires that you manage and
monitor the firewalls in your infrastructure. As with every
type of security, you can’t just install firewalls and forget
them. Every security safeguard must be locked down,
tuned, and monitored over time. Once the firewall has been
installed and configured, the work of managing it begins.
Firewall management is about understanding that new
threats are coming from hackers on a constant basis, and
that the defenses and settings that work successfully today
might not be the best defense against new attacks
tomorrow. Firewall management is the essential task of
maintaining a firewall in spite of these new threats.
Firewall management includes verifying that the
configuration settings of the firewall remain in place and
don’t change without authorization. Device failures,
electrical fluctuations, and unexpected reboots can delete
or corrupt firewall configurations. So, regularly verify that
the desired settings remain active on the firewall.
Firewall management includes applying updates and
patches to the firewall. Always test updates before
deployment. Back up firewall configurations before applying
new and tested updates. Once you apply an update, confirm
that the application of the update didn’t reset the
configuration to the default settings.
Firewall management includes testing the resistance of
the firewall to attacks. This can include the use of a variety
of automated and manual attack tools and techniques.
Effectively, firewall testing is the application of penetration
testing or ethical hacking against the firewall as the primary
target. Using the tools and methodology of criminal hackers
in an ethical and boundary-limited manner is an excellent
way to verify the ability of a firewall to withstand known
attacks.
Firewall management includes the use of monitoring
tools to watch over the performance and reliability of a
firewall over time. Properly use any valid tool in this
endeavor. Some recommended tools to consider include:
Nmap—This is a network mapper, port scanner, and
OS fingerprinting tool. It can check the state of ports,
identify targets, and probe services.
Netstat—This is a simple command line tool to list the
current open, listening, and connection sockets on a
system.
TCPView—This is a GUI tool to list the current open,
listening, and connection sockets on a system as well
as the service/program related to each socket.
Fport—This is a command line tool to list the current
open, listening, and connection sockets on a system as
well as the service/program related to each socket.
Snort—This is an open-source, rule-based IDS that can
detect firewall breaches.
Nessus—This is an open-source vulnerability
assessment engine that can scan for known
vulnerabilities.
Wireshark—This is a free packet capture, protocol
analyzer, and sniffer that can analyze packets and
frames (Figure 9-4) as they enter or leave a firewall.
Netcat—This is a hacker tool that creates network
communication links using UDP or TCP ports that
support the transmission of standard input and output.
It commonly creates covert channels to control a
target system remotely or to bypass a firewall. It can
test a firewall’s ability to detect and block covert
channels. Cryptcat offers similar capabilities using
encryption.
Backtrack—This is a Linux distribution that includes
hundreds of security and hacking tools, including
Nessus and Metasploit. It can perform attacks against
or through a firewall for testing purposes.
Syslog—This is a centralized logging service that
hosts a duplicate copy of log files. It provides a real-
time backup of every log on every participating host.
FIGURE 9-4
Wireshark.
These are only a few of the excellent tools to manage and
monitor a firewall. But more important than the tools you
use is ensuring that the careful management, monitoring,
and tuning of your firewalls actually take place.
Troubleshooting Firewalls
Firewall troubleshooting, like any form of troubleshooting, is
about the process more than the actual result. Most firewall
problems can be relatively easy to troubleshoot if you’ve
planned a detailed troubleshooting procedure with extensive
documentation. The foundation of successful
troubleshooting is preparation.
When trouble arises in or around the security of the
network, especially in regard to the firewall, you must act
promptly to resolve the issues at hand. Troubleshooting is
both an art and a skill set to systematically diagnose and
eliminate problems whatever the source. Although
troubleshooting might sometimes sound exciting, in reality
it’s a fairly lengthy and tedious process. Knowing a few
procedures and commonsense guidelines can improve your
troubleshooting skills and help keep downtime and security
breaches to a minimum.
You can never have too much useful troubleshooting
information. Information, data, documentation, resources,
and so on are the primary tools you can use to find and
resolve problems. Useful troubleshooting information
includes:
Complete hardware and software inventory (relative to
firewalls)
Paper and electronic copies of configuration settings
Firewall policy
Change documentation
Previous troubleshooting logs
Activity, error, and alert logs
Maintenance logs
Any information about the current problem
Once you have this information in hand, you can begin the
overall troubleshooting process. Don’t wait until a problem
occurs to collect this essential information, however.
Instead, maintain this collection of documentation as a
normal, regular, essential element of system maintenance
and management. The best time to document the
environment and configuration is when you do not urgently
need it. When problems do arise, you want to be able to
focus on resolving the issue, not collecting resources and
tools. Pre-assemble the tools and resources you’ll need for
troubleshooting so that you will be ready for action.
Murphy’s Law dictates that when things go wrong, and
they will, they will go bad at the least convenient time. To
combat this, be prepared before the problems arise. That
way, when the firewall fails, locks up, freezes, lets through
unwanted traffic, or falls to a hacker, you can focus on
dealing with the stress, time crunch, data loss, and
downtime ramifications without also having to deal with
collecting the essential materials to resolve the problem.
Being prepared is always a solid first step. Next, develop
a troubleshooting plan, technique, or procedure. While some
problems are predicable and have a known method of
resolution, many situations will require off-the-cuff
brainstorming to craft a new solution. Most solutions come
from a liberal application of common sense. The following
are several commonsense elements you need to integrate
into your troubleshooting planning:
Have patience—Keeping your cool and taking your
time will pay off by allowing you to find a solution
quickly without making mistakes, overlooking essential
details, or making the problem worse.
Know your firewall thoroughly—The more you
already know about the firewall hardware and
software, the more you will know how it functions. You
can immediately use that knowledge to seek out a
solution.
Isolate the problem—Whenever possible, isolate
elements or components of the firewall system that
are functioning correctly to narrow the range of
suspects of potential problem sources.
Simplify—Disable or disconnect software and
hardware not essential to the function of the firewall.
This will reduce the complexity of the situation and
may assist in uncovering the cause.
Focus—Seek to find a solution to the current most
critical problem. Don’t waste time fixing, repairing,
upgrading, resetting, or configuring any other problem
or aspect of the firewall system until you’ve resolved
the primary problem. You can become distracted by
minor details that “only take a second” to address;
make a list of these smaller issues and come back to
them later.
Review change documentation—Could a recent
change be responsible for the unwanted activity? If so,
try to undo the change to see if the problem stops.
Review previous troubleshooting logs—Consider
whether the current problem is the same as or similar
to recent problems already in the log. Try repeating
successful solutions.
Update the troubleshooting log—Record every
action attempted, whether successful or not. Record it
into the troubleshooting log and use it as a journal.
Think of something, then write it down. Then try the
solution, and write that down. Then test for
effectiveness, and write that down. Next, repeat the
failure fix, and write that down. Repeat until resolved,
writing down the successful solution and making note
of any other thoughts, ideas, or observations.
Try the quick and easy fixes first—Try the fast and
easy stuff before the hard and complicated options.
You might be lucky, but if not, undoing easily
attempted failed solutions will be simpler than undoing
more complex options.
Avoid destructive or irreversible solutions until
last—Attempting to use an irreversible fix is a poor
idea early in the troubleshooting Process. Only after
reversible and/or safe solutions have failed should you
attempt more drastic measures.
Try the free options before the costly ones—
Always try to perform repairs and fixes in-house using
tools and resources that you already own or can obtain
free. Hold off on purchasing new resources or hiring
technical support until you’ve exhausted other
options.
Let the problem guide and direct you—The more
you understand how your firewall operates and what
the problem is, the more the problem will direct you
toward the affected area or the source of the issue.
Make fixes one at a time—Try only one fix or repair
option at a time. Attempting multiple fixes at once is
more complex and might mask the successful
resolution.
Test after each attempt—After each fix is made,
test the repair to see if it was successful.
Reverse or undo solution failures—If a fix does not
resolve the issue, undo it to return to the previous
state. Leaving failed fixes in place may cause other
problems or may intensify the main problem.
Repeat the failure—Sometimes causing the failure
to repeat can assist in identifying the cause. However,
do so only when the repetition will not cause further
harm or loss.
Perform a post-mortem review—The most valuable
result of a problem, especially a resolved problem, is
your ability to learn something from the event. Always
review the entire troubleshooting response process.
Look for ways to improve the response to future
problems.
Use these commonsense highlights to create an official how-
to procedure that your IT and security staff can follow when
a firewall problem arises. Firewall problems won’t wait;
strive to understand and resolve them quickly. Otherwise,
your network will be at risk or productivity can suffer.
Neither is beneficial to the long-term viability of your
organization.
Proper Firewall Implementation
Procedure
Successful firewall implementation comes from a written
plan. As with every aspect of security, a written procedure is
essential for a reliable and trustworthy deployment. If a
firewall policy does not exist in your organization, then your
first step should be to craft one.
A firewall implementation procedure should prescribe the
systematic process to properly install and configure a
firewall. Since each firewall product is different and each
type of deployment is likely different (a border firewall
versus an internal host firewall, forinstance), you may even
find that you need several firewall implementation guides.
The specifics of an implementation guide are different for
each organization. Customizing a plan for your specific
environment is essential to obtain the best security from the
deployed firewall. However, every plan should have certain
common elements. Whether you are developing your own
firewall implementation policy or revising an existing one,
use the following plan components to make yours the best
possible policy for your organization.
Every firewall procedure should clearly define the
requirements for the firewall. A generic description of a
firewall is insufficient. Don’t just indicate that you need a
software firewall or an appliance firewall. Instead, dictate
the specific capabilities, features, and requirements to
accomplish the tasks and security goals. You can include a
specific example of a vendor’s exact make and model.
However, products change, are revised, are replaced, and
are retired by vendors on a rather frequent basis. So,
include an inventory of features and specifications, even if
you focus on a certain off-the-shelf product.
Specify the network design that the firewall will
complement. To be effective, network firewalls (as opposed
to host firewalls) must be at chokepoints or transition points.
The design of the network is an essential element of
effective firewall deployment. Define and even map out the
network structure that should exist along with pinpointing
exactly where the firewall is, down to the logical
configuration and the physical cables connecting to it. Your
network design will change over time, but this can always
change in the future when you perform change
documentation and guidelines revision.
Write the plan down. Write out step by step, point by
point, every action to take from the moment the firewall
arrives on site through the point of enabling the filtering of
production traffic. Include hardening of the bastion host,
applying patches, updating firmware, changing defaults
(especially passwords), locking down management
interfaces, changing configuration settings, defining the rule
sets, configuring interfaces, installing the physical
components, backing up the configuration, testing at
startup, testing for stress and load, documenting
performance and stability, obtaining approval from senior
management, and initiating filtering of production traffic.
Prescribe the process of shopping for and purchasing (or
otherwise obtaining) the firewall. Not all firewalls have a
purchase cost, such as those that are free, open source, or
obtained through bartering. Nonetheless, document a
procurement process. Consider purchase price; consider
whether the product is new, used, or reconditioned;
understand the return policy; look for discounts; investigate
the warranty; and know what levels of technical support are
free or available for a fee. If the product must be shipped to
you, either verify that it’s in stock or determine the backlog
waiting period. Consider overnight shipping and insuring the
package against shipping damage and loss. Don’t spend
hundreds or thousands of dollars on a product that may
arrive damaged without having recourse to a claim with the
shipping company.
Document, document, document. Write down every
aspect of firewall use before deployment. Journal every step
performed from start to finish of deployment, and then
record into the documentation every action in managing,
administering, monitoring, and troubleshooting the firewall
for the remainder of its deployment life. No action or event
is too insignificant to record relative to your firewall
deployment. This comprehensive firewall documentation is
essential to management, troubleshooting, recovery, and
incident response.
Responding to Incidents
Incident response is a key part of every security
infrastructure. Incident response is the planned reaction to
negative situations or events. Security breaches, or at least
attempts to breach security, will occur. When those events
affect the organization or its abilities to perform its tasks in
any way, incident response triggers. The goals of incident
response are to minimize downtime, minimize loss, and
restore the environment to a secure, normal state as quickly
as possible. This applies to breaches of a firewall as well as
every other aspect of security.
Most incident response solutions include six primary
steps or phases:
Preparation—Select and train security incident
response team (SIRT) members and allocate resources.
Detection—Confirm actual breaches.
Containment—Restrain further escalation.
Eradication—Resolve the compromise.
Recovery—Return to normal operation.
Follow-up—Review the process and improve future
responses.
Incident response is an important element of firewall
management.
CHAPTER SUMMARY
Firewall management involves addressing all security
concerns related to the security provided by a
firewall. This includes following recommended best
practices, knowing that a firewall is only part of a
complete security infrastructure, picking the right
firewall for the environment, considering the options
of building versus buying a firewall, being prepared to
mitigate firewall threats and risks, dealing with
tunneling across a firewall, firewall testing, using tools
for management and monitoring, troubleshooting
problems, planning out use, and being prepared with
an incident response policy.
KEY CONCEPTS AND TERMS
Fuzzing tools
CHAPTER 9 ASSESSMENT
1. All of the following are considered firewall management
best practices except:
A. Have a written policy.
B. Provide open communications.
C. Maintain physical access control.
D. Don’t make assumptions.
E. Develop a checklist.
2. All of the following are firewall management best
practices except:
A. Lock, then watch.
B. Back up, back up, back up.
C. Keep it simple.
D. Perform penetration testing.
E. Implement fail-open response.
3. You are the security administrator for a small medical
facility. To be in compliance with federal HIPAA
regulations, you need to deploy a firewall to protect the
entire office network. You are concerned that a firewall
failure could result in compliance violations as well as
legal costs due to client court cases. Which of the
following is the best choice of firewall for this situation?
A. Deploy a client system with a native OS firewall.
B. Select any open source firewall product.
C. Use the firewall provided by the ISP connection
device.
D. Deploy a well-known commercial firewall from the
approved products list.
E. Use a multifunction device, such as a wireless access
point.
4. From the following options, what is the most important
factor in selecting a firewall?
A. Biometric authentication
B. Types of traffic to be filtered
C. Sales or discounts
D. Bastion host OS
E. Built-in antivirus scanning
5. A well-designed and configured firewall provides more
than sufficient security protection without any additional
safeguards.
A. True
B. False
6. Which of the following is a benefit of buying a ready-to-
deploy firewall over using a build-it-yourself firewall?
A. Minimal setup time
B. Less expensive
C. Repurposing existing hardware
D. Using open-source software
E. More complex troubleshooting
7. Which of the following is a benefit of using a build-it-
yourself firewall over buying a ready-to-deploy firewall?
A. More costly
B. On-site technical support
C. Greater flexibility and customization
D. Product warranty
E. Requires skill and knowledge to deploy
8. Which of the following is not one of the possible but
rare attacks or exploits against a firewall?
A. Coding flaw exploitation
B. SMB share exploitation
C. Buffer overflow attacks
D. Firewalking
E. Fragmentation
9. The exploit or attack known as ________ can be used to
cause a DoS, confuse an IDS, or bypass firewall filtering.
A. Obfuscation
B. Trojan horse
C. SQL injection
D. Fragmentation overlapping
E. Spoofing
10. Although successful attacks and exploits against
firewalls are rare, what is the best response or
resolution to such compromises?
A. Deploying anti-malware scanning
B. Adding rules to the set
C. Positioning the firewall on a non-chokepoint
D. Increasing the transmission frequency
E. Patching and updating
11. Tunneling across or through a firewall can be used to
perform all of the following tasks except:
A. Using a closed port for covert communications
B. Bypassing filtering restrictions
C. Using any open port to support communication
sessions
D. Allowing external users access to internal resources
E. Supporting secure authorized remote access
12. Which of the following statements is false?
A. ICMP can be used as a tunneling protocol.
B. Encryption prevents filtering on content.
C. Outbound communications don’t need to be filtered.
D. Tunnels can be created using almost any protocol.
E. Tunnels can enable communications to bypass firewall
filters.
13. Which of the following provides anonymous, but not
encrypted, tunneling services?
A. Cryptcat
B. JanusVM
C. TOR
D. PacketIX VPN
E. HotSpotShield
14. What is the best way to know that a firewall is
functioning as expected?
A. Review the documentation.
B. Presume it is until a patch is received from the
vendor.
C. Test it.
D. Check the configuration.
E. Watch the log files.
15. Which method of testing a firewall grants the tester the
greatest range of freedom to perform tests that might
cause physical or logical damage to a firewall?
A. Live firewall tests
B. Virtual firewall tests
C. Laboratory test
D. Simulation tests
E. Production firewall tests
16. Which of the following tools tests and probes whether a
port is open or closed?
A. Nmap
B. Netstat
C. TCPView
D. Fport
E. Wireshark
17. Which of the following testing tools is an open-source
vulnerability assessment engine that scans for known
vulnerabilities?
A. Snort
B. Nessus
C. Wireshark
D. Netcat
E. Syslog
18. What is always the best tool for firewall
troubleshooting?
A. Source code
B. Crimping tool
C. Vulnerability scanner
D. Information
E. Fuzzing tool
19. Which of the following is not a recommended
commonsense element of troubleshooting?
A. Isolating the problem
B. Setting it aside and return to it later
C. Reviewing change documentation
D. Making fixes one at a time
E. Having patience
20. Which of the following is not part of a successful firewall
use?
A. A written plan
B. Specific requirements
C. Purchasing guidelines
D. User survey of preferences
E. Documentation
CHAPTER
10 Using Common
Firewalls
THE ACTUAL DEPLOYMENT of a firewall is a fairly straightforward process. This process begins with
understanding the network environment, includes selecting
a product that satisfies security needs, and ends with a
more secure network infrastructure. Toward that end, this
chapter examines a few of the remaining concepts that are
often part of the decision-making process.
Firewalls are useful in many different situations. Every
network infrastructure can benefit from proper use of a
firewall. This chapter presents additional concerns and
decision points for small and large network environments,
host software firewalls, native operating system (OS)
firewalls, third-party OS firewall alternatives, Internet
service provider (ISP) connection device firewalls,
commercial firewall options, open-source firewalls, hardware
firewalls, and virtual firewalls.
Chapter 10 Topics
This chapter covers the following topics and
concepts:
What some options are for individual and
small office/home office (SOHO) firewalls
What common uses for a host software
firewall are
How to use Windows 7’s host software
firewall
How to use a Linux host software firewall
How to manage the firewall on a connection
device from an Internet service provider (ISP)
What commercial software network firewalls
are
What open-source software network firewalls
are
What appliance firewalls are
What virtual firewalls are
What some simple firewall techniques are
Chapter 10 Goals
When you complete this chapter, you will be able
to:
Configure the Windows Firewall on Windows
7
Set up a broadband connection device
firewall
Individual and Small Office/Home
Office (SOHO) Firewall Options
Firewall options for the individual or for those running a
small office range from native OS firewalls to special-
purpose devices. Most individuals and small office/home
office (SOHO) users are concerned about security but don’t
want to spend more than really necessary. Obtaining a
reasonable level of security for most home or small office
environments is actually quite easy and cost effective.
First, an understanding of the common threats facing
such an environment suggests that firewall options can be
simple and inexpensive. While the Internet is not a safe
place, interacting with Internet resources is not an
automatic recipe for damage and destruction. Common
sense and use of basic security tools greatly reduces the
likelihood that a significant compromise from the Internet
will take place.
Generally, Internet threats fall into two main categories:
passive and active. Passive threats are those you must
seek out to be harmed. For example, you have to visit a
Web site to be harmed by malicious code embedded in that
site. Likewise, downloading infected content occurs only
when you elect to click on a download link. Users can avoid
most passive threats by making good and safe choices as to
where to go and what to do on the Internet.
To address passive threats, modern Web browsers
include pop-up blockers, cookie filters (Figure 10-1), and
malicious site managers to limit exposure. The use of
antivirus scanning, an anti-spyware scanner, and anti-spam
filters addresses other common threats. Adding a firewall to
your security stance protects against most of the passive
threats on the Internet that might be casually triggered.
While it’s still possible to go looking and find trouble, most
well-known and popular sites take security seriously and
strive to make accessing their resources as secure as
possible.
NOTE
Installing a handful of security tools doesn’t mean that
you can throw caution to the wind and randomly
explore the entire Internet safely. Instead, by using
simple security tools along with common sense, most
threats are either blocked or avoided. Potential
exceptions can always affect this rule, of course, such
as when a trusted site is compromised and your next
visit results in the transfer of malware to your hard
drive.
FIGURE 10-1
The Privacy section of Firefox’s Options dialog box. Note the
cookie settings.
The other category of Internet threat is active. An active
threat is one that takes some type of initiative to seek out
a target to compromise. This can be a hacker, an intruder,
or an automated worm. In any case, an active threat seeks
out vulnerable targets. If you do not have reasonable
security deployed and an active threat discovers your
system, you might be at risk for a compromise.
Fortunately, most individuals and small office
environments are not significant or primary targets of most
hacker activity. There just isn’t enough value or benefit in
spending the time and effort to compromise a moderately
secured single computer or small network. If your business
is getting lots of traffic and orders or you happen to be
hosting hundreds of systems, then you naturally become a
more valuable target to hackers.
In most circumstances, the average home user and most
small offices (such as those operating a dozen or fewer
computers in a network) can obtain reasonable security
protection from very simple and inexpensive firewall
options.
The first firewall option to consider is any native
firewall of the operating system. Most OSs include a default
or native firewall. If yours does, investigate its features and
options before automatically tossing it aside. Many of the
firewalls found in the latest releases of operating systems
are as good as or better than most commercially available
third-party host software firewall options.
One of the best-known examples of a native operating
system firewall is Windows Firewall. Windows Firewall made
its debut in the Windows OS as part of Service Pack 2 for
Windows XP. Initially, Windows Firewall was panned because
it imposed security, restrictions, and control on the Windows
OS where none existed before. Many applications and
services failed to function with Windows Firewall. Ironically,
many of these “failures” were caused not by Windows
Firewall, but by a service performing insecure and unfiltered
activities blocked by the security provided by the new OS
firewall.
Since its initial release, Windows Firewall has matured. It
appeared as a standard native feature in Windows Vista and
Windows 7 (Figure 10-2). The measure is likely to remain a
key OS component in future versions of Windows. The
feature set and uses of Windows 7 Firewall are discussed in
a later section in this chapter.
Other OSs may or may not have a firewall as well
recognized as Windows Firewall, but you should still
investigate the standard options and feature set provided
natively before seeking out alternatives. After all, you would
never custom turbo-charge a brand new car until you had
driven it and road tested its standard features.
FIGURE 10-2
Windows 7’s Windows Firewall Control Panel screen
FYI
Current industry nomenclature gives most ISP
connection devices a name that includes the word
“modem.” Don’t be fooled by this label; the term
modem comes from the function of a device that
modulates and demodulates (hence, mo-dem) digital
information into analog signals. Most ISP connections,
including cable, DSL, satellite, and long-range wireless,
are digital signaling systems that don’t employ analog
signals or information of any type. So, the use of the
term “modem” is a merchandising ploy to make the
device sound familiar and comfortable, rather than
complex and scary.
Linux distributions do not automatically come with a
native software firewall. And even when Linux does provide
a native firewall, it’s not likely to be enabled or configured
by default. Due to the wide range of variations in Linux
distributions, Linux provides a range of firewalls. Linux
firewalls include older products such as ipchains and
iptables, as well as newer options such as PF, Netfilter, and
Vyatta.
In addition to the free or native OS firewall options,
another simple and easy firewall that individuals and SOHOs
can use is firewalls hosted by ISP connection devices or
wireless access points. Most ISP connection devices,
including cable modems, digital subscriber line (DSL)
modems, satellite modems, and wireless modems, include
firewall features. A firewall feature may or may not
represent a fully functional firewall. Some are basic filtering
tools that block IP addresses, ports, or protocols using a
simple blacklist technique.
If the ISP connection device provides firewall services,
obtain a copy of the original manufacturer’s user manual for
the device. This will provide the best initial information on
accessing and configuring the device’s firewall, since your
ISP has probably chosen to lock down access to the
connection device. The use of an ISP connection device
firewall is discussed later in this chapter.
An ISP connection device may or may not offer wireless
connectivity. If the provider does not offer a wireless option
or requires you to pay extra for wireless via their equipment,
you should consider deploying your own wireless access
point. Most wireless access points for consumers and SOHO
environments cost under $100 and offer firewall services as
well as wireless connectivity.
The use of native host OS firewalls and a hardware
firewall provided by an ISP connection device or wireless
access point is usually more than sufficient filtering security
for a home user or a small office network. However, if you
want to explore other options or you have a larger, riskier,
or more sensitive environment, consider the other firewall
alternatives.
Uses for a Host Software Firewall
The next step up from a native OS firewall (or even an OS
without a firewall) is a third-party host software firewall.
These options include both open-source and commercial
software firewalls for most operating systems.
You can use a host software firewall in several situations.
The first and most obvious use is simply to protect a client
system. This is the original and intended purpose of a host
software firewall. Keep in mind that a host software firewall
provides protections for both inbound and outbound
communications. A host software firewall protects the client
from compromises on the network and protects the network
from compromises on the client.
NOTE
Before installing any third-party software firewall,
always double-check for full compatibility with your
current operating system version and patch level. If the
firewall’s documentation does not specifically list your
operating system as being fully compatible, don’t
assume that the measure will work properly. Firewall
security is not something to leave to chance.
Use a host software firewall as an additional layer of
protection on a server system. Most server operating
systems do not include a host software firewall. Therefore, a
dedicated firewall appliance often deploys on the network. A
host software firewall on a server is never a substitute for an
appliance firewall. However, it can be a supplement.
A host software firewall can provide firewall filtering
services in relation to a virtual private network (VPN). Just
because the VPN link itself may be encrypted does not
guarantee that the other end of the VPN connection is as
secure as you might desire. Using a host software firewall in
conjunction with either a software host VPN (such as a
transport mode VPN or a remote access VPN) or an
appliance VPN adds an additional layer of protection against
compromises that could traverse the VPN connection.
NOTE
When installing a third-party software firewall, make
sure all native or other firewalls are disabled or
uninstalled. Do not attempt to run two software
firewalls simultaneously on the same computer
system. It’s acceptable to run different software
firewalls on different systems and to even use one or
more appliance hardware firewalls. Just do not attempt
to use two software firewalls on one system.
A host software firewall can provide modest protection
for small networks. Home networks, gaming networks, and
small office networks are sometimes constructed using a
primary system connected to the Internet that shares that
connection with a small network off of a secondary network
interface. On a Windows system, the Internet Connection
Sharing service makes this type of network configuration
simple. Use a host software firewall and provide the
secondary network with modest firewall filtering services.
A host software firewall likely has many other uses. Don’t
limit your imagination or deployment options to those
discussed in books, described in manuals, or prescribed by
the vendor. Use host software firewalls in any network
configuration. The goal is to establish additional layers of
security, not conform to static notions of design and
implementation.
Examples of Software Firewall Products
Software firewall products are important options to consider
when designing and deploying a security solution for home
environments as well as corporate IT infrastructures.
However, as with any type of software, the available
products change constantly. Updated versions of software
firewalls are released frequently; some products disappear
from the marketplace, while new firewall products appear on
the scene all the time.
Before selecting a specific firewall product, do research
to confirm that the firewall is still a fully supported and
maintained solution. You don’t want to buy into a product
that has already been marked for retirement or phase-out,
or be invested in the installation of a version imminently at
risk of being superseded. Verify that the vendor is still
supporting the firewall product. Check on the revision
history and, based on previous time frames, estimate if the
current version release is it a bit stale or a bit tardy for a
revision.
Beware the textbook answer. Most authors are reluctant
to recommend specific current products. Books typically
take six to twelve months to reach the hands of readers
once the author completes the manuscript; coincidentally,
six to twelve months is the life span of many product
versions. A product an author recommends might no longer
be the best option by the time that recommendation
reaches readers.
Take caution when following any specific “textbook”
advice about a specific product, especially a specific version
of a product. Question a product’s shelf life. Gather fresh
information. Always double-check the facts, reviews, and
suggestions via current Internet search resources, vendor
Web sites, IT association blogs and discussion forums,
industry journals, and mass market computing magazines.
Like milk and cheese, most computer software products
have an effective “use by” date that you should be familiar
with.
All that being said, a host of third-party software firewalls
are worth considering. Here are just a few of the more
widely known options:
Check Point ZoneAlarm Pro (free and retail)
Comodo Firewall Pro (free)
eConceal Pro (retail)
Injoy Firewall (retail)
Jetico Personal Firewall (retail)
Lavasoft Personal Firewall (retail)
Look ’n’ Stop (retail)
Norman Personal Firewall (retail)
Outpost Firewall Pro (free and retail)
PC Tools Firewall Plus (free)
PrivateFirewall (free)
Sphinx Software Windows 7 Firewall Control (free and
retail)
Tall Emu Online Armor Personal Firewall (free and
retail)
In addition to standalone, third-party firewalls, some
firewalls come packaged as part of a security suite. These
suite-member firewalls are not available as standalone
products. However, the collection of security applications
might be worthwhile if you don’t already have existing
solutions. Some security suites to consider include:
BullGuard Internet Security
Computer Associates Internet Security
F-Secure Internet Security
Kaspersky Internet Security
McAfee Personal Firewall Plus
MicroWorld eScan Internet Security Suite
Microsoft Security Essentials
Norton Internet Security and Norton 360
Panda Internet Security
Trend Micro Internet Security
Webroot Internet Security Essentials
How fresh are these lists? These products were current and
available as of spring 2013. The lists are not exhaustive and
include only well-known products. As you read this, new
firewall options might now be available and some of the
listed products might have been terminated. If you want to
search for more or current options, search using keywords
such as software firewall, and review.
Using Windows 7’s Host Software
Firewall
The native Windows Firewall of Windows 7 (Figure 10-3) is a
sufficient security measure for many situations. Before
rushing to replace this free security component, take the
time to evaluate the benefits of this capable firewall option.
The version of Windows Firewall in Windows 7 is available
only in Windows 7 and is a host software firewall. However,
it can be used in a variety of situations and network
configurations for most home, SOHO, and mobile
environments.
Windows Firewall in Windows 7 includes configuration
profiles, so you can create custom firewall configuration
settings for work, home, and public connections. This allows
strict limitations in public, modest settings at work, and
more options available when accessing from home (or
whatever your preferences). The benefit is that, once
configured, the firewall will adjust its settings based upon
the network connection each time you’re connected to a
known, previously accessed network.
Windows Firewall in Windows 7 creates a password-
protected homegroup or work-group that allows file and
printer sharing between systems authorized by a password.
This is an improvement over previous versions of the
Windows Firewall, which often encouraged users just to turn
off the whole firewall rather than properly configure file and
printer sharing access rules. In addition, this applies not just
to Windows systems, but any devices or computers
recognized as media sharing devices (such as an Xbox 360).
FIGURE 10-3
Windows 7’s Windows Firewall with Advanced Security
configuration dialog box.
Other Windows Firewall improvements in the Windows 7
version include a more granular control and configuration
management interface, more extensive logging, and
extended ability to be managed from a command line (using
the “netsh advfirewall firewall” command instead of the
previous “netsh firewall” command).
While not revolutionary, and still lacking a few features
such as being a true two-way personal firewall with program
control, Windows Firewall for Windows 7 is a worthwhile host
software firewall for most clients in most network situations.
That said, you should still explore how this product fits your
own computing environment and security needs.
Using a Linux Host Software Firewall
A Linux system can benefit from a host software firewall or
can support a software firewall for a network. The first idea
is simply to install a host software firewall for the benefit of
the local user. This is the same idea as the Windows Firewall
on client versions of Windows. A variety of open source and
commercial host firewall options are available for Linux,
including:
IPCop
IPFire
m0n0wall
pfSense
SmoothWall (Figure 10-4)
FIGURE 10-4
SmoothWall, a Linux host software firewall.
If you selected Linux for its low cost of entry, then selecting
an equally low-cost host software firewall is often an
attractive option. However, paying for commercial host
firewall products might offer a greater range of functions or
services, along with better technical support.
Using a Linux software firewall as a replacement for a
commercial firewall appliance can be a very cost-effective
solution. Linux often can repurpose computer hardware
that’s no longer sufficient to support larger, bulkier, more
resource-intensive operating systems, such as Windows.
Linux can often extend the useful lifetime of computer
hardware by several years. A repurposed computer system
running Linux is a great option for use as a software firewall
host.
Managing the Firewall on an ISP
Connection Device
In addition to the free or native OS firewall options, another
simple and easy firewall that individuals and SOHOs can use
is firewalls hosted by ISP connection devices, routers, or
wireless access points. Most ISP connection devices,
including cable modems, DSL modems, satellite modems,
and routers, include firewall features. A firewall feature may
or may not be a fully functional firewall. It could be a basic
filtering tool that blocks IP addresses, ports, or protocols
using a simple blacklist technique.
An ISP connection device is any hardware connecting a
local network—or even a single computer—to a telco’s
carrier network to access the Internet. Common ISP
connection devices include DSL modems and cable modems
(remember that these are modems in name only; they are
really routers). This definition can also include a wide range
of other broadband devices, including routers, switches, and
wireless access points, especially when required by the ISP
to establish an Internet connection.
Most ISP connection devices use a Web interface. To
initiate access to the management interface, point a Web
browser to the IP address of the device. In most cases, the
device’s IP address is the default gateway address, DHCP
address, or possibly DNS address of the client’s interface
directly connected to a physical port on the device.
TIP
If the ISP connection device provides firewall services,
obtain a copy of the original manufacturer’s user
manual for the device. This documentation will provide
the best initial information on accessing and
configuring the device’s firewall.
Attempting to open the configuration interface is likely to
result in a prompt for authentication credentials. The
vendor’s user manual should indicate the device defaults for
these. If not, search the Internet using keywords such as
“default password” along with the device name, make, and
model. If that fails, try username “admin” with a password
of “admin” or “password.” It’s shocking how often these are
correct.
Your ISP has likely chosen to lock down access to the
connection device. This is sometimes done as a precaution
against the uninitiated, who might cause increased
technical support hassles. If you discover that your ISP
connection device is locked down, try calling your ISP and
asking them to grant you access (often by their revealing
the credentials to log into the device).
If they refuse to offer this information, then you have four
choices. First, you can accept their refusal as “just how it is”
and employ some other device as a hardware firewall.
Second, you can change ISPs or service providers to a
carrier that will grant you access to configure the device.
Third, you can try to replace the carrier’s device with one
that you own and fully control. Fourth, you can seek out ISP
and device-specific information on the Internet, which might
include bypass or hacking details. However, be very
cautious when choosing this last route; it’s often
unproductive, is probably a violation of the ISP terms of
service, is unethical, and may even be illegal.
NOTE
Cable providers are generally less likely to allow you
access into their connection device, while most DSL
providers seem willing to grant at least partial access.
If you are unable to find a legitimate path to accessing
the configuration interface of your ISP connection device,
hacking the device should be your last and final option.
Hacking an ISP-provided device will void your contract and
could make you liable for the cost of the device plus fines
and possible legal action. A more ethical solution would be
to replace the device with one you own and control, or
switch ISPs altogether.
If all else fails, add your own firewall between the ISP
connection device and your first networked system. With
this configuration, you are still gaining the benefit of an in-
line firewall without violating any contracts or flirting with
legal troubles. In most cases, you’ll want to supplement or
disable an ISP connection device’s firewall anyway. Thus, if
your ISP blocks access to it, just design your security as if
the device offered no firewall protection to begin with.
NOTE
Be careful about searching for Web sites that offer
information on how to hack or bypass ISP equipment.
Often the sites are booby trapped with malware to trap
the unsuspecting visitor. In addition, some ISP
equipment may be leased, not sold, and attempting to
access internal features may violate the contract, if not
the law.
Converting a Home Router into a Firewall
Many home routers have sufficiently robust features that
you can configure them to function as firewalls. To ensure
ease of use (and minimize product returns), these devices
are usually shipped with all security features turned off.
Because “plug and play” results in immediate connectivity,
many users never go back to configure their equipment for
security. Thus, hackers and malware often are able to
intrude easily into home networks. You can prevent that by
understanding what is available in this class of products.
To access a home router, type into your browser the IP
address of your gateway. To determine that on a Windows
machine, choose Start > Run, type Command, and at the
C:\> prompt, type ipconfig. Most routers ship with a default
address of 192.168.1.1. If you remember, 192.168.X.X is a
non-routable range of IP addresses, which means that traffic
inside that address range will not be shared with addresses
outside that range.
Once logged in, consider changing a number of settings
(Figure 10-5). First, if the router is a wireless device, change
the service set identifier (SSID) from the default setting. You
do not want to be one of eight access points named
“Linksys” in your neighborhood. Why is this important? Most
PCs will grab the strongest wireless signal from a known
SSID. If you have standard SSIDs such as Linksys in your
wireless access table, you may find yourself on a neighbor’s
(or hacker’s) system someday without realizing it. Another
good idea is to change the default IP address range to
something else other than 192.168.1.X. This creates a
custom range for your own network. If you hard-code your
internal network range to something like 10.20.30.X, you’re
less likely to stumble into that situation.
FIGURE 10-5
The initial configuration screen on a Cisco Linksys wireless
router.
Most routers enable Dynamic Host Configuration Protocol
(DHCP) by default. You could lock down your network by
either hard-coding IP addresses into each authorized
machine (and turning off DHCP) or setting a strict upper
limit on the number of devices permitted to have DHCP
leases (most default settings are 100). If you have five
devices, limit the number of connections to five. (Don’t
forget about the Xbox 360 or PS3—they need IP addresses
too!)
NOTE
Don’t forget to change the default administrator
password of your device.
For firewall settings, most routers will have a
configuration page to block services or control port access.
Determine what ports you need to access the Internet, and
then block all of the rest. Note this setting restricts
outbound traffic. So why block it if it originates from within?
Malware, zombies, bots, and other hostile applications
usually have to connect to the outside to do their damage. If
you accidentally download dangerous malware onto your
laptop at your favorite coffee bar, and then connect to your
home or office network behind the firewall, that malware
may have access to all of your peer systems. However, if
you are blocking all nonessential outbound traffic, then most
malware won’t be able to exfiltrate your sensitive
information or ask for evil instructions. Only those
applications that use a common port (like 80) will be able to
get through.
Which outbound ports should you block? First, consult
your policy, or determine what programs you are using. For
the most part, you’ll want to allow the following outbound
ports to be open at all times:
Port 25—SMTP (outbound mail)
Port 53—DNS
Port 80—HTTP
Port 110—POP (initiate request for inbound mail)
Port 443—HTTPS
Ports 465 and 995—SMTP and POP (if you’re using
Gmail)
Port 1024–1035—DCOM ports for downloading files
(increase number of ports based on number of
systems protected; 10 is usually sufficient for a home
network)
Beyond port 1035, you may not need to allow outbound
traffic, unless you are using cPanel to access an externally
hosted Web site on port 2083, or port 11371 if you’re
looking up PGP keys. By blocking all other high ports, you’ll
also quickly hear from people who may have been using
some of these ports, which are dedicated to gaming
software. At home, you might want to allow (or set time
limits); at work, you probably want to block these ports.
In general, you should not accept any connections that
originate from outside your firewall. Your policy may permit
exceptions, such as remote access tools, so be careful about
blocking everything. Some home firewalls don’t provide a
direct way to block specific incoming ports, but most allow
you to do port forwarding. A clever way to use this to thwart
external attacks is to forward to a nonexistent port. So, for
example, if your local network range goes from 10.20.30.40
to 10.20.30.49, you might forward incoming connection
requests to port 10.20.30.99—where no one is listening!
Ports you might consider forwarding are:
Ports 20 and 21—FTP-data and FTP. Prevent external
connections from downloading your files.
Port 23—Telnet. Prevent external connections from
insecurely logging into your internal systems.
Port 53—DNS. Prevent external entities from
poisoning your DNS cache.
Port 80—HTTP (unless you are running a Web server
from behind your firewall, which is a bad idea).
Ports 81 and 82—Often used as “overflow” for port
80. No valid use, so block them.
Ports 137, 138, 139—NetBIOS. Often exploited by
malware, this provides access into Windows systems.
Port 443—HTTPS (unless you are running a secure
Web server from behind your firewall, which is still a
bad idea).
Port 445—NetBIOS for Windows 2000 and later.
Port 3074—Xbox game port. Don’t allow strangers to
connect to your Xbox while you’re away. Remember—it
“lives” on your internal network.
An excellent way to test your configuration is to go to Steve
Gibson’s http://www.grc.com Web site and run his free
ShieldsUP! port scanning tool (Figure 10-6). Most people end
up scoring poorly. If you can achieve 100 percent stealth,
you’ve done a great job.
FIGURE 10-6
ShieldsUP! port scan result confirming a well-configured set
of home router firewall rules.
FYI
A commercial product is simply one that’s for sale
rather than given away without cost. Commercial is not
necessarily the antonym of open source or a synonym
of closed source. Additionally, commercial is not
necessarily the opposite of free.
An open-source product is one where the source code
can be obtained and viewed by anyone. A closed-
source product has its source code protected so that
the public cannot view it. A commercial product can be
either open-source or closed-source. However, most
commercial software is closed-source. This is viewed as
a means to protect intellectual property and allow the
vendor to continue to charge for the product.
Free can mean both no price or having liberty. Free
software can have no cost, which makes it non-
commercial. Free software can also be commercial
software that grants liberties to its users.
For further discussion on free software, please visit
GNU organization’s site at www.gnu.org.
Commercial Software Network
Firewalls
Commercial software network firewalls install onto your own
hardware and provide network-level security services. Some
commercial software network firewalls install on top of
existing operating systems, such as Windows. Others are
complete OS replacements, many of which are Linux-based.
As with any firewall selection, know your environment
and understand your security needs before shopping for a
firewall solution. It’s bad security to purchase a product
because it’s on sale, is prominently advertised, or is
recommended by a salesperson (or even an author).
Instead, match your security needs with the product that
best suits, fulfills, or satisfies those needs.
Open-Source Software Network
Firewalls
An open-source software network firewall is a product that is
usually available at no monetary cost and whose source
code is available for review. An open-source solution often
can be a cost-effective option. However, just because a
product is free does not ensure its reliability or
trustworthiness. Additionally, being able to review the
source code doesn’t warrant the reliability of a product.
You should thoroughly review and test every security
product, including firewalls, before purchase and
deployment. Seek out a product that meets your specific
organizational security needs, rather than selecting
something just because it’s open source or free of charge.
Appliance Firewalls
Appliance firewalls, whether called device or hardware
firewalls, are common and nearly essential elements of
every moderate to large network infrastructure. A hardware
firewall is a dedicated hardware device that has been
specifically built and hardened to support the functions of
the firewall software running on it. A hardware firewall is
also known as an appliance firewall.
A hardware firewall does not require any additional
hardware or software for its deployment. All it needs is
network connections and a power connection. A hardware
firewall has dedicated hardware resources not shared with
any other service. A hardware firewall can protect a single
system or an entire network.
A hardware firewall can filter only traffic that reaches the
network interfaces of its appliance. However, you can
position a hardware firewall on a network at a chokepoint or
gateway to analyze and filter all traffic.
Firewalls, specifically hardware appliance firewalls,
typically have two or more network interfaces. A firewall
with two interfaces is known as a dual-homed firewall, while
a firewall with three interfaces is known as a triple-homed
firewall or a three-legged firewall.
The benefit of multiple interfaces is that the segments,
subnets, or networks connected to each firewall interface
are electronically isolated from each other. This prevents
unfiltered traffic from leaping from one segment to another
in an attempt to bypass firewall filtering.
However, for firewalls using multiple interfaces, ensure
that you disable the TCP/IP protocol feature IP forwarding. IP
forwarding is actually a router rule that allows traffic from
one interface to traverse to another interface without
needing to move any further up the protocol stack than
where IP resides. In many cases, IP forwarding allows
packets to bypass filtering. If you’re using the system as a
firewall, be sure to disable this feature.
A personal hardware firewall can be part of an integrated
firewall product, such as a wireless access point or a
cable/DSL modem. Another variation of the personal
hardware firewall is the repurposing of a client or server
computer into a home-crafted, open-source firewall. One
example of this is SmoothWall, a hardened bootable Linux-
based firewall.
A commercial hardware firewall usually handles the
complexity of larger organizational networks. A commercial
hardware firewall is often very expensive—$10,000 or more
is not uncommon.
The personal and commercial variants of software and
hardware firewalls might include different add-ons or
enhancements than their commercial equivalents. These
add-ons or enhancements include antivirus, password
management, registry protection, driver protection, VPN
gateways, remote access support, IDS, IPS, spam filtering,
and more. Usually, these add-ons make the firewall products
more attractive to the potential individual buyer. However,
most commercial entities would generally avoid integrated
firewall solutions in favor of dedicated products to handle
the distinct security or management functions. An
integrated device might offer easier administration, but it
represents a single point of failure for multiple services.
Additionally, such devices are more difficult to troubleshoot
due to the complexity of the communications supported.
A variety of manufacturers and vendors make and
service appliance firewalls. The specific products in this
category change constantly, so including a list of exact
make and models would be outdated within months.
(Remember the “use by” date on that carton of milk?)
Instead, to find the best products available for either SOHO
or enterprise-sized environments, visit the vendor’s
technical review sites for updated product discussions, blogs
and discussion forums, and buyer’s guides. Some of the
major vendors/brands to consider include:
Barracuda
Cisco
D-Link
Fortinet
Juniper Networks
Linksys (now owned by Cisco)
NetGear
SonicWALL
WatchGuard
ZyXEL
When selecting a hardware or appliance firewall, keep a few
important points in mind. Commonsense or basic concerns
include ease of use, secured management interfaces, port
filtering support, stateful inspection filtering, and the ability
to be firmware/software upgraded.
Never skimp on throughput. Firewalls often represent
bottlenecks to network bandwidth and thus should be
selected to maintain wirespeed. Be sure a hardware firewall
can more than handle the current network speeds and allow
for future growth. If you are currently pushing a 1 Gbps
network, consider a firewall capable of filtering at 2.5 Gbps
wirespeed or higher.
For larger networks, centralized and remote
management options are often essential. If firewall
management requires direct physical contact or if you can
configure only a single firewall at a time, you may find these
significant hindrances to managing very large networks. An
important part of a realistic firewall solution for enterprise
networks can be multiple device management, including
simultaneous configuration synchronization features.
Consider whether add-ons, upgrades, or extras are
available and whether that’s important to your decision.
Some firewall devices convert to firewall-plus devices or
true multifunctional devices. Additional features may
include e-mail scanning, message quarantine, attachment
stripping, virus scanning, mobile code filtering, anti-
spyware, intrusion detection system (IDS) and intrusion
prevention system (IPS) features, spam filtering, compliance
monitoring, and network access control. Products that
support expansion or firewall additions are known as unified
threat management tools or may fall under the heading of
advanced intrusion detection and prevention systems.
Whatever the options presented by a vendor, always
consider them in light of your actual current and future
network needs. Just because a product is expensive does
not guarantee it will work better than a free, build-it-yourself
alternative.
Virtual Firewalls
The term “virtual firewall” describes a variety of firewall and
firewall-like concepts. This can include virtualized software
firewalls that provide filtering services for a standard
physical network as well as firewalls running between
virtualized client and server operating systems. In theory,
the use of a software firewall as a replacement for a network
appliance could work as long as the host OSs network
communication is routed through the virtual firewall before
leaving the host’s network interface controller (NIC).
This is a relatively new and growing area for firewall
deployment. Virtualization offers numerous benefits over a
traditional single OS to a single hardware box deployment.
Virtualization allows for rapid development, quick
prototyping, isolation, traffic management, quick recoveries,
testing, and so on. By virtualizing firewalls along with
operating systems, you can craft new network architectures
that do not or could not exist in the traditional network
architectural concepts.
For example, with a virtualized firewall, you could route
every communication between every virtualized OS through
the filtering services. This would be the equivalent of
deploying an appliance firewall between every system, but
without the hassle, expense, or complexity.
Virtual firewalls are not a panacea. Virtual firewalls will
not be useful in every situation, but they are an interesting
new option for deployment to monitor, manage, and filter
network traffic over traditional or virtualized network
segments.
Simple Firewall Techniques
A few mundane concerns affect every firewall user when
employing a firewall of any type. In most cases, these issues
are common sense or at least well known, but they are often
overlooked, forgotten, or discounted. For this reason, they
are included here.
After writing a firewall security policy, obtaining approval,
and obtaining the firewall to install, the first step in
deploying a new firewall is to change the default password
of the administrator account. Better yet, modify every pre-
defined user account and every default access code of any
type. Use something unique, original, and difficult to predict.
Testing is essential. No change or alteration of
configuration is so minuscule that testing is inappropriate.
Every change should trigger a test to confirm that the
change took effect and caused no unintended
consequences.
Many firewall appliances can be quickly reset to factory
defaults with the simple press of a button. Some devices
have a reset button prominently located and labeled so that
anyone with a finger can casually revert to default status.
However, such an obvious button has disadvantages, such
as accidental or innocent hand movements.
Fortunately, a growing number of devices that still offer
button-based reset options have receded the button behind
a tiny pinhole. A straightened paper clip (or an expensive
tiny screwdriver) depresses the reset button. Often, a single
quick press is insufficient to reset the device; a series of
presses or a prolonged 10- or 30-second depress may be
necessary to trigger a reset. This feature makes accidental
depression impossible but also makes intentional resetting a
bit of a challenge. Be sure to consult the user manual for
instructions that may not be obvious or intuitive.
Keep a printed or written copy of all rule sets and
settings on hand. Periodically, verify manually that all
settings remain as you want them. This is done by viewing
the configuration or management interfaces and comparing
the live settings to those defined in your documentation.
Whenever you discover a discrepancy, investigate and
repair it at once.
Finally, regularly visit the vendor’s Web site and
discussion forums (including non-vendor-supported ones) for
news and information about your firewall product. Keep
current with announcements of updates, problems with
updates, newly discovered holes or exploits, alternative
configuration ideas, troubleshooting options, and more.
CHAPTER SUMMARY
Firewalls are useful in many different situations. Every
network infrastructure can benefit from proper use of
a firewall. When making a choice about what firewall
to deploy, consider a breadth of options, including the
needs of both small and large network environments,
host software firewalls, native OS firewalls, third-party
OS firewall alternatives, ISP connection device
firewalls, commercial firewall options, open-source
firewalls, hardware firewalls, and virtual firewalls.
KEY CONCEPTS AND TERMS
Active threat
Cookie filter
Native firewall
Passive threat
Pop-up blocker
CHAPTER 10 ASSESSMENT
1. What types of Internet threats are considered passive,
in the sense that the user must seek them out to be
harmed? (Select all that apply.)
A. Malicious Web sites
B. Worms
C. Downloaded content
D. Spam
E. Trojan horse
2. Average home users and workers at a large corporation
can both benefit from which of the following:
A. Open-source hardware firewall
B. Gateway server firewall
C. Commercial appliance firewall
D. Host firewall
E. Proprietary device firewall
3. In what locations is a home or SOHO user likely to find a
firewall by default? (Select two.)
A. A self-installed software firewall
B. Hosted by the operating system
C. A build-it yourself appliance firewall
D. Hosted by the ISP connection device
E. A commercial firewall device
4. Windows operating systems are the only operating
systems that include a native or default host firewall.
A. True
B. False
5. What is the maximum number of host software firewalls
that should be operating on a single computer at any
point in time?
A. One
B. Two
C. Three
D. Four
E. None
6. Firewalls are designed to provide protection for both
________ and ________ communications.
7. An organization should consider purchasing last year’s
model firewall instead of this year if they receive a
significant discount.
A. True
B. False
8. When considering the deployment of a firewall, which of
the following should be considered? (Select all that
apply.)
A. Commercial firewalls
B. Legacy firewalls
C. Open-source firewalls
D. Beta firewalls
E. Do-it-yourself (DIY) firewalls
9. Windows Firewall for Windows 7 includes an easy-to-
configure new feature that allows file and printer
sharing between systems authorized by a password.
This feature no longer encourages users to just turn off
the whole firewall rather than figure out how to properly
configure file and printer sharing access rules. What is
this feature called?
A. Internet Connection Sharing
B. Quick config
C. Homegroup
D. Shared computing
E. Microsoft Easy Access Firewall
10. What is the command line tool used to configure
Windows Firewall for Windows 7?
A. route firewall
B. netsh advfirewall firewall
C. new use firewall
D. firewall config
E. netsh firewall
11. Using a Linux software firewall as a replacement for a
commercial firewall appliance can be a very cost-
effective solution. Linux often can repurpose computer
hardware that is no longer sufficient to support larger,
bulkier, more resource-intensive operating systems.
A. True
B. False
12. The firewall configuration on an ISP connection device
is most commonly accessed through what type of
management interface?
A. SMTP
B. HTTP/HTTPS
C. SSH
D. FTP
E. RSH
13. If your ISP refuses to grant access to configure their
connection device, what legal options are available to
you as alternatives? (Select all that apply.)
A. Live without configuring it.
B. Hack into it.
C. Deploy your own hardware firewall alternative.
D. Purchase your own connection device.
E. Change ISPs.
14. What is the command line utility used to display the IP
configuration of your Windows computer?
A. ifconfig
B. net use network
C. netconfig
D. ipconfig
E. netstat
15. When configuring a wireless access point to provide
firewall services, which of the following are important
configuration actions to take? (Select all that apply.)
A. Change the default administrator password.
B. Block unwanted ports.
C. Change the SSID.
D. Turn off SSID broadcasting.
E. Change the default IP address range.
16. In general, you should not accept any connections that
originate from ________ your firewall.
17. If your home firewall device is unable to block ports,
use ________ instead to route data to nonexistent hosts.
18. It is best to pick a firewall based on:
A. Actual network security needs
B. Recommendations of a salesperson
C. The list of awards given the product
D. The price
E. Prominent advertisement
19. Appliance firewalls are only and always commercial
firewalls.
A. True
B. False
20. When selecting a firewall, especially a hardware
firewall, never skimp on ________.
CHAPTER
11 VPN Management
VIRTUAL PRIVATE NETWORK (VPN) MANAGEMENT is a critical component in your organization’s computer security.
VPNs extend the internal network beyond the perimeter
secured by firewalls and other security technologies. Proper
management of a VPN requires an understanding not only of
VPN technologies, but also the business requirements
driving VPN implementation.
Using the wrong type of VPN or a VPN that doesn’t meet
your organization’s requirements can create security
problems where none previously existed. Before selecting a
VPN product or technology for your organization, create a
detailed requirements document. This should factor in not
only the security requirements for the VPN, but business
requirements as well. Although security is important, keep
in mind that security exists to support your organization’s
goals, not the other way around.
As soon as you have a set of prioritized requirements,
start looking for a solution that meets as many of these
requirements as possible. You may not be able to find a
single product that meets all requirements. When that
occurs, choose the solution that best fits the highest priority
requirements. In some cases, using multiple solutions to
meet all the requirements may be the right solution.
Good research is crucial to selecting the appropriate VPN.
Don’t rely solely on Web sites, technical magazine reviews,
or an attractive sales pitch. Depending on your
requirements, you may want to explore robust public
domain solutions rather than an off-the-shelf commercial
product.
Keep in mind that VPNs are a security technology, but
they may also degrade your security perimeter. Putting a
VPN in place is just the beginning of the project; you’ll need
to address a number of additional factors for a successful
VPN deployment.
Chapter 11 Topics
This chapter covers the following topics and
concepts:
What VPN management best practices are
How to develop a VPN policy
How to develop a VPN deployment plan
What common VPN threats and exploits are
What the tradeoffs are between commercial
and open source VPNs
What the differences are between personal
VPNs and network VPNs
How to balance anonymity and privacy
How to protect VPN security to support
availability
What the importance of VPN user training is
How to troubleshoot VPN issues
Chapter 11 Goals
When you complete this chapter, you will be able
to:
Describe VPN best practices
Write a VPN policy
Describe the issues involved with
deployment, placement, and implementation
of a VPN
Appraise the threats and attacks against
VPNs
Contrast the needs and features of personal
and enterprise or network VPNs
Compare anonymity and privacy
Compose an introductory VPN training
program for users
Formulate a procedure for troubleshooting
VPNs
VPN Management Best Practices
First, familiarize yourself with the recommendations,
guidelines, and procedures that will allow you to manage
your VPN securely, efficiently, and as cost effectively as
possible. These techniques and recommendations are
known collectively as “best practices” and are generally
developed and published or shared by experts in the field.
VPNs have been around since the late 1990s. That means a
significant amount of real world experience is available in
the industry for your reference.
A best practice is generally not a tool, but rather the
collected wisdom of fellow security practitioners sharing
what they have learned. One of the great things about
working in the information security field is that numerous
experts are generally willing to share their experience. Be
warned, however: Security experts tend to have very strong
opinions, so any time you are reviewing a best practice, be
sure to keep the needs and requirements of your own
environment in mind. A process that works great in a
25,000-employee global manufacturing company may not
work nearly as well in a 50-employee medical records
processing company.
That said, you might well be able to adapt a process from
another company to fit your environment. The key to
getting the most out of best practices is to consider them
with your specific environment and requirements in mind.
Keep what works, modify what you can adapt, and ignore
what doesn’t make sense. After some time in the business,
you will be the person other people come to for advice.
Provide redundancy, because everything, including VPNs,
can break. If your organization will be relying on your VPN
for remote access, encrypting and securing data, or
providing a business partner access to your extranet, you
will find out quickly how critical your VPN is on the day it
breaks. Most commercial VPN products offer a failover or
load-balancing capability so that in the event one device
fails, the other will pick up the traffic.
Often, VPNs are provided via a cloud implementation. In
this case, be sure that a level of redundancy is built in and
that the redundancy is clearly spelled out, and guaranteed,
in the contract or service level agreement (SLA), as it
will otherwise be out of your direct control. The good news
about anything implemented as a cloud application is that
someone else takes responsibility for the exact
implementation. This is also the bad news, especially for
security practitioners.
Alternatively, keep a spare VPN product on your shelf,
configured and ready to go live in the event of a failure.
Generally, waiting for tech support or ordering a spare part
can take more time than your organization is willing to wait
for restored service. You’ll learn more on this later in the
chapter.
Choosing the right VPN product is critical to the long-
term success of your VPN deployment. Take your time,
document your requirements, carefully evaluate the
capabilities of each VPN product you review, check with
peers if available, and review appropriate industry literature.
A security magazine review of VPN products is a valuable
tool for starting your search—or even narrowing the field
once you have your requirements documented—but don’t
select your solution solely based on who won last year’s
Editor’s Choice award from your favorite industry magazine.
While the editors and reviewers at most industry magazines,
Web sites, and blogs are technically capable and spend a lot
of time looking at products, they don’t have to support the
product in your environment. Ultimately, you will be
responsible for meeting your organization’s requirements
and maintaining support.
Beware the vendor with the slick PowerPoint presentation
offering a free lunch. Avoid purchasing products based on
promises rather than proven capabilities. Slideware, also
sometimes known as vaporware, is any product that
appears in a vendor’s PowerPoint presentation, but is not
yet available for sale. When possible, road-test a product in
your environment before purchasing. It’s always a good idea
to see what a product can do firsthand.
Finally, when looking for a product, consider using
resellers and consultants. A good reseller can do some of
the legwork for you by narrowing the search to a smaller
pool of products. While some resellers work much like a
standard department store, selling whatever is on the
shelves, many will go the extra mile to ensure you get a
product that will work in your environment. This saves them
the challenge of trying to support a poor product after
they’ve sold it, and if you like the solution, they have the
opportunity to sell you additional products in the future.
A VPN policy (often referred to as a remote access policy)
documents your organization’s rules for using the VPN. You
will read about creating a VPN policy at length later in this
chapter. Recognize, however, that proper policy framework
is a key best practice when dealing with security
technologies, especially those offering remote access to
your computing environment.
The client is a critical component of your VPN solution.
For the most part, VPN technology is both mature and
secure. VPNs are subject to denial of service (DoS) attacks,
but VPN servers are rarely hacked. Nevertheless, VPNs
remain a viable vector for someone who wants to attack
your network. The target of these attacks is typically the
weakest link of the VPN chain—the client. A typical VPN
client runs an operating system that needs to be patched at
least once a month, runs applications that may need to be
patched almost as often, and is vulnerable to viruses,
spyware, and other attacks. Be sure to install antivirus
software, anti-malware software, and a software firewall on
every client that will be connecting to your network through
the VPN.
Split tunneling is a configuration setting that allows
simultaneous access to both an untrustworthy network (like
a home network) and a secured VPN network connection.
This may not sound like a bad idea at first—after all, why
wouldn’t you want someone connected to the VPN to access
the Internet or their home network (or another network) at
the same time? The reason split tunneling is a bad idea is
that it potentially opens a door into your network that you
can’t control. This is known as hairpinning, because
malicious code can enter from the non-secure network,
make a hairpin (or sharp) turn, and enter your secure
network with little or no trouble because it is entering from
a secure and verified endpoint.
If the client machine is compromised by a virus that
permits remote control of the system by an attacker, and
that client machine connects to the VPN, the attacker will
have access to your internal network from anywhere on the
Internet. If you prohibit split tunneling, however, then even
if the attacker can compromise the client, the external
connections terminate as soon as the VPN connects,
ensuring your network is secure (even if the client is not).
If it doesn’t belong to the company, it shouldn’t connect
to the company’s network. One of the challenges of working
with remote access VPNs is making sure that the client at
the other end of the connection is secure. Remote access
VPNs permit access to a secure network from a remote
location across an untrustworthy network. If the client
system is not secure, you run the risk of compromising your
secure network.
Fortunately, you have some control over your
organization’s computers. You can require antivirus, anti-
malware, IDSs, and firewall software on any computers your
company owns. With systems not owned by the
organization, you cannot require anything. As a result, if you
don’t prohibit non-company systems from connecting to the
network, you cannot control whether those systems are
secure, meaning you can’t ensure that your network
remains secure. It’s very easy for an end user to load a VPN
client on a home PC and connect to your network. While
some VPN solutions offer techniques to prevent uncontrolled
systems from successfully connecting, it’s important that
you lay the groundwork by prohibiting the practice.
This is a problem that must be dealt with if the
organization has a Bring Your Own Device (BYOD) policy and
a virtual private network. How should BYO devices be
admitted to the VPN, and what are the policy and technical
guidelines for connection? How much security is the
organization willing to give up to gain the financial and
operational benefits of BYOD? In many cases, cloud-based
providers will offer support for a wider variety of client OS
types and versions than a traditional VPN product. Maybe it
is time to consider a cloud-based solution. These are all
factors your organization must take into account when
considering your VPN and the security, or insecurity, of your
information.
Effective vulnerability management can help manage
your remote clients. These are the technology and business
processes used to identify, track, and mitigate known
weaknesses on hosts or applications within a computing
environment.
Remember, everything is vulnerable to attack. UNIX,
Windows, routers, network printers, and even your VPN
solution will have vulnerabilities. Examples of vulnerabilities
include software coding errors, improper configurations, and
poor password choices. The danger with a VPN is that it
expands your network from systems you can closely control
to include systems in a home office, a branch office, a hotel,
a Starbucks, or even a business partner’s network.
Vulnerability management is a combination of tools and
processes that allow you to reduce risk in your computing
environment, including VPN-connected systems and
networks. Use tools that periodically test your environment,
including the VPN systems, for missing patches,
configuration issues, known exploits, and other
vulnerabilities. This will ensure that your remote systems as
well as your local systems are secure. Scan often and
address issues when you find them.
technical TIP
When addressing vulnerabilities in your environment,
be efficient. If you are using a tool that ranks
vulnerabilities from Level 1 to Level 5, where Level 1 is
informational and Level 5 is critical, you might be
tempted to address the Level 5s first, and then come
back and address Level 4s next, then Level 3s, and so
on. But this would be similar to having a keyboard with
several broken keys. You wouldn’t fix the “E” key first,
then come back later to fix the “U” key because it’s
less critical—you’d fix them all at once. Take a similar
approach with vulnerabilities. Determine what level of
vulnerabilities you want to address in your
environment (all Level 3 and above, for example), then
tackle them, system by system. While this approach
may leave some Level 5s in the environment a little
longer, it will take a lot less time to secure the entire
environment, since you will not need to touch the
systems multiple times.
Your VPN is only as secure as your authentication
method. One of the easiest ways to compromise a VPN is by
compromising the authentication credentials. All it takes is
one user with a password of “password” to open a direct
connection to your network. A best practice is to use two-
factor authentication for VPN access. This is a method of
proving identity using two different authentication factors.
Authentication factors are something you know, something
you have, or something you are. Examples include a smart
card (something you have) with a PIN (something you
know); a biometric device (something you are) coupled with
a password (something you know); or a proximity card
(something you have) that activates a fingerprint reader
(something you are).
If you fail to plan, you plan to fail. Document your
implementation plan! You can’t simply find an open rack in
the data center, run a cable, plug in a device, and keep your
fingers crossed that it will work. Document your
implementation and support plans. You’ll learn more on this
later in the chapter.
Monitoring the availability of the VPN can be a lifesaver.
The typical (and worst) method to discover issues with your
VPN is when users start calling for help. This can be
particularly challenging when the callers include members
of your organization’s senior management team. A corollary
of Murphy’s Law may be, “The likelihood that a senior
management team member will be trying to access the
network over the VPN is directly proportional to the
likelihood that the VPN will fail.” It’s far better to alert senior
management to temporary problems than to be informed by
them that something isn’t working. Since VPNs are network
components, you can generally use the same monitoring
equipment that you use to monitor routers, switches, and
other network gear.
NOTE
Vendors can be very helpful when your equipment is
down. Many technical and information security
professionals believe they can fix anything, and
sometimes they will work on a problem for long hours
before finally reaching out to tech support. While tech
support can be problematic, especially when wading
through the first level of support, the vendor can be
invaluable when the problem is in the VPN equipment
or software.
Once you have your VPN deployed, regularly review
usage. If you notice there are employees who don’t use the
VPN, you may want to remove their access. If you see
employees who have multiple concurrent connections, you
may have a security issue, and should investigate further.
Back up your VPN configuration regularly. This is a good
practice for any network equipment, but in the event your
VPN hardware fails and needs replacement, you’ll want to
be able to restore your last known working configuration
quickly. Rebuilding a VPN configuration from the default
settings can be a long and challenging task— not to mention
making post-incident review meetings an unpleasant
experience.
Patch regularly. Vendors typically release patches and
updates to VPN code throughout the life of the product.
These patches address security issues, fix bugs, or provide
additional functionality. In an ideal environment, you will
have a development VPN that you can use to test patches
and updates. In most environments, however, you will not
have the luxury of a development VPN and will have to test
when you implement in production. In either circumstance,
work closely with your vendor to make sure you receive
prompt notice of patches and updates, and establish an
operational process and maintenance window to apply
patches and updates in a timely fashion.
Your VPN solution may end up being a critical component
of the organization’s business continuity planning and
disaster recovery planning. In the event of an incident that
prevents employees from getting to their work location, a
VPN that provides work-from-home support is a key
component of many recovery plans. Events such as
earthquakes, snowstorms, tornadoes, floods, and other
natural disasters can make working remotely a viable
alternative to standard operations.
This collection of VPN management best practices is
meant to serve as the starting point for your successful VPN
deployment. It’s not meant to be comprehensive, but
instead to offer some common practices and processes to
help you with your VPN deployment. Depending on your
VPN solution, your environment, your business
requirements, and your experiences, you may find that you
will use every one of these—or use only a few. The key is to
ensure that you are doing what works in your environment.
If you need help, don’t be afraid to reach out to your peers
for advice and suggestions. You will find, over time, that you
will develop your own set of best practices as you gain more
experience as a security practitioner, and soon others may
be asking you for advice.
Developing a VPN Policy
If you are implementing or supporting a VPN solution, use a
VPN policy to ensure your users understand the
requirements for computing on the VPN. A VPN policy is
sometimes called a remote access policy, a term used when
dial-up lines and modems were the primary means to
access the network remotely. Keep in mind that a VPN policy
should be a part of your overall policy framework, and not a
standalone. If you try to develop your VPN policy in isolation
from the overall policy framework, you may find that you
are duplicating information, or potentially writing VPN policy
that conflicts with other aspects of your overall policy
framework. For example, if you put a requirement in your
VPN policy that user passwords must be 10 characters long
and the password policy says they have to be eight
characters long, you will confuse end users.
The components of a solid VPN policy include:
Introduction—State the policy by name and tell how
it fits into the organization’s policy framework.
Purpose—Describe the issues the policy addresses
and how the policy should be used. Include references
to any applicable governance, risk, or compliance
issues, as well as any specific legal or regulatory
requirements supported by the document.
Scope/binding nature statement—Describe the
systems, networks, or people covered by the policy.
Describe penalties associated with not following the
policy. The phrase “disciplinary action up to and
including termination” is common in security policies.
Definitions/acronyms—Define technical terms or
acronyms used in the policy.
Document—Include the document creator, creation
date, version, document status (for example, draft,
template, policy, and guidelines), as well as any
version tracking information.
Policy—This is the actual policy language. Be very
clear in this section, leaving as little open to
interpretation as possible.
Optional elements
Summary—If your policy is very long, you may
want to summarize it in a bulleted list at either the
beginning or end of the policy. This provides
employees a quick method to check for policy
statements.
Roles and responsibilities—If your document is
lengthy, or you need to document who does what
under the policy, include roles and responsibilities.
For example, a policy dealing with infrastructure
might include roles for the system manager, system
architect, end user, developer, or other key people
within the organization.
Some specific topics to include in your VPN policy are:
Restrict remote access to the organization’s VPN
solution.
Prohibit split tunneling.
Define what classes of employee can access the
network by VPN. This could include regular employees,
vendors, contractors, and temps, or it could be
restricted to only home office workers, depending on
business requirements.
Define what types of VPN connections will be
permitted.
Define authentication methods permitted.
Prohibit sharing of VPN credentials.
List the configuration requirements for remote hosts,
including current virus protection, anti-malware, host-
based intrusion detection system (HIDS), and a
personal firewall. Some VPN solutions include the
ability to check for these types of configurations.
Prohibit the use of non-company equipment or, if
personal systems may connect to the VPN, define the
minimum standards for those connections.
Define required encryption levels for VPN connections.
If you will be using your VPN for network-to-network
connections, define the approval process and criteria
for establishing a network-to-network connection.
Have your policy reviewed and approved by your
communications, legal, and human resources departments
before release. Document the appropriate approvals in the
document status portion of the policy, then communicate
the policy to your employees. Posting the policy to an
information security or security policy intranet Web site is a
common practice. Once it’s available on the intranet, you
can use standard communications methods to make
employees aware of the policy requirements. These
methods can include e-mail, a structured awareness
program, inclusion in new-hire training, or even
FYI
Before selecting and purchasing a VPN solution,
consider a number of factors. One that is too frequently
ignored is the budget for the solution. Carefully
consider your criteria and evaluate your options,
always keeping in mind that you need to live within
your budget. When budgeting, be sure to look at not
only acquisition costs, but also the ongoing support
and maintenance costs for at least the first three
years.
Web-based or in-person policy training. The method you
select will be based on your organization’s size, locations,
and requirements. They key with any type of awareness
training is to structure your communications to the correct
audience. A group of engineers will require a very different
introduction to a technical policy than a sales team might.
These are just some of the factors in developing a VPN
policy for your organization. While they should form the
basis for the development of your organization’s policy, be
sure to cover all applicable requirements. One sure way to
alienate your employees is to release a policy that makes no
sense to them or that you have to revise too soon to cover
things you didn’t think of the first time through. Take your
time, consider all the requirements, and you will end up with
a usable VPN policy.
Developing a VPN Deployment Plan
Now that you have an understanding of best practices and
VPN policy, you’ll look at how to select, place, and use a
VPN.
Consider these criteria during your search:
What types of VPN connections does the solution
support (user access, site-to-site, or both)?
What encryption protocols are supported?
How many VPN connections are supported?
How well does the VPN perform compared with a high-
speed network?
How well does the VPN interoperate with your existing
network infrastructure?
What are the support options available from the
vendor?
How easy or difficult is the VPN to set up?
What are the management capabilities available with
the VPN?
What additional features does the VPN offer?
Does the VPN support failover or high availability
configurations?
How scalable is the VPN?
Once you have gathered this information, you can start to
narrow your selection based on how well these features
meet your criteria.
Next, consider where you will deploy the VPN on your
network. Three common architectures typically accompany
VPN solution deployments.
Bypass Deployment
A bypass architecture (Figure 11-1) deploys the VPN so that
traffic to the VPN and from the VPN to the internal network
is not firewalled in any way.
This was a common architecture when VPNs were first
introduced to the market. The logic behind this deployment
architecture is that the since the VPN will accept only
encrypted connections on a specific port, the security is
adequate without additional firewalling. An additional
consideration is that since the traffic is encrypted, it doesn’t
require additional protection. Even if you did place a firewall
on the Internet-facing VPN connection, the firewall would
not be able to analyze the encrypted VPN traffic. This
architecture also considers anyone connected to the VPN as
a trusted host. Finally, passing traffic across a firewall
always causes concerns about performance impacts, and
justifiably so.
Two significant issues arise with this implementation
model. First, VPNs are like any network device—they can
have a variety of vulnerabilities. As a result, they are still
vulnerable to an attack against the device itself. The second
issue is that the uses for VPN have expanded greatly since
the technology first appeared, and it’s not uncommon in
today’s environment to leverage a VPN to provide
untrustworthy hosts access to portions of the network.
These could be customers accessing an order management
portal, vendors supporting systems on the internal network,
or suppliers who are transferring invoices to your internal
systems. While some controls (usually routing table–related)
are available in most VPN solutions, terminating a VPN
directly on your internal network is a very dangerous
practice. As a result, the circumstances where a bypass VPN
architecture is still a viable solution are limited, unless your
risk tolerance is pretty high.
FIGURE 11-1
A bypass VPN implementation.
FIGURE 11-2
An internally connected VPN.
Internally Connected Deployment
An internally connected architecture (Figure 11-2) deploys
the VPN so that traffic to the VPN and from the VPN to the
internal network is not firewalled in any way.
An internally connected VPN architecture recognizes that
the VPN is vulnerable to attack if placed directly on the
Internet, so it places the Internet-facing VPN connection
behind a firewall. Selecting the appropriate firewall for this
solution is critical to a successful implementation. The VPN
then connects any remote users or site-to-site connections
directly to the internal network.
While this is an improvement over the bypass
architecture, it still doesn’t address the potential security
issues associated with untrustworthy VPN connections. This
architecture is not recommended, although it will work if the
only hosts connecting are trusted hosts.
DMZ-Based Implementation
A demilitarized zone (DMZ)–based implementation (Figure
11-3) addresses the main shortcomings of the previous two
architectures.
This architecture features a firewall in front of the VPN to
protect it from Internet-based attacks, as well as a firewall
behind to protect the internal network. The firewall on the
inside can be configured to protect important infrastructure
like finance department or research department servers,
restrict business partners to only the systems to which they
need access or even limit vendor access to only those
systems that they support.
The largest negative in this design is the cost of
deploying multiple firewalls for the implementation.
However, many companies already have DMZs set up in this
configuration, so it may be just a matter of leveraging the
existing infrastructure for your needs.
After selecting the ideal VPN and determining where
you’re going to place it in your infrastructure, it’s time to
work up your deployment plan.
Before you look at the components of a successful
deployment plan, keep in mind that your environment is
unique to your organization. Some elements you will read
about won’t apply to your deployment. These are, rather,
just some common elements found in most typical VPN
deployment plans. Just as with the other topics discussed
here, review these while thinking of the requirements of
your organization.
To deploy your VPN successfully, you need to:
Plan the physical location of the VPN. This is commonly
rack space in your data center.
Ensure your selected location meets power and
cooling requirements. Get information on power and
cooling requirements from your VPN’s technical
specifications.
NOTE
You can use a project management application to plan
your VPN rollout, or use something as simple as a word
processing or spreadsheet application. The purpose of
this plan is to allow you to structure your deployment
more formally than a plan written on the back of a
cocktail napkin.
FIGURE 11-3
A VPN implemented in a DMZ.
Plan your IP addressing for the external and internal
network connections on the VPN, as well as a pool(s)
of addresses assigned to clients when they connect to
the VPN. Plan for peak usage when assigning these
pools to the VPN. While an average number of users is
an excellent use benchmark, peak use determines the
maximum number of IP addresses to ensure that all
users can connect. If this is a site-to-site connection,
your IP addressing plan will not be as complex, but will
still be important when setting up the tunnel.
If you are using firewalls as discussed in the previous
section, plan the rules you’ll need on the firewalls to
permit the VPN to work. Generally, IPSec VPNs will
require UDP port 500 for the IKE packets and TCP port
443 for the IPSec traffic. SSL VPNs use port 443
exclusively. Most VPN rule sets permit ICMP packets
from the Internet. If you are experiencing issues with
the VPN, it’s frequently useful during troubleshooting
to determine if the user can reach the VPN server
using tools like ping or traceroute.
Configure the VPN server by setting up the IP address
pools, assigning IP addresses to the interfaces,
establishing your banner message, and disabling split
tunneling. It’s also a good idea to have the vendor
review your configuration before going live to ensure
you haven’t missed anything in your planning. In some
cases, you might even want to have the vendor install
the VPN for you while you concentrate on client
rollouts, policy communications, and other related
tasks.
Set up the authentication mechanism. Ideally, this will
be a token-based authentication solution, but it could
also be RADIUS-based authentication or, in some
smaller environments, user accounts set up on the
VPN itself.
Follow your organization’s change management
policies when deploying the VPN. If your organization
doesn’t have a formal change management process,
be sure to inform management of your planning
schedule to avoid surprises. The last thing you want is
to bring the VPN online during the same weekend the
accounting department is doing a major upgrade to
your organization’s financial systems. If there’s a
problem with their upgrade, you can count on at least
one person blaming it on your VPN rollout.
Once the VPN is up and on the network, create a pilot
group to test the deployment. Address any issues
before you roll out to a larger user pool. Minimize any
issues that employees might face with the new
solution. The best way to doom a new solution is to
deploy it with lots of problems. You may find some
employees will have a low tolerance for issues.
Develop your operations manual, which will document
the configuration, operations procedures, change
planning processes, and change history.
Develop your user documentation. Include how to
install the client (if a manual install is required), how to
log on, whom to call for support, frequently asked
questions, and any other information you think will
make the user’s experience with the VPN easier.
Develop your support processes. Who gets the first call
when there’s an issue? What is the escalation path if
the issue can’t be resolved?
Communicate the rollout plan to management and
affected employees. Let them know the timing,
benefits of the new solution, and anything else that
you believe will help you have a successful
deployment.
Install the VPN client for any remote access users. If
this is a site-to-site deployment, configure the tunnel
connection.
Distribute authentication credentials, tokens, and so
on.
Train your users.
Go live—and enjoy a successful VPN rollout.
You now should be able to select, plan, and successfully
deploy a VPN for your organization.
VPN Threats and Exploits
Consider the threats and attacks against your VPN, and how
to mitigate them. A VPN can be a critical component of your
information security infrastructure. A properly implemented
VPN addresses a number of common attacks against your
infrastructure, including eavesdropping, man-in-the-middle,
replay, and others. However, while your VPN can mitigate
attacks, it also opens up an entirely new set of security
issues.
Remember, VPNs are essentially network devices and
subject to many of the same security issues you would find
in a router or a switch. If you are running a software VPN,
then your VPN can have many of the issues you find on your
network’s servers.
A hardware VPN solution can suffer from a number of
security vulnerabilities, including:
Weak default password
Insecure default configuration or misconfiguration by
the installer
One of the most common and easily exploited vulnerabilities
on any hardware network device is the default password.
Vendors set an initial password on their equipment. Usually,
all it takes to discover this password is a quick search on the
Internet. Often, it’s not even particularly hard to guess. Try
the vendor name, “admin,” or “password,” and odds are
good that you’ll be able to log on. It seems like a sensible
mechanism—the vendor doesn’t want to distribute its
equipment without a password, so it sets a standard
password that’s easy for the installer to remember.
The potential problem occurs when the installer forgets
to change that password. It’s not uncommon for an installer
to leave the password in place for the duration of the
installation. Typing in “admin” after each reboot is much
easier than typing in “$$Th!s!sAS3cur3P@ssw0rd!!” every
time you make a change requiring a reboot. The problem
occurs when either the installer forgets to change the
password when the work is done, or an attack occurs while
the installer is in the middle of the installation.
Imagine the installer has a couple of additional settings
to change, but it’s 6:00 p.m. on a Friday and he’s ready for
the weekend. He decides to come in early Monday to finish
up the configuration. So for the entire weekend, the VPN
you’re counting on to provide secure access to your network
is on the Internet with the password “admin.” The best way
to address this type of vulnerability is through stringent
system configuration procedures and strong awareness
training for your support staff and contractors. Disciplinary
action when an installer fails to follow the instructions is
also remarkably effective at getting the message across.
The second common issue with hardware VPNs is a
device that is installed in the default configuration. Very few
network devices come out of the box in a fully secure
configuration. For example, an important configuration
setting is disabling split tunneling. A default VPN
configuration might not disable that setting without
modifying the configuration. If you are completing your first
install, it’s very tempting to just change enough of the
configuration to get the VPN up and running and stay away
from any unfamiliar settings.
A related issue occurs when an inexperienced installer
modifies the configuration without understanding the
impact of the changes. For example, an installer with a
limited understanding of encryption protocols might decide
that using the DES algorithm for VPN encryption would be
“good enough” and would improve performance over a
higher encryption algorithm like 3DES. The installer
probably read somewhere that the longer the key length
used for encryption, the higher the impact on performance.
This is often true, but longer key lengths usually mean more
secure communications. Installer-induced security threats
are some of the hardest to track down. Since they were
caused by someone with a limited understanding of what he
or she was doing, the installer’s ability to help you track
down the issues is equally limited.
To mitigate the risk of these issues, make sure that you
train your installer (or yourself) before installing the VPN. If
you do not have the time or justification for training on the
product, then engage a vendor or systems integrator to
assist with the install or even complete it for you. Once the
installation goes online, it pays to have an expert perform a
vulnerability or penetration test against your VPN. It never
hurts to have an expert check your work.
A software VPN solution can suffer from the following
vulnerabilities:
Operating system vulnerabilities
Operating system misconfiguration
Application conflicts
Instability
Viruses and malware
While software VPN solutions are not typical in corporate
environments, they are not uncommon in smaller
organizations, academic environments, and other areas
where a hardware VPN does not meet the business
requirements. The main threats to software VPN solutions
arise in the operating system. Operating systems like UNIX
or Microsoft Windows consist of highly complex coding. They
are designed to support a number of business-related tasks,
and are more highly complex than the operating systems
found on hardware-based VPNs. As a result, the software-
related threats can also be much more complex.
Operating systems contain millions of lines of software
code, and as with anything written by people, they always
contain mistakes. Those mistakes are what attackers seek
to exploit when attacking an operating system. Exploits may
include buffer overflows, privilege escalation, or any number
of other issues. As a result, if you run your VPN on a
general-purpose operating system, your VPN becomes
susceptible to the same software vulnerabilities as your
operating system. In addition, software VPNs have many
more possible operating system configuration errors than
hardware VPNs.
Some organizations run VPN software on a server that
supports multiple applications. For example, the VPN server
might also be a SQL server, a Web server, or a file server. If
this is the case in your environment, be aware of potential
vulnerabilities created by application conflicts. This could be
a matter of two applications that contend for resources on
the servers causing issues, but it could also be the chance
that one of the applications opens a new vulnerability in the
VPN software. Think about a VPN server that is also a Web
server. If the Web server is configured incorrectly, you could
expose VPN configuration files to an attacker through the
Web server interface. In that case, you could configure your
VPN server securely just to have an attacker pull a copy of
your configuration files out of a Web directory, bypassing
your security.
Another potential threat associated with software VPNs is
instability. Many information security professionals are
reluctant to run software VPNs due to the challenges of the
operating system crashing and taking the VPN with it. Many
security professionals wouldn’t ever want to run a VPN that
could be taken out by a “blue screen of death”—the
nickname for the Microsoft server crash screen.
Finally, operating systems are vulnerable to viruses and
other forms of malware. These would include Trojan horses,
rootkits, or any of the other destructive malware currently
active on the Internet. Any of these infections could
compromise the security of your VPN, as well as your
internal network.
If you are planning to run a software VPN, be sure to run
it on a dedicated server, double-check both the operating
system configuration and the VPN configuration, and keep
the operating system fully patched and up to date. When
your VPN is fully configured, run a vulnerability
management tool against it, or have a professional come in
and conduct a penetration test. Moreover, be sure to install
and maintain current antivirus and anti-malware software on
the server. It’s a good idea to install a firewall application
and an intrusion detection/prevention application to ensure
that your VPN remains secure.
Credential Sharing
Credential sharing is sharing a logon and password, or
other security credentials with others. A person may
share credentials with another authorized user such
as a boss, secretary, or coworker, or even with a
family member. A person may also share credentials
for reasons such as unofficial outsourcing all or a part
of his or her job, such as data entry or coding,
unbeknown to the employer. The practice doesn’t
necessarily result in compromising the system, but
often it does.
Vulnerabilities common to both hardware and software
VPN implementations include:
Denial of service attacks
Missing patches
Backdoor attacks
Unpublished vulnerability in the code
Weak client security
Weak authentication
Hairpinning
Credential sharing
In a denial of service (DoS) attack, the attacker is trying
to crash or overload the VPN, essentially to deny access to
the VPN service. Attackers use specially crafted packets
designed to crash the VPN or, more likely, direct a flood of
traffic at the VPN in an attempt to overload it. This is not a
very common attack because of the large amounts of traffic
required to overload most companies’ network
infrastructures. Generally, you will not see a VPN targeted
with a DoS, as attacks against VPNs are typically designed
to allow the attacker access to the internal network. DoS is
more common against popular Web sites like Twitter or
Facebook, where there is significant publicity, or against
online merchants, who are subject to blackmail. When your
Web site is a significant source of revenue, a DoS attack can
be very expensive.
Any hardware or software platform that can run VPN
software is vulnerable. That’s the nature of any computer
technology. When these vulnerabilities are discovered, the
vendor will typically develop a patch or an update to
address the issue. If you do not keep your VPN current, you
leave your network open to these issues, and attackers will
try to exploit known vulnerabilities with your VPN.
A backdoor account attack is pretty rare, but can happen
in some instances. An example of the traditional backdoor
attack was featured in the movie War Games, where the
system developer left a user account and password on a
secure system in case he needed to get back in. This
account was exploited by an attacker (in the movie, a kid
just looking to play games)—nearly causing the end of the
world. Needless to say, the issues in your environment will
not be quite as dramatic, but they are still of concern. Code
running on VPNs and operating systems is closely
scrutinized, so system developers are less likely to be a
threat, but what about a system administrator who thinks
he’s about to be fired? Or a vendor who comes in to support
your VPN and creates an account for support that he or she
forgets to delete before leaving? The best way to mitigate
this type of attack is through scheduled auditing of all
accounts on your VPN, as well as strong, documented
procedures for how and when accounts are created and
deleted. This particularly applies to accounts with elevated
privileges or on systems accessible from the Internet.
One of the trickiest (and fortunately rarest) security
threats is an unpublished vulnerability in the VPN code.
Researchers or potential attackers can discover an
unpublished vulnerability. If it’s unpublished, it means the
vendor is not yet aware of it, and thus has not yet
developed a patch or an update. These are probably the
most difficult threats you will face because there isn’t a lot
you can do beyond following security best practices,
creating a layered security environment, and monitoring the
behavior of your environment for anomalies. Should you
encounter this issue, be sure to follow your incident
response process and work with the vendor to identify the
issue and create a patch.
Another vulnerability is not directly on the VPN, but in the
devices connecting to the VPN. VPNs offer significant
security advantages, but if the client at the other end of the
connection is not secure, then your network is at risk. To
mitigate this risk, have a standard client configuration,
which includes antivirus, anti-malware, firewall, and maybe
even intrusion-detection software. Also make sure that the
only clients connecting to the VPN are company-owned.
Permitting personal assets to connect to your network opens
a number of additional issues, since you are not able to
supervise the configuration of those systems. All it takes is
one employee whose daughter clicks on the video link that
her friend sent her (generally with a comment like “check
out this video I took of you”), and you could end up with a
virus on your network when Dad connects to the VPN using
the same system.
A final vulnerability to consider is the challenge of weak
authentication. Your VPN is really only as secure as your
authentication mechanism. If you are authenticating via
user ID and password, you run the risk of someone guessing
or stealing those credentials and accessing your network
without permission. To mitigate this risk, rely on either
token-based or biometric authentication methods instead of
—or in addition to—a user ID and password. If you must use
a user ID and password for authentication, be sure to coach
users in the use of strong passwords.
A familiarity with the various threats, attacks, and
mitigations is critical to the long-term support of your VPN
and your total network. Be aware that no list of threats and
attacks can be all-inclusive because attackers are constantly
developing new methods for compromising your network. In
the absence of specific threats and attacks, rely on good
security practices to keep things safe.
Commercial or Open Source VPNs
When looking at VPN solutions, decide if you want to include
the option to leverage open source VPNs. If so, be aware of
some of the tradeoffs you will encounter when leveraging an
open source VPN product.
A commercial solution offers the following benefits:
Ease of installation and management
Available management tools
Access to vendor support
Available hardware maintenance
The benefits of an open source solution include the
following:
Low cost
Flexibility
Ability to run on existing hardware
Access to Internet-based support
Both commercial and open source solutions pose some
challenges. Commercial solutions are typically easier to
implement, but that ease of installation comes at a cost. Not
only are commercial solutions more expensive than open
source solutions, but also they are typically less flexible.
Open source solutions like OpenVPN (www.openvpn.net)
offer significant flexibility, but generally require significantly
higher skill in installation and support of the product. You
rarely have access to vendor support, as open source
solutions usually rely on the knowledge of the user and the
development community. When you have an issue, you can
normally post it on a discussion board, and the community
will assist you in resolving your issue.
While weighing the pros and cons of open source VPN
solutions, take into account a couple of other factors. First,
many organizations have policies about the use of open
source software. These policies derive from the company’s
tolerance for risk, the open source licensing agreements,
and intellectual property implications of open source. If your
organization embraces open source, an open source VPN is
probably worth considering.
The best VPN application still comes down to identifying
your requirements and finding the best solution for your
organization. If you’re on a low budget or have access to
solid technical resources, an open source solution could be
the best choice for your needs.
Differences Between Personal and
Enterprise VPNs
Much of the information in this chapter has dealt with VPNs
deployed in support of an enterprise or at least a midsized
or large network. Another class of VPN applications—the
personal or individual VPN—is sometimes referred to as the
small-office or home-office VPN solution. Many home routers
will include support for VPN connections, and open source
VPNs are also very popular in this space. Shrew Soft
(www.shrew.net) offers an open source VPN client that will
connect to many standards-based VPN gateways like
OpenSWAN (www.openswan.org). The value of these
personal VPNs is twofold. First, implementing a personal
VPN provides you secure access to your home network.
Even better, implementing a personal VPN provides you
with some valuable experience with VPNs that you can then
transfer to your organization’s enterprise VPN.
Balancing Anonymity and Privacy
A key concept to understand about VPN technologies is the
difference between anonymity and privacy. Anonymity is
the ability of a network or system user to remain unknown.
Tools that support anonymous access include Tor
(www.torproject.org), an open software and network to
anonymously surf the Web. A hardware solution that
leverages the Tor network for anonymity is JanusVM
(www.janusvm.com). The problem with solutions for
anonymity is that they don’t always protect your privacy. In
many cases, the traffic carried anonymously by these
applications is unencrypted, which means an attacker can
read it with access to the right part of the network. If you
are passing user IDs and passwords, credit card numbers, or
other information that you would like to keep private, these
are not the correct solutions for you.
Privacy, on the other hand, is keeping information about
a network or system user from being disclosed to
unauthorized people. If you want to protect your
information, a VPN connection does an excellent job of this
by encrypting the data that it carries. Leverage VPNs
whenever you are connected to an untrustworthy network
and want to send sensitive information. Wireless networks
are a particularly ripe environment for attackers trying to
get private information from a public network. VPNs do not
offer any anonymity, however, as you are always able to
track the endpoints of a VPN connection. That information is
needed to maintain the VPN connection.
Protecting VPN Security to Support
Availability
One of the design decisions you made when selecting your
VPN was whether you needed a highly available solution.
Once your users expect to access the network from a hotel,
from a customer location, from Starbucks, or from home
when they have a sick child, you will find they have little
tolerance for outages. A downed VPN means none of your
remote workers can do much work, and in some
organizations that can mean a majority of the company
could be off the network until the VPN is back up and
running. A highly available solution makes a lot of sense.
technical TIP
When considering VPN availability, don’t overlook the
little things. Put your VPNs in separate racks,
connected to separate power supplies. Nothing’s more
embarrassing than explaining to your manager that the
VPN was down for two hours because someone
accidentally switched off a power strip.
The most common method for implementing a highly
available VPN is pretty simple. You buy two VPN hardware
units (or implement two open source VPNs) and then
configure them as a highly available pair using the vendor’s
high-availability mechanisms. Cisco offers the Hot Standby
Router Protocol (HSRP), for example, which allows
configuration of a pair of Cisco VPNs so that in the event the
primary VPN fails, the backup takes over seamlessly. If
configured correctly, end users don’t even notice the
cutover. A more industry-standard protocol that offers
similar functionality is the Virtual Router Redundancy
Protocol (VRRP). You also have the option to use a third-
party solution. Many of today’s load balancers offer the
ability to load-balance VPNs. When one VPN fails, the load
balancer automatically directs all traffic to the remaining
gateway.
In addition to ensuring your VPN is highly available, also
ensure that your Internet circuits have similar redundancy.
You don’t want to end up with your VPN up and your one
Internet connection down. The net result is still unhappy
users who cannot access the network. In the event of circuit
outages, the user will typically need to reconnect to the
VPN. This is still better than not being able to connect at all.
When you are considering a highly available VPN
solution, be sure to consider not only the acquisition costs,
but also the ongoing maintenance costs over the following
three to five years. It’s important to capture the full cost of
the solution rather than just the purchase price.
The Importance of User Training
Now that your VPN is up and running, you must train your
users on how to use it. One of the most common challenges
with IT infrastructure deployments, especially with security
infrastructure like a VPN, is for the IT team to assume that,
since they understand how the solution works, their end
users understand it as well. That’s almost always a bad
assumption. It can turn a successful rollout into an
unsuccessful one.
To develop good user training, start by setting
appropriate training goals. One of the first mistakes security
practitioners make when developing training is jumping past
any planning and starting with taking screen shots, typing
up documentation, and scheduling meetings. However,
much like a successful VPN deployment, the first part of
successful training is planning. Determine the following
before designing your user training:
Who is your target audience for the training? Before
you start writing your training, understand who will be
learning.
What is the technical awareness level of your
audience? Are you training tech-savvy IT professionals,
or salespeople who just want to turn on their PCs and
start working?
Where is your audience? Is your audience in one
central location, or spread out regionally—or even
nationally? This will affect the choice of media you use
to train users.
What level of training are you trying to deliver? Will
users need to install the client software? Do you want
to include basic troubleshooting in the training? Are
you trying to sell features or do you just want to train
them on how to log on? Should you include additional
security issues in this training?
Once you gather the appropriate information, determine the
best mechanism for delivering the training. You may
distribute some written instructions, have a conference call,
or even hold a Web conference. For high-profile users, or
users who require significant support, hold classroom
training. If you decide to go with live training, definitely plan
to do additional information security training. After all, you
have their attention for the period of the training; you
should maximize the benefit not only to your users, but also
to your company. Remember that well-trained employees
tend to be the most secure computer network users.
Other things to keep in mind as you do user training:
Make sure your training plan includes how you will train new
employees. Will your training post to an intranet Web site or
load onto a DVD that new hires can watch? Will you offer
new-hire training at a regular interval to ensure everyone
understands how to use the VPN?
Finally, don’t forget your support staff. If a user with VPN
issues is supposed to call the help desk, make sure the help
desk knows how to help.
VPN Troubleshooting
To successfully troubleshoot and resolve VPN issues, you
must be organized, methodical, and prepared. Like anything
else on your network, your VPN at some point will
experience an issue. The preparations you undertake during
installation and maintenance will prove to be critical
components of your troubleshooting process.
Before you start troubleshooting your VPN issue, have
access to the following information:
A network diagram showing the placement of the VPN
and other key network components like firewalls,
routers, and switches
A copy of the current VPN configuration
Any error, system, or alert logs
An operations guide
Maintenance logs and change management records
technical TIP
When troubleshooting issues with a VPN, or any
network equipment, be sure to review all recent
changes to the environment, not just changes to the
VPN. An update to a DNS server, the replacement of a
router, or changes to IP addressing can affect your
VPN.
Now that you have your basic information, you can start
troubleshooting. There’s no one way to troubleshoot an
issue, particularly a VPN issue. What you can do is
determine what works best for you, and stick with that
process. Some people like to start at the far end and work
back to the local VPN server. Others will start at the network
level and work their way up to the application. The actual
process is not as critical as having an established process
and sticking with it. One way to tackle this process is the
following:
1. Identify the symptoms—Frequently, when
you are dealing with a user-reported issue, the
reported item will bear little resemblance to the
actual problem. Users tend to generalize with
statements like “No one can get on the VPN” or
“The intranet is down from the VPN.” You need more
specifics before you start correcting an issue.
Ideally, you will receive an automated alert from
your monitoring system, which generally permits
you to track down issues much more quickly than a
help desk ticket.
2. Determine the scope of the problem—Know
whether your problem is bigger than a breadbox or
a 747. Do you have one user who cannot connect,
100 users, or the entire company? Not only will this
help you get a handle on the urgency of the issue,
but it also gives you valuable clues to what the
problem might be. If it’s one user, the odds are
pretty good that it’s a client issue, or possibly a
network issue on the user’s end, and the help desk
can probably assist with the issue. If a large group
but not everyone is affected, you can look for
commonalities. Do all the users belong to the same
VPN group? Do they all connect from the same part
of the country (indicating it could be an ISP issue)? If
you have multiple VPNs, are the problems all on one
VPN?
3. Look for changes—Before you assume
something is broken, see if anything has changed. If
the issue is with a single user, did he or she install a
new application like Skype or Tor that could be
interfering with the VPN? If the VPN is unreachable
from the Internet, was someone working on your
Internet connection? Did you do a code upgrade
over the weekend? The importance of formal
change management is critical to successfully
maintaining a production computing environment.
When you are troubleshooting, determine what has
changed. Be aware that sometimes the toughest
part of chasing down change-related issues in a
complex environment is figuring out which of the 20
or 30 changes performed during a weekend change
window is causing your problem.
4. Call the vendor—It’s never a bad idea to call
the vendor and see if it has seen your issue before.
If you don’t have phone support with the vendor,
visit its Web site and check its knowledge base. The
Internet is an invaluable tool for helping with
troubleshooting.
5. Try the most likely solution—As the resident
expert, once you have gathered all the information
and reviewed the likely issues, try a fix. Record
these fixes not only in your operations guide, but
also in your change control process.
6. Test it—You made a change; test to see if it
worked. If not, back out the change you made and
repeat the previous step with the next most likely
fix. Repeat the process until the problem is solved.
Do not keep trying fix after fix without backing out
previous fixes; you could end up making so many
changes that you won’t be able to easily get back to
a stable configuration.
7. Check to see if you broke anything else—
This is a critical step. Changes to the environment—
even if you are trying to fix something—can have
unpredictable effects. The last thing you want is to
assume the problem is solved, just to get a call later
saying no one can get to the Internet.
8. Document, document, document—This is
probably the most important part of the process. If
you don’t write processes and procedures down, it’s
as if you didn’t even do them. When the next expert
comes along to troubleshoot and your changes
aren’t documented, he or she will have to start with
incorrect information or guesswork. And if you
encounter the same problem 12 months later, you’ll
be glad you can refer to your previous process to
speed up the second recovery. Create a section in
your operations guide just for this kind of
documentation.
Now that you have a general troubleshooting process,
consider some other things when troubleshooting a
situation:
Don’t panic—During a major outage, people tend to
panic. They will start sending e-mails to large
distribution lists, sending alerts, escalating issues, and
doing a variety of other things that are not particularly
helpful to you while you’re troubleshooting an issue.
Keep your cool, work on the problem at hand, and
keep management informed of the progress you make.
Don’t overcommit or make promises you can’t
keep—If you don’t know what the issue is, don’t tell
your manager that the network will be back up in an
hour.
Focus on the problem at hand—Getting sidetracked
when troubleshooting a complex issue is easy. Be sure
that the problem at hand is the one you are working to
address. If you identify other potential issues unrelated
to the current outage, document them and handle
them under your change control process. But don’t go
off on a tangent and delay addressing the immediate
issue.
NOTE
When you are troubleshooting a VPN issue,
management will often require frequent status
updates. The worst place for you to be when the VPN is
down is spending all your time on conference calls
fielding questions like, “When will it be fixed?”
Management needs to be educated to the concept that
things won’t be fixed until you get off the phone and
back to working on the problem.
You can do a couple of quick and easy tests if you are
having a major VPN outage and you just want to be sure
that your VPN is still on the network. Generally, your VPN
will have two interfaces. One will be accessible from the
Internet, and the other will be the connection to your
internal network (possibly through a firewall). In the event of
a major outage, start by verifying that both of those ports
are functioning.
To verify the internal port is available, you can use the
ping command from the Windows command prompt or from
a UNIX command line. See Figure 11-4 for an example of a
successful ping response.
Once you’ve validated the internal port, also validate the
external port. This is frequently a challenge because in most
organizations, a direct connection to outside the network is
not readily available. In some larger organizations, you may
have a DSL Internet connection dedicated for testing, but if
you don’t have that type of access, a number of Internet
sites will let you run network diagnostics from their Web
sites. See Figure 11-5 for a sample Internet traceroute
command from www.network-tools.com. If you do an
Internet search on “network tools,” you can find a number of
sites that offer a similar capability.
FIGURE 11-4
Troubleshooting a VPN issue using PING.
FIGURE 11-5
Using Internet-based traceroute tools to determine if your
VPN is accessible from the Internet.
You now have the tools to create your own
troubleshooting process for your VPN, using some or all of
the steps and tips discussed. You just need to determine
what works best in your environment. Be methodical, don’t
panic, keep focused on the issue, and you will be very
successful in quickly addressing VPN issues in your
environment.
CHAPTER SUMMARY
VPN management is a complex activity that requires
attention to detail and good documentation. A variety
of best practices may assist you in your VPN
deployment and ongoing support. Selecting and
deploying a VPN solution that meets your business
requirements is essential. This includes deciding
between open source and commercial VPN solutions
when selecting your product. Understanding the
threats, attacks, and mitigations and ensuring your
VPN is available are key components of success. In
addition, you must understand the difference
between privacy and anonymity, know the difference
between personal/individual and enterprise/network
solutions and, finally, be able to train your users well.
Once you have mastered all these facets of
successful VPN rollout and support, you’ll be ready to
move on to other security topics.
KEY CONCEPTS AND TERMS
Anonymity
Hairpinning
Service level agreement (SLA)
Slideware
Two-factor authentication
Vulnerability management
CHAPTER 11 ASSESSMENT
1. Which response contains the three most common VPN
deployment architectures?
A. Bypass, encrypted, OpenVPN
B. DMZ, OpenVPN, internally connected
C. DMZ, encrypted, OpenVPN
D. Encrypted, OpenVPN, internally connected
E. Bypass, DMZ, internally connected
2. All of the following are considered VPN management
best practices except:
A. If one is good, two is better.
B. Patch regularly.
C. Permit split tunneling.
D. Do not allow employee-owned computers to connect.
E. Review usage.
3. Three of the threats common to both software and
hardware VPNs include ________, ________, and ________.
4. The two different types of VPN commonly used for
remote access VPN are ________ and ________.
5. Pick two advantages of using an open source VPN
solution instead of a commercial solution.
A. Low cost
B. Good vendor support
C. Less installation and configuration time
D. Use of existing hardware
E. Ease of troubleshooting
6. The ability of a network or system user to remain
unknown to adversaries is ________.
7. Which of the following are benefits of using a
commercial VPN instead of an open source VPN
solution? (Multiple answers may be correct.)
A. More costly
B. Less flexible
C. Product support
D. Greater skill needed to deploy and support
E. Dedicated hardware
8. A document that details the requirements for using a
VPN is called a ________.
9. Which of the following are vulnerabilities common to
both software and hardware VPN solutions? (Multiple
answers may be correct.)
A. Default password
B. Unpublished vulnerability in the code
C. Weak client security
D. Weak authentication
E. Blue screen of death
10. Which of the following are components of a VPN policy?
(Multiple answers may be correct.)
A. Introduction
B. Scope
C. VPN configuration settings
D. Definitions
E. Backup strategy
11. Keeping information about a network or system user
from being disclosed to unauthorized people is known as
________.
12. Recognizing that vulnerabilities will be found with both
hardware and software VPNs, be sure to ________
frequently.
13. Which of the following are not VPN best practices?
(Multiple answers may be correct.)
A. Back up your configuration.
B. Pick the solution that gets the best reviews.
C. Don’t permit split tunneling.
D. Use vulnerability management.
E. Secure your endpoints.
14. The best authentication method for client VPNs is
________.
15. When protecting the availability of your VPN, it is a
good practice to have ________ VPN gateways in your
environment.
16. Which of the following are protocols that can be used
for high availability with VPNs? (Multiple answers may
be correct.)
A. IPSec
B. 3DES
C. HSRP
D. VRRP
E. SSL
17. If you want to verify that the VPN is on the network,
what is the simplest tool you can use?
A. Snort
B. Ping
C. Traceroute
D. VPN Monitor
E. Syslog
18. When troubleshooting a VPN issue, which of the
following are valid troubleshooting steps? (Multiple
answers may be correct.)
A. Don’t panic.
B. Gather the symptoms.
C. Run a vulnerability scan.
D. Review changes to the environment.
E. Upgrade the VPN software.
19. Your VPN policy should address which of the following
topics? (Multiple answers may be correct.)
A. Defining authentication methods permitted
B. Defining the VPN platform
C. Defining required encryption levels for VPN
connections
D. Defining the troubleshooting process
E. Defining how to respond to incidents
20. In addition to redundant VPNs, also make sure to have
redundant ________ for your VPN to be truly available.
CHAPTER
12 VPN Technologies
VIRTUAL PRIVATE NETWORK (VPN) is a general industry term that actually covers many different technologies. Ask
anyone who works in a large company and needs to access
a corporate network remotely and he or she will probably
confirm using a VPN to connect to the network and get to
his or her e-mail, intranet, and other corporate applications.
Ask him or her how that VPN works, however, and you will
almost always get a blank stare. End users are typically
interested only in the result of a solution, not in how it
works. For you, the information security practitioner,
however, just how a VPN works is as important as what
benefits a VPN provides your organization.
VPNs are deployed in a number of different ways,
leveraging a variety of technologies, platforms, and
protocols. Determining which VPN is the right fit for your
organization requires successfully gathering and
interpreting your business requirements. Once you’ve
documented those requirements, it’s up to you as the
security practitioner to understand the various options and
capabilities to fit the VPN technology to the appropriate
business requirements.
A variety of technical factors affect the selection and
installation a VPN solution. Some VPNs are available as
software installed on a workstation or a server. Other VPNs
are software components of other devices, like a router or a
firewall. Finally, dedicated VPN hardware appliances provide
secure remote connectivity.
A variety of underlying protocols can provide different
functions, features, and levels of encryption. When a vendor
starts talking about L2TP, IPv6, SSL and SSH, or IPSec, you’ll
need to speak the lingo and make the right technology
decision for your organization.
Finally, other infrastructure considerations you need to
take into account when working with VPN technologies
include how things like network address translation (NAT),
Internet Protocol (IP) version, and the use of virtualization
can affect how you deploy, maintain, and troubleshoot a
VPN.
Chapter 12 Topics
This chapter covers the following topics and
concepts:
What the differences are between software
and hardware solutions
What the differences are between Layer 2
and Layer 3 VPNs
What Internet Protocol Security (IPSec) is
What Layer 2 Tunneling Protocol (L2TP) is
What Secure Sockets Layer (SSL) and
Transport Layer Security (TLS) are
What the Secure Shell (SSH) protocol is
How to establish performance and stability
for VPNs
How to use VPNs with network address
translation (NAT)
What some types of virtualization are
What the differences are between Internet
Protocol (IP) versions 4 and 6
Chapter 12 Goals
When you complete this chapter, you will be able
to:
Contrast hardware and software VPN
solutions
Describe VPN protocols, their uses, their
features, and their problems
Explain the problem of using VPNs with NAT
Evaluate hardware VPN devices
Differences Between Software and
Hardware Solutions
A key topic in discussing VPN technologies is the differences
between software and hardware solutions. The following
definitions help reveal those differences:
Software VPN—Software-based VPNs are sold either
as part of a server operating system, as part of an
appliance operating system, or as a third-party add-on
software solution.
Hardware VPN—A hardware VPN is a standalone
device, dedicated to managing VPN functions such as
authentication, encapsulation, encryption, and
filtering.
NOTE
In the early days of VPNs, VPN software commonly ran
on a Windows or UNIX server. Today, server-based
implementations show up mostly in small
environments because of the poor scalability and
reliability of the operating system. Most software VPNs
act as a component of a firewall or router, not as an
add-on to a server.
While the functionality of software and hardware VPN
solutions is essentially the same, providing a secure remote
connection on demand points out some important
differences.
Software VPNs
When evaluating whether or not to deploy a software VPN,
consider two types of software VPNs:
Operating system–based VPN—An operating
system–based VPN solution is an application that runs
on a Windows or UNIX operating system. These are
generally used in smaller companies, as they tend to
be less scalable and less stable than other VPN
solutions. They are generally less expensive,
especially as they are running on a shared server,
which may be running other applications. Many of
these solutions are open source, which further reduces
the cost, although it can increase the complexity of
the solution.
One potential security issue with this solution is that
the server communicates with the public network
(generally the Internet) for the connections to occur.
Any time you connect a server and the associated
operating system to a public network, you increase the
security risk, since you are exposing it to a much
larger pool of attackers. You can mitigate this risk by
limiting the ports open to the server, and, if you are
doing just site-to-site VPN connections, you can
sometimes restrict the connections to specified IP
addresses. You can also add a firewall to the VPN
server, which adds to the overhead on the server, but
will provide additional protection to offset the
increased exposure.
Module-based VPN—A module-based VPN runs as a
component on a larger system. These are sometimes
included as part of the overall feature set, or in other
cases may require the purchase of additional licenses
to use the VPN. An example of this would be the VPN
capability included with many firewalls. Many routers
also offer this type of capability, which permits the
easy encryption of WAN links for security-conscious
companies. The benefit of this type of VPN solution is
reduced complexity of the environment, since you
have fewer discrete devices to manage. VPN modules
are also typically less expensive than hardware VPN
solutions. Some vendors also offer hardware
accelerators for improving overall performance of this
solution.
Hardware VPNs
Hardware VPNs are dedicated appliance-based solutions,
generally based on a router-type platform. Hardware VPNs
are the most common type of VPN deployed in corporations
today. While hardware VPNs can be complex to deploy, they
are typically more scalable than their software counterparts,
and can be easily deployed in a redundant manner.
Hardware VPNs can increase the complexity of an
environment, because you are deploying additional
equipment. The good news is that you can usually manage
this additional hardware with the same types of network
management tools you use to manage the routers and
switches in an environment.
Hardware VPNs can create some security issues, largely
related to potential vulnerabilities in the VPN software code
on the appliance itself. A number of security alerts related to
VPN vulnerabilities have appeared in recent years.
Fortunately, you can manage this issue fairly easily by
keeping current on your vendor’s security alerts and by
upgrading VPN code in a timely fashion. A good rule of
thumb is to run the N21 version of code, where N is the
current version of code, unless a known issue with that
previous version of the code has been published.
Ultimately, the requirements of your business will drive
your selection of a software or hardware VPN. The good
news is that many options are available to you in your
search for the best solution.
NOTE
You must make a risk-based decision on whether to
accept the possibility of undiscovered bugs in a new
version of hardware or to live with the known bugs in a
previous version. If an upgrade is issued primarily for
fixing security flaws, you may be better off with the
new version, surprises and all.
Differences Between Layer 2 and
Layer 3 VPNs
One distinguishing component of current VPNs is that they
use a variety of transport protocols to establish their
connections. This is helpful not only because the protocols
have different capabilities, encryption strengths, and
authentication mechanisms, but they also can run at
different layers of the Open Systems Interconnection (OSI)
Reference Model. The OSI model is the standard seven-layer
conceptual tool that describes protocols and their functions.
Each layer communicates with its peer layer on the other
end of a communication session. While the OSI model is
helpful in discussing protocols, most protocols are not in full
compliance with it.
In the case of VPNs, the protocols used by the vast
majority of solutions work at Layers 2 and 3 of the OSI
model.
Layer 2 of the OSI model is the Data Link Layer. The Data
Link Layer is the protocol layer that transfers data between
adjacent network nodes. In the case of a VPN, this protocol
transfers data from one VPN endpoint to the other.
An example of a protocol that communicates using Layer
2 would be Layer 2 Transport Protocol (L2TP).
Layer 3 of the OSI model is the Network Layer. The
Network Layer is responsible for end-to-end packet delivery
and includes the ability to route packets through
intermediate hosts.
An example of a VPN protocol that communicates at
Layer 3 is IPSec.
technical TIP
SSL/TLS and SSH are protocols that operate at Layer 7
of the OSI model, the Application Layer.
technical TIP
An RFC is a request for comments. These “requests”
are published by the Internet Engineering Task
Force (IETF). The IETF is the standards body for
Internet-related engineering specifications. The IETF
uses RFCs as a mechanism to define Internet-related
standards. (See www.ietf.org for more information.)
Internet Protocol Security (IPSec)
Internet Protocol Security (IPSec) is a standards-based
protocol suite designed specifically for securing Internet
Protocol (IP) communications. IPSec authenticates and
encrypts each IP packet in an IP data stream. In addition,
IPSec has protocols that can establish mutual authentication
and cryptographic key negotiation during a session. IPSec
operates at the Network Layer of the OSI model.
The IPSec standard utilizes three major components:
Authentication Header (AH)
Encapsulating Security Payload (ESP)
Internet Key Exchange (IKE)
Authentication Header (AH) provides integrity protection
for packet headers and data, as well as user authentication.
It can optionally provide replay protection and access
protection. AH cannot encrypt any portion of a packet. In the
initial version of IPSec, the ESP protocol could provide only
encryption, not authentication, so AH and ESP were often
used together to provide both confidentiality and integrity
protection for communications. Because authentication
capabilities were added to ESP in the second version of
IPSec, AH has become less significant; in fact, some IPSec
software no longer supports AH. However, AH is still of value
because AH can authenticate portions of packets that ESP
cannot. Also, many existing IPSec implementations use AH.
Encapsulating Security Payload (ESP) is the second
core IPSec security protocol. In the initial version of IPSec,
ESP provided only encryption for packet payload data.
Integrity protection was provided by the AH protocol if
needed. In the second version of IPSec, ESP became more
flexible. It can perform authentication to provide integrity
protection, although not for the outermost IP header.
technical TIP
Why does the layer matter? Because IPSec operates at
Layer 3 of the OSI model, it can encrypt any traffic in
Layers 4 through 7 of the OSI model. That means IPSec
can be used to encrypt any application traffic.
Therefore, in all but the oldest IPSec implementations, ESP
can provide encryption only, encryption and integrity
protection, or integrity protection only. This chapter mainly
addresses the features and characteristics of the second
version of ESP.
NOTE
IPSec supports the Data Encryption Standard (DES), a
56-bit encryption protocol, and 3DES (data is
encrypted three times using DES), which effectively
yields a 168-bit encryption protocol.
Internet Key Exchange (IKE) negotiates, creates, and
manages security associations. Security association (SA) is
a generic term for a set of values that define the IPSec
features and protections applied to a connection. You can
also create SAs manually, using values agreed upon in
advance by both parties, but because these SAs cannot be
updated, this method does not scale for real-life large-scale
VPNs. In IPSec, IKE provides a secure mechanism for
establishing IPSec-protected connections.
IPSec supports two different modes:
Transport mode (host-to-host)—In transport mode,
only the data packet payload is encapsulated, while
the packet header is left intact. In this mode, the
destination host decapsulates the packet. This is the
mode used in a Microsoft Windows environment to
secure a client-to-server connection using IPSec.
Tunnel mode (gateway-to-gateway or gateway-
to-host)—In tunnel mode, the IP packet is entirely
encapsulated and given a new header. The
host/gateway specified in the new IP header
decapsulates the packet. This is the mode used to
secure traffic for a remote access VPN connection from
the remote host to the VPN concentrator on the
internal network. (A VPN concentrator decrypts
information coming from a remote user over the
Internet, and encrypts information sent back over the
Internet to the remote user.)
IPSec is a little different from some of the other protocols. It
provides high-quality, interoperable, cryptographically
based security for IPv4 and IPv6. As a result, the protocol
supports a comprehensive set of security services,
including:
Access control
Connectionless data integrity checking
Data origin authentication
Replay detection and rejection
Confidentiality using encryption
Traffic flow confidentiality
IPSec-based VPNs have been the dominant VPN platform for
many years, although in recent years SSL-based VPNs have
been making significant inroads. IPSec is so popular for
three reasons:
It supports all operating system platforms.
It provides secure, node-on-the-network connectivity.
It offers a standards-based solution, permitting easier
interoperability between different devices and
vendors.
For more information on IPSec, see
http://tools.ietf.org/html/rfc4301. While RFC 4301 provides
the main IPSec standard definitions, separate RFCs exist for
some IPSec features. The full set of RFCs defines the entire
standard.
Layer 2 Tunneling Protocol (L2TP)
Layer 2 Tunneling Protocol (L2TP) is an older protocol
largely replaced by IPSec and SSL/TLS-based VPNs in
production environments. You will still encounter references
to the protocol in current VPN literature, however, and it
may still be in use in some older environments, where
backward compatibility could still be an issue. L2TP was
used extensively in early VPN solutions but lost its
popularity as other protocols proved to be more usable as
industry standards developed.
L2TP is a combination of the best features of Point-to-
Point Tunneling Protocol (PPTP), a Microsoft proprietary
protocol, and the Layer 2 Forwarding (L2F) Protocol,
which was an early competing protocol for PPTP, developed
by Cisco Systems. Like PPTP, L2TP was an extension of
Point-to-Point Protocol (PPP) to allow PPP to be tunneled
through an IP network. L2TP support was first included in a
Microsoft server product with the release of Windows 2000
Server. Prior to Windows 2000, PPTP was the only supported
protocol. A number of hardware VPN vendors, including
Cisco, also supported it.
One of the challenges with L2TP is that it only provides a
mechanism for creating tunnels through an IP network. It
doesn’t provide a mechanism for encrypting the data being
tunneled. As a result, L2TP was typically used in conjunction
with IPSec protocol’s ESP for encryption. For this reason, you
may sometimes see L2TP referred to as L2TP/IPSec.
RFC 3193 defines the use of IPSec to secure an L2TP
implementation.
For more information on L2TP, see
http://tools.ietf.org/html/rfc2661. While RFC 2661 provides
the main L2TP standard definitions, separate RFCs for some
other implementations and features exist. The full set of
RFCs defines the entire standard.
Remember that you may never encounter L2TP in a
production environment, but you should know the basic
aspects of this protocol when looking at tunneling and VPN
protocols in general.
technical TIP
PPP was defined in the late 1990s to provide a
standard transport mechanism for point-to-point data
connections. This was used largely in conjunction with
modem connections and has been phased out as high-
speed Internet connections have replaced modem
connections.
Secure Sockets Layer (SSL)/Transport
Layer Security (TLS)
One of the key VPN protocols today is SSL/TLS, which is the
main alternative for a VPN solution if you don’t want to
leverage an IPSec solution. However, before you consider
this protocol in conjunction with VPNs, it’s important to
understand the origin of this protocol.
If you have ever surfed the World Wide Web, you have
used the Hypertext Transfer Protocol (HTTP) to connect to a
Web site. One of the drawbacks of HTTP is that is does not
include the ability to encrypt or otherwise protect the data
stream between the client and server. This wasn’t an issue
until the early 1990s, when the need to protect against
eavesdropping on communications became critical to the
ultimate success of the World Wide Web. While several
technologies have addressed this need, one solution has
rapidly become the industry standard: Secure Sockets Layer
(SSL).
HTTPS is the Web protocol that utilizes SSL to encrypt
HTTP, and is used worldwide today for secure Web
communications. (See Figure 12-1.)
NOTE
SSL supports 128-bit encryption, while TLS supports
the Advanced Encryption Standard (AES) with keys up
to 256 bits.
FIGURE 12-1
A secure browser session using SSL. Note the “https” in the
address bar.
FIGURE 12-2
A certificate used to authenticate a server in an HTTPS
connection.
SSL was originally proposed as a standard by Netscape.
Version 1.0 had serious security flaws, which were corrected
in versions 2.0 and 3.0. As this protocol has become more
widely used, it has been formalized in the IETF standard
known as Transport Layer Security (TLS). The SSL/TLS
protocol provides a method for secure client/server
communications across a network. SSL/TLS prevents
eavesdropping and tampering with data in transit. SSL/TLS
also provides endpoint authentication and communications
confidentiality through encryption.
In typical end user/browser usage, SSL/TLS
authentication is one-way. Only the server is authenticated
when the client compares the information entered to access
a server to information on the SSL certificate on the server.
The client knows the server’s identity, but not vice versa;
the client remains unauthenticated or anonymous. See
Figure 12-2 for an example of the information in a server
certificate.
technical TIP
The terms SSL and TLS sometimes confuse people. In
practical terms, they are the same thing. While the
IETF standard refers to the protocol as TLS, the
industry still uses the acronym SSL when referring to
the protocol used to secure browser communications.
FYI
While SSL/TLS is supposed to authenticate servers, it
hasn’t been as robust as originally planned. Phishing
attacks—that is, attacks that direct a user’s browser to
a counterfeit Web site—are a major problem for
security professionals. Users typically do not check to
see if a site is encrypted or if the certificate information
matches their destination Web site. Newer versions of
browsers check encryption status for the user and warn
of a mismatch between a certificate and the domain
presenting it.
SSL/TLS can also perform bidirectional authentication by
using client-based certificates. This is particularly helpful
when using this protocol to access a protected network, as it
adds a layer of authentication to the access.
SSL/TLS and VPNs
As you learned in the section on IPSec, a VPN creates a
secure tunnel through a public network like the Internet.
While SSL VPNs still leverage the concept of tunneling, they
create their tunnels differently than IPSec. An SSL VPN
establishes connectivity using the SSL protocol. IPSec works
at Layer 3 of the OSI model, while SSH functions at Layers 4
and 5. SSL VPNs can also encapsulate information at Layers
6 and 7, which makes SSL VPNs some of the most flexible
available.
On additional function of an SSL VPN is that it usually
connects using a Web browser, whereas an IPSec VPN
generally requires client software on the remote system.
SSL VPNs create predominantly remote access VPN
connections, where a client connects to applications on an
internal network. This is different from a site-to-site
connection, where two gateways connect disparate private
networks across the Internet.
SSL/TLS VPNs benefits over IPSec VPNs include:
Less expense—Since an SSL VPN is typically
clientless, you don’t have the costs of rolling out,
supporting, and updating client software.
Platform independence—Since the access to an SSL
VPN comes through the standard SSL interface, which
is a component of virtually every Web browser,
virtually any OS that runs a browser is supported.
While the operating system (OS) support for VPN
clients is good for common OSs, a significant lag can
exist in client development following the release of a
new OS or the release of a new client version. You may
see a Windows client 90 to 180 days earlier than the
Mac version.
Client flexibility—As a general rule, IPSec clients are
installed only on corporate systems. Due to the
additional configuration flexibility, SSL VPNs allow
access from a variety of clients, including corporate
systems, home systems, customer or supplier
systems, or even a kiosk machine in a library or an
Internet café. This wider accessibility tends to increase
employee satisfaction with the technology.
No problems with network address translation
(NAT)—Historically, NAT caused issues with IPSec
VPNs. As a result, virtually all IPSec vendors have
created workarounds. With an SSL VPN, you don’t have
these issues because SSL works at a higher layer than
IPSec and, as a result, is not affected by NAT.
Granular access control—This is a benefit or a
drawback, depending on your environment. SSL VPNs
require a greater granularity of access than a typical
IPSec VPN because instead of creating a tunnel from
the host to the internal network, SSL VPNs require
explicit definition of each resource accessed. The
upside is that, unless you have defined it explicitly, an
SSL VPN user cannot access the resource. Although
this barrier has significant security benefits, in a
complex environment, this could add significant
overhead to your VPN support.
Fewer firewall rules required—To access an IPSec
gateway across a firewall, you need to open several
ports to support the individual protocols for
authentication and the tunnel. With an SSL VPN, you
need to open only port 443, which is easy because of
the prevalence of the HTTPS protocol.
For more information on TLS, see
http://tools.ietf.org/html/rfc5246.
Secure Shell (SSH) Protocol
The Secure Shell (SSH) protocol is a method for secure
remote logon and other secure network services over a
public network such as the Internet. SSH services a number
of applications across multiple platforms including UNIX,
Microsoft Windows, Apple Mac, and Linux.
You can use SSH:
For logon to a shell on a remote host, replacing telnet
and rlogin (see Figure 12-3 for an example of an
application that uses SSH for this application)
For executing a single command on a remote host,
replacing rsh
For file transfers to a remote host
In combination with rsync to back up, copy, and mirror
files securely
In conjunction with the OpenSSH server and client to
create a full VPN connection
The SSH protocol consists of three major components:
Transport Layer Protocol, which provides server
authentication, confidentiality, and integrity with
perfect forward secrecy
User Authentication Protocol, which authenticates the
client to the server
Connection Protocol, which multiplexes the encrypted
tunnel into several logical channels
For more information on SSH, see
http://tools.ietf.org/html/rfc4251.
FIGURE 12-3
PuTTY is an application that leverages SSH to provide secure
connections to hosts.
Establishing Performance and
Stability for VPNs
Now that you have an in-depth understanding of the many
options available to you for VPNs as well as other secure
access protocols, it’s time to discuss some of the challenges
you might encounter when supporting your VPN. For your
VPN rollout to be successful, consider two factors:
performance and stability.
Performance
Some critical factors can affect the performance of your
VPN:
VPN type—When considering the performance of your
VPN, consider the type of VPN you’ve chosen. The
performance characteristics of a VPN supporting
remote clients can be very different from the
performance characteristics of a VPN supporting site-
to-site connections, or even a mixture of remote
clients and site-to-site connections.
Protocol—The performance characteristics associated
with an IPSec VPN can be very different from what you
may find with an SSL VPN implementation. How you
apply IPSec and SSL/TLS in a VPN solution can affect
your VPN’s performance. Validating the performance
specifications of the solution before you roll out should
allow you to address any performance issues
associated with the protocol startup.
Load—The number of remote access or site-to-site
VPNs will affect the overall performance of your VPN
rollout. The challenge in addressing this issue,
particularly in an environment supporting a large pool
of remote clients, is that the performance issues will
tend to crop up during peak use. To appropriately
diagnose these issues, you’ll need to be able to report
on use in a way that tracks the peaks. Many of the
current reporting tools available for VPNs tend to show
averages over time, which can hide peaks and valleys
in your use numbers. Be sure you fully understand
these performance reports.
Client configuration—In a remote VPN connection,
much of the performance is actually related to the
client’s capabilities. If the remote client is running on
old hardware with limited memory and an
underpowered processor, the overhead associated
with encrypting the traffic will affect performance of
the VPN connection. Another factor contributing to
overhead is what else is being done with the remote
PC. If the user is running a memory-intensive
application such a photo editing suite, you may find
that this resource impact reduces the performance of
the VPN.
NOTE
Don’t forget time-of-day considerations when
investigating load-related performance issues. You will
generally find your peak times for VPN use will be first
thing in the morning, as employees get started for the
day; after lunch, when everyone comes back from the
break; and at the end of the business day. If
performance issues arise, be sure to note the times of
day to help correlate the data and identify root causes
or at least common factors.
Bandwidth—The bandwidth available to your VPN can
have a significant impact on its performance and can
vary widely among the remote hosts and gateways. If
your VPN is supporting site-to-site VPNs connecting
two locations, the bandwidth allocated at either (or
both) ends of the connection may affect performance.
You may find, for example, that an unreliable DSL
connection at a remote client location creates
unacceptable delays for the user.
Topology—Depending on the location of your VPN
endpoints, the topology may affect performance. For
example, if your VPN connection has to traverse a
firewall or a proxy server, you may find reduced
performance depending on how well those devices
handle the VPN traffic.
Encryption level—The higher the encryption level,
the greater the impact on the memory and processor
of the endpoint devices. That being said, you should
always run the highest encryption available. If you
suspect encryption is causing performance issues, you
can look into either a dedicated processor for handling
encryption or upgrading the processing capabilities of
the central processor.
Traffic—An issue related to bandwidth is traffic loads.
If, for example, the sales department likes to watch
streaming video baseball games on Wednesday
afternoon, and you have VPN performance issues
during that time, increasing bandwidth may fix the
problem, but does not really address the root cause,
which is a traffic spike rather than too little bandwidth.
To diagnose a performance issue related to traffic,
devise some way to look at the traffic on your network.
Another facet of this issue is what the traffic load looks
like across the VPN. Do your remote users store their
documents on servers in the core network? If you are
running your VPN with split tunneling disabled, are
remote users doing Web browsing through the VPN
connection? Optimizing traffic both within the VPN as
well as outside network traffic can go a long way to
ensuring you don’t encounter performance issues.
Client version—Sometimes, the version of the client
can affect performance. Managing older versions on
remote devices can be very difficult depending on how
your organization manages those devices. Keep your
clients up to date, and you should be able to avoid any
performance issues related to client versions.
Stability
To ensure a successful VPN deployment, the implementation
must be stable. Some factors that can affect VPN stability
include:
Configuration—Ultimately, how you configure your
VPN will have a major impact on your VPN
deployment. Not only should you check your internal
VPN configuration, but also factor stability into your
initial design. If access to the network through the VPN
is mission-critical, you should ensure you use a
configuration that includes some level of high
availability or failover.
Location—Consider where you have placed your VPN
in the network. If the VPN connection has to traverse
three firewalls, multiple local routers, and a proxy
server, you may find that the connections are not as
stable as you need them to be.
Software version—The version of VPN software (or in
the case of a hardware VPN, the concentrator code)
can have a significant impact on the stability of your
rollout. Be sure to keep your VPN software up to date.
Updating too quickly can also be a source of stability
issues, so a good rule of thumb is to keep your
software version one less than the latest version
number of the VPN software. That model allows you to
keep your VPN relatively current, so you avoid any
issues contained in older versions of code, but also
keeps you from being the vendor’s beta tester for new
code, which is never a good idea in a production
environment.
Underlying OS—The OS on which you run your VPN
can definitely affect the stability of your VPN
implementation. A VPN running on an old Windows
operating system might have issues with the dreaded
blue screen of death. A hardware-based VPN could run
into challenges if there are firmware or OS issues,
although those problems are typically less common
than with an OS-based solution. The number of lines of
software code needed to run a hardware VPN are quite
a bit less than the current OS coding. The leaner the
software, the less risk you run of issues with the OS.
While these lists contains many of the most common
sources of performance issues you may encounter, be sure
to reference your troubleshooting processes and procedures
when diagnosing VPN performance and stability issues.
Using VPNs with Network Address
Translation (NAT)
VPNs and network address translation (NAT) have
historically suffered from some conflicts when used
together. NAT is an Internet standard that allows you to use
one set of IP addresses on your internal LAN and a second
set of IP addresses for the Internet connection. A device
(usually a router or firewall) stands between the two
connections and provides NAT services, managing the
translation of internal addresses to external addresses. This
allows companies to use large numbers of unregistered
internal addresses while needing only a fraction of that
number of addresses on the Internet, thus conserving the
addresses. This is similar to a company that may have
hundreds of phones in a building but pays for only a small
number of connections to the phone switch, as it is unlikely
that every employee would pick up the phone at the exact
same time.
NAT was created as a workaround to IP addressing
issues. Since the Internet relies on the TCP/IP protocol for
communications, it also relies on the IPv4 addressing that is
an integral part of the TCP/IP protocol suite. The explosive
growth of the Internet threatened to exhaust the pool of
IPv4 IP addresses. Without unique addresses, the Internet
would be unable to successfully route TCP/IP traffic. This was
clearly unacceptable because the Internet was fueling the
explosive growth of many businesses. As a result, NAT was
proposed and adopted widely as a way to conserve critical
IPv4 addresses.
In the early days of the Internet, when IP addressing was
being created, developers believed the 32-bit addressing
scheme (known as IPv4) to be more than adequate for any
potential network growth. Theoretically 4,294,967,296
unique addresses were available using 32-bit addressing
and, even discounting the reserved ranges, more than 3
billion addresses were possible. At the time, that was
enough addresses to provide one for every person on the
planet.
Unfortunately, the designers of the addressing scheme
dramatically underestimated the explosive growth of the
Internet, as well as the popularity of TCP/IP in business and
home networks. There are no longer enough addresses to
go around. IPv6 is contains an addressing scheme that
allows for a dramatically larger pool of addresses, but is
receiving very limited deployment in corporate networks
and on the Internet today. This is due in large part to the use
of NAT. For more information on NAT, see RFC 3022 at
http://tools.ietf.org/html/rfc3022.
Two main types of NAT are available:
Static NAT—This version of NAT maps an unregistered
IP address on the private network to a registered IP
address on the public network on a one-to-one basis.
This is used when the translated device needs to be
accessible from the public network. For example, a
Web server on your private network might have an
unregistered address of 10.10.10.10, but a NAT
address of 12.2.2.123. A user trying to connect to that
Web site can enter 12.2.2.123, and the router or
firewall at the other end will translate that address to
10.10.10.10 when the packet reaches it.
Dynamic NAT—This version of NAT maps an
unregistered IP address to a registered IP address from
a group of registered IP addresses. This is more
commonly used when large pools of systems on the
internal network need to access the Internet and don’t
have a requirement for a static address. The
workstation’s address is translated to the next
available registered address as soon as it initiates a
connection to the public network.
The critical thing to remember about NAT is that due to
limitations in the IPSec standard, IPSec has issues traversing
a translated network. VPN vendors have addressed this
issue, but the workaround they have put in place can create
challenges for troubleshooters. If possible, run your IPSec
VPNs on untranslated addresses or deploy an SSL VPN.
Because SSL runs at a higher level in the OSI model, it’s not
affected by NAT.
NAT traversal is a general term for techniques that
establish and maintain TCP/IP network and/or UDP
connections traversing NAT gateways.
For IPSec to work through NAT, configure the firewall to
permit the following protocols and ports:
Internet Key Exchange (IKE)—User Datagram
Protocol (UDP) port 500
Encapsulating Security Payload (ESP)—IP protocol
number 50
Authentication Header (AH)—IP protocol number
51
Types of Virtualization
A number of definitions and types of virtualization are
available to businesses today. Operating system
virtualization is the emulation of an operating system
environment hosted on another operating system. A virtual
machine exists logically, but does not have an associated
dedicated physical device. Thus, a single physical machine
can host multiple virtual machines. Virtualization of storage
allows a storage manager to abstract the underlying
physical storage technologies and manage storage at a
logical level. Network virtualization allows you to run
multiple logical switches within a single physical switch
chassis. Some SSL VPNs support VPN virtualization.
All of these technologies can potentially affect your VPN
environment.
Desktop Virtualization
Desktop virtualization (sometimes called client
virtualization) is a concept that separates the personal
computer desktop environment from the physical desktop
machine by using a client/server model of computing. This
model is reminiscent of the thin client client/server
architectures of years ago, where the operating system was
run centrally. This generation of the model offers
significantly more business benefits. A virtualized desktop is
hosted on a remote central server instead of on the local
hardware of the remote client. This allows users to work
from their remote desktop client, while all of the programs,
applications, processes, and data used are kept and run
centrally.
This has an immediate impact on your VPN in ensuring
the compatibility of your VPN client with the virtualized
desktop. The possibility always exists that the virtualization
of the client might cause issues with the client or complicate
troubleshooting of any issues with the VPN. The best
approach to working in a virtualized desktop environment is
to test your VPN applications carefully before the virtual
implementation goes into production.
Another issue that can come up in conjunction with the
VPN is how you publish the virtual desktop to a remote
client that is not connected to the network. One model
would be to make the VPN connection first, then publish the
virtual desktop across the VPN connection. This is an
environment that lends itself well to SSL VPNs, due to the
lack of dedicated client software. With an IPSec VPN
deployment, you need to get a working VPN client on the
remote desktops before publishing the virtual desktop,
adding to the complexity of your VPN environment. The
other model is to publish the virtual desktops natively from
a DMZ environment across the Internet, and then connect
back to the network via VPN, publishing the VPN client (if
using IPSec) as part of the virtual desktop image.
Some limitations of desktop virtualization include:
Additional security risks associated with the complex
network and desktop image environments used when
working with remote virtual desktops.
Loss of employee privacy as all storage and processing
is centralized.
Maintaining your VPN clients in the virtual images.
Increased downtime in the event of network failures.
Outages can also affect a greater number of
employees.
The concept of virtualization is becoming more popular
among enterprise customers. For SSL VPNs, the need for
virtualization is natural. Enterprises like to provide different
remote access VPN presences to different user groups, such
as partners and different departments of employees. The
following section covers some of the basic capabilities you
should consider for a “virtualized” SSL VPN deployment.
SSL VPN Virtualization
Virtualized SSL VPNs provide a unique virtual VPN
configuration for each individual user group. Much like other
types of virtualization, a virtualized SSL VPN allows you to
separate the physical and logical sides of the VPN.
Some benefits of a virtualized SSL VPN environment
include:
Greater flexibility—A virtualized SSL VPN gives you
the ability to create custom authentication methods
and VPN group policies for different user groups.
Delegation of management—Virtual VPNs allows
the delegation of management roles for each virtual
instance. If one virtual VPN instance allows a business
partner to connect to an internal application, the
management of that virtual VPN can go to someone
supporting that business partner.
Added security when working in a multigroup
environment—Virtual VPNs provide a total logical
separation of the VPN’s instances in terms of system
resources, routing tables, user databases, and policy
management interfaces.
The use of virtualized VPNs is especially attractive to
companies that provide VPNs as a service. Being able to
create completely separate environments and resource
pools is critical to a successful service provider. Setting up
dedicated hardware environments for each customer does
not allow a service provider to take advantage of the
economies of scale offered by a single implementation.
Differences Between Internet
Protocol Version 4 (IPv4) and Internet
Protocol Version 6 (IPv6)
One of the critical topics associated with today’s VPN
implementations has to do with IPv4 versus IPv6. A quick
look at the history of the Internet Protocol (IP) will be helpful
first.
The Internet has driven the development of the TCP/IP
suite, and TCP and IP remain tightly coupled. TCP/IP has
always been at the root of the Internet; today, you are using
TCP/IP in your corporate network because of the success of
both the Internet and TCP/IP. In the early days of computing,
multiple protocols ran on corporate networks, and you had
to worry about how to tunnel other protocols across the
VPN. Today, most networks run TCP/IP exclusively.
The TCP/IP Suite
The TCP/IP suite is composed of a large number of protocols,
defined in a series of RFCs. Each of the protocols in the
TCP/IP suite provides a different function, and together they
provide the functionality known as TCP/IP.
The TCP/IP suite got its name from the two main
protocols in the suite: TCP (Transmission Control Protocol)
and IP (Internet Protocol). TCP is responsible for providing
reliable transmissions from one system to another, and IP is
responsible for addressing and route selection. IP defines
how computers communicate over a network. IP version 4
(IPv4), the currently prevalent version (defined at
http://tools.ietf.org/html/rfc791), contains just over four
billion unique IP addresses. IPv6 offers a newer numbering
system that provides a much larger address pool than IPv4,
among other features.
IPv4 Challenges
The largest challenge with IPv4 is address exhaustion. While
IPv4 addressing has kept the Internet and corporate
networks running since the early years of the Internet, the
industry is running out of addresses. The judicious use of
NAT has extended the life of IPv4 far beyond its expected
life span; however, currently less than 10 percent of total
IPv4 address space remains. Organizations will soon need to
start adopting IPv6 to support applications that require
ongoing availability of contiguous IP addresses.
TIP
The assignment of both IPv4 and IPv6 addresses is the
domain of suborganizations of a global organization
called the Internet Assigned Numbers Authority (IANA).
To find out more about IANA, go to www.iana.org. In the
U.S., the suborganization is the American Registry for
Internet Numbers (ARIN); for more information, visit
www.arin.net.
FIGURE 12-4
Comparison of IPv4 and IPv6 addresses.
IPv6
IPv6 is the next-generation IP version and has been
designated as the successor to IPv4, the first
implementation used in the Internet. The main driving force
for the redesign of Internet Protocol is the foreseeable IPv4
address exhaustion. IPv6 was defined in December 1998 by
the IETF with the publication RFC 2460. IPv6 is documented
in several requests for comments (RFCs) starting with
RFC 2460.
Some benefits of IPv6 include:
Increased address space—IPv6 supports 340
undecillion (3.40282E38) IP addresses for network
devices.
More efficient routing—The routing functionality of
IPv6 has been enhanced.
Reduced management requirement—A more
robust protocol, IPv6 requires less management. In
contrast, IPv4 required significant management due to
new requirements after the introduction of the
protocol.
Better quality of service (QoS) support for all
types of applications—Support for QoS is built into
IPv6, whereas it was an add-on in IPv4.
Security—IPv6 includes a native information security
framework (IPSec) that provides for both data and
control packets.
Plug-and-play configuration with or without
DHCP—IPv6 permits hosts to automatically configure
themselves when they connect to an IPv6 network by
querying the local routers with a multicast message. If
the routers are configured correctly, they will respond
with the appropriate configuration information. If this
mechanism is not appropriate for a specific
environment or application, support is available for an
IPv6 version of DHCP. It also supports static
configurations.
Three mechanisms currently exist for the transition from
IPv4 to IPv6. It’s important to understand that when the IPv6
standard appeared, the expectation was that the two
protocols would need to coexist in the network for 20 to 30
years, allowing for a gradual transition period. Three of the
proposed migration strategies are:
Dual-stack—With this transition solution, both IPv4
and IPv6 protocol stacks coexist in the same terminal
or network equipment. This would allow the network to
communicate using both protocols, but adds
significant overhead to the network infrastructure.
Tunneling—This solution allows two IPv6 hosts to
create a tunnel for traffic between two IPv6 hosts
through an IPv4 network, or vice-versa, as IPv4 starts
to phase out. This could add significant configuration
overhead.
Translation—This solution enables an IPv4 host to
talk to an IPv6 host. This solution will require
additional development, as currently IPv6 does not
include this capability.
IPSec and IPv6
IPSec is a mandatory component for IPv6, and is used to
natively protect IPv6 data as it is sent over the network. The
components of IPSec in IPv6 are not dramatically different
from IPSec, which industry has been using since the 1990s.
In IPv6, IPSec uses the AH and the ESP extension header.
The IPv6 IPSec is a set of Internet standards that uses
cryptographic security services to provide the following:
Confidentiality—IPSec traffic is encrypted and cannot
be deciphered without the appropriate encryption key.
This should be easier to use in conjunction with IPv6,
since it’s a native component of the protocol.
Data origin authentication—Ipv6 IPSec uses a
cryptographic checksum that incorporates a shared
encryption key so that the receiver can verify that it
was actually sent by the apparent sender. This
prevents spoofing of transactions.
Data integrity—The cryptographic checksum can
also be used by the receiver to verify that the packet
was not modified in transit.
You can find more information about IPv6 in RFC 2460 at
http://tools.ietf.org/html/rfc2460.
CHAPTER SUMMARY
You should now be familiar with the different VPN and
related protocols and their uses, such as IPSec, Layer
2 Tunneling Protocol (L2TP), Secure Sockets Layer
(SSL)/Transport Layer Security (TLS), and SSH. You
should also understand the advantages and
disadvantages of hardware and software solutions,
and be able to determine which solution would be
appropriate in your environment.
You learned how some of the challenges associated
with establishing performance and stability for VPNs
can affect the performance and stability of your VPN.
You learned about the issues network address
translation (NAT) can present when rolling out a VPN,
as well as the impact of both client and VPN
virtualization on your VPN.
You took a detailed look at Internet Protocol version 4
(IPv4) and Internet Protocol version 6 (IPv6), including
challenges and benefits associated with the rapidly
approaching migration to IPv6.
KEY CONCEPTS AND TERMS
Authentication Header (AH)
Encapsulating Security Payload (ESP)
Internet Engineering Task Force (IETF)
Internet Key Exchange (IKE)
Layer 2 Forwarding (L2F) Protocol
Layer 2 Tunneling Protocol (L2TP)
Point-to-Point Protocol (PPP)
Point-to-Point Tunneling Protocol (PPTP)
Requests for comments (RFC)
Secure Shell (SSH)
CHAPTER 12 ASSESSMENT
1. What are the two modes supported by IPSec? (Multiple
answers are correct.)
A. Transition
B. Tunnel
C. Encrypted
D. Transport
E. Internally connected
2. Which of the following are not considered IPSec
services? (Multiple answers may be correct.)
A. Access control
B. Encryption
C. NAT interoperability
D. Replay rejection
E. Support for AES encryption
3. The strongest encryption protocol currently supported
by IPSec is ________.
4. The two different protocols commonly used for remote
access VPN are ________ and ________.
5. Pick two advantages of using an IPSec-based VPN
solution instead of an SSL-based solution. (Multiple
answers are correct.)
A. IPSec provides a direct connection to the network.
B. Since IPSec works at Layer 3, it can support virtually
all network applications.
C. IPSec requires the configuration of each application
being accessed via the VPN.
D. IPSec is a clientless solution.
6. A solution that permitted industry to extend the life of
IPv4 addresses is ________.
7. Which of the following are benefits of using an SSL
VPN? (Multiple answers may be correct.)
A. More costly
B. Less flexible
C. Support for NAT
D. Fewer firewall rules required
E. Used for secure logons
8. SSL VPNs are considered ________ because access is
granted through SSL, which is supported by Web
browsers on virtually all platforms.
9. Which of the following can affect the stability of your
VPN? (Multiple answers may be correct.)
A. Number of users
B. VPN configuration
C. Code revision level
D. Operating system
E. Encryption level
10. Which of the following are types of network address
translation? (Multiple answers may be correct.)
A. On demand
B. Dynamic
C. Secure
D. Static
E. Encrypted
11. The mechanism used by the IETF to document Internet
standards is the ________.
12. Separating the physical devices from the logical
devices is known as ________.
13. Which of the following are uses for the SSH protocol?
(Multiple answers may be correct.)
A. Secure remote logon
B. Secure file transfers
C. Secure access to a Web site
D. Encrypting data on backup tapes
E. Creating a VPN connection
14. The L2TP protocol was created by the combination of
these two protocols: ________ and ________.
15. When you need to securely connect to a router for
remote logon, ________ would be the recommended
protocol.
16. Which of the following are protocols that can be used
for a VPN connection? (Multiple answers may be
correct.)
A. IPSec
B. 3DES
C. SSH
D. IETF
E. SSL
17. When working with IPSec in an environment using
network address translation, which protocols and ports
need to be open for IPSec to communicate? (Multiple
answers may be correct.)
A. IKE/UDP port 500
B. IKE/UDP UDP port 500
C. ESP/IP port 50
D. SSL/TCP port 443
F. AH/IP protocol number 51
18. When designing a VPN solution, which of the following
areas could affect VPN performance? (Multiple answers
may be correct.)
A. Available bandwidth
B. Client configuration
C. Client patch level
D. Traffic
E. Topology
19. Which of the following are benefits of IPv6? (Multiple
answers may be correct.)
A. IPSec is defined as a native protocol.
B. Support for SSL included in the standard.
C. IPv6 has the ability to address a limit of 4.3 billion
hosts.
D. IPv6 allows plug-and-play configuration with or
without DHCP.
E. IPv6 defines how to respond to incidents.
20. The ability to traverse a firewall using network address
translation on port 443 is a component of which VPN
protocol ________?
PART THREE
Implementation,
Resources, and the Future
CHAPTER
13
Firewall Implementation
CHAPTER
14
Real-World VPNs
CHAPTER
15
Perspectives, Resources, and the
Future
CHAPTER
13 Firewall
Implementation
THE LOCAL AREA NETWORK (LAN) ADMINISTRATOR oversees all aspects of Internet and Web security
administration. This chapter is for those professionals who
don’t have enough time to dig into the more technical
aspects of Internet and Web security, but need reliable
options for Internet protection. Here are practical
instructions to get a firewall up and running at your
organization.
Chapter 13 Topics
This chapter covers the following topics and
concepts:
How to construct, configure, and manage a
firewall
What SmoothWall is
How to examine your network and its
security needs
What the hardware requirements for
SmoothWall are
How to plan a firewall implementation with
SmoothWall
How to install a firewall with SmoothWall
How to configure a firewall
What the elements of firewall deployment
are
How to perform testing with SmoothWall
How to troubleshoot a firewall with
SmoothWall
What some additional SmoothWall features
are
What firewall implementation best practices
are
Chapter 13 Goals
When you complete of this chapter, you will be
able to:
Install a host software firewall
Constructing, Configuring, and
Managing a Firewall
Say you want to protect a small office, home office (SOHO)
network of about 25 computers. Many firewall products are
available for small businesses and those working from
home. SOHO VPN hardware firewalls are often built on a
secure virtual private network (VPN) connection to the
company network to transfer e-mail and sensitive files.
In many cases, the SOHO firewalls have additional
features such as an antivirus tool, IP filtering, Web content
filtering, router options (router/firewall combinations),
intrusion detection, and DDoS/DOS attack detection. Some
of the firewalls come with a Linux or Linux-like operating
system and use ipchains to manage their filter rules.
A SOHO VPN hardware firewall is the best solution when
you already have a working network and want to provide
remote access. For example, you may already connect your
personal computers within your office. If you want to open a
new office in another location, you could connect both
offices with a SOHO VPN firewall at each office. It will create
a secure connection to transfer sensitive data (bank
information, customer information, or company-related
information) from one office to the other. Another example
is a mobile worker such as a salesperson working in the
field. The salesperson could use the VPN’s secure
connection to access company files and presentations or
customer-related information directly from the company
office, even when working in the field.
Recall that a firewall allows you to restrict unauthorized
access between the Internet and an internal network. It
exists to block unauthorized connections and keep outside
attackers from penetrating the internal network. It also
prevents inside connections from reaching out to the
Internet without authorization. By monitoring inside users,
firewalls can prevent them from sending out to the Internet
sensitive information, such as personally identifiable
information or sensitive corporate data.
SmoothWall
You have many choices for firewall applications. This section
discusses one possible choice: SmoothWall, which supports
many different network types and is a practical solution for
just about any organization. SmoothWall uses colors to
differentiate networks. A green network interface card (NIC)
is a private, trusted segment of the network, while an
(optional) orange NIC is not trusted, but does share the
Internet connection. A red interface is a connection to the
Internet. This could be a conventional Ethernet adapter, a
dial-up modem, an Integrated Services Digital Network
(ISDN), or a USB asymmetrical digital subscriber line
(ADSL) or a conventional Ethernet adapter. Figure 13-1
illustrates this scenario. A purple interface indicates a
wireless connection.
FIGURE 13-1
A typical SmoothWall network interface setup.
Key features of the SmoothWall firewall include:
Compatibility with a wide range of hardware and
systems
Flexibility and ease of use
Support for multiple network zones—client local
network (green), demilitarized zone (DMZ) for hosting
servers (orange), wireless client (purple), and external
(red)
Comprehensive reporting and logging capabilities
POP3 e-mail antivirus proxy
Web proxy support
Snort IDS support
Static and dynamic Domain Name System (DNS)
support
Remote access and VPN support
DHCP and network time server support
Powerful traffic graphs and bandwidth bars
Inline proxy support for instant messaging (MSN, ICQ,
Yahoo!, AOL) and VoIP with logging capabilities
Universal Plug and Play support (UPnP)
Bandwidth management
Real-time graphs and traffic stats per IP
System updates
Outbound traffic blocking with time-based controls
Examining Your Network and Its
Security Needs
According to the National Security Agency (NSA),
attacks to systems connected to the Internet are becoming
more and more complex and dangerous. For instance,
hackers can penetrate computer systems using a variety of
techniques to exploit weaknesses hidden in the complex
code of many operating systems and applications.
NOTE
Tim Berners-Lee started the World Wide Web while at
CERN (the European Laboratory for Particle Physics).
The project sought to build a “distributed hypermedia
system.” The Web is a large collection of
interconnected Web pages providing dynamic content
documents, accessible throughout the world. Berners-
Lee is still working on this project, now under the
auspices of the W3 Consortium at MIT.
What to Protect and Why
Internet-facing servers are accessible to people anywhere in
the world who have Internet access, and these servers are
often targets of attacks. They include Web servers, e-mail
servers, File Transfer Protocol (FTP) servers, and more. If a
server has a public IP address, it’s a potential target for
hacker attack. Firewalls provide protection for Internet-
facing servers. Firewalls also provide protection for internal
clients. They provide a layer of protection to limit the ability
of attackers to exploit system weaknesses—both hardware
and software.
Imagine an organization that sells products over the
Internet and processes credit card transactions. Customers
insist that the merchant protect their credit card data. To do
this, organizations need to address two distinct security
areas:
Network security—Computers, hard disks,
databases, and other computer equipment attached
directly or indirectly to the Internet need protection.
Firewalls serve an important role in this aspect of
network security.
Transaction security—Web servers must be able to
securely complete private transactions with other
entities in databases accessible on the Internet.
Hypertext Transfer Protocol Secure (HTTPS) is an
important tool used to encrypt the transactions.
Additionally, firewalls provide protection for the data.
For example, it’s common for a Web server to stand
behind one firewall. The database server stands
behind a second firewall that restricts access to the
database to only the Web server. In this scenario, the
area where the Web server operates is called a
demilitarized zone (DMZ).
Network security and transaction security have four
overlapping types of risk:
Risk that unauthorized individuals can breach
the server’s document tree—Depending on what
data resides on the server, this threat can compromise
the confidentiality of documents stored there.
Risk that transaction data can be intercepted—
This threat can include personal data, financial data,
or credit card information.
Risk that information about the server can be
accessed—If attackers learn details about the server,
such as the type of server and its operating system,
they may be able to identify and exploit its known
vulnerabilities.
Risk of denial of service (DoS) attacks—Many
different types of DoS attacks are possible. A simple
SYN-flood attack withholds the third packet in the TCP
three-way handshake, for example. Hundreds of these
incomplete sessions in a short time can consume
substantial resources on a server and even crash it.
If your organization conducts business on the Internet, you
need to take steps to protect those transactions. E-
commerce requires a zero tolerance for failure. Protection is
not optional.
Protecting Information and Resources
An organization must protect against attackers trying to
access information and resources within the internal
network, such as servers and workstations. Servers can host
massive amounts of data that’s invaluable to attackers.
Database servers may host personally identifiable
information (PII) about customers, including their credit card
data. Domain Name System (DNS) servers host information
such as the IP addresses and names of all systems in the
network.
Protecting Clients and Users
Most organizations have a written security policy that
outlines specific security requirements. A firewall can be
useful in upholding the security policy by providing
perimeter security. In other words, the firewall limits the risk
of attack from hackers outside the internal network.
However, if you want to guarantee the security of an
organization’s network and protect its clients’ and users’
interests, you should do the following as well:
Treat private messages as confidential—Private
messages should be encrypted to ensure the message
remains confidential. Encryption prevents the
unauthorized disclosure of the private message.
Maintain integrity of information—Integrity
methods verify that data has not changed. For
example, hashing is often used to verify the integrity
of messages. A hash is simply a number calculated
using an algorithm on a message. No matter how
many times you calculate the hash, it will always be
the same as long as the data has not changed. The
hash is calculated at the source and sent with the
message. The hash is recalculated at the destination
on the received message and compared with the hash
sent with the message. If they’re both the same, the
integrity of the message is ensured.
Use strong authentication and nonrepudiation
methods for all transactions—Digital signatures
commonly accompany both authentication and
nonrepudiation. For example, a sender can sign a
message with a digital signature. The receiver can use
this signature to verify the identity of the sender. In
other words, the digital signature provides
authentication. Additionally, since it was digitally
signed, the sender can’t later deny sending it. In other
words, the digital signature also provides
nonrepudiation.
Preserving Privacy
It’s more difficult to preserve a user’s privacy on the
Internet than in the physical world. Usually, you can close
your door when seeking privacy or whisper something so
that others can’t hear you. But the digital era has changed
things. There’s no such thing as whispering on the Internet.
When data is sent or received by a user surfing the
Internet, that information can be intercepted and collected.
Much of this data is stored in databases and can be made
available for sale to others. Data mining methods are then
used to help build customer preference profiles. From the
perspective of an organization selling products, this data is
valuable for identifying an individual’s buying habits and
targeting advertising. However, this data can be easily
misused.
The Electronic Privacy Information Center (EPIC)
was established in 1994, in Washington, DC. Its goal is to
alert the public on emerging privacy issues relating to the
National Information Infrastructure (NII), such as the
Clipper chip, the Digital Telephony Proposal, medical
record privacy, and the sale of consumer data. EPIC’s
mission is to preserve the right of privacy in the electronic
age as well as to give individuals greater control over
personal information, and to encourage the development of
new technologies that protect privacy rights. EPIC can
provide valuable information to IT professionals on emerging
cyber laws and other privacy threats.
Preserving privacy on a corporate network may require
more stringent security if you have users accessing
resources from all over the world. While administrators are
responsible for setting up security policies to guarantee
users’ privacy, each user accessing the company’s network
is responsible for browsing the Web with ethical regard for
others. They also should be aware of information they may
reveal while accessing resources from outside of the
network.
Typically, most network servers (and Web servers) log all
the hits they receive. This log usually includes the IP
address and/or the host name. If the site uses any form of
authentication, the server will also log the username. If the
user filled out any form during the session, all the values of
any variable from that form will be also recorded. The status
of the request, the size of data transmitted, the user’s e-
mail address, and so on can also be logged. Moreover, Web
servers can make all this information available to Common
Gateway Interface (CGI) scripts. Since the majority of
Web browsers are running on single-user PCs, very likely all
the transactions can be attributed to the individual using
the PC.
TIP
If you want to know more about EPIC, you can check
out its Web page at http://epic.org/.
Revealing any of this information can harm the user. This
is especially true if the user has logged any PII. Attackers
can use PII for identity theft. Some PII may allow an attacker
to access bank accounts or fraudulently charge credit cards.
As a subtler example, if a user researches a job opening
opportunity at a site, it may indicate that the user is
searching for a new job. Browser lists, hotlists, and caches
can also reveal certain patterns about the user.
A proxy server, for instance, will track every single
connection outside the Web by IP address and the URL
requested. If you install a proxy server within an
organization, data needs to be protected so that only
authorized individuals have access to it.
Firewall Design and Implementation
Guidelines
When deciding to install a firewall, you should consider
several basic decisions before going ahead with the project.
Before you start thinking about the type of firewall you
want to use, where to install it, and how to deploy it, you
should make sure you have a guideline in hand. You need a
policy that will set the security standards for the network,
including the rules users and system administrators will
follow and the security strategy configuration you plan to
deploy.
Many security policies have a special section just for the
firewall, outlining how to configure and use it. For example,
many organizations recognize that every service and
protocol allowed through the firewall represents a risk. By
blocking traffic that isn’t needed to support the
organization, these risks are eliminated. A simpler route is
to just monitor the activity at the network and Web server,
but it may subject the network to risks you can easily avoid.
Be prepared to face a situation where the final design of
the firewall may involve political issues from upper
management and other departments of the company. For
example, the security policy may state that the Network
News Transfer Protocol (NNTP) is not essential for the
organization. You would then design the firewall to block all
NNTP traffic. But even though it may not be essential, upper
management may decide to allow the traffic.
Once you decide on the design, then you need to identify
a firewall that can meet your needs. You’ll need to consider
several items including:
Suitability—Can the firewall implement the policy?
Flexibility—Is it easily reconfigurable?
Training—Is training required and if so, what is the
cost?
Need—Make a list of traffic you want to allow, filter, or
block. This is often derived from the organization’s
security policy.
Risk—Make a separate list of all the risks in the
network based on the traffic allowed.
FIGURE 13-2
Simple firewall solution.
Cost—Add the “need” and “risk” lists up and find out
how much it will cost to provide everything. You then
need to divide this result by available financial
resources, and you will have a clear picture of how
much it will cost to implement your ideal firewall
system. The result may even point out the likely type
of firewall you must purchase. Many times, you’ll find
you must reevaluate your needs so that the plan is
more realistic, from both the security and financial
perspectives.
You can recommend a firewall solution that costs almost
nothing or a solution that may cost hundreds of thousands
of dollars. You need to balance the security needs with the
resources within your organization.
On the technical side, you need to decide how you want
to configure the firewall and what strategy you’ll use. Figure
13-2 shows a simple firewall solution with one network
firewall and all resources placed behind it.
This method is generally not recommended for
organizations that host Internet-facing servers such as e-
mail servers or Web servers. These servers can go behind
this single firewall and you can configure the firewall to
direct Internet traffic to the servers using port forwarding.
However, this exposes the internal network to potential
threats from the Internet. If you instead put your Internet-
facing servers directly on the Internet, you expose them to
threats of attack from anywhere in the world.
An alternative for organizations that have Internet-facing
servers is to use a perimeter network. Figure 13-3 shows
one example. The firewall has three connections: one to the
Internet, one to the internal network, and one to the
perimeter network. This is also known as a bastion host.
In this solution, the firewall will direct traffic destined for
the Internet-facing servers to the servers on the perimeter
network. Unrequested traffic from the Internet will be
blocked from entering the internal network.
FIGURE 13-3
Multi-homed firewall used for a perimeter network.
The third solution uses two firewalls to create a DMZ as
shown in Figure 13-4. This provides several benefits. The
two firewalls provide an additional layer of security for the
internal network. If the Web server accesses a database, the
database server can go in the internal server for better
protection. Internet users won’t be able to access the
database server directly.
Many organizations use two different brands for their
different firewalls. If a flaw or vulnerability appears in one,
it’s unlikely the second firewall will be vulnerable at the
same time. Additionally, an attacker may be an expert on
one brand of firewall, but it’s less likely that the attacker has
the same level of expertise for two separate brands.
Remember, though, you need to balance the needs of
the organization with the security requirements. While it’s a
true a DMZ provides more protection than a single firewall,
it also costs more.
FIGURE 13-4
Two firewalls used to create a DMZ.
Selecting a Firewall
Before you select a firewall, you should make sure that your
organization has created a written security policy. You would
then select the firewall that can fulfill and comply with the
policy. When evaluating firewalls, take the time to evaluate
the levels of security they provide. Quite simply, some are
better than others, and a high cost doesn’t necessarily
mean high quality.
The basic concept of any firewall is the same, so you
should evaluate a firewall based on the level of security and
features it offers. First and foremost, the firewall should be
able to fulfill and comply with your security policy. Some
other characteristics to consider are:
Security assurance—Independent assurance that
the relevant firewall technology meets its
specifications.
Privilege control—The degree to which the product
can impose user access restrictions.
Authentication—The ability to authenticate clients
and allow different types of access control for different
users.
Audit capabilities—The ability to monitor network
traffic, generate logs, and provide statistical reports.
Logs may include both authorized traffic and
unauthorized attempts and may be able to trigger
alarms in response to certain events.
When considering the features, consider the product’s
ability to meet the needs of the organization. A good firewall
product should provide:
Flexibility—The firewall should be open enough to
accommodate the security policy of your organization,
as well as allow for changes. Security policies can
change, and security procedures should also be able
to change and adapt to different needs.
Performance—A firewall should be fast enough that
users don’t notice the screening of packets. The
volume of data throughput and transmission speed
associated with the product should be reasonable and
consistent with the organization’s network bandwidth
to the Internet.
Scalability—Firewalls should be able to handle
additional workload. The additional workload can be
due to growth within the organization or due to
increased use of the Internet connection.
When considering integrated features, consider the ability of
the firewall to meet your network and users’ needs. This
includes:
Ease of use—The firewall product should ideally have
a graphical user interface (GUI), which simplifies the
job of installing, configuring, and managing it.
Customer support—Vendors that sell firewalls
provide support for them. This includes providing
prompt access to technical expertise for installation,
use, and maintenance. It also includes training.
FIGURE 13-5
SmoothWall topology.
Hardware Requirements for
SmoothWall
As mentioned previously, one of the main advantages of
SmoothWall is that it will run on a variety of hardware. It’s
recommended you use a machine that is 166 MHz or faster.
In any case, you will need at least two network cards (NICs)
in your SmoothWall machine, as firewalls traverse two or
more network connections. You may or may not need a
crossover cable as well. The Dell Powerconnect 2650 switch
performs auto-sensing, so there is no need to use a
crossover cable. This is common with many switches today.
Figure 13-5 depicts the topology of SmoothWall.
The minimum requirements for a computer running
SmoothWall are:
Processor running 166 MHZ or greater
512 MB PC133 synchronous dynamic random
access memory (SDRAM)
20 GB hard drive
Two NICs
Planning a Firewall Implementation
with SmoothWall
As a software appliance, SmoothWall will convert a
computer server or PC into a dedicated hardware security
appliance, running the security-hardened Linux operating
system and all other necessary software. When planning a
firewall, you should use standard hardware, typically from
major manufacturers such Dell, HP, or IBM, which will
provide you with considerable benefits including:
Flexibility—You can easily add RAID, redundant power
supplies, additional RAM, and a range of network
interface cards.
Performance and value for the money—The
average desktop PC will have many times the
processing power and memory complement of most
mid-range hardware firewall appliances. Office PCs
have become a commodity, offering exceptional value
for the money.
Support—The major PC manufacturers can support
their products virtually anywhere in the world,
including rapid, on-site repair or replacement if the
customer requires. Alternatively, in most major cities,
several computer support companies also support
such hardware. In contrast, the support available for
smaller manufacturers’ equipment is often limited to
repairs done after you’ve had to ship the machine
back to the factory.
What kind of firewall is right for an organization? Truthfully,
no single correct and definite answer exists. A security
policy developed by a Fortune 500 company certainly will
not be suitable for a small business owner (and vice versa).
The following are brief fictitious scenarios to illustrate
different firewall designs to meet different needs.
Firewalling a Big Organization: Application-
Level Firewall and Package Filtering, a
Hybrid System
Employees at Other People’s Money, Inc. (OPM) access the
Internet on a daily basis for a wide variety of different
business purposes. Additionally, they host a Web server that
has a high volume of access from OPM customers. Finally,
mobile workers use a VPN server to access internal
resources.
OPM might decide a DMZ with two application-level
firewalls and packet filtering is adequate for its needs. The
Web server and VPN server would go in the DMZ so that
they are accessible from the Internet, but the internal
network has additional layers of protection.
Firewalling a Small Organization: Packet
Filtering or Application-Level Firewall, a
Proxy Implementation
Imagine a smaller organization that requires Internet access
by employees, but doesn’t host a Web server or a VPN
server. All users in the organization require access to the
Internet, and they need a layer of protection against
Internet-based attacks.
A proxy server or a firewall such as SmoothWall would be
enough. All users could access the Internet through the
SmoothWall firewall, and it would provide protection against
external attacks. While SmoothWall was the example
examined in depth in this chapter, many other products can
provide the same level of service for a small organization.
Firewalling in a Subnet Architecture
Imagine a larger organization with multiple subnets. They
may want to limit specific types of traffic within subnets. For
example, they may want to ensure that traffic within a
specific subnet is encrypted with IPSec. Additionally, they
may want to allow NNTP traffic on one subnet, but not on
others.
You can configure routers to provide basic packet
filtering. In other words, they can block or allow traffic based
on IP addresses, ports such as port 119 for NNTP, and some
protocols such as ICMP or IPSec.
If the organization wants to protect subnets within the
network, basic packet filtering provided by routers might be
the most appropriate choice. This model supports each type
of client and service within the internal network. No
hardware or software modifications or special client software
would be necessary. The access through the routers used as
packet-filtering firewalls is transparent for both the user and
the applications. The existing routers can handle the packet
filtering. This solution doesn’t require the purchase of a host
or firewall product. Buying an expensive UNIX host or
firewall product would be unnecessary.
Installing a Firewall with SmoothWall
The installation of SmoothWall is easy. As long as you ensure
you have the computer BIOS set to boot from a CD, the
installation process will begin automatically. SmoothWall
Express runs on a workstation with a bootable CD-ROM
drive. After booting, it will automatically check the
workstation and hardware components.
The common interfaces on the installation screen of
SmoothWall are listed below:
Red—Internet. This interface is protected by the
iptables firewall rules.
Orange—Filtered/special purpose. This is commonly
used for a DMZ or other special section you want to
allocate.
Green—Trusted network. All traffic is permitted to and
from this interface.
WARNING
During the installation process, SmoothWall will delete
all data you may have on your hard disk. So, before
you start the installation, ensure that all valuable data
is safely backed up.
Note the green + red configuration. The green interface
card connects to the internal network and the red interface
to the external network. If you have a different setup or
hardware, please use the appropriate configuration.
At this point, you should read the information that
appears on the following screen and press the Enter key on
your keyboard.
Next, you should see the screen alerting you that your
hard drive will be prepared for installing the firewall.
If you have two of the same NICs, you may want to pay
attention to the Media Access Control (MAC) addresses so
you know which cable to connect to the modem and which
one goes to your switch. If your red interface connects to an
ISP, ensure you configure it based on the requirements of
the ISP. For example, some ISPs will assign manual
IP addresses, while others use DHCP. When DHCP is used,
all the Transmission Control Protocol/Internet Protocol
(TCP/IP) configuration information such as DNS, gateway,
and IP address happens automatically.
The green interface should have a static IP (such as
192.168.0.1) to connect to the internal network. Once you
have the interfaces set up correctly, it’s time to reboot the
computer. Also, it’s very important that you power-cycle the
modem. Often, ISPs will assign a different IP when the MAC
address of the device attached to the modem changes.
When configuring the NICs for the green and red
interfaces, you can use static IP addresses for both
interfaces.
Now you will need to set up the DNS and default gateway
accordingly.
Next, enter the SmoothWall admin password. You will
need it for logging into the Web interface later. Then, set up
the root password.
At this point, the setup of SmoothWall is complete and
your network should be protected. You should see a screen
showing that the installation is complete. Remove the CD
and restart SmoothWall.
TIP
An excellent Web site is available that will walk you
step by step through SmoothWall installation:
http://www.linux-tip.net/cms/content/view/316/26/.
Configuring a Firewall with
SmoothWall
Once you have finished installing SmoothWall, you will have
to configure the firewall via a Web browser. The interface is
clean and well laid out, and works well with Mozilla Firefox,
Google Chrome, and Microsoft Internet Explorer. Once you
reboot the computer, you can access it via a browser from a
Web interface (usually https://192.168.0.1:441) to start
configuring the firewall. SmoothWall Express version 2.0
added the ability to use HTTPS. You can also access it using
port 81. Without logging in, you should be able to see part
of the management menu, the version, and load averages.
Since the install connected the red interface to the
Internet, your first access of the home page should lead you
to the following message: “There are updates available for
your system. Please go to the ‘Updates’ section for more
information.” You will find the Updates menu item under
Maintenance.
At this point, if you want to verify or change anything,
you must log in. During the configuration process you were
asked to specify some passwords. To log in to the Web
interface, you must use admin as the username and the
password you specified. Logging in as root will work only
over Secure Shell (SSH) or from the console. You cannot log
in as root using the Web interface.
For most scenarios, the out-of-the-box SmoothWall
installation should work without any additional
configuration. But additional customization can bring out the
real power of SmoothWall features. The Services tab allows
you to monitor each advanced feature, including time,
remote access, intrusion detection, dynamic DNS updates,
and proxy services. Some services such as SSH access
services are not started by default. Interestingly, ICMP is
configured to reply to both external and internal ping
requests, making the firewall susceptible to DoS attacks.
The Networking tab exposes the interface settings, IP
address blocking, timed access, and traffic rules. Incoming
and outgoing rules are easy to create and maintain. You can
view the status of the system at all times with various
options. Configuration and resources appear in text form.
You can also view a summary screen of all the services
running on the SmoothWall system (computer).
In the quality of service (QoS) configuration section, you
can use drop-down boxes to select upload and download
connection speeds and enable the service. The QoS engine
prioritizes different types of traffic to make the connection
speed seem faster. The settings are combo boxes, which
makes them understandable even to non-technical users. By
default, instant messaging traffic is set to low priority, VPN
traffic to normal, and gaming traffic to high.
Elements of Firewall Deployment
At this point, you should start thinking about deploying the
firewall and about the services you want it to run. You
should pay special attention to the Services tab. You have
the ability to run:
Web cache/proxy (SQUID)
DHCP server
DDNS (for dynamic IPs)
Intrusion detection system (Snort)
Secure Shell (Open SSH)
To enable the Web proxy, you must select it by checking the
box. The Web proxy information needs to be changed.
The Transparent option simply means that every client on
the network will be forced to connect through the proxy
server. Browser settings will not need to be changed, and
the clients will not even know they are using the proxy. You
should change the cache size from 50 to 5000 MB. You
shouldn’t change the other options, as caching objects too
large or too small can create problems.
One of the great features of SmoothWall is the ability to
view network usage. You can view graphs of network traffic
generated by RRDtool (round robin database tool)
every five minutes.
You can also view the logs of Web usage through the
proxy. You can even dig further by filtering the log by IP. This
way, you can see all the Web sites visited by a certain IP (or
user).
Performing Testing with SmoothWall
To test SmoothWall’s ability to mitigate attacks, you can
enable Snort intrusion detection software and run a few
attacks against the firewall over the red interface. For
example, you can use Nmap, the Metasploit framework, and
some other port scanning and attacking tools. In all cases,
the firewall should be able to deal with them. The Snort and
firewall logs should identify most types of attacks, the IP
address of the attacker, and the time and date of the attack.
SmoothWall’s IP lookup feature can determine and report
the origin of an attacker.
TIP
ICMP may be blocked by the host you ping. If the ping
fails, consider pinging another host that you know will
respond.
Once SmoothWall is up and running, the next step is to
test its ability to access Internet resources. You should first
ensure you can access the Internet from the SmoothWall
box. To do this, run the following command: ping
www.google.com
ping www.google.com
If you get a successful reply, it means your host can access
the Internet.
Now, if you have an internal client configured, try to ping
one by running the command, substituting the actual IP
address of an internal client. An example would be:
ping 173.16.0.1
You can also test a client’s ability to traverse the firewall.
Start a Web browser on a client system and enter the IP
address of the SmoothWall router. For example, if the IP
address for the green NIC on the SmoothWall machine is
172.16.1.95, then you would enter http://172.16.1.95 in the
location bar of the browser. You should be able to see the
SmoothWall startup screen. If you see the screen, then the
firewall is up and running. Next, try to access any Web site
to confirm that you can surf the Internet. If you encounter
problems accessing the Internet, try the following:
Check the TCP/IP settings on the SmoothWall host.
Make sure all of the addresses and subnet masks are
correct.
Make sure the NIC accessing your ISP (red) is the
correct card. Some ISPs will provide access only when
the MAC address on the NIC is correct.
Check the TCP/IP settings on the client computer.
Firewall Troubleshooting
Sometimes, right after installing SmoothWall, you may have
problems being able to SSH into the system. This is typically
because port 22 is not open. In this case, you should make
sure that SSH is enabled and that port 22 or 222 is open.
This enables you to tunnel different SSH connections at the
same time.
One small disadvantage of using SmoothWall from the
console is that some traditional Linux tools are modified. For
example, some shell commands such as whereis and locate
are not included, which can make it a little hard to find
items. Also, config files are stored in non-traditional Linux
locations, and partitions are not named according to
standards. For instance, the snort.conf file is stored in /etc
and the squid.conf file is stored in /var/SmoothWall/proxy.
If you are still having trouble with the networking aspect
of the firewall during the configuration process, you still
have access to traditional tools such as ping, traceroute,
and tcpdump. They are all useful in determining what your
network problem may be. Another factor to watch for is the
crossover cable. Some networking devices require a
crossover cable when they are connected together, while
others have auto-sensing capabilities and will automatically
switch to crossover mode even when you’re using a regular
cable. The cable from your green interface may or may not
need to be a crossover cable.
While SmoothWall does not natively contain an FTP
server, you can still transfer files to and from the system via
SCP/SFTP. To do so, you simply need to connect to port 22 or
222 with a client such as WinSCP3, which is nearly the same
as using another FTP client.
Additional SmoothWall Features
SmoothWall is a versatile product that gives power to
network security administrators, allowing them to decide
how to control their networks by making it easy to do so.
The Web-based GUI is clean and easy to read, and provides
a wealth of information about the status of a network’s
traffic and security. The Web-based interface is organized
into broad areas with tabs that allow navigation for specific
features. You can run SmoothWall as a proxy server or a
DHCP server, forward ports to machines in the green zone,
and more. You can even set up advanced proxy server
features such as per-user authentication and delay pools.
Larger organizations may want to use a dedicated proxy
server to get these functions, however.
You can configure the address range, WINS server, and
static hosts for the DHCP server. You can specify dynamic
DNS, offer remote access for SHH, and synchronize with a
Network Time Protocol server. SmoothWall also lets you
enable Snort, a popular open source intrusion detection
system.
Some of the network settings you can control include:
Port forwarding—This allows you to forward a port
from the firewall to a machine inside the green or
orange zones. You can use this feature to hide your
Web servers behind a single IP address.
External service access—You can access any
services running on the SmoothWall machine by
opening the ports you need.
DMZ pinholes—As the name implies, this allows you
to open a pinhole from the DMZ to the green zone.
This is useful if your external servers need to
communicate with servers inside the green zone. For
example, your Web server may need to communicate
with a database server inside the green zone.
PPP settings—You can set up various profiles,
configure up to four modems, and use dial on demand.
IP block—You can ban specific IP addresses or ranges.
Firewall Implementation Best
Practices
You must keep the firewall and your protected network
logically secure. Sound security logic should be the starting
point in putting together a security policy that will use
secure systems such as Kerberos, IPSec, and many others.
The requirements to run a secure firewall, such as
SmoothWall, also include a series of good habits that
administrators should cultivate. It’s a good policy to try to
keep the strategies simple so that the system is easier to
maintain.
Most bastion hosts and firewall applications have the
capability to generate traffic logs. You can record user-
browsing patterns on these servers. This may include
information about the users, their connections, their
address, or even specifications about their organization.
These logs usually include:
The IP address
The server/host name
The time of the access
The user’s name (if known by user authentication or,
with UNIX, obtained by the identd protocol)
The URL requested
The data variables submitted through forms users
usually fill out during their session
The status of the request
The size of the data transmitted
CHAPTER SUMMARY
Firewalls provide protection from Internet threats to
servers and workstations. They can be configured to
allow only specific traffic based on what an
organization wants to allow. Organizations typically
define what traffic is acceptable in a comprehensive,
written security policy. IT professionals then identify a
firewall solution that can fulfill and comply with the
policy within the established budget.
SmoothWall Express is an Internet firewall that can
protect an organization’s network. This chapter
demonstrated how to configure and use a firewall
such as SmoothWall using a Web-based GUI.
SmoothWall is an open source firewall, requiring no
knowledge of Linux to install or use. SmoothWall
turns any typical PC into a network appliance whose
sole function is to route network traffic to and from
the Internet, assign IP addresses, and protect the
private side of the network from intrusion.
KEY CONCEPTS AND TERMS
Asymmetric digital subscriber line (ADSL)
Clipper chip
Common Gateway Interface (CGI) script
Electronic Privacy Information Center (EPIC)
Integrated Services Digital Network (ISDN)
Kerberos
National Information Infrastructure (NII)
National Security Agency (NSA)
RRDtool (round-robin database tool)
Synchronous dynamic random access memory
(SDRAM)
tcpdump
traceroute
CHAPTER 13 ASSESSMENT
1. The following are all key features of SmoothWall,
except:
A. POP3
B. Static and dynamic DNS support
C. Cybercash support
D. Snort IDS support
E. DHCP and network time server support
2. According to the ________ ________ ________ , attacks to
systems connected to the Internet are becoming more
and more complex.
A. National Systems Agency
B. National Security Agency
C. Central Intelligence Agency
D. Navy Security Agency
E. Federal Bureau of Investigation
3. Firewalling involves two distinct areas that must be
protected:
A. Network and transaction security
B. Access and controls
C. File sharing and printing capabilities
D. Access to the Internet and from the Internet
E. None of the above
4. The ________ was created to alert the public to the
emerging privacy issues relating to the National
Information Infrastructure.
A. EDIP
B. EPIC
C. NII
D. CERN
E. W3C
5. The following are characteristics you should be looking
for in a firewall, except:
A. Security assurance
B. Privilege control
C. Digital switches
D. Authentication
E. Audit capabilities
6. A good firewall product should provide:
A. Flexibility
B. Performance
C. Scalability
D. All the above
E. A and C
7. The following are all characteristics of SmoothWall
firewall, except:
A. It is a simple Linux kernel.
B. It cannot use iptables to control and route traffic.
C. It is built to run as a dedicated firewall/router.
D. It provides a way to gain extra capability with NAT.
E. It runs on a variety of hardware.
8. The following are all common interfaces used by
SmoothWall, except:
A. Green: Trusted network
B. Blue: DMZ connection
C. Red: Internet
D. Orange: Filtered/special purpose
9. The following are attributes of a minimum hardware
specification to run SmoothWall, except:
A. 512 MB PC133 SDRAM
B. 20 GB hard drive
C. 10/100 on-board NIC
D. AMD Duron 1100
E. Flat LCD screen
10. To install SmoothWall, you need to make sure the
computer BIOS is set to boot from a CD. True or False?
11. In a typical SmoothWall firewall installation the green
interface should have:
A. A static IP
B. Software bugs but not flaws
C. Dynamic addressing
D. Proxy servers connected to it
E. Internal code connecting to an external service
12. When configuring the NICs for the green interface, it is
advisable to use ________.
A. Capacity planning
B. Maximum utilization
C. A static IP address
D. Wirespeed settings
E. Factory defaults
13. Which of the following is not related to SmoothWall
offered services?
A. Web cache/proxy
B. Fingerprint authentication
C. DHCP server
D. DDNS
E. Intrusion detection system
14. What does the Transparent option do when you
configure Web proxying in SmoothWall?
A. It allows you to create a tunnel mode.
B. Every client on the network will be forced to connect
through the proxy server.
C. Every client on the network will be waived access to
the network.
D. The proxy server is in stealth mode.
E. Collisions on the network are not seen.
15. SmoothWall does not work well with Mozilla Firefox
and Google Chrome. True or False?
16. The following are services found in the Services tab of
SmoothWall, except:
A. SQUID
B. Web cache/proxy
C. DDNS
D. Diskcopy
E. SSH
17. The following are tools you can use when
troubleshooting a firewall installation, except:
A. ping
B. traceroute
C. robocopy
D. ipconfig
E. tcpdump
CHAPTER
14 Real-World VPNs
VIRTUAL PRIVATE NETWORKS (VPNs) are a key technology and component in today’s computer security environment.
Recall that the Internet is open to virtually any user, while
an intranet is open only to individuals within your
organization. A third kind of network is the extranet.
Extranets lie somewhere between the Internet and an
intranet.
Companies use extranets to connect with suppliers and
customers, two constituencies that are essential to business
processes. Extranets usually use VPN technology to ensure
confidentiality and integrity of information. VPNs are
becoming an increasingly important component of any
successful business’s information technology plan. VPNs can
substantially enhance the technological architecture of any
organization’s network through the use of efficient and
flexible collaborative technology.
In this chapter, you’ll learn how to do a complete VPN
installation at your organization, from operating systems
and VPN appliances to remote desktops.
Chapter 14 Topics
This chapter covers the following topics and
concepts:
What operating system-based VPNs are
What VPN appliances are
What a remote desktop protocol is
How to use remote control tools
How to perform remote access
What terminal services are
What Microsoft DirectAccess is
What DMZ, extranet, and intranet VPN
solutions are What Internet café VPNs are
What the online remote VPN options are
What the Tor application is
How to plan a VPN implementation
What VPN implementation best practices are
Chapter 14 Goals
When you complete this chapter, you will be able
to:
Create a remote control VPN using Remote
Desktop Evaluate hardware VPN devices
Experiment with Tor
Set up an Internet café VPN client
Assess online remote control products, such
as GoToMyPC and LogMeIn Configure an
IPSec VPN
Operating System–Based VPNs
An operating system–based VPN is very convenient because
you can refer to remote servers by their assigned Internet
Protocol (IP) addresses, rather than use network address
translation (NAT). This avoids problems inherent in
connecting to servers behind a many-to-one NAT
configuration. You can choose from several ways to install a
VPN using computers running commercial operating
systems. You can configure a VPN connection from a client
computer using a variety of operating systems, including
Windows XP, Vista, Windows 7, Linux, and UNIX.
A VPN is a hardware and software solution for remote
workers, providing users with a data-encrypted gateway
through a firewall and into a corporate network. VPNs were
once practical only for large businesses. Today, however,
most businesses—large and small—can afford the
technology, and VPNs are becoming increasingly popular in
the small to midsized business market. VPNs are ideal for
companies with telecommuters, satellite offices, or
employees who travel and need to connect to the corporate
network via the Internet. If used properly, VPNs block
hackers attempting to access your network to steal
sensitive data. They can also save your organization a lot of
money on long-distance phone calls.
As a data-encrypted tunnel over the Internet, a VPN can
offer a robust and secure Internet connection for your
organization. It can also be a cheap alternative to a
dedicated phone line. Some solutions for small companies
start as low as $200. How can you know if your organization
needs a VPN? That depends on some key factors you should
consider before deciding to use a VPN: Does your
organization traffic in sensitive data? For most businesses,
the answer is probably yes. Most companies have customer
information and records, financial records, and proprietary
information in their internal networks that merit protection.
On the other hand, if your organization stores its sensitive
data offline or you don’t have anything online of interest to
hackers, perhaps your organization doesn’t need to invest in
a VPN.
Does your organization employ telecommuters,
traveling employees, or other remote workers? If so, a
VPN can provide two main advantages: It can offer
secure network access to employees away from the
office, traveling or working off-site, and it can extend
the corporate network to them, enabling them to
remain productive outside your office.
Does your company already use Secure Sockets Layer
(SSL)–encrypted Internet pages? Some companies
using Microsoft Exchange servers for e-mail, for
example, may already have the encryption protection
necessary for remote workers—at least for accessing
their e-mail (via Outlook Web Access). In this case, the
VPN is a built-in feature of the operating system.
Businesses without sensitive information can use
operating system–based VPNs and Web-based
alternatives to a VPN for authentication and
encryption, though these may be less secure.
Does your organization have more than a few
employees? A VPN may be an expensive solution for a
company with fewer than five employees, so some
alternatives might work better for such an
environment.
Suppose you’ve considered these issues and concluded that
your organization does need a VPN. In this case, here are six
further important factors to consider: Consider the
difference between a VPN based on customer premise
equipment (CPE) and one based on an operating system.
A CPE solution represents the majority of VPNs on the
market and is commonly referred to as a VPN appliance.
This solution is easy to set up, manage, and maintain.
Windows Server 2008 Network Access is an example of an
operating system–based VPN. If you have a server running
Windows Server 2008, you can install the Network Policy
and Access Services role and configure the server as a VPN
server. This requires some expertise with Windows Server
2008 and can be a little more challenging than a CPE
solution. However, the operating system–based VPN can be
cheaper and easier to manage than a CPE.
Should you install the VPN yourself or use a managed
service? Any competent IT staff can probably install
leading commercial products from vendors such as
Cisco or SonicWall. While the DIY approach provides
more control over setup and usage, installing a VPN
incorrectly can inadvertently open a security hole in
your organization’s network. In addition, the
administration and management of a VPN in-house
can sometimes be complicated. Telecommunications
companies such as Qwest, Verizon, and BellSouth, as
well as several Internet service providers, offer
managed security solutions that can save you time
and money.
Do you have a firewall? A VPN cannot replace a
firewall. Some administrators tend to use a VPN
instead of a firewall, which is not a smart choice. The
purposes of a VPN are to create an encrypted tunnel or
gateway through your network’s firewall and to keep
out hackers. The VPN encrypts the pieces of data, but
the firewall still protects the internal network from
outside threats. A VPN without a firewall doesn’t make
good security sense.
Do you have an operating system–based VPN?
Regardless of the strategy you end up using, make
sure you have an IPSec (Internet Protocol Security)–
compliant operating system. IPSec is a VPN-supporting
technology included in Windows XP, Vista, Windows 7,
Windows Server 2008, and Windows Server 2008 R2.
Used with compatible VPNs, IPSec guarantees the
authenticity, integrity, and confidentiality of network
traffic. Interoperability with a VPN may be an issue
with Macintosh systems or some variants of UNIX or
Linux. If you decided to buy a VPN, make sure it is
compatible with your operating system.
Do you have a wireless local area network (LAN)? The
VPN should operate securely with it. A VPN can
enhance the capabilities of a wireless LAN, but
improperly layering a VPN on a wireless network can
result in security holes. One method places the
wireless LAN outside the firewall, hosting the VPN
behind the firewall to ensure security. Otherwise,
wireless network traffic can access systems behind the
firewall, canceling the benefits of the VPN. Many
organizations use layered firewalls so that the wireless
network is protected from the outside while restricting
access to the inside. In essence, the LAN operates in
what is called a demilitarized zone (DMZ).
Can your organization tolerate a potential decrease in
network performance? A VPN may cause a
performance lag for internal users accessing the
Internet. This happens when 10 to 15 percent of the
Internet bandwidth serves as security overhead. While
VPNs are great for setting up a secure connection,
they can take a measurable toll on connection speed.
The tradeoff is that VPNs are worthwhile investments
for providing a secure connection for remote and
traveling workers.
VPN Usage in Organizations
VPNs serve an organization’s computer network in
two primary ways. They give remote users access to
internal networks or they connect two separate
offices. These are the host-to-gateway model and the
gateway-to-gateway models: Host-to-gateway
VPN—In a host-to-gateway VPN, the mobile user
takes specific actions to connect to the VPN. For
example, the mobile user would first connect to the
Internet from a remote location outside the
organization. Once connected to the Internet, the user
could then initiate the VPN to tunnel through the
Internet. The VPN appliance or server then acts as a
gateway for the user to access resources on the
internal network.
Gateway-to-gateway VPN—A gateway-to-
gateway VPN is used to connect two offices in
different locations. For example, an organization
could have a main office in Virginia Beach and a
remote office in Miami. VPN appliances or servers
can operate in both locations with an always-on
VPN connection between them. Now users in
Miami can connect to resources in Virginia Beach
using this gateway-to-gateway model. In this
model, users in the remote office don’t need to
take any additional steps to connect. The
gateway-to-gateway model is also called a site-
to-site model.
VPN Appliances
One of the easiest and most cost-effective ways to provide
secure access to a network is to purchase an inexpensive
VPN appliance and set it up, which will take about an hour of
your time. VPN appliances can make secure remote access
easy.
When considering the purchase of a VPN appliance,
ensure that you have the required complementary hardware
in place. First, the VPN appliance must have access to the
Internet. Remote users will use the public IP address
assigned to the appliance to connect to it. Second, the VPN
server must have access to the internal network. It will use
internal routing to connect remote users from the Internet to
the internal network. Of course, resources in the internal
network must be on and available for the VPN users to
access them.
Not long ago, VPN appliances were expensive and
required client licenses for each computer in addition to the
appliance itself. VPN technology was too expensive for all
but the largest companies. But new products make it
possible to install a VPN appliance on virtually any size
network for budget-minded organizations and small office,
home office (SOHO) networks. For example, Buffalo
Technology’s 125 High-Speed Mode wireless secure remote
gateway is a VPN gateway/firewall router and a wireless
access point rolled into one neat package. Another great
product is the Linksys WRV54 Wireless-G VPN broadband
router, a similar product that provides robust protection for
your network. You should know that some VPN appliance
products on the market are designed for home installations.
While these products are very easy to install, they allow
only a very limited number of accounts and some of them
provide relatively slow access.
Configuring a Typical VPN Appliance
Most VPN appliances are designed for simple and quick
installations, with plenty of wizards and an automated setup
that makes it easy even for non–computer-savvy people. All
you typically need to do is to plug the appliance into your
network between your ISP provider’s connection and your
internal network. If your network does not have a router or
hub, this device can serve that purpose as well. Once you
turn on the VPN appliance, you can use any computer on
the network to log on to a Web page, complete your
configuration, and add user access accounts.
While VPN appliances are a secure technology, you need
to take basic security measures to preserve the security of
your network and remote connections. When you are
configuring user account access on the VPN gateway
system, for instance, always change the default settings
and never use the default passwords. Also, you should give
each VPN user an individual access account. In practice,
that means if an employee leaves the company, you don’t
have to change the access passwords for everyone—you
just turn off the associated account.
Client-Side Configuration
Once you have configured your appliance, you will need to
configure the software on the computers (clients) connected
to the network. The systems designed for small installations
assume that you will use Microsoft or Macintosh VPN client
software. Some variants of Linux and UNIX may have built-in
client VPN software.
Adding a VPN appliance to your office network gives you
a remote access solution that lets you and your staff be
more productive from anywhere in the world. Not a bad
return on a few hundred dollars and an hour of your time.
Remote Desktop Protocol
Remote Desktop Protocol (RDP) is a proprietary protocol
developed by Microsoft that provides a user with a graphical
interface to another computer. The protocol is an extension
of the ITU-T T.128 application-sharing protocol. Clients exist
for most versions of Microsoft Windows, Windows Mobile,
Linux, UNIX, Mac OS X, and other modern operating
systems. By default, RDP uses TCP port 3389.
Remote Desktop Connection (RDC) is a built-in
application that uses RDP. When RDC is enabled, you can
connect to another computer, log on, and perform almost
any action as if you are sitting in front of the remote
computer. You can do this from a desktop PC to another
desktop PC using the same operating system. In large
organizations, administrators commonly use this to
remotely manage servers from their desktop PCs.
RDC must be enabled on the remote computer. In most
Windows operating systems, you do this by right-clicking
Computer in Windows Explorer or in the Start menu and
selecting Properties. You then change the Remote settings
to allow remote desktop connections. This also opens port
3389 on the remote computer. If the connection goes
through a firewall, port 3389 must also be open on the
firewall. You can launch RDC differently in different Windows
operating systems. However, one method that works in all
current Windows versions is to type MSTSC at the command
line. The initials represent Microsoft Terminal Services
Connection.
The client can run other operating systems, such as Mac
OS, Linux, or UNIX, as long as the terminal services protocol
is supported. When connecting to Windows Server 2008,
Windows Vista, or newer systems, you’ll need to weaken
security to support the non-Microsoft clients.
GoToMyPC is another remote desktop technology that
allows you to remotely access your computer from any
other Internet-connected computer in the world with almost
any operating system through a secure, private connection.
The application is ideal for organizations that need remote
desktop access for up to 20 computers. It’s an easy and
secure remote-access solution that enables you to
conveniently access e-mail, files, programs, and network
resources from home or the road.
NOTE
Microsoft changed the name of Terminal Services to
Remote Desktop Services in Windows Server 2008 R2.
However, the MSTSC command still works. It’s also
worth noting that Terminal Services and Remote
Desktop Services have much broader usage than just
connecting to remote desktops. For example, you can
use these services when a Microsoft server is
configured as VPN server.
Using Remote Control Tools
As companies continue to expand their networks and
increasingly use remote offices and telecommuting, they
need the ability to manage devices from virtually any
location.
Microsoft has offered a built-in remote control solution
called Remote Assistance for modern operating systems
since Windows XP. It allows help desk professionals or other
IT administrators to remotely control a user’s system, while
the user is watching.
For example, a user may not know how to configure an
application. The user calls the help desk for assistance.
Instead of trying to talk the user through the steps, the help
desk pro can show the user how to do it. The help desk pro
can use Remote Assistance to take control of the user’s
desktop. While connected, the helper will have control of the
user’s desktop as long as the user allows it. The user is able
to disconnect the helper at any time.
While the built-in Remote Assistance is great as a free
tool, it doesn’t meet the needs of every organization.
Several third-party tools are available that can provide
additional features. For example, Symantec offers
pcAnywhere as a solution for organizations to access and
securely manage remote computers.
The pcAnywhere program supports multiple platforms for
both host and remote systems, including Windows
(including Vista and Windows Server 2008), Linux, and Mac.
Systems can also be securely accessed from Windows
Mobile/Pocket PC devices and Web browsers. The application
allows organizations to easily connect to servers and
endpoint devices.
Some of what pcAnywhere offers:
A feature-rich, secure, reliable remote control solution.
Compatibility with a heterogeneous host and remote
platform support across Windows, Linux, and Mac OS
X. All hosts can also be accessed from Microsoft Pocket
PC devices or Web browsers.
Support for 64-bit environments.
A gateway option that enables real-time discovery of
and connection to multiple devices behind firewalls
and NAT devices, which mitigates private and dynamic
IP.
Using Remote Access
VPNs allow remote users to connect to a private network
over a public network. The private network is the
organization’s internal network. The public network is often
the Internet, but it’s also possible for an organization to use
leased lines from a telecommunications company to create
the VPN connection.
Remote users can be:
Salespeople on the road
Field technicians
Consultants working in customer work sites
Anyone who needs to have access to internal company
resources while away Since data transmits over a
public network, you need to protect it. VPNs use
tunneling protocols to establish secure connections.
These tunneling protocols include different types of
encryption to protect the data.
The Technology for Remote Use
Several protocols support VPNs. These include:
Point-to-Point Tunneling Protocol (PPTP)—This
protocol supports Microsoft’s remote access servers
and has known issues. It uses Microsoft Point-to-Point
Encryption (MPPE). While PPTP is still used for some
remote access solutions, IPSec and SSL-based
solutions are replacing it.
Layer 2 Tunneling Protocol (L2TP)—Cisco and
Microsoft collaborated to create this by combining
strengths from Cisco’s Layer 2 Forwarding (L2F)
protocol and Microsoft’s PPTP. It uses IPSec for
encryption. A significant weakness is that IPSec can’t
go through a Network Address Translation (NAT)
server, since NAT breaks IPSec.
Secure Sockets Layer (SSL)–based tunneling
protocols—Due to the limitations of IPSec with NAT,
newer tunneling protocols use SSL for encryption. For
example, Microsoft can use Secure Socket Tunneling
Protocol (SSTP). VPN appliances can also use SSL-
based tunneling protocols. SSL requires public key
infrastructure (PKI) support to obtain and use a
certificate.
Internet Key Exchange v2—Internet Key
Exchange v2 (IKEv2) is an IPSec-based VPN protocol
that uses NAT traversal (NAT-T). NAT-T allows IPSec
traffic to pass through a NAT server. IKEv2 provides
significant improvements over IKE and has been
adopted by several companies such as Microsoft, in
Windows Server 2008 R2; Cisco; and Openswan.
Openswan is a Linux-based solution presented later in
this chapter. IKEv2 requires public key infrastructure
(PKI) support to obtain and use a certificate.
Each method has its advantages depending on the access
requirements of your users and your organization’s IT
processes. While many solutions only offer either IPSec or
SSL, some vendors, such as Microsoft and Cisco, offer
multiple technologies integrated on a single platform with
unified management. Offering both IPSec and SSL
technologies can enable organizations to customize their
remote-access VPN without any additional hardware or
management complexity.
SSL-based VPNs also enable remote-access connectivity
from almost any Internet-enabled location using a Web
browser and its native SSL encryption. It does not require
any special-purpose client software to be pre-installed on
the system. This makes remote access SSL VPNs capable of
“anywhere” connectivity from company-managed desktops
and non–company-managed desktops, such as employees’
PCs, contractor or business partner desktops, and Internet
kiosks. Any software required for application access across
the SSL VPN connection is dynamically downloaded on an
as-needed basis, thereby minimizing desktop software
maintenance.
IPSec-based VPNs are the deployment-proven remote-
access technology used by most organizations today. IPSec
VPN connections use pre-installed VPN client software on
the user desktop, thus focusing it primarily on company-
managed desktops. IPSec-based remote access also offers
versatility and customizability through modification of the
VPN client software. Using APIs in IPSec client software,
organizations can control the appearance and function of
the VPN client for use in applications such as unattended
kiosks, integration with other desktop applications, and
other special use cases.
Both IPSec and SSL VPN technologies offer access to
virtually any network application or resource. SSL VPNs offer
additional features such as easy connectivity from non–
company-managed desktops, little or no desktop software
maintenance, and user-customized Web portals upon login.
Choosing Between IPSec and SSL Remote
Access VPNs
Both IPSec and SSL can provide the level of security needed
for a VPN. The primary drawback with IPSec is that it can’t
traverse a NAT server. If you are deploying a VPN server and
want the connection to go through a NAT server, SSL is a
sound solution.
While it is possible to use NAT traversal (NAT-T) to allow
IPSec traffic to pass through a NAT server, be aware of some
issues with it. For example, Microsoft has specifically
recommended that NAT-T not be used, though IT
professionals still recommend NAT-T with non-Microsoft
hosts.
Terminal Services
Terminal Services is a built-in Microsoft Server product with
multiple uses. It works in two modes: Terminal Services for
Administration and Terminal Services for Applications. Other
vendors also use terminal services for remote applications.
Terminal Services for Administration allows
administrators to connect remotely into servers from their
desktop computers. It allows them to remotely administer
the server as described in the “Remote Desktop Protocol”
section earlier in this chapter.
Terminal Services for Applications is the focus of this
section. It allows a single server to host one or more
applications for remote users. For example, suppose a
legacy application does not run on Windows 7. A Terminal
Services server could be configured to host the application,
and multiple Windows 7 clients could then connect to the
server to run the application. Each client would run a
separate instance of the application in a separate memory
space.
It’s also possible for a Terminal Services server to host
entire desktops. For example, older computers may be
running Windows 2000 and they don’t have the hardware to
support Windows 7. An organization can configure a
Terminal Services server to host Windows 7 desktops for
these clients. The users would start the Windows 2000
computer, connect to the Terminal Services server, and then
run a Windows 7 desktop.
As mentioned earlier, Microsoft renamed Terminal
Services to Remote Desktop Services when it released
Windows Server 2008 R2. Windows Server 2008 R2
increased the capabilities and features, but supports the
older capabilities and features.
Over the past few years, many software publishers have
experimented with offering hosted services. The basic idea
behind hosted services architecture is that an organization
does not have to purchase licenses for software applications
or have the hassles of installing or maintaining those
applications. Instead, an ISP or a software vendor leases the
applications to the organization. The application actually
runs on the service provider’s servers, and users interact
with the application over the Internet.
This arrangement has some drawbacks, however. For
instance, terminal services take an application’s
configuration out of an organization’s direct control. It’s not
uncommon to hear about network administrators who were
put out of a job because the companies that they worked for
decided to outsource all of their applications to a hosting
provider. Another compelling argument against the use of
hosted services has to do with service availability. If your
Internet connection goes down, then nobody can access the
hosted applications. Of course, Internet service is more
reliable in some areas than others.
Terminal services for hosted applications have many
benefits. The primary one is that the service provider takes
care of all of the application maintenance for you. Many of
these benefits are things that you just don’t get if you install
the applications locally on each individual workstation or if
you outsource your applications to a hosting provider.
Microsoft products can provide hosted applications using TS
RemoteApp and TS Web Access.
TS RemoteApp
One of the challenges with running applications on remote
servers is that it looks odd to users and they have trouble
adapting. TS RemoteApp is a Microsoft solution that runs on
a Microsoft Terminal Services server but appears, to end
users, as if it were actually running on their systems.
They don’t need to open a Terminal Services session, but
instead launch the application from their Start menu or a
shortcut on their computer. The application appears in a
window on the users’ computers just as if it were running on
the local computer.
TS Web Access
An extension of TS RemoteApp is TS Web Access. This allows
TS RemoteApp applications to launch from a Web browser.
This provides many possible benefits.
The TS RemoteApp applications can intertwine into Web
pages and appear to launch from a Web server. In other
words, the clients use a Web browser to access a Web site.
From within this Web site, they can then click on a link for
the TS RemoteApp application. TS WebAccess can be
configured in an internal intranet or accessible to users from
the Internet.
Notice that TS Web Access allows remote clients to
connect to internal resources without the need for a VPN.
Depending on what your remote clients need, this is a
suitable substitute.
Microsoft DirectAccess
DirectAccess is a newer Microsoft solution that can be used
as an alternative to a traditional Internet Engineering Task
Force (IETF) VPN. It allows remote clients to connect to
internal servers without initiating a VPN connection. As long
as clients have Internet connectivity, they will be able to
access internal resources using DirectAccess.
Microsoft introduced DirectAccess in Windows 7 and
Windows Server 2008 R2 products. Once it’s configured on
the clients and servers, it is relatively invisible to the clients.
Client computers connect to the DirectAccess computer,
which acts as a gateway to internal resources. Only
resources configured to be accessible with DirectAccess can
be accessed from clients. In other words, you could have 10
servers in the internal network, but choose to make only a
few of them accessible.
For example, you could configure a Microsoft Exchange
server (used for e-mail) with DirectAccess. When a
DirectAccess-enabled Windows 7 client connects to the
Internet, it would automatically connect with a DirectAccess
server. When the user starts Microsoft Outlook, DirectAccess
automatically makes the connection to the internal Microsoft
Exchange server. In other words, users can be on the road
and still use their e-mail client just as if they were in the
office. The same process works for any servers that an
administrator wants to make accessible on the Internet.
DirectAccess can be enhanced by combining it with
Forefront Unified Access Gateway (UAG). UAG gives
administrators more control over the connections and
enhances security. When UAG is run, a UAG server acts as
the gateway between the client and the internal network.
This is similar to how DirectAccess works by itself in that
clients don’t need to establish a separate VPN connection.
A significant added benefit of DirectAccess is that
administrators can execute control over the remote clients.
For example, in a Microsoft environment, Group Policy can
ensure that a system has minimum-security settings. While
this is normally not possible for systems that are
disconnected from the internal network, DirectAccess with
UAG allows an administrator to apply Group Policy to these
remote computers.
It’s also possible to use Network Access Protocol with
DirectAccess. You can create policies to ensure that the
remote system has other security measures in place. For
example, you can ensure that the system is up to date with
current security updates and that it has up-to-date antivirus
software installed and enabled.
DMZ, Extranet, and Intranet VPN
Solutions
A demilitarized zone (DMZ) is a physical or logical
subnetwork that contains and exposes an organization’s
external services to a larger untrusted network, usually the
Internet. The purpose of a DMZ is to add an additional layer
of security to an organization’s LAN. An external attacker
can gain access to equipment in the DMZ, but not parts of
the network behind the firewall.
For example, public-facing servers that need to be
accessible from the Internet are placed in the DMZ. This
could include Web servers, e-mail servers, FTP servers, and
more. Organizations that employ VPN servers for remote
users often place them in the DMZ.
In a network, the hosts most vulnerable to attack are
those that provide services such as e-mail, Web, and FTP
servers to users outside of the local area network. Because
of the increased potential of these hosts being
compromised, they are placed into their own subnetwork to
protect the rest of the network if an intruder were to
succeed.
Hosts in the DMZ have limited connectivity to specific
hosts in the internal network, though communication with
other hosts in the DMZ and to the external network is
allowed. For example, a Web server in the DMZ may be able
to connect to a database server in the internal network, but
not to any other hosts in the internal network. This allows
hosts in the DMZ to provide services to both the internal
and external network, while an intervening firewall controls
the traffic between the DMZ servers and the internal
network clients.
Intranet VPNs
An intranet is an internal network. While users within the
intranet can access the Internet using different resources
such as a proxy server, access to the internal network is
severely restricted. Since traffic in the intranet is primarily
from internal clients, the intranet is a trusted zone and
needs fewer security measures.
An intranet VPN is a VPN that connects two or more
internal networks. Earlier in this chapter, you learned about
the concept of gateway-to-gateway VPNs. A gateway-to-
gateway VPN provides connectivity between two locations
such as a main office and a branch office. This is also known
as an intranet VPN.
It’s important to realize that even though the VPN may
be called an intranet VPN, it will still have to traverse a wide
area network (WAN) link. Most organizations will rent access
to this WAN link and it’s very rare that a company has
exclusive access to it. In other words, the WAN link will be
accessible to users outside the organization. The same level
of security measures used in a DMZ VPN should also secure
an intranet VPN.
Extranet VPNs
Extranet VPNs link customers, suppliers, partners, or
communities of interest to a corporate intranet over a
shared infrastructure. For example, an organization may hire
a consulting company to look at different processes within
the organization and provide recommendations to improve
them. The organization could create an extranet VPN to
allow the consultants access to some internal resources.
Extranets are commonly configured to connect via the
Internet, but can use leased lines or even dedicated
connections. Extranets differ from intranets in that they
allow access to remote users outside of the enterprise.
Figure 14-1 illustrates an extranet VPN topology. Using
digital certificates, clients establish a secure tunnel over the
Internet to the enterprise. A certification authority (CA)
issues a digital certificate to each client for device
authentication. The CA server checks the identity of remote
users and then authorizes remote users to access
information relevant to their functions.
FIGURE 14-1
An extranet VPN topology.
Internet Café VPNs
An Internet café is a public location that sells Internet
access, often by the minute. The café will often sell typical
café items such as coffee and sandwiches. However, with
the explosion of wireless in recent years, many eateries
provide free wireless Internet access to bring in customers.
For example, many Starbucks and McDonald’s locations
provide free WiFi.
The challenge when using an Internet café or even an
open wireless connection at an eatery is security. Others in
the local area may be able to view data in the connection
unless it’s encrypted. Since the majority of Internet traffic is
not encrypted, attackers may be able to gain valuable
information by capturing another user’s Internet use.
The owner of the Internet café can capture any data that
passes through with a free packet sniffer such as Wireshark.
Additionally, many free wireless sniffers are available that
an attacker can use over a shared wireless connection to
capture all of the traffic.
An alternative is to use an Internet café VPN connection.
As soon as you connect with the Internet café or the
wireless connection, you would connect to the Internet café
VPN. This would be hosted at your organization. It will
encrypt all the traffic and prevent any sniffing attacks.
For example, HotSpotVPN is a product your organization
can purchase and use as an Internet café VPN connection.
Once you set it up, you can direct your users to connect to it
for all Internet access.
NOTE
You can get more details about HotSpotVPN at
http://www.hotspotvpn.com/overview/.
Online Remote VPN Options
GoToMyPC, LogMeIn, and NTRconnect are remote access
and control solutions that which all perform extremely well.
Each product is easy to set up and use, and all offer a
similar set of features. While each product is similar, you
should know about a few noteworthy differences.
Security
While each technology handles security slightly differently,
all are extremely secure and can be safely used in any
environment. LogMeIn and NTRconnect do offer a few more
features than GoToMyPC. Both LogMeIn and NTRconnect
provide 256-bit end-to-end encryption. GoToMyPC, on the
other hand, provides only 128-bit. For example, LogMeIn
and NTRconnect allow you to restrict the times that your
computer can be remotely accessed and specify the IP
addresses from which it can be remotely accessed—
functionality that is not offered by GoToMyPC. Also,
NTRconnect is the only product to provide keycard security.
If you feel that you need to limit remote access times and/or
restrict access to only certain IPs, then you will want to
consider either LogMeIn or NTRconnect.
Wake-on-LAN Support
Wake-on-LAN is an extremely valuable feature. Most
computers include power management capabilities, allowing
them to turn off or go to a low power state when they aren’t
being used for a time. These computers can then be
awakened when they are sent a specific string of bits in a
“magic packet.” When the computer receives the magic
packet, it wakes up. If it was off, it will turn on. If it was in a
lower power state, it will go to a full-power state.
Of the products mentioned, only NTRconnect enables you
to remotely start your computer. To use GoToMyPC or
LogMeIn, the remote computer must be switched on. If you
work away from your home or office computer for extended
periods and switch off your computer while away, you’ll
probably find NTRconnect’s wake-on-LAN support to be a
real benefit.
File Sharing
LogMeIn provides file-sharing functionality that enables you
to e-mail a link to a file on your computer that the recipient
can use to download the file (directly from your computer)
at any time. To share files in this manner, you do not need
to invite the person to share your desktop and you do not
need to be at your computer at the time he or she
downloads the file. This feature is especially useful if you
frequently need to share files that are too big to e-mail.
This feature is not available with GoToMyPC or
NTRconnect.
Remote Printing
GoToMyPC and LogMeIn enable you to easily print a
document on the host using the printer attached to the
client. However, NTRconnect does not support this feature.
NTRconnect’s lack of support for remote printing is not too
much of a problem, as you can easily copy a document from
the host to the client (and then print it). That said, if remote
printing is something that you need to do on a regular basis,
you’ll probably prefer the convenience of GoToMyPC or
LogMeIn.
Mac Support
With all three products, you can use a Mac as the client, but
only NTRconnect enables you to use a Mac as the host. So,
if you need to be able to remotely access a Mac,
NTRconnect is your only choice.
The Tor Application
Tor is an application that uses “onion routing.” Generically,
onion routing was designed as an architecture to limit a
network’s vulnerability to eavesdropping and traffic
analysis. It uses multiple proxy servers or relays to provide
anonymous connections. Each proxy server knows only the
details from the previous proxy server or the next proxy
server.
The proxy servers provide anonymity for users by
requesting access to resources and making it appear as if
the proxy server is requesting the access, not the original
user.
FYI
Data leakage is also a common problem with peer-to-
peer (P2P) networks such as BitTorrent. Users share
data they didn’t intend to. As an example, the Top
Secret plans for the U.S. president’s helicopter were
leaked through a P2P network and found on servers in
Iran. Some people think that organizations forbid these
types of applications to prevent piracy of copyrighted
material. However, the primary reason is due to the
inherent security risks that most people simply don’t
understand. Of course, there’s nothing wrong with
helping prevent the theft of copyrighted material in the
process.
Tor was derived from the Onion Routing Project managed
by the U.S. Naval Research Lab. However, Tor is not an
acronym for The Onion Routing project. Instead, it is simply
a brand name—similar to Kleenex for facial tissues. The
torproject.org Web site still uses an onion as a logo;
however, Tor is not all uppercase.
The goal of Tor is to allow users to browse the Internet
anonymously. Instead of going directly to an Internet site,
Tor uses the computers of other Tor users as relays or
proxies. Any single Tor connection will go through multiple
other computers.
Interestingly, even though the U.S. Naval Research Lab
originally designed Tor, it’s forbidden on most government
systems. The primary reason is related to data leakage.
While the Tor network does provide a level of anonymity, the
user never knows what other computers the request will go
through. Data sent and received can be captured by any of
these computers.
For example, in 2007 Dan Egerstad, a security
professional in Sweden, collected usernames and passwords
for 100 e-mail accounts of users at different embassies. He
simply installed Tor on his system and then captured all the
data that went through it. His computer was used as a proxy
in the Tor network for thousands of users, and a simple
protocol analyzer captured the data. More than the
credentials, he also captured a significant number of
sensitive e-mail messages from embassies and Fortune 500
companies.
NOTE
You can download the Openswan RPM package at
www.openswan.org. The RPM package has an
extension of .rpm (from the original Red Hat Package
Manager standard used by many Linux distributions
today). Be aware that to download the RPM version of
Openswan you must have the IPSec-tools RPM package
installed on your system.
Planning a VPN Implementation
VPNs create a secure data link with a branch office, remote
employee, business partner, or customer that will enable or
require server access behind a firewall. VPNs can provide a
secure and encrypted data stream between a firewall and a
remote client or server.
This section provides you with the configuration of a
permanent site-to-site VPN tunnel using Openswan, one of
the most popular VPN packages for Linux.
Requirements
For this implementation you will need Linux kernel 2.0, 2.2,
2.4, or 2.6.
For Linux kernels 2.0 or 2.2, use Openswan 1.0.10.
For Linux kernels 2.4 and 2.6, use Openswan 2.4.x.
For FreeBSD, OpenBSD, NetBSD, and OSX, use
Openswan 2.5.x.
Before you attempt this simple SOHO Linux VPN, keep the
following in mind:
The IPSec protocol on which VPNs are based will not
tolerate network address translation (NAT) of its data
packets. If your firewall does NAT, then you’ll have to
disable it specifically for the packets that will traverse
the VPN.
You should set up your Linux VPN box also as a
firewall. Configure and test the firewall first, and then
configure the VPN.
The networks at both ends of the VPN tunnel must use
different IP address ranges. For example, the
organization’s internal network may be using an IP
address range of 192.168.0.1 to 192.168.0.254. The
other network must use a different address range,
such as 192.168.1.1 through 192.168.1.254. To avoid
confusion, you may want to use completely different
private address ranges for each network such as
172.16.y.z. or 10.x.y.z.
Permanent site-to-site VPNs require firewalls at both
ends that use static IP addresses.
Figure 14-2 depicts an Openswan sample topology diagram
of a VPN between two environments.
NOTE
In this implementation, the external IP of the machine
is listed as 12.34.56.78. The gateway IP is listed as
12.34.56.1. The internal IP of the VPN server (since it
has a NIC on both the inside and the outside) is
192.168.1.1 in this example. You can change it to fit
your needs.
FIGURE 14-2
Openswan sample topology diagram.
FIGURE 14-3
Installing Openswan from the source.
FIGURE 14-4
Using Openswan’s userland-only install.
Installation
You can install Openswan in two different ways: by
performing an RPM install or by installing it from source
libgmp development libraries.
Performing an RPM Install
You’ll find different instructions for installing Openswan
depending on what version of UNIX/Linux you’re using.
Openswan hosts a Wiki site that includes instructions for
many different types of RPM installations at
http://wiki.openswan.org/. This site also includes a lot of
other details on installing, configuring, and troubleshooting
Openswan.
Install from the Source
As root, unpack your Openswan source somewhere in your
drive, such as /usr/src. Figure 14-3 provides an example.
You now need to choose your install method. You can
choose userland-only, for 2.6 kernels, or a KLIPS install for
kernels 2.6 or earlier (2.0, 2.2, and 2.4). If you decide to use
the userland-only install, change your new Openswan
directory, and then make and install Openswan’s userland
tools, as depicted in Figure 14-4.
Once you finish entering these commands you should be
done with the install. Now all you need to do is to start
Openswan and test your new install. If you decide to use
KLIPS, you will have to make a modular of it, along with
other Openswan programs you’ll need for the VPN. To do so,
enter the command sequence shown in Figure 14-5, which
will change to your new Openswan directory, make the
Openswan module, and install it all.
NOTE
Kernel IP Security (KLIPS) modifies the Linux kernel to
support IPSec protocols.
FIGURE 14-5
Performing an Openswan’s KLIPS install.
FIGURE 14-6
Link KLIPS statically into your kernel.
FIGURE 14-7
Starting Openswan.
At this point, you can actually enhance the security of
the VPN by using NAT traversal (NAT-T) support. NAT-T is a
method for encapsulating IPSec ESP packets into UDP
packets for passing through routers or firewalls employing
Network Address Translation (NAT). To deploy NAT-T, you
need to patch and rebuild your kernel. However, rebuilding
the kernel is a risky operation and so should be approached
cautiously.
To link KLIPS statically into your kernel (using your old
kernel settings) and install other Openswan components,
just follow the commands listed in Figure 14-6, then reboot
your system and test your install.
NOTE
For more information on installing NAT-T, check the
Openswan Web site at
http://wiki.openswan.org/index.php/Openswan/NATTrav
ersal.
Start Openswan
To start Openswan, enter the command shown in Figure 14-
7.
This step is not necessary if you have rebooted your
system, as Openswan will launch automatically after it’s
been successfully installed.
You can take additional steps to secure the VPN
connection. For example, you can use certificate-based keys
to secure the connection. You can follow the steps in an
excellent walk-through here:
http://www.linuxhomenetworking.com/wiki/index.php/
Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs.
Deployment
Before you deploy your VPN, you need to start Openswan on
both VPN devices for the new /etc/ipsec.conf settings to take
effect. You can do that by issuing the following commands:
Once that’s done, it’s time for you to initialize the tunnel. To
initialize it you can use the ipsec command to start the
tunnel net-to-net. Be sure to issue the command
simultaneously on the VPN boxes at both ends of the tunnel.
The IPSec SA established message highlighted in Figure 14-
8 signifies a successful deployment.
FIGURE 14-8
Successfully deploying the Openswan VPN.
Testing and Troubleshooting
To check that you have a successfully installed VPN you
should run the command ipsec verify. If your installation was
successful, you should see a screen display similar to the
one depicted in Figure 14-9.
If any of these first four checks fails, check the
Troubleshooting section below on the installation screen.
Firewalls can interfere with Openswan, so you’ll want to
pay attention to your firewall settings. Make sure you allow
UDP 500 and ESP (protocol 50) through the firewall. This is
necessary because for IPSec traffic to traverse through a
firewall, you need the following ports/protocols open in both
directions: Protocol 50 ESP
Protocol 51 AH (optional)
UDP port 500 IKE
UDP port 4500 (if you are using NAT traversal to tunnel
through NAT/other firewalls) The Smoothwall firewall
works well with Openswan. You will need to do the
following: Create some name for the remote VPNs in
the zones file.
Describe which IPSec interface to use based on the
names in the zone file.
Describe how the networks named in the zones file
interact in the policy file.
Define the public IP address of the remote sites in the
tunnels file.
Smoothwall automatically makes the rules necessary to
allow IPSec for the networks named in the tunnels file.
NOTE
Another alternative for a firewall to work with
Openswan is Shorewall. This firewall also works well
with IPSec and Openswan. Best of all, you will find
comprehensive documentation at their Web site at
http://www.shorewall.net.
FIGURE 14-9
Testing Openswan’s install.
TABLE 14-1 VPN implementation best practices.
DO DON’T
Passwords Do change the
original
password to
something you
will remember.
Don’t write down
your password
unless it will be
stored in a safe.
Software
Do buy or
upgrade
antivirus
detection
software.
Do update your
virus definitions
daily.
Do check
frequently for
updated OS
(operating
system)
patches and
application
patches.
Don’t go without
antivirus software.
Don’t ignore OS
and application
updates/patches.
Don’t use unsafe
applications, such
as peer-to-peer
file sharing tools
or applications of
unknown origin.
Firewalls
Do enable
built-in
firewalls. Do
use external
standalone
firewalls
whenever
possible.
Don’t go without
either a built-in or
standalone
firewall.
Hardware If connecting
via a wireless
interface, do
disconnect or
disable the
wired network
interface.
If connecting
via a wired
Don’t enable or
connect more
than one network
interface while
using a VPN-
connected
computer.
Don’t allow people
to use the
interface, do
disconnect the
wireless.
Do use the VPN
for work
purposes only.
computer who
might do so
unsafely.
Services
and
protocols
Do disable any
unneeded
services or
protocols.
Don’t run default
services and
protocols if they
aren’t needed.
VPN Implementation Best Practices
The VPN is only as safe as the machine it is used on. Before
deploying a VPN, review the implementation best practices,
listed as dos and don’ts, in Table 14-1.
Additional steps you can use for the VPN server include:
Use strong authentication—Ensure that only
authorized clients can connect. Since the VPN server
will have a public IP address, it’s accessible from an
Internet user anywhere in the world. If someone can
easily log on to the VPN server, that person can easily
access your Internet network.
Use strong encryption—The two primary encryption
protocols used in VPNs today are IPSec and SSL. Either
of these is strong enough to protect a VPN, but other
protocols should also be carefully evaluated.
Protect the VPN server behind a firewall—
Whether you’re using a host-to-gateway or gateway-
to-gateway configuration, you should not put the VPN
server directly on the Internet. Instead, place it behind
a firewall such as in a DMZ configuration. This will
provide a layer of protection from Internet attacks.
CHAPTER SUMMARY
This chapter discussed the different types, design,
configuration, implementation, and testing of VPNs. It
also discussed the main VPN technologies available
on the market and best practices in their
implementation. VPNs can provide remote clients
access to your internal network in a host-to-gateway
configuration. They can also provide access between
two offices in the same organization using a gateway-
to-gateway model.
Many different VPN applications are available.
Microsoft provides VPN solutions built into the server
operating system. Cisco and other vendors sell VPN
appliances you can install and configure easily. You
can also use UNIX or Linux systems and install free
VPN solutions such as Openswan.
VPNs are increasingly becoming a part of everyday
life on the Internet. Many people use them to gain
access to resources in their offices, such as e-mail
servers and other intranet resources. This trend is
certain to become more popular as many companies
are finding it cheaper for their employees to work
from home, relieving them of the need to lease
additional office space.
Site-to-site VPNs will also continue to be deployed as
companies both small and large find it increasingly
necessary to share access to their main networks
with remote offices. One notable area is in the realm
of IP telephony, where VPNs enable all remote offices
to use a single IP switchboard at the center of a VPN
hub and spoke network. Intra-office communication is
encrypted and the use of a single switchboard saves
money.
KEY CONCEPTS AND TERMS
Customer premise equipment (CPE)
Gateway-to-gateway VPN Host-to-gateway VPN
Internet Key Exchange v2 (IKEv2)
CHAPTER 14 ASSESSMENT
1. ________ provide(s) secure communications between
external users and internal servers located behind a
firewall. (Multiple answers may be correct.) A. VPNs
B. IPSec
C. Intranets
D. Extranets
E. SSL
2. A desirable feature of an operating system–based VPN
is the ability to refer to remote servers by their network
address translated IP addresses. True or False?
A. True
B. False
3. A VPN is also known as:
A. A neural network
B. A data-encrypted tunnel over the Internet
C. A file sharing and printing server
D. A bastion host
E. None of the above
4. Encrypted communications using Web browsers usually
use the ________ protocol.
5. An easy and cost-effective way to secure access to a
network is by purchasing (an) inexpensive ________.
A. Switch
B. Router
C. Antivirus software
D. Remote terminal
E. VPN appliance
6. Most VPN appliances are designed for complex
installations. True or False?
7. VPN appliances are ________.
A. Not readily available
B. OS specific
C. Very expensive
D. Secure technologies
E. A and B
8. What does RDP stands for?
A. Remote Desktop Processing
B. Remote Desktop Protocol
C. Radio Demilitarized Processing
D. Recovery Dispatching Process
E. Remote Dial-up Process
9. Another name for Terminal Services is:
A. Remote Dial-up System
B. Remote Desktop Services
C. Remote Desktop System
D. Radius Dial-up Services
10. GoToMyPC is a remote desktop technology that allows
you to remotely access your computer from any other
Internet-connected computer in the world with almost
any operating system through a secure, private
connection.
A. True
B. False
11. What are two primary methods for deploying remote-
access VPNs?
A. SSL and SSH
B. SSL and API
C. IPSec and SSL
D. IPSec and SSH
E. None of the above
12. Terminal Services provides the ability to:
A. Host multiple, simultaneous client sessions
B. Implement software bugs
C. Implement dynamic addressing
D. Sync proxy servers
E. All of the above
13. Terminal Services RemoteApp applications appear to
users as if the applications are installed locally when
they are actually running a remote server.
A. True
B. False
14. Microsoft’s DirectAccess:
A. Is an alternative to a traditional VPN
B. Is not a VPN
C. Is a mix of Microsoft Access database served through
a VPN
D. Is a DDNS
E. Is an intrusion detection system
15. Users must have physical connectivity with the
internal network for the DirectAccess connection to be
established.
A. True
B. False
16. When performing a download and install of the RPM
version of Openswan, you do not need to have the
IPSec-tools RPM package installed on your machine.
A. True
B. False
17. What are the two methods of installing Openswan?
A. KLIPS and IPSec
B. RPM and source libgmp development libraries
C. By hand and automatically
D. Remotely and through a diskette
E. None of the above
18. To check that you have a successfully installed
Openswan VPN you should run the command ipsec
verify.
A. True
B. False
CHAPTER
15 Perspectives,
Resources, and
the Future
IN YOUR CAREER as a security professional, you will make it your business to know how to secure your organization’s IT
assets, networks, and systems. You are already learning a
great deal about the tools, technologies, processes, and
procedures currently available. In your work, you will know
how to use firewalls to secure the perimeter of the network
and VPNs to secure data in transit. A deep knowledge of the
current security landscape is vital to your professional
success. But you need to know what’s on the road ahead,
too. In this chapter you’ll learn about what’s next.
Today’s information security professionals face a
daunting task. Not only do you need to understand how to
secure a complex, diverse, and rapidly changing IT
environment, but you also need to be aware of the
challenges and threats to come. An in-depth understanding
of security technologies such as VPNs and firewalls and of
threats like malware and social engineering provides the
foundation of your arsenal. To be truly successful, however,
you also need the ability to identify and respond to trends in
both the technologies and the threats under development.
To keep up with attackers, you need to know what’s coming
and where to get reliable, current information.
Throughout your career as an information security
professional, you will encounter situations in which you will
need to apply security best practices to new technologies or
new architectures. You may find that you are conducting
investigations, trying to determine how your infrastructure
was compromised. You may be monitoring new attacks and
trying to develop new defenses. Whatever challenges you
face in the future will require that you leverage the
experience, understanding, and best practices you’ve
learned to ensure you are effective against new risks and
threats.
Chapter 15 Topics
This chapter covers the following topics:
What the future holds for network security,
firewalls, and VPNs
What some resources sites for network
security technologies, techniques, and
threats are
What some useful network security tools are
What the impact of ubiquitous wireless
connectivity is
What potential uses of security technologies
are
What specialized firewalls are available
What the impact of anti-hacker technologies
like honeypots, honeynets, and padded cells
is
What emerging network security
technologies are
Chapter 15 Goals
When you complete this chapter, you will be able
to:
Discuss the different types of integrated and
specialized firewalls, as well as the
advantages and disadvantages of each
List additional sources of information related
to network security
Describe emerging IT and security trends and
their impact on network security
Identify challenges and advantages
presented by the new technologies and
emerging threats to network security
Understand the difference between an IDS
and an IPS
Discuss the future of network security,
firewalls, and VPNs
What the Future Holds for Network
Security, Firewalls, and VPNs
In this chapter, you will be looking to the future of network
security, firewalls, and VPNs.
How does a security expert discern what the future
holds? A number of factors should influence your planning
as you try to draw a road map for your information security
strategy:
Historical progression of threats—If you are
familiar with how threats have progressed over time,
you will have a better understanding of where those
threats may be headed in the future. For example, 10
years ago, virtually all malware attacks were focused
on operating systems. Today, malware attacks go after
applications far more than operating systems.
Browsers are a particularly popular target for attacks
today.
Your industry—Each industry has a different focus
when looking to the future. A bank will have very
different requirements from a shoe store, for example.
Understand your industry, network with your peers,
and make sure you are looking at the proper
framework for your planning.
Experts—It’s always a good idea to see what the
people who predict the future of the industry think
before doing your planning. While experts can
disagree over certain specific predictions, if you keep
an eye on the major information sources (some of
which are provided later in this chapter), you will find
you can develop a pretty good idea of where
information security is headed.
Vendors—Since they are frequently trying to sell you
their next-generation solution, vendors usually have a
biased view of the future. They can provide valuable
information for your planning, however. If the vendors
you work with or follow are all targeting a particular
threat or technology, they view it as an area to
generate revenue. If an industry targets a specific area
as a source of revenue, it’s a good bet that a threat
lurks there somewhere.
Role of cybersecurity in national security—In his
State of the Union Speech in February 2013, President
Obama highlighted the role of cybersecurity in the
future of the United States. While the experienced
security professional knows that nothing new has
really happened, public awareness, along with that of
lawmakers, heads of organizations, and—importantly—
employers has increased dramatically. Every major
publication from The New York Times to The Wall
Street Journal and everyone in between has stated
that there are not enough, and will not be enough,
trained security professionals to fill the need. This
reality must be as important as a part of your own
career planning as it is in planning to protect your
organization.
Here are some of the areas you should pay attention to as
you plan your information security strategy.
Threats
One area that is evolving extremely quickly is the variety of
threats to your infrastructure. Several years ago, the most
prevalent threats were from unsophisticated attackers
whose main goal was to accomplish something they could
brag about in chat rooms with their buddies. Today,
organized crime has zeroed in on the huge amounts of
money to be made in computer hacking. You now see
targeted attacks against specific industries and companies;
viruses that target credit card numbers, bank account
information, and Social Security numbers; and rootkits that,
once installed on a computer, turn it into a host the attacker
can control remotely to attack other systems and networks.
Some attackers will threaten to crash networks with denial
of service attacks unless the system owner pays extortion
money—the high-tech equivalent of a protection racket.
In the future, you will see more resilient networks that
will mitigate the risk of traffic-based attacks, more secure
operating systems and applications to resist malware, and
intrusion prevention systems that will respond instantly to
attacks, choking them off before they can damage your
infrastructure.
Firewall Capabilities
Firewalls have been adding capabilities since they were first
introduced. Early firewalls contained some limited filtering
and NAT capabilities and not much else. You will learn about
the wide range of today’s firewall capabilities and
specialties later in this chapter.
Encryption
Encryption is a constantly evolving standard. In 1977, the
Data Encryption Standard (DES) was specified in the Federal
Information Processing Standards (FIPS) Publications. It
became a national standard. The standard has since
changed from DES, a 56-bit algorithm, to 3DES, an effective
168-bit algorithm, to the Advanced Encryption Standard
(AES), which supports a 256-bit algorithm. The problem with
encryption is the constantly improving processing power of
computers. As computers get faster and more capable, with
bigger and bigger memory space, encryption algorithms
become easier and easier to break through brute force and
other techniques.
Encryption’s popularity has grown as concerns about
protecting data at rest, in transit, and while archived have
come to the forefront of many industries. How many stories
have you seen about the stolen laptop with 100,000 Social
Security numbers on it or an application compromised by an
attacker able to read data directly from a hard drive
because it was stored in cleartext? Today, some government
agencies (the Department of Defense, for example) require
full-drive encryption for all laptops.
Recognizing the growing need for encryption, the
industry is responding quickly. The AES standard was
designated as the replacement for DES. It is designed to
scale upward with longer keys. Keep in mind as you look
into encryption solutions whether they support AES or an
equivalent algorithm, and be sure that you encrypt your
data everywhere it’s vulnerable. The days of relying on your
VPN as the only data protection are gone. You need to
secure data with encryption everywhere it can be accessed.
Authentication
Another area where you can expect to see dramatic
changes in future capabilities is in authentication, especially
with respect to identity and access management. In the
past, much of user security was based on a user ID and
password. Years were spent trying to teach users what a
strong password is, why they need a strong password, and
why they need to change their passwords every 90 days.
The effort has been largely ineffective. Users still choose
poor passwords, and even when they select strong
passwords, the passwords can still be cracked with sufficient
computer power.
The other challenge associated with authentication is
actually a user-management issue. All too often in a
complex environment, the creation, permissioning,
management, and eventual retiring of user accounts doesn’t
work. Accounts retain permissions long after users move on
to other roles, accounts remain on systems long after
employees have left the organization, and, in many cases,
no auditing of actions using privileged accounts takes place.
Collectively, these critical tasks are known as identity and
access management.
How will these challenges evolve in the future? One trend
is moving away from passwords to tokens, smart cards, and
biometric authentication as a replacement to user ID and
password solutions.
On the identity and account management front, a
number of solutions automate these activities, providing full
account life-cycle management and the associated auditing
capabilities many companies look for. The one challenge
with these solutions is that, due to the sophistication of
most corporate computing environments, they are very
complex to install and maintain. It’s not just a matter of
automating the creation of Active Directory accounts in
most cases. Companies have multiple application systems
and authentication requirements. Making all of these
components work together is not easy. Once you get them
working together, however, you’ve removed a significant
threat to your security landscape.
Metrics
One of the biggest complaints from CIOs about information
security is the lack of measures for the success of a
program. Information security has moved from being an
esoteric discipline practiced by a few misunderstood experts
to a core business function vital to supporting the bottom
line. While this evolution has been long overdue, today
management expects you to quantify your contribution to
the company and justify the expenditures they make to
support security.
The good news is that the industry has been moving this
direction for some time and has developed a number of
performance metrics. The most popular is the Information
Technology Infrastructure Library (ITIL), which is a set
of concepts you can use to formalize your security
management practice and the associated reporting. In
addition, numerous solutions allow you to automate not only
these processes, but also the associated measurements.
Focus
Another area of significant evolution in information security
is in the nature of what you are trying to protect. Initially,
information security was all about keeping the bad guys out
of your network. As a result, companies invested significant
amounts of money in firewalls and other network security
technologies.
Then focus shifted from the network to the host,
however, and organizations focused more on managing
patches, hardening operating systems, and installing host-
based firewalls.
Once the industry secured the host, attackers shifted to
threatening the applications running on those hosts. IT then
started focusing on integrating security into the software
development lifecycle, testing and evaluating code, hiring
penetration testers to try to break code deliberately, and
deploying firewalls and proxy servers specifically to secure
applications.
The next shift in focus for information security is a
growing focus on what is truly valuable—the data itself.
Ultimately, all the measures developed to date, from the
network firewalls, to the host hardening, to the penetration
testing, have all been about securing the data. The industry
is now moving toward a data-centric security model, which
is a significant paradigm shift from previous models. A data-
centric model will force companies to focus on classifying
and applying values to their data. While this will
undoubtedly be a painful process for many companies, this
approach will ultimately yield a much more secure
environment.
Securing the Cloud
Cloud computing is a relatively new phenomenon in
computing infrastructure that involves moving computing
resources out to the Internet. Resources are then shared by
multiple applications and, in many cases, shared by multiple
corporations. Think of how the phone networks or the
electrical grid operate. These clouds are typically built using
virtualization that allows for exceptional efficiencies, but
also opens up a number of new security challenges.
First, to leverage the true benefits of cloud computing,
you have to trust the vendor providing your cloud. This
requires a shift in focus from deploying security
technologies to ensuring that your vendors are contractually
obligated and physically able to keep your data secure. You
also need to be able to evaluate vendors to determine how
trustworthy they are. If you have the available resources,
you should be auditing the vendor(s) to ensure they
consistently keep your data secure.
You’ll learn about the security challenges specific to
virtualization later in the chapter.
Securing Mobile Devices
A rapidly growing sector of the end user computing space is
the use of mobile devices like smartphones, netbooks, or
tablet computers. These devices present some unique
challenges. Think about how many people today receive e-
mail on their smartphone, or who ran out to get a new iPad
and are now reviewing confidential documents while riding
the train to work. How do you secure these devices?
The good news is that once the industry identifies issues
like these, it concentrates resources to work and ultimately
solve the problem. The computer security industry has very
few “unsolvable” issues. Already, virus protection, mobile
device management, and encryption applications are
available for mobile devices. The challenge you’ll typically
see in both current and future technology is that these types
of devices are frequently overlooked or discounted when
documenting security risks. Be sure to keep these devices
on your list of risks. They possess an alarming amount of
storage and processing capacity, which makes it easy for an
employee to inadvertently place confidential information on
them.
Mobile IP
The future will bring with it an increased clarity of the
techniques, technologies, and protocols associated with
making IP mobile, from the technology actually called
Mobile IP to a potential host of other technologies,
including IP Multimedia Subsystem (IMS), and including
changes to the Domain Name Service and other
fundamental technologies.
Bring Your Own Device (BYOD)
Bring Your Own Device will increase, as will the need to
secure a growing number of mobile endpoints and different
operating systems and applications. The BYOD mobility
aspect becomes even more important when it is considered
in light of the discussion of mobility technologies and the
mobility enablement of base technologies, and when you
consider that employees, contractors, clients, and others
need to connect securely, with potentially varying
permissions, to the assets of the organization.
Resource Sites for Network Security,
Firewalls, and VPNs
A variety of resource sites are available to you for more
information on network security, firewalls, and VPNs. While
this list of online and offline resources provides a good start,
it’s impossible to cover every source. Here are some sites
and books covering the critical topics just to get you started.
If you need additional information, you are only a search
engine click or a bookstore trip away from the answer.
At press time, all Web sites listed here were valid;
however, with the mergers, acquisitions, and other changes
in the industry, some of these links may change over time.
Firewall Vendors
Check Point Software—www.checkpoint.com
Cisco—www.cisco.com
Juniper Networks—www.juniper.net
Fortinet—www.fortinet.com
McAfee—www.mcafee.com
Palo Alto Networks—www.paloaltonetworks.com
Sophos—www.sophos.com
SonicWALL—www.sonicwall.com
WatchGuard—www.watchguard.com
Virtual Private Network Vendors
Citrix—www.citrix.com
F5 Networks—www.f5.com
Microsoft—www.microsoft.com
Nortel—www.nortel.com
OpenVPN—www.openvpn.net
Openswan—www.openswan.org
Juniper Networks—www.juniper.net
Cisco—www.cisco.com
Network Security Web Sites
CERT (security research)—www.cert.org
Data Breach Investigations Report (security research)
—www.verizonenterprise.com/DBIR/
Gibson Research Corporation (security testing and
tools)—www.grc.com
HackerWhacker (firewall testing Web site)—
www.hackerwhacker.com
ISACA (standards/certifications)—www.isaca.org
(ISC)2 (standards/certifications)—www.isc2.org
National Institute of Standards and
Technology/Computer Security Research Center—
csrc.nist.gov
SANS (security research and training)—www.sans.org
Symantec (security vendor)—www.symantec.com
Network Security Magazine Web Sites
CSO Magazine—www.csoonline.com
Data Breach Investigations Report (security research)
—www.verizonenterprise.com/DBIR/
SC Magazine—www.scmagazine.com/
Search Security—searchsecurity.techtarget.com
Tools for Network Security, Firewalls,
and VPNs
As you review the information security technologies that
you may encounter as your information security career
progresses, one of the questions you’ll probably have is,
where will you find these tools?
In your studies, you’ve probably learned about a number
of commercial and open source solutions for network
security. Numerous commercial and open source solutions
for network security tools, firewalls, and VPNs are available.
Where will you find the tools of the future?
Commercial Off-the-Shelf (COTS) Software
Commercial software remains the choice of corporations
everywhere, and this won’t be changing any time in the
future. A number of reasons account for the dominance of
commercial solutions in the information security industry.
They include:
The popularity of combining hardware and
software into an appliance—Many of the most
popular firewall, VPN, vulnerability management,
intrusion detection, and other security applications will
be developed and distributed in an appliance format.
While some open source solutions will allow you to use
standard server hardware to create an appliance-like
solution, a truly open source appliance will probably be
distributed as a commercial solution.
Companies rely on solutions they can support—
One of the ongoing challenges with open source
software is the lack of commercial support for the
solutions. Highly technical people can work well within
the open source support community. Support from an
open source community is typically better than what
comes from a commercial help desk, but corporations
are generally reluctant to trust security-related
solutions to that model.
The commercialization of open source solutions
—Many of the most popular open source solutions are
being commercialized as their developers look to
generate revenue off the products. Two examples
would be the Snort intrusion detection solution as well
as the Nessus vulnerability scanner. Both tools were
widely used and extremely popular open source
security solutions, and both are now available
commercially.
Open Source Applications and Tools
While it is pretty common to see companies embrace
commercial tools in their production environments, you
can’t discount the sheer innovation available in the open
source community. Most of the tools referenced in this book
are open source, and you can expect to see continued
development on most of them.
Keep in mind a couple of other advantages of open
source tools as you build your security tool kit. First, working
with open source tools is a great way to build your
information security skill set. Most security professionals
cannot afford to purchase multiple commercial security
applications to learn with, so leveraging open source is a
cost-effective career builder.
The other value that open source security tools bring to a
security professional is that these are the same tools many
of the people attacking your network will use. One of the
most important skills you can develop is the ability to
understand the people trying to get into your systems.
Learning the tools and techniques they may use by
developing parallel expertise will take you far in your career.
Commercial applications seldom offer the same learning
opportunities. Attackers generally are not using commercial
applications in their attacks, and they typically don’t draw
from the same community available with open source
solutions as you will to help your learning.
The Impact of Ubiquitous Wireless
Connectivity
No chapter on the future of information security would be
complete without a discussion of the influence of wireless
connectivity on security technologies. The first thing to
realize as you think about wireless is that you need to
consider a variety of wireless technologies. Be sure not to
focus too narrowly and miss something critical. Consider the
types of wireless technologies that affect your environment:
Wireless deployed as a LAN technology—The
deployment of wireless as part of the office LAN
caused constant sleepless nights for security
departments. Security departments used to invest
countless hours test-driving their locations, searching
for unsecured wireless access points on their
networks. The real challenge with this technology,
other than the fact that it permitted the bypassing of
perimeter security controls, was that it was so
convenient. Setup was so easy for an employee—
particularly setting up in the default configuration,
with all the attendant security issues.
The good news is that the industry has made great
strides in wireless security. Stronger authentication
technologies like 802.1x, which requires connecting
systems to be authenticated using PKI machine
certificates, stronger encryption technologies, and
significant improvements in user awareness, have
made wireless LAN in the office a viable replacement
for the wired LAN, while still affording the security you
need to keep your data secure.
Public and home office wireless—Public/home
office wireless is a great thing for your employees.
Take out your laptop, connect to the wireless, and
you’re on the Internet, ready to surf. You can connect
to the corporate network, do your banking, shop
online, or just catch up on the news. What could be
more convenient? As is often the case, convenience is
the enemy of security. A number of security challenges
present themselves with public/home office wireless.
First, any unencrypted traffic sent over these wireless
networks can be intercepted. Counting on Starbucks
(or an employee’s cable company) to configure their
wireless with the most advanced security capabilities
enabled is not reasonable. Work with your users to
make sure they understand the risks associated with
these types of wireless. The good news from a
corporate network perspective is that you are probably
running a VPN for business connections, so that data
should be secure.
Mobile wireless—The ubiquity of smartphones and
other devices that can connect to cellular networks
presents the third challenge when discussing the
impact of wireless connectivity on information security.
Now employees don’t need to search for a wireless hot
spot before connecting to the network; they can
access their mail from just about anywhere. The best
defense against these risks is a combination of policy
and technology. First, your policy should restrict access
to company systems and e-mail to company-owned
devices. That allows you some level of control over the
types and configurations of devices with access to
your data. Next, make sure the devices you’re using
leverage the appropriate security technologies like
encryption and antivirus scanning. While it’s virtually
impossible to physically secure something as portable
as a smartphone, you can ensure that the data on the
device can’t be recovered if it is stolen or lost.
Potential Uses of Security
Technologies
One ever-expanding area of discussion when looking at
security technologies like firewalls, VPNs, intrusion
detection, honeypots, vulnerability management, and others
is the many uses for this technology. Obviously, you use
security technologies to secure your data, networks, and
systems. And that is certainly the primary use for security
technologies. But you should be aware of some additional
uses for this technology.
The core security concepts can be summed up with the
acronym C-I-A. This stands for confidentiality, integrity, and
availability.
Confidentiality—Confidentiality deals with keeping
information, networks, and systems secure from
unauthorized access. This issue is particularly critical
in today’s environment in light of the high-profile
leaking of people’s personal information by several
large companies. These breaches in confidentiality
made the headlines largely because the thefts
exposed people to the potential of identity theft.
Several technologies support confidentiality in an
enterprise security environment. These include:
Strong encryption
Strong authentication
Stringent access controls
Integrity—Integrity is the consistency, accuracy, and
validity of data or information. One of the goals of
successful information security is to ensure that the
information is protected against any unauthorized or
accidental changes. The architecture should include
processes and procedures to manage intentional
changes, as well as the ability to detect changes.
Availability—Availability is the third core security
principle, defined as a characteristic of a resource
being accessible to a user, application, or computer
system when required. In other words, when users
need information, it’s available to them. Typically,
threats to availability come in two types: accidental
and deliberate. Accidental threats include natural
disasters such as storms, floods, fire, earthquakes, and
so forth with attendant power outages. This category
also includes outages due to equipment failure,
software issues, and other unplanned system,
network, or user issues. The second category is related
to outages that result from the exploitation of a
system vulnerability. Some examples of this threat
include a denial of service attack or a network worm
that affects vulnerable systems and their availability.
In some cases, one of the first actions you need to
take following an outage is determining which
category an outage fits into. Companies handle
accidental outages very differently from deliberate
ones.
As you continue to work in the information security field,
another acronym you will encounter is GRC. This stands for
governance, risk, and compliance. This is the best way to
look at your security technologies from a business
perspective. Look at how the security technologies you’re
deploying provide much more than just securing data:
Governance—Governance includes the processes and
procedures that ensure employees are following your
organization’s security policy. For example, you have a
policy that says that data in transit across a public
network must be secured with at least 56-bit
encryption. You would ensure that the only way to
connect to the network is through a VPN that uses at
least 56-bit encryption. This mechanism would be part
of your governance efforts.
Governance is generally used to demonstrate to
management, customers, and auditors that your
information security program is operating as outlined
in your policies, procedures, and practices. If you are a
service provider, you can leverage your governance
capabilities to show that you can be trusted to keep
clients’ information secure.
Risk—One of the foundations of any information
security program is a robust risk management
practice. If you don’t identify your risks, how do you
know which security technologies to deploy and
where? A risk is the likelihood or potential for a threat
to take advantage of a vulnerability and cause harm or
loss. Risk is a combination of an asset’s value,
exposure level, and rate of occurrence. A goal of
security is to recognize, understand, and eliminate
risk.
A risk management process starts with a risk
assessment of your environment. Start with your
critical data, applications, systems, and networks.
Document the risks associated with them in a risk
matrix. A typical risk matrix will contain the following:
A description of the risk
The likelihood that the risk will actually occur
The impact of the risk
A total risk score
The relevant business owner for the risk
Which of the core security principles the risk affects:
confidentiality, integrity, and/or availability
The appropriate strategy or strategies to deal with the
risk
The last bullet is the one that’s critical with respect to
security technologies—you leverage security technologies
as part of the strategy to deal with the risks. One of the
fastest-growing sectors in the information security field is
compliance. Compliance means ensuring your company
obeys internal policies as well as any applicable laws or
other regulatory requirements. A good example of this is the
Sarbanes-Oxley Act, which requires publicly traded
companies to validate the controls securing all financial
data. You will find that your security program, in conjunction
with the security technologies supporting it, are critical to
ensuring compliance with a growing number of regulations.
What Happens When There Is No
Perimeter?
If you look back to the first uses of network security,
security professionals essentially put a firewall between the
corporate network and the Internet. That firewall marked
the perimeter of the network. As networks became more
complex, companies started finding they were connecting to
the Internet in more locations, so more firewalls were
installed. The perimeter remained the demarcation between
the Internet and the corporate network. Today, the
vanishing perimeter has been the subject of many
presentations, white papers, and sales pitches, as vendors
try to convince organizations to invest to protect their
perimeter-less environments.
VPNs extended the internal network outside the nice,
neat network perimeter defined by the firewall/Internet
interface. Suddenly, your network could be in any hotel or
coffee shop in the country, as your employees discovered
the benefits of mobile computing. To make matters worse,
high capacity drives and portable storage meant that not
only was your network being extended into places that you
had never imagined, but your data storage was no longer
contained within your office space. Critical information could
be stored easily anywhere your employees wanted.
Unfortunately, that wasn’t the end of the challenges you
faced as an information security professional. In addition to
your employees taking your network and data anywhere
they wanted, your business discovered the benefits of
interconnecting with customers, vendors, suppliers, and
partners. Each of these groups needed varying levels of
access to your systems, networks, and data.
In addition to all the challenges with connections and
data beyond your network, businesses also discovered the
benefits of online commerce over the Internet. That seems
harmless enough, until you realize that to do business on
the Internet, you need to punch holes in the network
perimeter to provide access from the Internet to your
systems, networks, and data. It’s a little like installing
skylights in your roof: You want the benefit of the sunlight in
the house, but you don’t want leaks when it rains.
In a perfect world, upper-level management would have
consulted with you before they embarked on these projects.
They would have given you an unlimited budget to deploy
network zones separating each of the different types of
data, with firewalls and intrusion detection deployed at each
level, and enough staff to monitor all the infrastructure to
ensure nothing is getting past your security measures.
In reality, the first few connections were most likely put
in without input from security, and these might not even be
firewalled. It’s so much easier than having to justify
purchasing firewalls, set up firewall rules, monitor logs, and
do all the other things an organization needs to do as it
opens holes in its protective perimeter.
What’s needed in this case is a clear, well-established
policy with strong senior management support. The
appropriate controls should be put in place to reestablish
your perimeter. If you treat the risk of all these new
technologies connecting to your network the same way you
treat the risks posed by the Internet, you’ll mitigate the
risks associated with the increasingly fluid perimeter you
will be dealing with.
Specialized Firewalls Available
In this section you’ll learn about some of the specialized
firewalls that are available or are coming soon, such as:
Hybrid—A hybrid firewall combines a number of
different functions in a single appliance. You learned
about firewalls with integrated VPN capabilities, but
you can also expect to see firewalls combined with
vulnerability management, intrusion detection and
prevention, antivirus/anti-spyware, content filtering, or
a variety of other network and security-related
technologies. The key when looking into hybrid
firewalls is ensuring that they will meet your specific
security needs while not creating a performance
bottleneck. The more functions you put on a single
system, the more chances you’ll run into a
performance bottleneck.
Data protection—A data protection firewall is a
hybrid firewall, but deserves some additional
explanation. The focus of a mature security program is
to ensure that data is secure. An emerging technology
is data leakage prevention (DLP), which is a
technology specifically designed to ensure that your
data stays within your network. When combined with
firewall technologies at the perimeter of the network, a
data protection firewall becomes an invaluable tool in
keeping your data out of Gmail and Facebook accounts
and within the internal network where it belongs.
Application—An application firewall is specifically
designed to control input, output, and/or access to an
application. This type of firewall became very popular
when the focus of attacks shifted from operating
systems to applications. An application firewall
operates by monitoring the input, output, and system
calls made in an application, and blocking any that do
not conform to the firewall rules. An application
firewall can block buffer overflow attacks, SQL
injection attacks, and the majority of other application-
focused attacks.
Application firewalls are either network-based or host-
based applications. One drawback of application
firewalls is they are typically designed for specific
types of applications (i.e., Web applications or
databases), whereas a standard firewall can secure
many different types of applications, though not to the
level an application firewall provides.
Database—A database firewall is an application
designed to control the input, output, and system calls
made to a database. While limited to database
security, this firewall offers very granular security for
databases.
Ubiquitous—This is ultimately the direction that
firewalls will likely take in the future. The industry
currently supports a variety of firewalls integrated into
the network and the host that run on the perimeter
and the core to protect demarcation between network
zones. Now firewalls are moving into the virtualization
area. Eventually, this intelligence and control will be
pushed directly into the infrastructure and managed
from a single console. Instead of controlling isolated
ports on a firewall-by-firewall basis, you’ll be able to
manage secure data as it flows into, out of, and
through your environment from the originating host to
the perimeter of your network and at all connections in
between. This will allow you to reestablish the
perimeter that disappeared with all the external
connections to your network.
Intrusion Detection Systems (IDSs) and
Intrusion Prevention Systems (IPSs)
Two other security technologies available to secure
networks are intrusion detection systems (IDSs) and
intrusion prevention systems (IPSs). An IDS detects
unauthorized user activities, attacks, and network
compromises (Figure 15-1). IDSs come in two types, host-
based and network-based.
An intrusion prevention system (IPS) is very similar to an
IDS, except that in addition to detecting and alerting, an IPS
can also take action to prevent a breach from occurring
(Figure 15-2).
NOTE
IDS/IPS is used largely on Internet connections, since
those connections typically present the largest threat
to the network. You can also deploy IDS/IPS in strategic
locations on the internal network. This is an excellent
idea if your internal network has connections to third-
party networks such as customers, vendors, or
business partners.
FIGURE 15-1
IDS detects an attack, and alerts operators—manual
intervention needed.
FIGURE 15-2
IPS detects attack, alerts operators, and then modifies
firewall and router configuration to address the attack.
Two common deployment methods are used when
placing an IDS/IPS for protecting a network from the
Internet. Each has its own advantages and disadvantages.
An unfiltered IDS/IPS installation examines the raw
Internet data stream before it crosses the firewall (Figure
15-3). This provides the highest amount of visibility to
attacks, but also means that a significantly higher volume of
data will be monitored, with a higher possibility of false
positives. During periods of high traffic, the IDS/IPS might
not be able to process all the packets, and attacks can be
missed.
FIGURE 15-3
Placement of the intrusion detection system so it gets
unfiltered traffic for analysis.
FIGURE 15-4
An intrusion detection system deployed behind a screening
firewall.
A screened IDS/IPS solution monitors traffic that gets
through the screening firewall (Figure 15-4). The advantage
to this model is it dramatically reduces the amount of traffic
to be monitored, reducing the chances of false positives and
lost packets during high traffic volumes. A loss of visibility
accompanies this model, as you cannot see attacks blocked
by the screening firewall.
Effect of Honeypots, Honeynets, and
Padded Cells
Honeypots, honeynets, and padded cells are
complementary technologies to IDS/IPS deployments. A
honeypot is a trap for hackers. A honeypot is designed to
distract hackers from real targets, detect new exploitations,
and learn about the identity of hackers. A honeynet is just a
collection of honeypots used to present an attacker an even
more realistic attack environment. A padded cell is a system
that waits for an IDS to detect attackers and then transfers
the attackers to a special host where they cannot do any
damage to the production environment.
While these are all extremely useful technologies, not
many corporate environments deploy them. You generally
see these deployed by educational institutions and security
research firms. Generally, corporate information security
professionals are so busy securing their environment from
attacks that they don’t spend time researching attack
patterns. As long as the attack doesn’t succeed, they are
satisfied.
Emerging Network Security
Technologies
In addition to these future enhancements to security
technologies, you should also be aware of three more areas
of emerging security technology:
Data leakage prevention (DLP)—DLP technologies
are systems that identify, monitor, and protect data in
use, data in motion, and data at rest from
inappropriate use, distribution, transmission, or other
unauthorized actions. DLP technologies perform deep-
content inspection within a scope defined by a central
management console and are usually deployed at
multiple locations within the environment to ensure
full coverage. As the value of data continues to climb,
this technology should see wider implementation. The
technology is already used heavily in the financial
industry. New government regulations will help drive
the implementation in other sectors, most likely health
care. HIPAA, HITECH, and PCI have specific data
protection requirements.
Biometrics—Biometrics identify a user based on
anatomical characteristics such as a fingerprint, a
voice print, or iris patterns. These methods of
identification have a number of advantages over
passwords, tokens, or ID cards.
First, biometric authentication requires the person
being authenticated be physically present. Second,
biometric security removes the need to remember
complicated passwords. No more passwords taped
under keyboards; you carry your password with you
wherever you go. Finally, biometrics remove the need
to carry a token or ID card with you. You don’t have to
worry about not being able to work when you leave
your token on the kitchen table at home.
The areas where biometrics are currently being
investigated include ATMs, laptops, and computer
networks.
Virtualization security—As virtualization and cloud
computing continue to gain ground, a new generation
of virtualization-aware security tools are under
development. Antivirus, vulnerability management,
data leakage prevention, and IDS/IPS technologies are
all being developed to run against the underlying
hypervisor layer. The hypervisor layer is the hardware
or software on which virtual machines run. This gives
the security applications direct access to the
underlying data transport layer of the virtual
environment rather than forcing them to run against
each virtual server, dramatically improving
performance, visibility to security issues, and ease of
use.
In multi-tenant environments (multiple companies
sharing the same virtual environment), additional
security tools are being developed to ensure that no
access occurs between the virtual environments.
IP Version 6
IPv6 is the next-generation IP version and the successor to
IPv4. While the main driving force for the redesign of
Internet Protocol was the rapidly approaching exhaustion of
IPv4 addresses, IPv6 has significant implications to future
information security professionals.
IPv6 includes a native information security framework
(IPSec) that provides for both data and control packets. This
means that what you currently do with a traditional VPN you
will be able to do natively with any IPv6 device. At a high
level, that means you can run your IPSec VPN without
requiring a client, but the implications are significantly more
profound than just that.
In a fully IPv6 environment, any connection can use an
IPSec connection. This means that any connection from a
user to an application, a host to a host, or even a peer to a
peer authenticates and encrypts as it passes across the
network.
While the thought of a network featuring nothing but
secure connections seems like a security professional’s
dream configuration, you should also consider some
drawbacks before kicking off your IPv6 migration project.
One of the challenges with encryption is that it not only
secures data from the bad guys, but it also secures the data
from the good guys. A number of security technologies like
IDS/IPS, content filtering, network-based antivirus, data
leakage prevention, and even firewall technologies rely on
being able to look at packets as they cross the network to
determine how to handle them. Once those packets are
encapsulated in a secure IPSec connection, all the security
tools you have relied on stop working.
With the limited deployment of IPv6, significant
development on solutions to overcome these challenges
hasn’t occurred yet, but it will be a subject of great interest
as the use of IPv6 expands.
VPNs, Firewalls, and Virtualization
Here are some areas that look to the future of virtualization
that you should think about.
Virtualization and VPN deployment are examples; some
SSL VPNs have the ability to provide a unique virtual VPN
configuration for each individual user group. Much like other
types of virtualization, a virtualized SSL VPN allows you to
separate the physical and logical use of the VPN. In the
future, this capability could extend to IPSec VPNs as well.
While this technology offers some unique abilities when
configuring secure VPN contexts for different user groups,
the additional complexity is something you need to know. A
misconfigured virtual VPN context could expose parts of
your network to groups that should not have access to
them. For example, if you are using a virtualized VPN to
provide customers access to a help desk ticketing system,
and you inadvertently grant that context access to your
intranet where all your pricing information resides, you
expose the organization’s proprietary data to unnecessary
risk.
Firewalls are another technology that is starting to permit
virtualization. Currently, some firewalls on the market can
partition into multiple virtual firewalls. Each virtual firewall
appears to be a separate firewall with its own security
policy, interfaces, and configuration. This allows you to use
your firewall hardware more efficiently than you might
otherwise, but once again, additional risks occur with the
deployment of virtual firewalls.
First, while firewalls exist that support this technology,
not all of them support all their features in the virtualized
environment. Before you deploy a virtualized firewall, be
sure it supports all the features you need to meet your
business and security requirements. While this is a very
promising technology, it’s also very new, and sometimes
early adopters can find themselves encountering issues the
vendor didn’t discover during the quality assurance
processes.
Next, you are relying on the logical segregation of
firewalls rather than the physical separation offered by
multiple physical firewalls. While this technology remains
new, do some testing before deploying virtual firewalls into
a critical environment. Finding that there’s a way to bypass
the virtual security and move from one virtual environment
to another would not be good if you are using the firewall to
separate two customers connected to your network.
Finally, this model suffers from the same complexity
challenges with respect to the virtual VPNs. Any time you
have a solution that offers greater flexibility, you also open
the possibility for greater complexity. Complex
environments are almost always more difficult to secure,
monitor, and manage than simple environments.
However, in spite of all the challenges associated with
virtualizing security technologies like VPN and firewalls, a
compelling business case exists for leveraging hardware
more effectively in a virtualized environment. Be sure you
understand the technology thoroughly before deploying it.
Information security is seldom a forgiving field for learning
as you go.
Steganography
Steganography is the art and science of writing hidden
messages so that only the sender and intended recipient
know a message exists. Steganography is the ultimate
security through obscurity technology.
Probably the most well known technique for
steganography in the modern era is the embedding of
additional information in a digital image. An image before
and after a message has been embedded in it appears
unchanged to the naked eye. But if you run the image
through the proper program, the secret message appears.
However, steganography has been around a lot longer than
digital images, and it can take many forms. Simply writing a
message in invisible ink on the page of a book is a form of
steganography.
The main advantage of steganography is that messages
do not arouse suspicion. If you encrypt an e-mail message
and send it, and the message is intercepted, then whoever
intercepted the message assumes there’s something
sensitive in the message. If however, you send a copy of a
picture of your kids at the amusement park with a message
embedded in the photo, unless the intercepting party knows
the coded message is coming, they will not give it any
special attention. Encrypted messages protect the message.
Steganographic messages protect the data as well as the
intentions of the sender and the receiver.
Anti-Forensics
The final topic for discussion in this chapter is the use of
anti-forensics. Anti-forensics are a series of techniques
designed to try to frustrate forensic investigators and their
digital forensic techniques.
Forensic techniques are well known to the information
security community and, by extension, to the hacker
community as well. As a result, hackers have developed an
arsenal of counter-techniques they use to foil investigations.
If they can prevent the investigator from recovering usable
evidence, they stand a better chance of avoiding discovery
or prosecution. Some of these techniques are also used to
hide rootkits and other malware.
Some examples of anti-forensic tools and techniques
include:
Securely overwriting data
Overwriting metadata
Designing code that won’t run when the system is in
debugging mode
Designing code that won’t run in a virtual machine
Preventing a system from entering safe mode or
debugging mode
Running all code from an external device like a USB
drive
Tampering with file system date and time stamps
Running in read-only mode to prevent the system from
updating file information.
You should be familiar with the concepts associated with
anti-forensics, but unless you plan to become a forensic
investigator, you probably won’t encounter any of these
except possibly securely overwriting data.
CHAPTER SUMMARY
In this chapter, you learned about a number of topics
dealing with the future of security technologies and
some of the significant emerging security threats.
Future information security tools may come from the
commercial or the open source communities, and you
learned about the pros and cons of both of those
areas of development.
Governance, risk, and compliance are the pillars of
good policy for guiding your use of security
technologies. While the obvious use for security
technologies is to provide security, when all is said
and done, information security needs to be a
business enabler, created with an understanding of
the business requirements and the bottom line. The
days of deploying information security technologies
based solely on management’s fear of security
incidents are long gone.
Changes in networking technologies on the security
perimeter can affect how network security operates.
Firewall specialization includes hybrid, data
protection, application, database, and ubiquitous
firewalls. IDS, IPS, and other complementary
technologies, such as honeypots, honeynets, padded
cells, steganography, and anti-forensics, are essential
elements in modern secure networks.
KEY CONCEPTS AND TERMS
Anti-forensics
Data leakage prevention (DLP)
Digital forensic techniques
Information Technology
Infrastructure Library (ITIL)
IP Multimedia Subsystem (IMS)
Mobile IP
CHAPTER 15 ASSESSMENT
1. Pick the two most common IDS/IPS deployment models:
A. Bypass
B. Unfiltered
C. Tunneled
D. Intranet
E. Screened
2. Which of the following are types of specialized firewalls?
A. Data protection
B. Host
C. Application
D. Hybrid
E. Network
3. Two technologies used to identify attack techniques and
patterns include ________ and ________.
4. Techniques used to counter digital investigations are
known as ________.
5. Pick the two changing areas to watch when developing
your information security road map.
A. Security industry focus
B. Vendors
C. Computer processing power
D. Cloud computing
E. Network design
6. The technique of hiding a secret message in plain sight
is known as ________.
7. Which of the following is a potential disadvantage of
IPv6 from a security perspective?
A. Additional address space
B. Less flexible than IPv4
C. Industry support
D. Maturity of the standard
E. Ubiquitous encryption
8. Identifying a user based on anatomical characteristics is
known as ________.
9. Which of the following are biometric characteristics?
A. Default password
B. Fingerprint
C. Iris pattern
D. Voice print
E. Token
10. Which of the following are considered complementary
technologies to an IDS/IPS implementation?
A. Honeypot
B. Encryption
C. VPN
D. Padded cell
E. Virtual firewall
11. A device that monitors network traffic and alerts during
an attack is an ________.
12. A device that monitors network traffic and alerts and
takes action without manual intervention during an
attack is an ________.
13. Which of the following contribute to the erosion of the
network perimeter?
A. Specialized firewalls
B. VPN
C. IPS/IDS
D. Cloud computing
E. Business partner connections
14. The act of ensuring your company obeys internal
policies and any applicable laws is known as ________.
15. The processes and procedures used to ensure
employees are following corporate security policies are
known collectively as ________.
16. Identify one risk associated with the use of a public
wireless connection.
A. Encryption
B. Virus
C. Data interception
D. Data corruption
E. Social engineering
17. What is one advantage to commercial security solutions
that might make a company select them over open
source equivalents?
A. Flexibility
B. Support
C. Cost
D. Availability
E. Value
18. Which of the following might be included in a risk
register?
A. Risk description
B. Impact
C. Cost
D. Business owner
E. Continuity planning
19. Which of the following are considered core security
principles when discussing the uses of security
technologies?
A. Confidentiality
B. Governance
C. Integrity
D. Risk
E. Compliance
20. When an IDS detects an attack, it can direct the
attacker to a host where the attacker cannot do any
damage. This host is known as a ________.
Answer Key APPENDIX
A
CHAPTER 1 Fundamentals of Network Security 1. C 2. E 3.
A 4. B 5. C 6. E 7. D 8. B 9. B 10. A 11. A 12. E
13. B and C 14. D 15. E 16. B 17. D 18. C 19. E
20. E
CHAPTER 2 Firewall Fundamentals 1. B 2. C 3. A 4. E 5. D 6.
B 7. C 8. B 9. A 10. E 11. E 12. E 13. D 14. A
15. D 16. D 17. B 18. C 19. D 20. B 21. C 22. A
23. E
CHAPTER 3 VPN Fundamentals 1. D 2. B 3. E 4. A 5. B 6. C
7. A 8. E 9. A 10. C 11. D 12. D 13. D 14. D 15.
A 16. B 17. A 18. B 19. A 20. D 21. C 22. C 23.
B 24. A 25. D
CHAPTER 4 Network Security Threats and Issues 1. C 2. A
3. D 4. E 5. C 6. D 7. E 8. C 9. B 10. E 11. A 12.
A 13. C 14. B 15. D 16. D 17. C 18. E 19. A 20.
C
CHAPTER 5 Network Security Implementation 1. C 2. E 3. C
4. A 5. A 6. D 7. D 8. C 9. B 10. A 11. E 12. B
13. D 14. A 15. D 16. C 17. B 18. D 19. C 20. A
CHAPTER 6 Network Security Management 1.
D 2. B 3. E 4. C 5. D 6. A 7. E 8. E 9. A 10. E
11. D 12. B 13. C 14. C 15. E 16. E 17. B 18. E
19. A 20. D
CHAPTER 7 Exploring the Depths of Firewalls 1. B 2. A 3. D
4. C 5. E 6. D 7. E 8. D 9. B 10. C 11. C 12.
wirespeed 13. A 14. C 15. E 16. E 17. C 18. C
19. C 20. E
CHAPTER 8 Firewall Deployment Considerations 1. B 2. E 3.
D 4. B 5. A 6. D 7. B 8. C 9. D 10. B 11. E 12. D
13. C 14. A 15. D 16. D 17. B 18. D 19. A 20. B
CHAPTER 9 Firewall Management and Security Concerns 1.
B 2. E 3. D 4. B 5. B 6. A 7. C 8. B 9. D 10. E
11. A 12. C 13. C 14. C 15. B 16. A 17. B 18. D
19. B 20. D
CHAPTER 10 Using Common Firewalls 1. A, C, and E 2. D 3.
B and D 4. B 5. A 6. inbound, outbound 7. B 8.
A, C, and E 9. C 10. B 11. A 12. B 13. A, C, D,
and E 14. D 15. A, B, C, D, and E (all) 16.
outside 17. port forwarding 18. A 19. B 20.
throughput CHAPTER 11 VPN Management 1.
E 2. C 3. Three of the following: Denial of
service attack, missing patches, backdoor
attack, unpublished vulnerability in the code,
weak client security, weak authentication,
weak encryption key selection, social
engineering 4. SSL, IPSec 5. A and D 6.
anonymity 7. C and E 8. VPN policy 9. B, C,
and D 10. A, B, and D 11. privacy 12.
patch/update 13. B 14. two-factor or
token/biometric 15. redundant 16. C and D 17.
B 18. A, B, and D 19. A and C 20. circuits
CHAPTER 12 VPN Technologies 1. B and D 2.
C and E 3. 3DES 4. SSL and IPSec 5. A and B 6.
network address translation (NAT) 7. C and D
8. platform independent 9. B, C, and D 10. B
and D 11. request for comments (RFC) 12.
virtualization 13. A, B, and E 14. L2F and PPTP
15. SSH 16. A, C, and E 17. B, C, and F 18. A,
B, D, and E 19. A and D 20. Secure Sockets
Layer CHAPTER 13 Firewall Implementation
1. C 2. B 3. A 4. B 5. C 6. D 7. B 8. B 9. E 10.
True 11. A 12. C 13. B 14. B 15. False 16. D 17.
C
CHAPTER 14 Real-World VPNs 1. A and D 2. B 3. B 4.
Secure Socket Layer (SSL) 5. E 6. False 7. D 8.
B 9. B 10. A 11. C 12. A 13. A 14. A 15. B 16. B
17. B 18. B
CHAPTER 15 Perspectives, Resources, and the Future 1. B
and E 2. A, C, and D 3. honeypots and
honeynets 4. anti-forensics 5. A and D 6.
steganogrophy 7. E 8. biometrics 9. B, C, and
D 10. A and D 11. IDS or IPS 12. IPS 13. B, D,
and E 14. compliance 15. governance 16. C
17. B 18. A, B, and D 19. A and C 20. padded
cell
Standard Acronyms APPENDIX
B
3DES
triple data encryption standard
ACD
automatic call distributor
AES Advanced Encryption Standard
ANSI
American National Standards Institute
AP
access point
API
application programming interface
B2B
business to business
B2C
business to consumer
BBB
Better Business Bureau
BCP
business continuity planning
C2C
consumer to consumer
CA certificate authority
CAP
Certification and Accreditation Professional
CAUCE
Coalition Against Unsolicited Commercial
CCC
CERT Coordination Center
CCNA
Cisco Certified Network Associate
CERT
Computer Emergency Response Team
CFE
Certified Fraud Examiner
CISA
Certified Information Systems Auditor
CISM
Certified Information Security Manager
CISSP Certified Information System Security
Professional
CMIP
Common Management Information Protocol
COPPA
Children’s Online Privacy Protection
CRC
cyclic redundancy check
CSI
Computer Security Institute
CTI
Computer Telephony Integration
DBMS
database management system
DDoS
distributed denial of service
DES
Data Encryption Standard
DMZ demilitarized zone
DoS
denial of service
DPI
deep packet inspection
DRP
disaster recovery plan
DSL
digital subscriber line
DSS
Digital Signature Standard
DSU
data service unit
EDI
Electronic Data Interchange
EIDE
Enhanced IDE
FACTA Fair and Accurate Credit Transactions Act
FAR
false acceptance rate
FBI
Federal Bureau of Investigation
FDIC
Federal Deposit Insurance Corporation
FEP
front-end processor
FRCP
Federal Rules of Civil Procedure
FRR
false rejection rate
FTC
Federal Trade Commission
FTP
file transfer protocol
GIAC Global Information Assurance Certification
GLBA
Gramm-Leach-Bliley Act
HIDS
host-based intrusion detection system
HIPAA
Health Insurance Portability and
Accountability Act
HIPS
host-based intrusion prevention system
HTTP
hypertext transfer protocol
HTTPS
HTTP over Secure Socket Layer
HTML
hypertext markup language
IAB
Internet Activities Board
IDEA International Data Encryption Algorithm
IDPS
intrusion detection and prevention
IDS
intrusion detection system
IEEE Institute of Electrical and Electronics
Engineers
IETF
Internet Engineering Task Force
InfoSec
information security
IPS
intrusion prevention system
IPSec
IP Security
IPv4
Internet protocol version 4
Internet protocol version 6
IPv6
IRS
Internal Revenue Service
(ISC)2 International Information System Security
Certification Consortium
ISO
International Organization for Standardization
ISP
Internet service provider
ISS
Internet security systems
ITRC
Identity Theft Resource Center
IVR
interactive voice response
LAN
local area network
metropolitan area network
MAN
MD5
Message Digest 5
modem
modulator demodulator
NFIC
National Fraud Information Center
NIDS
network intrusion detection system
NIPS
network intrusion prevention system
NIST
National Institute of Standards and
Technology
NMS
network management system
OS
operating system
OSI open system interconnection
PBX
private branch exchange
PCI
Payment Card Industry
PGP
Pretty Good Privacy
PKI
public key infrastructure
RAID
redundant array of independent disks
RFC
Request for Comments
RSA
Rivest, Shamir, and Adleman (algorithm)
SAN
storage area network
SANCP Security Analyst Network Connection Profiler
SANS
SysAdmin, Audit, Network, Security
SAP
service access point
SCSI
small computer system interface
SET
Secure electronic transaction
SGC
server-gated cryptography
SHA
Secure Hash Algorithm
S-HTTP secure HTTP
SLA
service level agreement
SMFA
specific management functional area
SNMP
Simple Network Management Protocol
SOX
Sarbanes-Oxley Act of 2002 (also Sarbox)
SSA
Social Security Administration
SSCP
Systems Security Certified Practitioner
SSL
Secure Sockets Layer
SSO
single system sign-on
STP
shielded twisted cable
TCP/IP Transmission Control Protocol/Internet
Protocol
TCSEC
Trusted Computer System Evaluation Criteria
TFTP Trivial File Transfer Protocol
TNI
Trusted Network Interpretation
UDP
User Datagram Protocol
UPS
uninterruptible power supply
UTP
unshielded twisted cable
VLAN
virtual local area network
VOIP
Voice over Internet Protocol
VPN
virtual private network
WAN
wide area network
WLAN wireless local area network
WNIC
wireless network interface card
W3C
World Wide Web Consortium
WWW
World Wide Web
Glossary of Key Terms
802.1x | Port or portal authentication. A mechanism
commonly used by network devices, such as firewalls,
routers, switches, and wireless access points, to perform
authentication of users before allowing communication to
continue across or through the device. The authentication
can take place locally on the device or go to an
authentications service, such as a credit card payment
system, PKI, or directory service.
A
Access control | The process or mechanism of granting or
denying use of a resource; typically applied to users or
generic network traffic.
Access control list (ACL) | Mechanism defining traffic or
an event to apply an authorization control of allow or deny
against. Often used interchangeably with the terms rule and
filter in relation to firewalls. An ACL focuses on controlling a
specific user or client’s access to a protocol or port.
Active threat | A form of threat that takes some type of
initiative to seek out a target to compromise. These can be
hackers, intruders, or automated worms. In any case, an
active threat seeks out vulnerable targets. If you don’t have
reasonable security measures and the active threat
discovers your system, you might be at risk for a
compromise.
Advanced persistent threat (APT) | A network attack in
which an unauthorized person gains access to a network
and stays there undetected for a long period of time. The
purpose of such an attack is to steal data, not to damage
the network or organization. Sectors with high-value
information, such as national defense, manufacturing, and
the financial industry, are commonly the target of such
attacks.
Adware | Unwanted software that displays advertisements.
Often linked with spyware.
Agent | A malicious software program distributed by a
hacker to take over control of a victim’s computers. Also
known as a bot or a zombie. Agents are commonly used to
construct botnets.
Alert | A notification from a firewall that a specific event or
packet was detected. Alerts notify administrators of events
that may need real-time human response or attention.
Algorithm | A set of rules and procedures, usually
mathematical in nature. Algorithms can define how the
encryption and decryption processes operate. Often very
complex, many algorithms are publicly known; anyone can
investigate and analyze the strengths and weaknesses of an
algorithm.
Alternate data stream (ADS) | A feature added to the
NTFS file system to support files from POSIX, OS/2, and
Macintosh. ADS supports multiple resource forks for file
objects. Hackers use ADS to hide files.
Annualized loss expectancy (ALE) | The calculation of
the total loss potential across a year for a given asset and a
specific threat. ALE calculations are part of risk assessment.
ALE = SLE × ARO.
Annualized rate of occurrence (ARO) | A probability
prediction based on statistics and historical occurrences on
the likelihood of how many times in the next year is a threat
going to cause harm. ARO
is used in the ALE calculation.
Anomaly-based detection | A form of intrusion detection
system/intrusion prevention system (IDS/IPS) based on a
defined normal, often defined using rules similar to firewall
rules. All traffic or events that fail to match defined normal
are considered anomalies and potentially malicious.
Anonymity | The ability for a network or system user to
remain unknown. A number of tools and techniques provide
anonymity when connected to a network, although the
underlying network protocols make true anonymity very
difficult.
Anti-forensics | A series of tools and techniques used to
prevent forensic examination from identifying an attack or
attacker.
AppleTalk | A legacy protocol developed by Apple Inc. for
use in networks hosting mainly Macintosh computers.
Mostly replaced by TCP/IP.
Appliance | A hardware product that is dedicated to a
single primary function. The operating system or firmware
of the hardware device is hardened and its use is limited to
directly and exclusively supporting the intended function.
Firewalls, routers, and switches are typical appliances.
Appliance firewall | A hardened hardware firewall.
Application Layer (Layer 7) | The top or seventh layer of
the OSI model. This layer is responsible for enabling
communications with host software, including the operating
system. The Application Layer is the interface between host
software and the network protocol stack. The sub-protocols
of this layer support specific applications or types of data.
Application firewall | A type of firewall that filters on a
specific application’s content and session information.
Application gateway | See application firewall.
Application proxy | See application firewall.
Arbitrary code execution | An exploit that allows a hacker
to run any command line function on a compromised
system. Buffer overflow attacks and SQL injection attacks
can often allow arbitrary code execution.
ARP spoofing | The falsification of ARP replies to trick the
requestor into sending frames to a system other than its
intended destination.
Asset | Anything you use in a business process to
accomplish a business task.
Asset value (AV) | The cumulative value of an asset based
on both tangible and intangible values. AV supports the SLE
calculation.
Asymmetric cryptography | A means of encoding and
decoding information using related but different keys for
each process. A key used to encode cannot decode, and
vice versa. Cryptography based on algorithms that use
either key pairs or some other special mathematical
mechanism. Asymmetric cryptography that uses key pairs is
commonly known as public key cryptography. Different keys
serve different purposes. Different keys are used by
different members of the communication session. Some
systems use something different from keys altogether.
Asymmetric digital subscriber line (ADSL) | A form of
the digital subscriber line technology, which enables faster
data transmission over copper telephone lines than a
conventional voice band modem can provide.
Attack surface | Portions of a software system that
unauthenticated users can run.
Auditing | Act of conducting an audit. Auditing can be the
action of a system that is recording user activity and system
events into an audit log. Auditing can also be the action of
an auditor who checks for compliance with security policies
and other regulations.
Auditor | Either an outside consultant or an internal
member of the information technology staff. The auditor
performs security audits, confirms that auditing is sufficient,
and investigates audit trails produced by system auditing. In
the case of regulatory compliance, auditors should be
external and independent of the organization under audit.
Authentication | The process of confirming the identity of
a user. Also known as logon.
Authentication, authorization, and accounting (AAA)
services | Programs used to control access to computer
resources, enforce policies, audit usage, and provide billing
information. Examples include RADIUS, TACACS, 802.1x,
LDAP, and Active Directory.
Authentication Header (AH) | A protocol that provides
integrity protection for packet headers and data, as well as
user authentication.
Authenticity | The security service of the combination of
authentication and access control (authorization) that
provides either the identity of the sender of a message or
controls who is the receiver of a message.
Authorization | Defining what users are allowed and not
allowed to do. Also known as access control.
Availability | When a system is usable for its intended
purpose. The security service that supports access to
resources in a timely manner. If availability becomes
compromised, a denial of service is taking place.
Avalanche effect | A common feature of hash algorithms.
This effect ensures that small changes in the input data
produce large changes in the outputted hash value. A single
binary digit change in a file should produce a clearly
recognizable difference in the resultant hash value.
Awareness | Basic security training that focuses on
common or basic security elements that all employees must
know and abide by. Less rigorous than training or education.
B
Backdoor | Unauthorized access to a system.
A backdoor is any access method or pathway that
circumvents access or authentication mechanisms.
Backup | The process of making copies of data onto other
storage media. The purpose of a backup is to protect
against data loss by having additional onsite or offsite
copies of data that can be restored when necessary.
Banner | A message sent by a service in response to a valid
or invalid query. A banner can confirm communication is
functioning properly or announce an error. Some banners
disclose the product name and version number of the
service.
Banner grabbing | The act of capturing or extracting
banners from services. Hackers often perform banner
grabbing after port scanning to learn what service is active
on a port.
Bastion host | A firewall positioned at the initial entry point
where a network interfaces with the Internet. It serves as
the first line of defense for the network. Also known as a
sacrificial host.
Bastion host OS | A system designed, built, and deployed
specifically to serve as a frontline defense for a network.
Behavioral-based detection | A form of IDS/IPS detection
based on a recording of real-world traffic as a baseline for
normal. All traffic or events that fail to match the normal
baselines are considered abnormal and potentially
malicious.
Blacklist | A type of filtering in which all activities or
entities are permitted except for those on the blacklist. Also
known as a block list.
Blog | A contraction of the words “web” and “log,” it is a
form of Web site where the site owner posts messages,
images, and videos for the public to view and potentially
comment on. Blogs are commonly a platform for discussing
issues, causes, or interests.
Border sentry | A description often applied to firewalls
positioned on network zone transitions or gateway locations.
Botnet army | A network of zombie/bot/agent–
compromised systems controlled by a hacker.
The network consists of the bots, agents, or zombies that
intercommunicate over the Internet. Another term for
zombie.
Botnet | A network of zombie/bot/agent–compromised
systems controlled by a hacker.
The network consists of the bots, agents, or zombies that
intercommunicate over the Internet.
Bots | Malicious software programs distributed by hackers
to take over control of victims’ computers. Also known as
agents or zombies. Bots are commonly used to construct
botnets.
Bottleneck | Any restriction on the performance of a
system. Can be caused by a slower component or a
pathway with insufficient throughput. A bottleneck causes
other components of system to work slower than their
optimum rate.
Breach | Any compromise of security. Any violation of a
restriction or rule whether caused by an authorized user or
an unauthorized outsider.
Bridge | A network device that forwards traffic between
networks based on the MAC address of the Ethernet frame.
A bridge forwards only packets whose destination address is
on the opposing network.
Bring Your Own Device (BYOD) | A policy of allowing or
even encouraging employees, contractors, and others to
connect their own computers, smartphones, and other
devices to their organization’s networks. BYOD can save
expenses and afford employees more autonomy, but it can
also compromise security.
Brute-force password attack | A form of password or
encryption key cracking attack that tries all possible valid
combinations from a defined set of possibilities (e.g., a set
of characters or hex values). Brute-force attacks will
eventually generate a valid solution given enough time,
assuming the hacker uses the correct set of possibilities.
Buffer overflow | A condition in which a memory buffer
exceeds its capacity and extends its contents into adjacent
memory. Often used as an attack against poor programming
techniques or poor software quality control. Hackers can
inject more data into a memory buffer than it can hold,
which may result in the additional data overflowing into the
next area of memory. If the overflow extends to the next
memory segment designated for code execution, a skilled
attacker can insert arbitrary code that will execute with the
same privileges as the current program. Improperly
formatted overflow data may also result in a system crash.
Bump in the stack | A term for a firewall that is
implemented via software.
Bump in the wire | A term for a firewall that is a separate
hardware implementation.
Business continuity plan | A plan to maintain the
mission-critical functions of the organization in the event of
a problem that threatens to take business processes offline.
The goal of business continuity planning is to prevent the
interruption of business tasks, even with a damaged
environment and reduced resources.
Business task | Any activity necessary to meet an
organization’s long-term goals. Business tasks are assigned
to employees and other authorized personnel via their job
descriptions.
C
Caching | Retention of Internet content by a proxy server.
Various internal clients may access this content and provide
it to subsequent requesters without the need to retrieve the
same content from the Internet repeatedly.
Centralized logging system | A technique of storing or
copying log events to a centralized logging server. This
mechanism is used to create a redundant copy of all log
files in a single warehousing location. A common example of
this is syslog.
Certificate Authority (CA) | A trusted third-party entity
that issues digital certificates to verify and validate
identities of people, organizations, systems, and networks
digitally.
Channel | A communication pathway, circuit, or frequency
dedicated or reserved for a specific transmission.
Chip creep | The slow movement of a chip out of its socket
or solder points because of expansion and contraction
caused by extreme temperature fluctuations.
Chokepoint | Similar to a bottleneck, but deliberately
created within a network infrastructure. A chokepoint is a
controlled pathway through which all traffic must cross. At
this point, filtering to block unwanted communication or
monitoring can occur.
Ciphertext | The seemingly random and unusable output
from a cryptographic function applied to original data.
Ciphertext is the result of encryption. Decryption converts
ciphertext back into plaintext.
Circuit | A logical connection between a client and a
resource server. May exist at Layer 3, 4, or 5 of the OSI
model. Also known as a session or a state.
Circuit firewall | A filtering device that allows or denies the
initial creation of a circuit, session, or state, but performs no
subsequent filtering on the circuit once established.
Circuit proxy | See circuit firewall.
Client | A host on a network. A client is the computer
system, which supports user interaction with the network.
Users employ a client to access resources from the network.
Users can also employ a client generically as any hardware
or software product to access a resource. For example,
standard e-mail software is a client.
Client/server network | A form of network where certain
computers are designated as “servers” to host resources
shared with the network. The remaining computers are
designated as “clients” to enable users to access shared
resources. Most client/server networks employ directory
services and single sign-on. Also known as a domain.
Client-to-server VPN | A VPN created between a client
and a server either within the same local network or across
a WAN link or intermediary network to support secure client
interaction with the services of a resource host. Also known
as a host-to-host VPN.
Clipper chip | A chipset developed and promoted by the
U.S. government as an encryption device to be adopted by
telecommunications companies for voice transmission. It
was announced in 1993 and was discontinued in 1996.
Closed source | A type of software product that is pre-
compiled and whose source code is undisclosed.
Cluster | A logical division of data composed of one or more
sectors on a hard drive. A cluster is the smallest
addressable unit of drive storage, usually 512, 1,024, 2,048,
or 4,096 bytes, depending on the logical volume size.
Cold calling | A tactic of pursuing and extracting
information for the purpose of making a sale or performing a
social engineering attack. A cold call presupposes little or no
knowledge of the person answering the phone. It requires
the caller to be able to pick up on vocal and word clues, be
knowledgeable about human nature, and adapt quickly to
changes in conversation.
Command shell | A software interface with a system that
allows code execution. A command shell is often the focus
of an attack. If a hacker gains access to a command shell,
he or she can perform arbitrary code execution. Also known
as a terminal window or a command prompt. For example,
in Windows, the command shell prompt is usually “C:\>”.
Commercial firewall | A firewall product designed for
larger networks. Usually a commercial firewall is a hardware
device.
Common Gateway Interface (CGI) script | The Common
Gateway Interface (CGI) is a standard that defines how Web
server software can delegate the generation of Web pages
to a console application. Such applications are known as CGI
scripts. They can be written in many programming
languages, although scripting languages are often used.
Compliance audit | A detailed and thorough review of the
deployed security infrastructure compared with the
organization’s security policy and any applicable laws and
regulations.
Compression | Removal of redundant or superfluous data
or space to reduce the size of a data set. Compression
consumes less storage space and increases the speed of
data transmission.
Confidentiality | The security service of preventing access
to resources by unauthorized users, while supporting access
to authorized users.
Content filtering | A form of filtering that focuses on traffic
content. Application proxies perform most content filtering.
Contract worker | An outsider brought into an organization
to work on a temporary basis. Contracted workers can be
consultants, temporary workers, seasonal workers,
contractors, or even day-laborers. Contracted workers
potentially represent a greater risk than regular, full-time
regular employees because they might lack loyalty, not see
the company as worthy of protection, might not be
accountable after a project ends, and so on.
Cookie filter | A cookie is a small text file used by Web
browsers and servers to track Web sessions. A cookie filter
blocks the sending and receiving of cookies. Blocking
cookies can reduce some threats of session tracking and
identify theft, but can also disable many Web-based services
such as online purchasing.
Corporate firewall | An appliance firewall placed on the
border or edge of an organization’s network.
Cost/benefit analysis | The final equation of risk analysis
to assess the relative benefit of a countermeasure against
the potential annual loss of a given asset exposed to a
specific threat.
Covert channel | An unknown, secret pathway of
communication. Covert channels can be timing or storage-
based.
Cross-site scripting (XSS) | The malicious insertion of
scripting code onto a vulnerable Web site. The results of an
XSS attack can include the corruption of the data on the
Web site or identity theft of the site’s visitors.
Cryptography | The art and science of hiding information
from unauthorized third parties. Cryptography is divided into
two main categories: encryption and decryption.
Customer premise equipment (CPE) | A customer
premise equipment-based VPN. This VPN is also known as a
VPN appliance.
D
Data leakage prevention (DLP) | A distributed data
protection technology that leverages deep analysis, context
evaluation, and rules configured from a central console to
ensure confidential information remains secure while in use,
in transit, and at rest
Data Link Layer (Layer 2) | The second layer of the OSI
model responsible for physical addressing (MAC addresses)
and supporting the network topology, such as Ethernet.
Database-based detection | A form of IDS/IPS detection
based on a collection of samples, patterns, signatures, and
so on stored in a database of known malicious traffic and
events. All traffic or events that match an item in the
database is considered abnormal and potentially malicious.
Also known as signature, knowledge, and pattern-matching
based detection.
Dead-man switch | A form of auto-initiation switch that
triggers when the ongoing prevention mechanism fails.
Common dead-man switches include firewalls and hand
grenades. If the firewall stops functioning, the connection is
severed. If a person dies while holding a live grenade, the
safety latch opens and the grenade explodes.
Decryption | The process of converting cipher text back
into plain text.
Dedicated connection | A network connection that is
always on and available for immediate transmission of data.
Most leased lines are dedicated connections.
Dedicated leased lines | See dedicated connection and
leased line.
De-encapsulation | The action of processing the contents
of a header, removing that header, and sending the
remaining payload up to the appropriate protocol in the next
higher layer in the OSI model.
Default allow | A security stance that allows all
communications except those prohibited by specific deny
exceptions. Also known as allow by default.
Default deny | A security stance that blocks all access to
all resources until a valid authorized explicit exception is
defined.
Defense in depth | A tactic of protection involving multiple
layers or levels of security components. Based on the idea
that multiple protections create a cumulative effect that will
require an attacker to breach all layers, not just one.
Demilitarized zone (DMZ) | A type of perimeter network
used to host resources designated as accessible by the
public from the Internet.
Denial of service (DoS) attack | A form of attack that
attempts to compromise availability. DoS attacks are usually
of two types: flaw exploitation and flooding. DDoS
(Distributed Denial of Service) often involves the distribution
of robots, zombies, or agents to thousands or millions of
systems that are then used to launch a DoS attack against a
primary target.
Deny by default/allow by exception | A security stance
that prevents all communications except those enabled by
specific allow exceptions. Also known as default deny.
Deterrent | A form of security defense that focuses on
discouraging a perpetrator with disincentives such as
physical harm, social disgrace, or legal consequences. A
deterrent can also be a defense that is complex or difficult
to overcome, such as strong encryption, multifactor
authentication, or stateful inspection filtering.
Dialer | A rogue program that automatically dials a modem
to a pre-defined number. Sometimes this is to auto-
download additional malware to the victim or to upload
stolen data from the victim. In other cases, the dialer calls
premium rate telephone numbers to rack up massive long
distance charges.
Dictionary password attack | A form of password or
encryption key-cracking attack that uses a pre-constructed
list of potential passwords or encryption keys.
Digital certificate | An electronic proof of identity issued
by a certificate authority (CA). A digital certificate is an
entity’s public key encoded by the CA’s private key.
Digital envelope | A secure communication based on
public-key cryptography that encodes a message or data
with the public key of the intended recipient.
Digital forensic techniques | Identifying, extracting, and
evaluating evidence obtained from digital media such as
computer hard drives, CDs, DVDs and other digital storage
device
Digital signature | A public-key cryptography–based
mechanism for proving the source (and possibly integrity) of
a signed dataset or message. A digital signature uses the
private key of a sender. Not the same as a “digitized
signature,” which is a digital image of handwriting.
Directory service | A network service that maintains a
searchable index or database of network hosts and shared
resources. Often based on a domain name system (DNS). An
essential service of large networks.
Disaster recovery plan | A plan to restore the mission-
critical functions of the organization once they have been
interrupted by an adverse event. The goal of disaster
recovery planning is to return the business to functional
operation within a limited time to prevent the failure of the
organization due to the incident
Disgruntled employee | A worker who feels wronged by
his or her employer and who may take malicious, unethical,
potentially illegal actions to exact revenge on the
organization.
Distributed denial of service (DDoS) | An attack that
uses multiple remotely controlled software agents
disseminated across the Internet. Because the denial of
service attack comes from multiple machines
simultaneously, it is “distributed.” DDoS attacks can include
flooding, spam, eavesdropping, interception, MitM, session
hijacking, spoofing, packet manipulation, distribution of
malware, hosting phishing sites, stealing passwords,
cracking encryption, and more.
Distributed LAN | A LAN whose components are in
multiple places that are interconnected by WAN VPN links.
Diversity of defense | An approach to security similar to
defense in depth, in that it supports multiple layers, but
unlike it, in that it uses a different security mechanism at
each, or most, of the layers.
DNS poisoning | A form of exploitation in which the data
on a DNS server are falsified so subsequent responses to
DNS resolution queries are incorrect. DNS poisoning can
wage man-in-the-middle attacks.
DNS spoofing | A form of exploitation in which
unauthorized or rogue DNS server responds to DNS queries
with false, spoofed resolutions. DNS poisoning can wage
man-in-the-middle attacks.
Domain | A client/server network managed by a directory
service.
Domain Name System (DNS) | A network service that
resolves fully qualified domain names (FQDNs) into their
corresponding IP address. DNS is an essential service of
most networks and their directory services.
Domain registration | The information related to the
owners and managers of a domain name accessed through
domain registrar’s Web sites and whois lookups. A domain
registration might include a physical address, people’s
names, e-mail addresses, and phone numbers. This
information is useful in waging social engineering attacks.
Downtime | Any planned or unplanned period when a
network service or resource is not available. Downtime can
be caused by attack, hardware failure, or scheduled
maintenance. Most organizations strive to minimize
downtime through security and system management.
Dual-homed firewall | A firewall that has two network
interfaces. Each network interface is located in a unique
network segment. This allows for true isolation of the
segments and forces the firewall to filter all traffic moving
from one segment to another.
Dumpster diving | A type of reconnaissance in which an
attacker examines an organization’s trash or other
discarded items to learn internal or private information. The
results of dumpster diving are often used to wage social
engineering attacks.
Dynamic packet filtering | The process of automatically
created temporary filters. In most cases, the filters allow
inbound responses to previous outbound requests. Also
called stateful inspection.
E
Eavesdropping | The act of listening in on digital or audio
conversations. Network eavesdropping usually requires a
sniffer, protocol analyzer, or packet capturing utility.
Eavesdropping may be able to access unencrypted
communication, depending on where it occurs.
Edge router | A router positioned on the edge of a private
network. Usually an edge router is the last device owned
and controlled by an organization before an ISP or telco
connection.
Education | The third and highest level of obtaining
security knowledge that leads to career advancement.
Security education is broad and not necessarily focused on
specific job tasks or assignments. More rigorous than
awareness or training.
Egress filtering | Filtering traffic as it attempts to leave a
network, which can include monitoring for spoofed
addresses, malformed packets, unauthorized ports and
protocols, and blocked destinations.
Electronic Privacy Information Center (EPIC) | A public
interest research group in Washington, D.C., established in
1994 to focus public attention on emerging civil liberties
issues and to protect privacy, the First Amendment, and
Constitutional values in the information age. It pursues a
wide range of activities, including privacy research, public
education, conferences, litigation, publications, and
advocacy. It maintains two of the world’s most popular
privacy sites—epic.org and privacy.org—and publishes the
online EPIC Alert every two weeks with information about
emerging privacy and civil liberties issues.
Encapsulating Security Payload (ESP) | The second core
IPSec security protocol; it can perform authentication to
provide integrity protection, although not for the outermost
IP header.
Encapsulation | The process of enclosing or encasing one
protocol or packet inside another protocol or packet. Also
known as “tunneling.” Encapsulation allows for
communications to cross intermediary networks that might
be incompatible with the original protocol. Encapsulation is
distinct from encryption, but many encapsulation protocols
include encryption.
Encryption | The process of converting original data into a
chaotic and unusable form to protect it from unauthorized
third parties. Decryption returns the data back to its
original, usable form.
Enumeration | The process of discovering sufficient details
about a potential target to learn about network or system
vulnerabilities. Enumeration often starts with operating
system identification, followed by application identification,
then extraction of information from discovered services.
Exploit | An attack tool, method, or technique a hacker
uses to take advantage of a known vulnerability or flaw in a
target system.
Exposure factor (EF) | The potential amount of harm from
a specific threat stated as a percentage. Used in the
calculation of SLE.
Extranet | A type of perimeter network used to host
resources designated as accessible to a limited group of
external entities, such as business partners or suppliers, but
not by the public. Often, access to an extranet requires the
use of a virtual private network or VPN, especially when
access originates from the Internet.
Extranet VPN | A VPN used to grant outside entities access
into a perimeter network; used to host resources designated
as accessible to a limited group of external entities, such as
business partners or suppliers, but not the general public.
F
Fail-open | A failure response resulting in open and
unrestricted access or communication.
Fail-safe | A failure response resulting in a secured or safe
level of access or communication.
Fail-secure | A failure response resulting in a secured or
safe level of access or communication.
Fair queuing | A technique of load balancing that operates
by sending the next transaction to the firewall with the least
current workload.
False negative | An event that does not trigger an alarm
but should have, due to the traffic or event actually being
abnormal and/or malicious. This is the unwanted non-
detection of a malicious event.
False positive | An event that triggers an alarm but should
not have, due to the traffic or event actually being benign.
This is the unwanted false alarm that wastes time and
resources pursuing a non-malicious event.
File encryption | A form of security protection that
protects individual files by scrambling the contents in such a
way as to render them unusable by unauthorized third
parties.
File Transfer Protocol (FTP) | A protocol and a data
exchange system commonly used over TCP/IP networks,
including the Internet, but which is unencrypted and
performs authentication and data transfer in plaintext.
Filter | A written expression of an item of concern (protocol,
port, service, application, user, IP address) and one or more
actions to take when the item of concern appears in traffic.
A filter expresses the intention to block or deny unwanted
items of concern. Also known as a rule or ACL.
Filtering | The process of inspecting content against a set
of rules or restrictions to enforce allow-and-deny operations
on that content. Firewalls and other security components
use filtering.
Firewalking | A hacking technique used against static
packet filtering firewalls to discover the rules or filters
controlling inbound traffic.
Firewall | A network security device or host software that
filters communications, usually network traffic, based on a
set of predefined rules. Unwanted content is denied and
authorized content is allowed. Also known as a sentry
device.
Flaw exploitation attack | A form of DoS that uses a
software specific exploit to cause the interruption of
availability. Once you apply the appropriate patch, the
system is no longer vulnerable to this particular exploit.
Flooding | An attack, usually resulting in a DoS, in which
hackers direct massive amounts of traffic toward a target to
fully consume available bandwidth or processing
capabilities.
Footprinting | The act of researching and uncovering
information about a potential attack target. Also known as
reconnaissance.
Fragmentation | This occurs when a dataset is too large
for maximum supported size of a communication container,
such as a segment, packet, or frame. The original dataset
divides into multiple sections or fragments for transmission
across the size-limited medium, then reassembles on the
receiving end. Fragmentation can sometimes corrupt or
damage data or allow outsiders to smuggle malicious
content past network filters.
Frame | The collection of data at the Data Link Layer (Layer
2) of the OSI model, defined by the Ethernet IEEE 802.3
standard, that consists of a payload from the Network Layer
(Layer 3) to which an Ethernet header and footer have been
attached.
Fully qualified domain name (FQDN) | A complete
Internet host name including a top-level domain name, a
registered domain name, possibly one or more sub-domain
names, and a host name. Examples include:
www.itttech.edu and maps.google.com. A DNS is used to
resolve FQDNs into IP addresses.
Fuzzing tools | Hacking and testing utilities that use a
brute force technique to craft packets and other forms of
input directed toward the target. Fuzzing tools stress a
system to push it to react improperly, to fail, or to reveal
unknown vulnerabilities.
G
Gateway | An entrance or exit point to a controlled space. A
firewall is often positioned at a gateway of a network to
block unwanted traffic.
Gateway-to-gateway VPN | A VPN model used to connect
to offices together such as a main office and a remote
office. It is also referred to as a site-to-site VPN.
General purpose OS | An operating system such as
Windows, Linux, Mac OS, UNIX, which can support a wide
variety of purposes and functions, but which, when used as
a bastion host OS, must be hardened and locked down.
H
Hacker | A person who performs hacking. Modern use of
this term now implies malicious or criminal intent by the
hacker, although criminals are more correctly known as
“crackers.” An “ethical hacker” obtains the permission of
the owner of a system before hacking.
Hacking | The act of producing a result not intended by the
designer of a system. Hackers may perform such acts out of
curiosity or malice. Malicious hacking is known as
“cracking,” but many people typically call all these actions
“hacking,” regardless of intent.
Hacktivism | Politically or socially motivated hacking, seen
by activists as a form of civil disobedience in the interest of
free speech and human rights, but seen by its opponents as
a form of cyberterrorism.
Hairpinning | A process by which malicious code can enter
from a non-secure network, and make a hairpin, or sharp
turn and enter a secure network with little or no trouble
because it is entering from a secure and verified endpoint.
Hairpinning is a particular issue for organizations whose
work-at-home employees want to connect to both an
unsecure network and a VPN at the same time.
Hardening | The process of securing or locking down a host
against threats and attacks. This can include removing
unnecessary software, installing updates, and imposing
secure configuration settings.
Hardware address | The physical address assigned to a
network interface by the manufacturer. Also known as the
MAC address.
Hardware firewall | An appliance firewall. A hardened
computer product that hosts firewall software exclusively.
Hardware VPN | A dedicated device hosting VPN software.
Also known as an appliance VPN. Hardware VPNs can
connect hosts and/or networks.
Hash algorithm | A set of mathematical rules and
procedures that produces a unique number from a dataset.
See hash and hashing.
Hash or hash value | The unique number produced by a
hash algorithm when applied to a dataset. A hash value
verifies the integrity of data.
Hashing | The process of verifying data integrity. Hashing
uses hash algorithms to produce unique numbers from
datasets, known as hash values. If before and after hash
values are the same, the data retain integrity.
Header | The additional data added to the front of a
payload at each layer of the OSI model that includes layer-
specific information.
Hierarchical File System (HFS) | A storage device file
system developed by Apple Inc. for use on Macintosh
computers. HFS supports multiple resource forks for file
objects.
Hijacking | This attack occurs when a hacker uses a
network sniffer to watch a communications session to learn
its parameters. The hacker then disconnects one of the
session’s hosts, impersonates the offline system, and then
begins injecting crafted packets into the communication
stream. If successful, the hacker takes over the session of
the offline host, while the other host is unaware of the
switch.
Honeynet | A collection of multiple honeypots in a network
for the purposes of luring and trapping hackers.
Honeypot | A closely monitored system that usually
contains a large number of files that appears to be valuable
or sensitive, and serves as a trap for hackers. A honeypot
distracts hackers from real targets, detects new
exploitations, and learns the identities of hackers.
Host | A node that has a logical address assigned to it,
usually an IP address. This typically implies that the node
operates at and/or above the Network Layer. This would
include clients, servers, firewalls, proxies, and even routers.
The term excludes switches, bridges, and other physical
devices such as repeaters and hubs. In most cases, a host
either shares or accesses resources and services from other
hosts.
Host firewall | A software firewall installed on a client or
server.
Host VPN | A VPN endpoint located on a host client or
server. A host VPN relies on either a native feature of the
operating system or a third-party application.
Host-to-gateway VPN | A VPN model where the remote
client connects to the VPN server to gain access to the
internal network.
Host-to-host VPN | A VPN created between two individual
hosts across a local or intermediary network. Host-to-host
VPNs is also known as client-to-server or remote-to-office or
remote-to-home VPNs.
Host-to-site VPN | A VPN created between a host and a
network across a local or intermediary network. Also known
as a remote access VPN.
HOSTS file | A static file on every IP-enabled host where
FQDN-to-IP address resolutions can be hard-coded.
Hybrid attack | A form of password or encryption key-
cracking attack that combines dictionary attacks with brute
force attacks. A dictionary list provides seed values to a
brute force attack tool that makes modifications to the seed
value. A very effective attack against users who mistakenly
believe that changing a few characters or adding a few
characters to a base password is actually improving the
password’s strength. For example, hybrid attacks may
combine dictionary words with a digit or two to increase the
likelihood of obtaining a successful result.
Hybrid VPN | A form of VPN establishing a secure VPN over
trusted VPN connections.
I
ICMP redirect | An announcement message sent to hosts
to adjust the routing table. ICMP type 5 messages are
known as redirects. Hackers can use ICMP redirects to
perform man-in-the-middle or session hijacking attacks.
Identity and access management (IAM) | The security
discipline that enables the right individuals to access the
right resources at the right times consistent with
organizational policy.
Identity proofing | The act of authentication. Confirming
the identity of a user or host.
IDS insertion | An attack that exploits the nature of a
network-focused IDS to collect and analyze every packet to
trick the IDS into thinking an attack took place when it
actually hasn’t. The common purpose of IDS injection
attacks is to trick signature or pattern matching detection of
malicious network events.
Incident response plan | A predefined procedure to react
to security breaches to limit damage, contain the spread of
malicious content, stop compromise of information, and
promptly restore the environment to a normal state.
Information Technology Infrastructure Library (ITIL) |
A set of concepts and practices that provide detailed
descriptions and comprehensive checklists, tasks and
procedures for common IT practices. The Security
Management section is based on the ISO 27002 standard.
Ingress filtering | Filtering traffic as it attempts to enter a
network. This can include monitoring for spoofed addresses,
malformed packets, unauthorized ports and protocols, and
blocked destinations.
Insertion attack | An exploit-based on the introduction of
unauthorized content or devices to an otherwise secured
infrastructure. Three common insertion-based attacks
include SQL injection, IDS insertion, and rogue devices.
Instant message (IM) | A form of near real-time text
communication. Also known as chat, IRC, and SMS
messaging.
Intangible cost (or value) | Costs or values not directly
related to budgetary funds. They can include but are not
limited to research and development, marketing edge,
competition value, first to market, intellectual property,
public opinion, quality of service, name recognition, repeat
customers, loyalty, honesty, dependability, assurance,
reliability, trademarks, patents, privacy, and so on.
Integrated Services Digital Network (ISDN) | A set of
communications standards for simultaneous digital
transmission of voice, video, data, and other network
services over the traditional circuits of the public switched
telephone network.
Integrity | The security service of preventing unauthorized
changes to data.
Intentional electromagnetic interference (IEMI) | The
result of an intentional discharge made to damage or
destroy electronic equipment ranging from cell phones to
computers and servers.
Interception attack | Any attack that positions the
attacker inline with a session between a client and server.
Such attacks typically allow the hacker to eavesdrop and
manipulate the contents of the session. Also known as a
man-in-the-middle attack.
Intermediary network | Any network, network link, or
channel located between the endpoints of a VPN. Often the
Internet.
Internal personnel | Any worker or person who is
physically present within the building or who has
authorization to remotely connect into the network. Internal
personnel are the most common cause of security
violations.
Internet Assigned Numbers Authority (IANA) | The
entity responsible for global coordination of IP addressing,
DNS root, and other Internet protocol resources.
Internet Control Message Protocol (ICMP) | A
commonly used protocol found in the Network Layer (Layer
3). ICMP rides as the payload of an IP packet. ICMP supports
network health and testing. Commonly abused by hackers
for flooding and probing attacks.
Internet Engineering Task Force (IETF) | The standards
body for Internet-related engineering specifications.
Internet Key Exchange v2 (IKEv2) | The second and
latest version of the IKE protocol.
Internet Relay Chat (IRC) | A real-time text
communication system. Hackers commonly use IRC as a
way to communicate anonymously and control botnets.
Internetwork Packet Exchange/Sequenced Packet
Exchange (IPX/SPX) | A legacy protocol developed by
Novell for their NetWare networking product. Mostly
replaced by TCP/IP.
Intrusion detection system (IDS) | A security mechanism
to detect unauthorized user activities, attacks, and network
compromise. An IDS can respond in a passive manner
through alerts and logging or in an active manner by
disconnecting an offending session.
Intrusion prevention system (IPS) | A security
mechanism to detect and prevent attempts to breach
security.
IP address | The temporary logical address assigned to
hosts on a network. An IP address is managed and
controlled at the Network Layer (Layer 3) of the OSI model
by IP (Internet Protocol). IPv4 addresses are 32-bit
addresses presented in human-friendly dotted-decimal
notation. IPv6 addresses are 128-bit address presented in a
special hexadecimal grouping format.
IP Multimedia Subsystem (IMS) | An architectural
framework for delivering IP multimedia services; IMS would
carry packet communications in all known forms over
wireless or landline, everything from traditional telephony to
video on demand (VoD).
IPSec | IP protocol encryption services extracted from IPv6
to be used as an add-on component for IPv4. IPSec provides
tunnel mode and transport mode encrypted Network Layer
connections between hosts and/or networks.
J
Job description | An essential part of security and an
extension of the written security policy. The job description
defines the business tasks for each person within the
organization. This in turn prescribes the authorization
personnel need to accomplish these assigned tasks.
K
Kerberos | A computer network authentication protocol
that allows nodes communicating over a non-secure
network to prove their identity to one another in a secure
manner. It is also a suite of free software published by
Massachusetts Institute of Technology (MIT) that implements
this protocol. It was designed as a client-server model, and
it provides mutual authentication—both the user and the
server verify each other’s identity. Kerberos protocol
messages are protected against eavesdropping and replay
attacks.
Key or encryption key | The unique number used to guide
an algorithm in the encryption and decryption process. A
valid key must be within the keyspace of an algorithm.
Key exchange | The cryptographic function ensuring that
both endpoints of a commutation have the same symmetric
key. Key exchange occurs by simultaneous key generation
or with a digital envelope.
Key pair | The set of associated keys including a public key
and a private key used by public key cryptography. Only the
public key can decrypt data encrypted by the private key,
and vice versa.
Keyspace | The range of valid keys used by an algorithm.
Keyspace is the bit length of the keys supported by the
algorithm.
Keystroke logger | Malware that records all keyboard
input and transmits the keystroke log to a hacker.
Knowledge-based detection | A form of IDS/IPS detection
based on a collection of samples, patterns, signatures, and
so on stored in a database of known malicious traffic and
events. All traffic or events that match an item in the
database is considered abnormal and potentially malicious.
Also known as signature, database, and pattern-matching–
based detection.
L
LAN-to-LAN VPN | A VPN between two networks over an
intermediary network. Also known as WAN VPN and site-to-
site VPN.
Layer 2 Forwarding (L2F) Protocol | An early
communications protocol that competed with Point-to-Point
Tunneling Protocol.
Layer 2 Tunneling Protocol (L2TP) | An older protocol
largely replaced by IPSec and SSL/TLS-based VPNs in
production environments, but still in use in some older
environments.
Leased line | A network communications line leased from
an ISP or telco service. A leased line is usually a dedicated
line between network locations or to the Internet.
Leetspeak | A somewhat secret form of communication or
language hackers use based on replacing letters with
numbers, symbols, or other letters that somewhat resemble
the original characters. For example, “elite” becomes
“eleet,” and then becomes “31337.”
Load balancer | A system or device (hardware or software)
that takes the load coming into a set of servers and ensure
that the load is balanced between or among the servers.
Load balancing | A network traffic management technique
to spread the workload or traffic levels across multiple
devices to maintain availability, uptime, and high-
performance at wirespeed.
Local area network (LAN) | A network confined to a
limited geographic distance. Generally, a LAN is comprised
of segments that are fully owned and controlled by the host
organization as opposed to using lines leased from telcos.
Log | A log is a recording or notation of activities. Many
security services, applications, and network resources
automatically create a log of all events. Also known as an
event log or a log file.
Logging | The act of creating or recording events into a log.
Similar to auditing and monitoring.
Logic bomb | Malware that acts like an electronic land
mine. Once a hacker places a logic bomb in a system, it
remains dormant until a triggering event takes place. The
trigger can be a specific time and date, the launching of a
program, the typing of a specific keyword, or accessing a
specific URL. Once the trigger occurs, the logic bomb
springs its malicious event on the unsuspecting use.
Logical address | A temporarily assigned address given to
a host. IP address is a common example of a logical
address. Most logical addresses exist at the Network Layer
(Layer 3) of the OSI model.
M
MAC spoofing | The act of a hacker changing the MAC
address of their network interface. Commonly used to
bypass MAC filtering on a wireless access point by
impersonating a valid client.
Malicious code | Any software that was written with
malicious intent. Administrators use anti-virus and anti-
malware scanners to detect and prevent malicious code
(also known as malware) from causing harm within a private
network or computer.
Management interface | The command line or graphical
interface used to control and configure a device. Often
accessible through a console (CON) port on the device or
through a logical interface across the network.
Man-in-the-middle (MinM) attack | This attack occurs
when a hacker is positioned between a client and a server
and the client is fooled into connecting with the hacker
computer instead of the real server. The attack performs a
spoofing attack to trick the client. As a result, the
connection between the client and server is proxied by the
hacker. This allows the hacker to eavesdrop and manipulate
the communications.
Maximum Transmission Unit (MTU) | The largest amount
of data that a datagram can hold based on the limitations of
the networking devices managing a given segment. As an
MTU changes across a communication path, a datagram
may be fragmented to comply with the MTU restriction.
Mean time between failures (MTBF) | A rating on some
hardware devices expressing the average length of time
between significant failures.
Mean time to failure (MTTF) | A rating on some hardware
devices expressing the average length of time until the first
significant failure is likely to happen.
Media Access Control (MAC) address | The physical
address assigned to a network interface by the
manufacturer. The MAC address is a 48-bit binary address
presented in as hexadecimal pairs separated by colons. The
first half of a MAC address is known as the Organizationally
Unique Identifier (OUI) or vender ID, the last half is the
unique serial number of the NIC.
Metacharacter | A character that has a special meaning
assigned to it and recognized as part of a scripting or
programming language. Metacharacters should be filtered,
escaped, or blocked to prevent script injection attacks.
Escaping metacharacters is a programmatic tactic to treat
all characters as basic ASCII rather than as something with
special meaning or purpose.
Mission-critical | The state or condition of an asset or
process vitally important to the long-term existence and
stability of an organization. If a mission-critical element is
interrupted or removed, it often results in the failure of the
organization.
MITRE | The MITRE Corporation is a not-for-profit
organization chartered to work in the public interest. It
sponsors a vulnerability research, cataloging, and
information organization: http://cve.mitre.org/.
Mobile code | A form of software transmitted to and
executed on a client. Hackers can use mobile code for
malicious purposes.
Mobile IP | A standard communications protocol designed
to let mobile device users move from one network to
another while maintaining a permanent IP address; this
concept is also known as IP mobility. Mobile IP for IPv4 is
described in RFC 5944. Mobile IPv6, designed to work with
next generation of the Internet Protocol, is covered in RFC
6275.
Modeling | The process of simulating and testing a new
concept, design, programming, technique, and so forth
before deployment into a production environment. Modeling
often occurs before piloting.
Monitoring | The act of watching for abnormal or unwanted
circumstances. Commonly used interchangeably with
logging and auditing.
Monkey-in-the-middle attack | Another term for man-in-
the-middle attack.
Multifactor authentication | Authentication that requires
multiple valid proofs of identity used in simultaneous
combination.
N
National Information Infrastructure (NII) | The product
of the High Performance Computing and Communication Act
of 1991. It was a telecommunications policy buzzword,
which was popularized during the Clinton administration
under the leadership of Vice President Al Gore. It was a
proposed advanced, seamless web of public and private
communications networks, interactive services,
interoperable hardware and software, computers,
databases, and consumer electronics to put vast amounts of
information at users’ fingertips.
National Institute of Standards and Technology
(NIST) | NIST is a non-regulatory federal agency within the
U.S. Department of Commerce whose mission is to promote
U.S. innovation and industrial competitiveness by advancing
measurement science, standards, and technology. As part of
its mission, the NIST performs vulnerability research,
cataloging, and information distribution: http://nvd.nist.gov/.
National Security Agency (NSA) | The National Security
Agency/Central Security Service (NSA/CSS) is a cryptologic
intelligence agency of the United States government,
administered as part of the United States Department of
Defense. It is responsible for the collection and analysis of
foreign communications and foreign signals intelligence,
which involves cryptanalysis. It is also responsible for
protecting U.S. government communications and
information systems from similar agencies elsewhere, which
involves cryptography.
Native firewall | A firewall within an operating system or
hardware device placed there by the vendor or
manufacturer. Can also include firewalls not necessarily
installed by default, but which you can add to a system
through an update or patch installation.
NetBIOS Extended User Interface (NetBEUI) | An
application-programming interface (API) developed by IBM
in 1985 to emulate NetBIOS on a token ring network. Still
used by Microsoft to describe a Transport Layer protocol for
file and print sharing over Ethernet, which technically is
better termed NetBIOS Frames (NBF). NBF makes extensive
use of broadcast messages and thus introduces additional
traffic to a network.
Network access control (NAC) | A mechanism that limits
access or admission to a network based on the security
compliance of a host.
Network address translation (NAT) | A service that
converts between internal addresses and external public
addresses. This conversion is performed on packets as they
enter or leave the network to mask and modify the internal
client’s configuration. The primary purpose of NAT is to
prevent internal IP and network configuration details from
being discovered by external entities, such as hackers.
Network Layer (Layer 3) | The third layer of the OSI
model. This layer is responsible for logical addressing (IP
addresses) and routing traffic.
Network News Transfer Protocol (NNTP) | The protocol
used by the USENET message service. USENET is a
persistent message service that allows anyone to post and
read messages from over 100,000 named, categorized,
topical newsgroups.
Network security | The collection of security components
assembled in a network to support secure internal and
external communications. Network security depends on
upon host security. Network security operates to protect the
network as a whole, rather than as individual systems.
New Technology File System (NTFS) | A file format
developed by Microsoft commonly used on Windows
systems. NTFS offers file security, large volume size, large
file size, and alternate data streams (ADS).
Nmap | A network mapping tool that performs network
scanning, port scanning, OS identification, and other types
of network probing. Nmap is available at
http://www.insecure.org/.
Node | Any device on the network that can act as the
endpoint of a communication. This includes clients, servers,
switches, routers, firewalls, and anything with a network
interface that has a MAC address. A node is a component
that can receive communication with, rather than one that
communication only through or across. For example,
network cables and patch panels are not nodes.
Non-authenticating query service | Any communication
exchange that does not verify the identity of the endpoints
of a communication and accepts any properly formed
response as valid. DNS and ARP are common examples.
Hackers can easily spoof such a service.
Non-dedicated connection | A network connection not
always on and available for immediate transmission of data.
A connection must be established through a negation
process before the channel is open and ready for data
transmission. Dial-up, ISDN, and DSL lines are non-
dedicated connections.
Nonrepudiation | A security service that ensures that a
sender cannot deny sending a message. This service can be
provided by public key cryptography, typically through a
digital signature.
O
One-time pad | A form of cryptography in which each
encryption key is used once before being discarded. Keys
are pseudorandom and never repeat. Key length must
match message length, so that each character is encrypted
with a unique key character.
One-way function | A mathematical operation performed
in one direction relatively easily; reversing the operation is
impossible—or nearly so.
Open source | A type of software product that may or may
not be pre-compiled and whose source code is freely
disclosed and available for review and modification.
Opportunistic hackers | A person who takes advantages
of unique or abnormal situations to perform malicious
actions, but who would not initiate such actions otherwise.
Optical carrier (OC) | A form of network carrier line, often
leased or dedicated, which uses fiber optic cables for very
high-speed connections. An OC-1 connection supports a
throughput of 51.84 Mbps.
OS/2 | A multi-tasking operating system developed jointly
by Microsoft and IBM. First released in 1987, it lost nearly its
entire market share to Windows after the two companies
ceased collaboration in 1990. IBM discontinued support in
2006.
Open Systems Interconnection (OSI) Reference Model
| A standard conceptual tool used to discuss protocols and
their functions. The OSI model has seven layers. Each layer
can communicate with its peer layer on the other end of a
communication session. While the OSI model helps to
discuss protocols, most protocols are not in full compliance
with it.
Out of band | A method of communication through an
alternative route, mechanism, or pathway than the current
one employed (the current communication is known as “in
band”). Commonly used as a technique for secured data
exchange or verification of an identity.
P
Packet | The collection of data at the Network Layer (Layer
3) of the OSI model. It consists of the payload from the
Transport Layer (Layer 4) above and the Network Layer
header. IP packets are a common example.
Padded cell | Specialized host used to place an attacker
into a system where the intruder cannot do any harm.
Partition | A logical division of a hard drive that can be
formatted with a file system.
Passive threat | Any harmful code or site that depends
upon the user’s actions to be accessed or activated. If users
never visit an infected site or do not perform the risky
activity, the threat never reaches them. A passive threat is
similar to a virus in that it depends upon the activity of the
user to activate, infect, and spread.
Patch management | The procedure of watching for the
release of new updates from vendors, testing the patches,
obtaining approval, then overseeing the deployment and
implementation of updates across the production
environment.
Payload | The non-header component of a
PDU/segment/packet/frame. The payload is the data
received from the layer above that includes the above
layer’s header and its payload.
Permission | An ability to interact with a resource that is
granted or denied to a user through some method of
authorization or access control, such as access control lists
(ACLs)
Personal firewall | Typically a software host firewall
installed on a home computer or network client. Can also
refer to SOHO hardware firewalls such as those found on
DSL and cable modems and wireless access points.
Phishing | An attack that seeks to obtain information from
a victim by presenting false credentials or luring victims to
an attack site. Phishing can occur face to face, over the
phone, via e-mail, on a Web site, or through IM.
Physical address | The hardware address assigned to a
network interface by the manufacturer. Also known as the
MAC address.
Physical Layer (Layer 1) | The bottom or first layer of the
OSI model. This layer converts data into transmitted bits
over the physical network medium.
Piloting | Using a new service, device, configuration,
software, and so on to a limited number of testing hosts
before rolling out the new component to the entire
production environment. Piloting often occurs after
modeling. Also called beta testing.
Ping sweep | A network scan that sends ICMP type 8 echo
requests to a range of IP addresses to obtain ICMP type 0
echo responses. A ping sweep can discover active systems
and identify the IP addresses in use.
Playback attack | See replay attack.
Point-to-Point Protocol (PPP) | A protocol commonly
used in establishing a direct connection between two
networking nodes.
Point-to-Point Tunneling Protocol (PPTP) | An early
proprietary protocol from Microsoft.
Pop-up blocker | A software tool that prevents or restricts
Web sites from automatically opening additional tabs or
windows without the user’s consent. These additional
windows are known as pop-ups or pop-unders. Pop-ups are
commonly used as methods of advertising, as well as
elements in social engineering and distribution of malicious
code.
Port address translation | An extension to network
address translation (NAT) that permits multiple devices on a
local area network (LAN) to be mapped to a single public IP
address.
Port-based network access (admission) control
(PNAC) | A form of network access control or admission
control (NAC) used on individual network access devices,
such as firewalls, VPN gateways, and wireless routers, to
offload authentication to a dedicated authentication
server/service. Only after valid authentication are
communications with or across the network device allowed.
Port forwarding | The function of routing traffic from an
external source received on a specific pre-defined IP address
and port combination (also known as a socket) to an internal
resource server. Also known as reverse proxy and static NAT.
Port number | The addressing scheme used at the
Transport Layer (Layer 4) of the OSI model. There are
65,535 ports, each of which can in theory support a single
simultaneous communication.
Port scanning | A network scan that sends various
constructions of TCP or UDP packets to determine the open
or closed state of a port. Tools such as nmap are used to
perform port scanning.
POSIX | A variant of the UNIX operating system. Supported
by Windows NT 4.0, but not in any subsequent version of
Windows. POSIX used the ADS feature of NTFS.
Post Office Protocol (POP) | An Application Layer protocol
used by e-mail clients to receive messages from an e-mail
server. The default TCP/IP port is 110, and it does not
encrypt communications. The companion SMTP protocol
sends messages to an e-mail server.
Presentation Layer (Layer 6) | The sixth layer of the OSI
model translates the data received from host software into a
format acceptable to the network. This layer also performs
this task in reverse for data coming from the network to
host software.
Principle of least privilege | The guideline that all users
should be granted only the minimum level of access and
permission required to perform their assigned job tasks and
responsibilities.
Privacy | Keeping information about a network or system
user from being disclosed to unauthorized entities. While
typically focused on private information like a Social
Security number, medical records, credit card number,
cellular phone number, etc., privacy concerns extend to any
data that represents personally identifiable information (also
known as PII).
Private branch exchange (PBX) | A type of business
telephone network. PBX systems allow for multiple phone
extensions, voice mailboxes, and conference calling. PBX
systems require specialized equipment. PBX systems are
largely being replaced by VOIP (Voice over IP) solutions.
Private IP address | The ranges of IP addresses defined in
RFC 1918 for use in private networks that are not usable on
the Internet.
Private key | The key of the public key cryptography key
pair kept secret and used only by the intended entity. The
private key decodes information encoded with its associated
public key, encrypting information that can be decrypted
only by its associated public key. This process validates the
identity of the originator and creates a digital signature.
Privilege | An increased ability to interact with and modify
the operating system and desktop environment granted or
denied to a user through some method of authorization or
access control, such as user rights on a Windows system.
Privilege escalation | The act of obtaining a higher level
of privilege or access for a user account or a session. A
tactic employed by hackers once they intrude into a
network through the compromise of a normal user account.
Professional hacker | A criminal whose objective is to
compromise IT infrastructures. Whether operating as
individuals, offering mercenary hacking services, or
functioning as members of a criminal ring, professional
hackers focus time and energy on becoming effective cyber
attackers. A professional hacker is someone who contracts
out his or her hacking skills to others.
Proprietary OS | An operating system built exclusively to
run on a bastion host device. Most appliance firewalls
employ a proprietary operating system.
Protocol Data Unit (PDU) | The collection of data at the
Session, Presentation, and Application layers (Layers 5–7) of
the OSI model.
Proxy attack | See man-in-the-middle attack.
Proxy manipulation | An attack in which a hacker modifies
the proxy settings on a client to redirect traffic to another
system, such as the hacker’s own machine. The hacker may
host a proxy server in addition to eavesdropping and
manipulating the redirected traffic.
Proxy server | A network service that acts as a “middle
man” between a client and server. A proxy can hide the
identity of the client, filter content, perform NAT services,
and cache content.
Pseudo random number generator (PRNG) | The
mechanism of computer systems that produces partially
random numbers using a complex algorithm and a seed
value that is usually time based. Computers are currently
unable to produce true random numbers and a PRNG
approximates randomness.
Public IP address | Any address that is valid for use on the
Internet. This excludes specially reserved addresses such as
loopback (127.0.0.1–127.255.255.255), RFC 1918
addresses, and the Windows APIPA addresses (169.254.0.0–
169.254.255.255). Organizations lease public addresses
from an Internet Service Provider (ISP).
Public key | The key of the public key cryptography key
pair shared with other entities with whom the holder of the
private key wishes to correspond. The public key decodes
messages encoded with its associated private key,
originates messages that only the holder of the associate
private key can decrypt, and creates digital envelopes.
Public key cryptography | A subset of asymmetric
cryptography based on the use of key pair sets. Public key
cryptography uses public and private keys to create digital
envelopes and digital signatures.
Public key infrastructure (PKI) | A combination of
several cryptographic components to create a real-world
solution that provides secure communications, storage, and
identification services. Commonly uses symmetric
encryption, asymmetric/public key encryption, hashing, and
digital certificates. In most cases, when PKI refers to
authentication, digital certificates are used as credentials.
Public network | Any network that accessible by entities
from outside an organization. Most often, use of this term
implies the Internet, but many other public networks exist.
Pwned | A leetspeak word derived from a common IRC typo
of “owned.” Used to mean hacking and taking over control
of a computer or network.
R
Reconnaissance | The act of learning as much as possible
about a target before attempting attacks. Reconnaissance
consists of collecting data about the target from multiple
sources online and offline. Effective reconnaissance is done
covertly, without tipping off the target about the research.
Reconnaissance can also be called footprinting, discovery,
research, and information gathering.
Recreational hacker | Someone who enjoys exploring and
learning about computer technology but may put an
organization’s network at risk by bringing in unapproved
software, experimenting on the network, or just trying an
exploit to “see if it works.”
Redundancy | The feature of network design that ensures
the existence of multiple pathways of communication. The
purpose is to prevent or avoid single points of failure.
Redundant array of independent disks (RAID) | A disk
set management technology that gains speed and fault
tolerance. RAID can provide some protection against hard
drive failure, but does not protect against software or data
compromises, such as virus infection.
Regional Internet Registry (RIR) | The five regional
organizations that oversee and monitor the allocation and
registration of IP addresses (both IPv4 and IPv6). RIR
consists of American Registry for Internet Numbers (ARIN),
RIPE Network Coordination Center (RIPE NCC), Asia-Pacific
Network Information Centre (APNIC), Latin American and
Caribbean Internet Address Registry (LACNIC) and African
Network Information Centre (AfriNIC).
Rekeying | The process of triggering the generation of a
new symmetric encryption key and secure exchange of that
key. Rekeying can take place based on time, idleness,
volume, randomness, or election.
Remote access | A communications link that enables
access to network resources using a wide area network
(WAN) link to connect to a geographically distant network. In
effect, remote access creates a local network link for a
system not physically local to the network. Over a remote
access connection, a client system can technically perform
all the same tasks as a locally connected client, with the
only difference being the speed or the bandwidth of the
connection.
Remote access server (RAS) or network access server
(NAS) | A network server that accepts inbound connections
from remote clients. Also known as a network access server
(NAS).
Remote access VPN | Another name for host-to-site VPN.
Remote-to-home VPN | A VPN used to connect a remote
or mobile host into a home computer or network. Also
known as a host-to-host VPN.
Remote-to-office VPN | A VPN used to connect a remote
or mobile host into office network workstation. Also known
as a host-to-host VPN.
Remote control | The ability to use a local computer
system to remotely take control of another computer over a
network connection. Often used for remote technical
assistance.
Replay attack | This attack occurs when a hacker uses a
network sniffer to capture network traffic and then
retransmits that traffic back on to the network at a later
time. Replay attacks often focus on authentication traffic in
the hope that retransmitting the same packets that allowed
the real user to log into a system will grant the hacker the
same access.
Request for comments (RFC) | A document that defines
or describes computer and networking technologies. These
documents are published by the Internet Engineering Task
Force, the standards body for Internet engineering
specifications. RFCs exist for hardware, operating systems,
protocols, security services, and much more.
Resources | Any data item or service available on a
computer or network accessible by a user to perform a task.
Return on Investment (ROI) | A business evaluation
technique to determine whether an investment will earn
back equivalent or greater benefit within a specific time.
Reverse caching | A means of providing faster access to
static content for external users accessing internal Web
servers.
Reverse proxy | The function of routing traffic from an
external source received on a specific pre-defined IP address
and port combination (also known as a socket) to an internal
resource server. Also known as port forwarding and static
network address translation (NAT).
RFC 1918 addresses | IP addresses that, by convention,
are not routed outside a private or closed network. Class A:
10.0.0.0–10.255.255.255; Class B: 172.16.0.0–
172.31.255.255; Class C: 192.168.0.0–192.168.255.255
Risk | The likelihood or potential for a threat to take
advantage of a vulnerability and cause harm or loss. Risk is
a combination of an asset’s value, exposure level, and rate
of occurrence of the threat. A goal of security is to
recognize, understand, and eliminate risk.
Risk assessment | Risk assessment is the process of
examining values, threat levels, likelihoods, and total cost of
compromise versus the value of the resource and the cost of
the protection. This involves the use of values and
calculations, such as AV, EF, SLE, ARO, ALE, and the
cost/benefit equation.
Risk management | Performing risk assessment, and then
acting on the results to reduce or mitigate risk. Often risk
assessment establishes a new security policy and then aids
in revising it over time.
Rogue access point | An access point set up and
configured by a hacker to fool users into connecting with it.
The hacker may then use the connection to carry out an
attack such as a man-in-the-middle attack.
Role or job role | A collection of tasks and responsibilities
defined by a security policy or job description for an
individual essential productivity, or security position.
Rootkit | A form of malware that hackers can upload and
deploy on a target system. It often replaces multiple
components of the host operating system with altered code.
Round-robin | A form of load balancing which hands out
tasks in a repeating non-priority sequence.
Router | A network device responsible for directing traffic
towards its stated destination along the best-known current
available path.
RRDool | A round-robin database tool intended to handle
time-series data like network bandwidth, temperatures, CPU
load, and so on. The data are stored in a round-robin
database (circular buffer); thus the system storage footprint
remains constant over time.
Rule | A written expression of an item of concern (protocol,
port, service, application, user, IP address) and one or more
actions to take when the item of concern appears in traffic.
Also known as a filter or ACL.
Rule set | The list of rules on a firewall (or router or switch)
that determine what traffic is and is not allowed to cross the
filtering device. Most rule sets employ a first-match-apply-
action process.
S
Sacrificial host | A firewall positioned at the initial entry
point where a network interfaces with the Internet serving
as the first line of defense for the network. Also known as a
bastion host.
Scalability | The ability of a product or service to provide
adequate performance across changes in size, load, scope,
or volume.
Scanning | The act of probing a network using custom
crafted packets. Scanning can determine the IP addresses in
use and whether ports are open or closed. The tool nmap
can be used to perform scanning.
Screening router | A router that can perform basic static
packet filtering services in addition to routing functions. A
screening router is the predecessor of modern firewalls.
Script kiddie | A new, inexperienced, or ignorant hacker
who uses pre-built attack tools and scripts instead of writing
his or her own or customizing existing ones. Even though a
derogatory term in the hacker community, “script kiddie”
still describes a serious threat to network security.
Sector | A subdivision of computer storage medium that
represents a fixed size of user-accessible data. Magnetic
disks typically have 512-byte sectors; optical disks have
2,048-byte sectors. When a device is formatted, sectors are
grouped into clusters.
Secure Shell (SSH) | A network protocol that allows data
exchange using a secure channel between two networked
devices. It is used primarily on GNU/Linux and UNIX based
systems to access shell accounts. SSH was a replacement
for Telnet and other insecure remote shells, which send
information, notably passwords, in plaintext, rendering them
susceptible to packet analysis. The encryption used by SSH
provides confidentiality and integrity of data over an
insecure network, such as the Internet.
Secure Sockets Layer (SSL) | A security protocol that
operates at the top of the Transport Layer (Layer 4) and
resides as the payload of a TCP session. Netscape designed
SSL in 1997 for secure Web e-commerce, but it can encrypt
any traffic above the Transport Layer. It uses public key
certificates to identify the endpoints of session and uses
symmetric encryption to protect transferred data. SSL v3.0
is the last version of SSL; TLS is replacing SSL.
Secured VPN | A VPN that uses encryption to protect the
confidentiality of its transmissions.
Security objectives | Sets of stated purposes or targets
for network security activity. Standard objectives are
confidentiality, integrity, and availability. Objectives are
generally more oriented towards achieving or maintaining
the goals, such as ensuring the confidentiality of resources.
Security policy | A written document prescribing security
goals, missions, objectives, standards, procedures, and
implementations for a given organization. Also identifies
what assets need protection based on their value.
Security stance | An organization’s filtering configuration;
in essence, its answer to the question, “What should be
allowed and what should be blocked?”
Security Technical Implementation Guides (STIGS) | A
security guideline, procedure, or recommendation manual.
Security through obscurity | A form of security based on
hiding details of a system, or creating convolutions that are
difficult to understand. Such strategies do not usually resist
a persistent attack, and are used when true security is
poorly understood or the perceived threat is insufficient to
overcome the obscure methodology. For example,
proprietary source encryption algorithms can be labeled
security through obscurity, as no forum for peer review or
for formal testing exists to examine whether the
methodology is cryptographically sound.
Segment | The collection of data at the Transport Layer
(Layer 4) of the OSI model. It consists of the payload from
the Session Layer (Layer 5) above and the Transport Layer
header. TCP segments are a common example. (Note: UDP
segments are called datagrams as they are connectionless,
rather than connection-oriented).
Senior management | The individual or group of highest
controlling and responsible authority within an organization.
Ultimately the success or failure of network security rests
with senior management.
Separation of duties | An administrative rule whereby no
single individual possesses sufficient rights to perform
certain actions. Achieved by dividing administrative level
tasks and powers among compartmentalized administrators.
Server | A host on a network. A server is the computer
system that hosts resources accessed by users from clients.
Service level agreement (SLA) | A contractual
commitment by a service provider or support organization
to its customers or users.
Session | A logical connection between a client and a
resource server. May exist at Layer 3, 4, or 5 of the OSI
model. Also known as a circuit or a state.
Session hijacking | When a hacker is able to take over a
connection after a client has authenticated with a server. To
perform this attack, a hacker must eavesdrop on the session
to learn details, such as the addresses of the session
endpoints and the sequencing numbers. With this
information, the hacker can desynchronize the client, take
on the client’s addresses, and then inject crafted packets
into the data stream. If the server accepts the initial false
packets as valid, then the session has been hijacked.
Session Layer (Layer 5) | The fifth layer of the OSI model.
This layer manages the communication channel, known as a
session, between the endpoints of the network
communication. A single transport layer connection
between two systems can support multiple simultaneous
sessions.
Shell code | The content of an exploit to be executed on or
against a target system.
Signature-based detection | A form of IDS/IPS detection
based on a collection of samples, patterns, signatures, and
so on stored in a database of known malicious traffic and
events. All traffic or events that match an item in the
database is considered abnormal and potentially malicious.
Also known as database, knowledge, and pattern-matching–
based detection.
Simple Mail Transfer Protocol (SMTP) | An Application
Layer protocol used by e-mail clients to send messages to
an e-mail server and is also used to relay messages
between e-mail servers. The default TCP/IP port is 25, and it
does not encrypt communications. The companion POP
protocol receives messages from an e-mail server.
Single-factor authentication | The use of only a single
element of validation or verification to prove the identity of
a subject. Considered much weaker than multi-factor
authentication.
Single loss expectancy (SLE) | The calculation of the loss
potential across of a single incident for a given asset and a
specific threat. SLE calculations are part of risk assessment.
SLE = AV × EF.
Single point of failure | Any element of a system or
network infrastructure, which is the primary or only pathway
through which a process occurs. The compromise of such an
element could result in system failure. Network design
should avoid single points of failure by including redundancy
and defense in depth.
Single sign-on (SSO) | A network security service that
allows a user to authenticate to an entire domain through a
single client log on process. All domain members will accept
this single authentication. Local authorization is used to
control access to individual resources. Such a single
authentication can be more complex, since multiple logons
for each individual server are not required.
Site-to-site VPN | A VPN used to connect networks. Also
known as a LAN-to-LAN VPN and WAN VPN.
Slack space | The unused portion of the last cluster
allocated to a stored file. It may contain remnants of prior
files stored in that location. Hackers can hijack slack space
to create hidden storage compartments.
Slideware | An industry term referring to any product that
appears in a vendor’s PowerPoint slide deck, but is not yet
available in one of its products. Also sometimes known as
“vaporware.”
Sniffer | A software utility or hardware device that captures
network communications for investigation and analysis. Also
known as packet analyzer, network analyzer, and protocol
analyzer.
Social engineering | The craft of manipulating people into
performing tasks or releasing information that violates
security. Social engineering relies on telling convincing lies
to manipulate people or take advantage of the victim’s
desire to be helpful.
Socket | The combination of an IP address and a port
number as a complete address.
Software firewall | A host firewall installed on a client or
server.
Software VPN | A VPN crafted by software rather than
hardware. Software VPN may be a feature of the operating
system or a third-party application.
SOHO (small office, home office) network | Any small
network, workgroup, or client/server, deployed by a small
business, a home-based business, or just a family network
in a home.
Spam | Unwanted and often unsolicited messages. Spam is
not technically malicious software, but spam can have a
serious negative effect on IT infrastructures through sheer
volume. Estimates vary, but spam may represents up to 95
percent of all e-mail (which implies for every legitimate e-
mail there are up to 19 unrelated spam e-mails.)
Split tunnel | A VPN connection that allows simultaneous
access to the secured VPN link and unsecured access to the
Internet across the same connection.
Spoofing | The falsification of information. Often spoofing is
the attempt to hide the true identity of a user or the true
origin of a communication.
Spyware | An advancement of keystroke logging to monitor
and record many other user activities. Spyware varies
greatly, but it can collect a list of applications launched,
URLs visited, e-mail sent and received, chats sent and
received, and names of all files opened. It can also record
network activity, gather periodic screen captures, and even
recording from a microphone or Web cam. Can be linked
with adware.
SQL injection | A form of Web site/application attack in
which a hacker submits SQL expressions to cause
authentication bypass, extraction of data, planting of
information, or access to a command shell.
State | A logical connection between a client and a
resource server. May exist at Layer 3, 4, or 5 of the OSI
model. Also known as a session or a circuit.
Stateful inspection | The process of automatically
tracking sessions or states to allow inbound responses to
previous outbound requests. Also called dynamic packet
filtering.
Static electricity discharge (SED) or Electrostatic
discharge (ESD) | A sudden and momentary electric
current, usually of high voltage and low amperage, that
flows between two objects. Commonly caused by low
humidity environments. Humans, polyester, and plastics are
prone to static build-up. SED can damage most computer
components.
Static NAT | The static coding of a translation pathway
across a NAT service. Also known as port forwarding and
reverse proxy.
Static packet filtering | A method of filtering using a
static or fixed set of rules to filter network traffic. The rules
can focus on source or destination IP address, source or
destination port number, IP header protocol field value,
ICMP types, fragmentation flags, and IP options. Static
packet filtering is therefore mainly focused on the Network
Layer (Layer 3), but can also include Transport Layer (Layer
4) elements. Static packet filtering focuses on header
contents and does not examine the payload of packets or
segments.
Sunk cost | Time, money, and effort already spent on a
project, event, or device. In economics, sunk costs are
irrelevant to future decisions. Emotionally, however, people
often use sunk costs as a rationalization to continue failing
processes or procedures.
Switch | A device, which provides network segmentation
through hardware. Across a switch, temporary dedicated
electronic communication pathways are created between
the endpoints of a session (such as a client and server). This
switched pathway prevents collisions. Additionally, switches
allow the communication to use the full potential throughput
capacity of the network connection, instead of 40 percent or
more being wasted by collisions (as occurs with hubs).
Symmetric cryptography | Cryptography based on
algorithms that use a single shared secret key. The same
key encrypts and decrypts data and the same key must be
shared with all communication partners of the same
session.
Synchronous dynamic random access memory
(SDRAM) | Dynamic random access memory (DRAM) that
has a synchronous interface. Traditionally, dynamic random
access memory (DRAM) has an asynchronous interface,
which means that it responds as quickly as possible to
changes in control inputs. SDRAM has a synchronous
interface, meaning that it waits for a clock signal before
responding to control inputs and is therefore synchronized
with the computer’s system bus.
Systems Network Architecture (SNA) | A legacy
networking protocol developed by IBM commonly used to
support communications between mainframes. Mostly
replaced by TCP/IP.
T
Tangible cost (or value) | Costs or values directly related
to budgetary funds. They can include, but are not limited to:
purchase, license, maintenance, management,
administration, support, utilities, training, troubleshooting,
hardware, software, updates/upgrades, and so forth.
Tcpdump | A common packet analyzer that runs at the
command line. It allows the user to intercept and display
TCP/IP and other packets being transmitted or received over
a network to which the computer is attached.
Telco | Short for telecommunications company or
corporation. Used to refer to any company that sells or
leases WAN connection services whether wired or wireless.
Telecommuting | The act of working from a home, remote,
or mobile location while connecting into “the employer’s
private network, often using a VPN.
Telnet | A protocol and a service used to remotely control or
administer a host through a plaintext command line
interface.
Terminal server/services/session | A modern form of
legacy thin client operation. A thin client software utility
connects to a central terminal server, which simulates
remote control. A terminal service system can support
multiple simultaneous terminal client connections. When
terminal services are in use, the client workstation coverts
to thin client status. All operations of storage and processing
then take place on the terminal server.
Thin client computing | A legacy terminal concept used to
control mainframes. Thin clients had no local processing or
storage capability. Modern thin clients simulate these
limitations and perform all operations on the terminal
server, remote control server, or thin client server.
Threat | Any potential harm to a resource or node on the
network. Threats can be natural or artificial, caused by
mother nature or man, or by the result of ignorance or
malicious intent. Threats originate internally and externally.
Traceroute | A computer network tool used to show the
route taken by packets across an IP network. An IPv6
variant, traceroute6, is also widely available.
Traffic congestion | The problem when too much data
crosses a network segment. This results in reduced
throughput, increased latency, and lost data.
Training | The second level of knowledge distribution
offered by an organization to educate users about job task
focused security concerns. More rigorous than awareness;
less rigorous than education.
Transmission Control Protocol (TCP) | The connection-
oriented protocol operating at the Transport Layer (Layer 4)
of the OSI model.
Transport Layer (Layer 4) | The fourth layer of the OSI
model. This layer formats and handles data transportation.
This transportation is independent of and transparent to the
application.
Transport Layer Security (TLS) | A security protocol that
operates at the top of the Transport Layer (Layer 4) and
resides as the payload of a TCP session. It uses public key
certificates to identify the endpoints of session and uses
symmetric encryption to protect transferred data. TLS 1.0 is
the replacement for SSL 3.0.
Transport mode encryption | A form of encryption also
known as point-to-point or host-to-host encryption.
Transport mode encryption protects only the payload of
traffic and leaves the header in plain-text original form.
Trapdoor | A form of unauthorized access to a system. A
trapdoor is any access method or pathway that circumvents
access or authentication mechanisms. Also known as a
backdoor.
Triple-homed firewall | A firewall that has three network
interfaces. Each network interface is located in a unique
network segment. This allows for true isolation of the
segments and forces the firewall to filter all traffic traversing
from one segment to another.
Trojan horse | A mechanism of distribution or delivery
more than a specific type of malware. The Trojan horse
embeds a malicious payload within a seemingly benign
carrier or host program. When the host program is executed
or otherwise accessed, the malware is delivered. The
gimmick of a Trojan horse is the act of fooling someone (a
type of social engineering attack) into accepting the Trojan
program as safe.
Trust | Confidence in the expectation that others will act in
your best interest, or that a resource is authentic. On
computer networks, trust is the confidence that other users
will act in accordance with the organization’s security rules
and not attempt to violate stability, privacy, or integrity of
the network and its resources.
Trusted Platform Module (TPM) | A dedicated microchip
found on some motherboards that host and protect the
encryption key for whole hard drive encryption.
Trusted third party | A mechanism of authentication using
a third entity known and trusted by two parties. The trusted
third party allows the two communicating parties, who were
originally strangers to each other, to establish an initial level
of inferred trust.
Trusted VPN | A VPN whose components are wholly owned
by the organization it serves.
Tunnel mode encryption | A form of encryption also
known as site-to-site, LAN-to-LAN, gateway-to-gateway,
host-to-LAN, and remote access encryption. Tunnel mode
encryption performs a complete encapsulation of the
original traffic into a new tunneling protocol. The entire
original header and payload are encrypted and a temporary
link or tunnel header guides the data across the
intermediary network.
Tunneling | The act of transmitting a protocol across an
intermediary network by encapsulating it in another
protocol. See encapsulation.
Two-factor authentication | A method of proving identity
using two different authentication factors. Authentication
factors are something you know, something you have, or
something you are. Examples include a smart card
(something you have) with a PIN (something you know), a
biometric device (something you are) coupled with a
password (something you know), or a proximity card
(something you have) that activates a fingerprint reader
(something you are).
U
Unified threat management (UTM) | The deployment of
a firewall as an all-encompassing primary gateway security
solution. The idea behind UTM is a single device can be
designed to perform firewall filtering, IPS, antivirus
scanning, anti-spam filtering, VPN end-point hosting,
content filtering, load-balancing, detailed logging, and
potentially other security services, performance
enhancements, or extended capabilities.
Universal participation | The principle that for an
organization’s security policy to be effective, everyone must
be forced to work within it and follow its rules.
Unpartitioned space | The area on a storage device not
contained within a partition. Unpartitioned space is not
directly accessible by the OS.
Upstream filtering | The management of traffic by a
firewall or other filtering device located one or more hops
away (upstream) from a private network.
URL injector | Malware that replaces URLs in HTTP GET
requests for alternative addresses. These injected URLs
cause a different Web page to appear in the browser than
the one requested by the user’s request. These replaced
Web pages could be advertisement sites, generate traffic to
falsify search engine optimization (SEO), or lead to fake or
spoofed sites.
USENET newsgroups | Persistent public messaging forums
accessed over the NNTP (Network News Transfer Protocol).
USENET has existed since 1980. Although the Web, e-mail,
and BitTorrent are more widely known, USENET is still in use
today.
User Datagram Protocol (UDP) | The connectionless
protocol operating at the Transport Layer (Layer 4) of the
OSI model.
V
Virtual private network (VPN) | A mechanism to
establish a secure remote access connection across an
intermediary network, often the Internet. This allows
inexpensive insecure links to replace expensive security
links. VPNs allow for cheap long-distance connections
established over the Internet. Both endpoints need only a
local Internet link. The Internet itself serves as a “free” long-
distance carrier. VPNs employ encapsulation and tunneling
protocols, such as IPSec.
Virus | Malware that needs a host object to infect. Most
viruses infect files, such as executables, device drivers,
DDLs, system files, and sometimes even document, audio,
video, and image files. Some viruses infect the boot sector
of a storage device, including hard drives, floppies, optical
discs, and USB drives. Viruses are spread through the
actions of users, and spread file-to-file (compare to worms).
VPN appliance | A hardware VPN device.
VPN Fingerprinting | A technique used by an attacker to
identify the vendor, and in some cases, the software
version, of a VPN server.
Vulnerability | A weakness or flaw in a host, node, or any
other infrastructure component that a hacker can discover
and exploit. Security management aims to discover and
eliminate such vulnerabilities.
Vulnerability management | The technology and
business processes used to identify, track, and mitigate
known weaknesses on hosts within a computing
environment.
Vulnerability scanning | A form of investigation that aims
at checking whether or not a target system is subject to
attack based on a database of tests, scripts, and simulated
exploits.
W
WAN VPN | A VPN between two networks over an
intermediary network. Also known as LAN-to-LAN VPN and
site-to-site VPN.
Wardialing | A method of discovering active modems by
dialing a range of phone numbers.
Wardriving | A method of discovering wireless networks by
moving around a geographic area with a detection device.
Wardriving | A method of discovering wireless networks by
moving around a geographic area with a detection device.
Weakest link | A security stance based on a repeating
process of locating the least secure element of an
infrastructure and securing it and then identifying a new
weakest link and securing it.
Whitelist | A type of filtering concept where the network
denies all activities except for those on the white list. Also
known as an “allow” or “permissions list.”
Whois | A tool used to view domain registration
information. Whois is a command line function of Linux and
Unix, but is also a tool on most domain registrar Web sites.
Whole hard drive encryption | The process of encrypting
an entire hard drive rather than just individual files. In most
cases, whole hard drive encryption provides better security
against unauthorized access than file encryption, because it
encrypts temporary directories and slack space.
Wide area network (WAN) | A network not limited by any
geographic boundaries. A WAN network can span a few city
blocks, reach across the globe, and even extend into outer
space. A distinguishing characteristic of a WAN is its use of
leased or external connections and links. Often, telcos own
these external connections.
Wirespeed | The maximum communication or transmission
capability of a network segment. Often used to describe a
network device’s ability to perform tasks on traffic, while
being able to maintain overall network transmission speeds
without introducing delay, lag, or latency.
Workgroup | A form of networking where each computer is
a peer. Peers are equal to each other in terms of how much
power or controlling authority any one system has over the
other members of the same workgroup. All workgroup
members are on equal footing because they can manage
their own local resources and users, but not those of any
other workgroup member.
Worm | Malware that does not need a host object; instead,
a worm is a self-sustaining program in its own right. Worms
are designed around specific system flaws. The worm scans
other systems for this flaw and exploits the flaw to gain
access to another victim. Once hosted on another system,
the worm seeks to spread itself by repeating the process.
Worms can act as carriers to deposit other forms of
malicious code as they multiply and spread across
networked hosts.
Wrapper | A tool used to create Trojan horses by
embedding malware inside of a host file or program.
Write-once read-many (WORM) | A form of storage
device that can be written to once, but once written cannot
be electronically altered. Examples include DVD-R, WORM
tapes, and WORM hard drives.
Z
Zero-day exploits | New and previous unknown attacks for
which are there no current specific defenses. “Zero day”
refers to the newness of an exploit, which may be known in
the hacker community for days or weeks. When such an
attack occurs for the first time, defenders are given zero
days of notice (hence the name.) Such attacks usually
exploit previously unidentified system flaws.
Zeroization | The process of purging a storage device by
writing zeros to all addressable locations on the device. A
zeroized device contains no data remnants that other users
could potentially recover.
Zombie | A malicious software program distributed by a
hacker to take over control of a victim’s computer. Also
known as a bot or an agent. Zombies are commonly used to
construct botnets (or zombie armies).
Zombie army | A network of zombie/bot/agent-
compromised systems controlled by a hacker. The network
consists of the bots, agents, or zombies that
intercommunicate over the Internet. Another term for
botnet.
Zone of risk | Any segment, subnet, network, or collection
of networks that represent a certain level of risk. The higher
the risk, the higher the security need to protect against that
risk. The less the risk of a zone, the lower security need
because fewer threats exist or existing threats are less
harmful. The flip side of risk zones is zones of trust.
Zone of trust | Any segment, subnet, network, or
collection of networks that represent a certain level of trust.
Highly trusted zones require less security, while low trusted
zones require more security. The flip side of trust zones is
zones of risk.
References
Beaver, Kevin. Hacking For Dummies. 3rd ed. Indianapolis:
Wiley Publishing, Inc., 2010.
Bhaiji, Yusuf. Network Security Technologies and Solutions.
Indianapolis: Cisco Press, 2008.
Bott, Ed. “The malware numbers game: how many viruses
are out there?” The Ed Bott Report, April 15, 2012.
http://www.zdnet.com/blog/bott/the-malware-numbers-
game-how-many-viruses-are-out-there/4783 (accessed
May 2, 2013).
Cheswick, William R., Steven M. Bellovin, and Aviel D. Rubin.
Firewalls and Internet Security: Repelling the Wily Hacker.
2nd ed. Boston: Addison-Wesley Professional, 2003.
Cisco Systems. “IKEv2 Packet Exchange and Protocol Level
Debugging,” 2013.
http://www.cisco.com/en/US/tech/tk583/tk372/technologie
s_tech_note09186a0080bf2932.shtml (accessed June 17,
2013).
Cisco Systems. Internetworking Technologies Handbook,
Virtual Private Networks.
http://www.cisco.com/en/US/docs/internetworking/technol
ogy/handbook/VPN.html (accessed July 15, 2010).
CNN. “How the President’s secret helicopter plans wound up
in Iran.” March 2009.
http://ac360.blogs.cnn.com/2009/03/10/how-the-
presidents-secret-helicopter-plans-wound-up-iran/
(accessed July 15, 2010).
Cole, Eric. Hiding in Plain Sight: Steganography and the Art
of Covert Communication. Indianapolis: Wiley Publishing,
Inc., 2003.
———. Network Security Bible. Indianapolis: Wiley
Publishing, Inc., 2009.
Comer, Douglas E. Internetworking with TCP/IP, Vol 1. 5th
ed. Upper Saddle River, NJ: Prentice Hall, 2005.
Davies, Joseph, and Elliot Lewis. Deploying Virtual Private
Networks with Microsoft Windows Server 2003 (Technical
Reference). Redmond, WA: Microsoft Press, 2003.
Davis, Michael, Sean Bodmer, and Aaron LeMasters. Hacking
Exposed Malware and Rootkits. New York: McGraw-Hill
Osborne Media, 2009.
Defense Information Systems Agency (DISA). “Information
Assurance Support Environment (IASE), Security
Checklists.” http://iase.disa.mil/stigs/checklist/index.html
(accessed July 15, 2010).
Defense Information Systems Agency (DISA). “Information
Assurance Support Environment (IASE), Security Technical
Implementation Guides (STIGS).”
http://iase.disa.mil/stigs/stig/index.html (accessed July 15,
2010).
DeLaet, Gert, and Gert Schauwers. Network Security
Fundamentals. Indianapolis: Cisco Press, 2004
Douligeris, Christos, and Dimitrios N. Serpanos. Network
Security: Current Status and Future Directions. Hoboken,
NJ: Wiley-IEEE Press, 2007.
Dr. K. Hackers’ Handbook 3.0 (Expanded, Revised and
Updated): Includes WiFi, Identity Theft, Information
Warfare and Web 2.0. New York: Carlton Books, 2009.
Erickson, Jon. Hacking: The Art of Exploitation. 2nd ed. San
Francisco: No Starch Press, 2008.
Feilner, Markus. OpenVPN: Building and Integrating Virtual
Private Networks. Packt Publishing, 2006.
Ford, Jerry Lee Jr. Absolute Beginner’s Guide to Personal
Firewalls. Indianapolis: Que, 2007.
Frenkel, Sheila, et al. “Guide to Ipsec VPNs:
Recommendations of the National Institute of Standards
and Technology.” Special publication 800-77. Computer
Security Division, Information Technology Laboratory,
National Institute of Standards and Technology, 2005.
Gibson, Darril. MCITP Windows Server 2008 Server
Administrator Study Guide. Indianapolis: Sybex, 2008.
Graves, Kimberly. CEH Certified Ethical Hacker Study Guide.
Indianapolis: Sybex, 2010.
Gregg, Michael. Certified Ethical Hacker Exam Prep.
Indianapolis: Que, 2006.
Harris, Shon. CISSP All-in-One Exam Guide. 5th ed. New
York: McGraw-Hill Osborne Media, 2010.
———, Allen Harper, Chris Eagle, and Jonathan Ness. Gray
Hat Hacking, Second Edition: The Ethical Hacker’s
Handbook. New York: McGraw-Hill Osborne Media, 2007.
Huang, Qiang, and Jazib Frahim. SSL Remote Access VPNs.
Indianapolis: Cisco Press, 2008.
IETF RFC Repository. http://www.ietf.org/rfc.html (accessed
July 15, 2010).
Internet Engineering Task Force (IETF). “Internet Key
Exchange (IKEv2) Protocol.” December 2005.
http://tools.ietf.org/html/rfc4306 (accessed July 15, 2010).
Irwin, Mike, Charlie Scott, and Paul Wolfe. Virtual Private
Networks. 2nd ed. Sebastopol, CA: O’Reilly Media, 1998.
ISA Server.org. “Setting Up the Windows XP PPTP and
L2TP/IPSec client.”
http://www.isaserver.org/img/upl/vpnkitbeta2/xpvpnclient.
htm (accessed July 15, 2010).
Katz, Jonathan, and Yehuda Lindell. Introduction to Modern
Cryptography: Principles and Protocols. Chapman &
Hall/CRC, 2007.
Komar, Brian, Ronald Beekelaar, and Joern Wettern. Firewalls
for Dummies. 2nd ed. Indianapolis: Wiley Publishing, Inc.,
2003.
Kozierok, Charles. The TCP/IP Guide: A Comprehensive,
Illustrated Internet Protocols Reference. San Francisco: No
Starch Press, 2005.
Krawetz, Neal. Introduction to Network Security. Charles
River Media, 2006.
Lewis, Mark. Comparing, Designing, and Deploying VPNs.
Indianapolis: Cisco Press, 2006.
Linux Home Networking. “Configuring Linux VPNs.”
http://www.linuxhomenetworking.com/wiki/index.php/Quic
k_HOWTO_:_Ch35_:_Configuring_Linux_VPNs (accessed
July 15, 2010).
Liu, Dale, and Stephanie Miller, Mark Lucas, Abhishek Singh,
and Jennifer Davis. Firewall Policies and VPN
Configurations. Rockland, MA: Syngress, 2006.
Long, Johnny, Jack Wiles, Scott Pinzon, and Kevin D. Mitnick.
No Tech Hacking: A Guide to Social Engineering,
Dumpster Diving, and Shoulder Surfing. Rockland, MA:
Syngress, 2008.
Lyon, Gordon Fyodor. Nmap Network Scanning: The Official
Nmap Project Guide to Network Discovery and Security
Scanning. City: Nmap Project, 2009.
Mairs, John. VPNs: A Beginner’s Guide. New York: McGraw-
Hill Osborne Media, 2001.
Maiwald, Eric. Network Security: A Beginner’s Guide. 2nd ed.
New York: McGraw-Hill Osborne Media, 2003.
McClure, Stuart, Joel Scambray, and George Kurtz. Hacking
Exposed: Network Security Secrets and Solutions. 6th ed.
New York: McGraw-Hill Osborne Media, 2009.
Merkow, Mark S. Virtual Private Networks for Dummies.
Indianapolis: Wiley Publishing, Inc., 1999.
Metheringham, Nigel. “IPSec/Netkey interaction with
IPTables/Netfilter.” Openswan open forum entry.
http://lists.openswan.org/pipermail/users/2005-
August/006101.html (accessed July 15, 2010).
Microsoft Technet. “DirectAccess Technical Overview.”
http://technet.microsoft.com/library/dd637827.aspx
(accessed July 15, 2010).
Mitnick, Kevin D., William L. Simon, and Steve Wozniak. The
Art of Deception: Controlling the Human Element of
Security. Indianapolis: Wiley Publishing, Inc., 2003.
———, and William L. Simon. The Art of Intrusion: The Real
Stories Behind the Exploits of Hackers, Intruders and
Deceivers. Indianapolis: Wiley Publishing, Inc., 2005.
MITRE Corporation. “MITRE’s Common Vulnerability
Database (CVE).” http://cve.mitre.org/ (accessed July 15,
2010).
National Institute of Standards and Technology (NIST),
National Vulnerability Database. http://nvd.nist.gov/
(accessed July 15, 2010).
Nichols, Randall K., and Panos C. Lekkas. Wireless Security:
Models, Threats, and Solutions. New York: McGraw-Hill
Osborne Media, 2001.
Noonan, Wes, and Ido Dubrawsky. Firewall Fundamentals.
Indianapolis: Cisco Press, 2006.
Off-line certificate enrolment on Windows 2000/XP.
http://www.jacco2.dds.nl/networking/certutil.html
(accessed June 21, 2010).
Peltier, Thomas R. Information Security Risk Analysis. 3rd
ed. Auerbach Publications, 2010.
Philipp, Aaron, David Cowen, and Chris Davis. Hacking
Exposed Computer Forensics. 2nd ed. New York: McGraw-
Hill Osborne Media, 2009.
PopTop + MSCHAPv2 + Samba + Radius + Microsoft Active
Directory + Fedora Howto.
http://www.members.optushome.com.au/~wskwok/popto
p_ads_howto_1.htm (accessed July 15, 2010).
Real Time Enterprises, Incorporated. “Create a IPSEC +
Certificates MMC.” http://support.real-time.com/open-
source/ipsec/index.html (accessed July 15, 2010).
Rhodes-Ousley, Mark, Roberta Bragg, and Keith Strassberg.
Network Security: The Complete Reference. New York:
McGraw-Hill Osborne Media, 2003.
Ruston, Chris, and Chris Peiris. How to Cheat at Designing
Security for a Windows Server 2003 Network. Rockland,
MA: Syngress, 2006.
SANS. “The Top Cyber Security Risks.”
http://www.sans.org/top-cyber-security-risks/?ref=top20
(accessed July 15, 2010).
Scarfone, Karn, and Paul Hoffman. Guidelines on Firewalls
and Firewall Policy: Special Publication 800-41, Revision 1.
Washington: National Institute of Standards and
Technology (NIST), 2009.
Schneier, Bruce. Schneier’s Cryptography Classics Library:
Applied Cryptography, Secrets and Lies, and Practical
Cryptography. Indianapolis: Wiley Publishing, Inc., 2007.
———. Secrets and Lies: Digital Security in a Networked
World. Indianapolis: Wiley Publishing, Inc., 2004.
Schudel, Gregg, and David J. Smith. Router Security
Strategies: Securing IP Network Traffic Planes.
Indianapolis: Cisco Press, 2008.
SearchNetworking.com. “Authentication, authorization, and
accounting (AAA)” (n.d.)
http://searchsecurity.techtarget.com/definition/authentica
tion-authorization-and-accounting (accessed June 17,
2013).
———. “Packet” (n.d.)
http://searchnetworking.techtarget.com/definition/packet
(accessed June 17, 2013) ———. “Port Address Translation
(PAT)” (n.d.).
http://searchnetworking.techtarget.com/definition/Port-
Address-Translation-PAT (accessed June 17, 2013).
Security Focus. “Embassy leaks highlight pitfalls of Tor.
September, 2007.”
http://www.securityfocus.com/news/11486 (accessed July
15, 2010).
Shinder, Thomas W. The Best Damn Firewall Book Period.
2nd ed. Rockland, MA: Syngress, 2008.
SmoothWall Community Forums.
http://community.smoothwall.org/forum/ (accessed July
15, 2010).
SmoothWall Limited. http://www.smoothwall.net/ (accessed
July 15, 2010).
SmoothWall Open Source Project.
http://www.smoothwall.org/ (accessed July 15, 2010).
Snader, Jon C. VPNs Illustrated: Tunnels, VPNs, and IPsec.
Boston: Addison-Wesley Professional, 2005.
Stevens, W. Richard, and Gary R. Wright. TCP/IP Illustrated,
Volumes 1–3. Boston: Addison-Wesley Professional, 1994.
Stewart, James Michael. CompTIA Security+ Review Guide:
SY0-201. Indianapolis: Sybex, 2008.
———, Ed Tittel, and Mike Chapple. CISSP: Certified
Information Systems Security Professional Study Guide.
4th ed. Indianapolis: Sybex, 2008.
Strassberg, Keith, Gary Rollie, and Richard Gondek.
Firewalls: The Complete Reference. New York: McGraw-Hill
Osborne Media, 2002.
Sweeney, T., (2000, April 3). Businesses Lock In On VPN
Outsourcing Options Providers of virtual private network
services put a new spin on the outsourcing spiel.
InformationWeek.
http://www.informationweek.com/780/vpn.htm (accessed
July 15, 2010).
“Using a Linux L2TP/IPsec VPN server.” May 2010.
http://www.jacco2.dds.nl/networking/openswan-l2tp.html
(accessed July 15, 2010).
Virtual Private Network Consortium. http://www.vpnc.org/
(accessed July 15, 2010).
Volonino, Linda, and Ian Redpath. e-Discovery for Dummies.
Indianapolis: Wiley Publishing, Inc, 2009.
Vyncke, Eric, and Christopher Paggen. LAN Switch Security:
What Hackers Know About Your Switches. Indianapolis:
Cisco Press, 2007.
Whitman, Michael E., Herbert J. Mattord, Richard Austin, and
Greg Holden. Guide to Firewalls and Network Security.
Florence, KY: Course Technology/Cengage Learning Inc.,
2008.
Yuan, Ruixi, and W. Timothy Strayer. Virtual Private
Networks: Technologies and Solutions. Boston: Addison-
Wesley Professional, 2001.
Zwicky, Elizabeth D., Simon Cooper, and D. Brent Chapman.
Building Internet Firewalls. 2nd ed. Sebastopol, CA:
O’Reilly Media, 2000.
Index
The index that appeared in the print version of this title was
intentionally removed from the eBook. Please use the
search function on your eReading device to search for terms
of interest. For your reference, the terms that appear in the
print index are listed below.
128-bit key
802.1x
2048-bit asymmetric key
A
AAA. See authentication,
authorization, and accounting
acceptable use policy (AUP)
access control. See also authorization access control list
(ACL)
access management
accidental threats
accidents
accounting
ACL. See access control list active sniffing
active threats
addressing
administrator account password ADS. See alternate data
streams ADSL. See Asymmetrical Digital Subscriber Line
Advanced Encryption Standard (AES) advanced persistent
threat (APT) adware
adware scanner. See anti-malware scanners agents
AH. See Authentication Header ALE. See annualized loss
expectancy alerts
algorithm encryption standard (AES) algorithms
allow by default
allow by exception
allow-exception rule
alternate data streams (ADS) annualized loss expectancy
(ALE) annualized rate of occurrence (ARO) anomaly-based
detection
anonymity
anonymous connectivity
anti-forensics
anti-malware scanners
anti-SPAM filters
anti-spyware scanner
antivirus scanners
anycast address
AppleTalk
appliance firewalls
appliance format
application conflicts
application firewall
application gateway
Application Layer (Layer 7)
application-level firewall
application proxy
application proxy firewalls
APT. See advanced persistent threat arbitrary code
execution
ARO. See annualized rate of occurrence ARP flooding
ARP spoofing
asset value (AV)
assets
asymmetric cryptography
Asymmetrical Digital Subscriber Line (ADSL) at-firewall
authentication
attack surface
attacking
audit capabilities
auditing
auditors
AUP. See acceptable use policy authentication
authentication, authorization, and accounting (AAA)
Authentication Header (AH)
authenticity
authorization
AV. See asset value availability
availability attack
avalanche effect
awareness
B
Back Orifice
backdoor account attack
backdoors
Backtrack
backups
bandwidth for VPN
banner
banner grabbing
basic packet filtering
bastion host
bastion host OS
behavioral-based detection
benign address
best practices
biometrics
BIOS/firmware flashing
BitTorrent
blacklist
blogs
“Blue Screen of Death”
boot sector
border firewall
border sentry
border-crossing communications botnet army
botnets
bots
bottlenecks. See also chokepoint boundary networks
breach
bricking
bridges
Bring Your Own Device (BYOD) brute force attack
brute-force password attack
buffer overflows
buffers
build-it-yourself firewall bump-in-the-stack bump-in-the-wire
business continuity plan
business operations
business tasks
BYOD. See Bring Your Own Device bypass VPN
implementation
C
CA. See Certificate Authority
cable modem devices
caching
centralized logging system
CERN. See European Laboratory for Particle Physics
Certificate Authority (CA)
CGI scripts. See Common Gateway Interface scripts
channels
chip creep
chokepoint
ciphertext
circuit
circuit firewall
circuit proxy
Cisco
Cisco Linksys wireless router client virtualization. See
desktop virtualization clients
client/server network
client-side configuration
client-to-server VPNs
Clipper Chip
closed source software
cloud backup storage
cloud computing
cloud implementation
clusters
code testing
coding errors
cold calling
co-location of Web server
command-line-based interface command shell
commercial firewall
commercial hardware firewall commercial off-the-shelf
(COTS) software commercial software firewall commercial
VPNs
Common Gateway Interface (CGI) scripts communication
encryption
communications in business environment communications
pathways
communications to block
compartmentalization
compliance
compliance auditing
compression compromise
computer viruses
conditional trust
confidentiality
configuration errors
configuration of VPN
configuration scans
Connection Protocol
containment
content filtering
contract workers
cookie filters
corporate firewall VPN termination cost/benefit analysis
cost-effective network security COTS software. See
commercial off-the-shelf software covert channels
CPE. See customer premise equipment credential sharing
cross-site scripting (XSS)
Cryptcat
cryptography
customer premise equipment (CPE) cybersecurity role
D
data at rest
data encryption. See encryption Data Encryption Standard
(DES) data integrity
data leakage
data leakage prevention (DLP) Data Link Layer (Layer 2)
data origin authentication
data protection firewall
database-based detection
database firewall
data-centric security model
data-encrypted tunnel
DDoS attacks. See distributed denial of service attacks
dead-man switch
decryption
dedicated application-specific proxy firewall dedicated
connection
dedicated leased lines
de-encapsulation
default allow
default deny
default-deny rule default password default-permit stance
defense in depth
defensive programming technique delay
deliberate threats
demilitarized zone (DMZ)-based implementation
demilitarized zones (DMZs)
denial of service (DoS)
denial of service (DoS) attacks deny by default
deny by exception
deny exception rule
deployment of a VPN
DES. See Data Encryption Standard desktop virtualization
detailed implementation plans detection
deterrence
deterrent
device firmware replacement options DHCP. See Dynamic
Host Configuration Protocol dialers
dial-up modem connections
dictionary attacks
dictionary password cracking Diffie-Hellmann
digital certificates
digital envelope
digital forensic techniques
digital signatures
digital subscriber line (DSL) modems DirectAccess
directory services
disaster recovery plan
disasters
disgruntled employees
distributed denial of service (DDoS) attacks distributed LAN
diversity of defense
divide and conquer
DLP. See data leakage prevention DMZ pinholes
DMZ Web server
DMZs. See demilitarized zones DNS. See Domain Name
System DNS poisoning
DNS spoofing
documentation
do-it-yourself firewall
Domain Name System (DNS)
domain registrations
domains
domains of IT infrastructure DoS. See denial of service DoS
attacks. See denial of service attacks downtime DSL
modems. See digital subscriber line modems dual IP
stacks
dual-homed firewall
dual-stack migration strategy dumpster diving
duplicate servers
dynamic addressing
dynamic filtering system
Dynamic Host Configuration Protocol (DHCP) dynamic NAT
dynamic packet filtering
dynamic password token
E
easy access management console
port or interface
easy-access power switch
eavesdropping
ECC. See elliptical curve cryptography edge routers
education
EF. See exposure factor efficient network security
egress filtering
electricity consumption
Electronic Privacy Information Center (EPIC) electrostatic
discharge (ESD) elliptical curve cryptography (ECC)
Encapsulating Security Payload (ESP) encapsulation
encapsulation protocols. See also tunneling protocols
encrypted protocols
encryption
encryption filtering
encryption key sets
encryption level
endpoint security
enhancements for firewall
enumeration
EPIC. See Electronic Privacy Information Center equipment
selection for secure network design eradication, incident
response ESD. See electrostatic discharge ethernet frame
ethical hackers
ethical hacking. See penetration testing European
Laboratory for Particle Physics (CERN) experts
exploitation of system vulnerability exploits
exposure factor (EF)
external attacks
external entities threats
external service access
external threats
external-only communications extranet VPNs
extranets
F
factory defaults
fail-close state
fail-open state
fail-safe security stance
fail-safe/fail-secure response fail-secure state
failures
fair queuing
fallback attacks
false negative
false positives
Federal Information Processing Standards (FIPS) Publications
file encryption
file sharing
File Transfer Protocol (FTP) filtering
filters
firewalking
firewall checklist
firewall filtering
firewall implementation firewall limitation
firewall logging
firewall management
firewall monitoring
firewall policy
firewall rules
firewall specialization
firewall-to-firewall VPN
firewall troubleshooting
firewalls
firmware flash memory on-board chip flaw exploitation
attacks
flexibility
flooding
focus for information security follow-up, incident response
footprinting
forced universal participation Forefront Unified Access
Gateway (UAG) forensic techniques
formal change management
forms-based authentication
Fport
FQDNs. See fully qualified domain names fragmentation
fragmentation attacks
frames
free software
FTP. See File Transfer Protocol full mesh of leased lines
fully qualified domain names (FQDNs) future developments
fuzzing tools
G
gateway
gateway-to-gateway VPN
general filter firewall
general purpose OSs
goals of network security GoToAssist GoToMyPC
governance
governance, risk, and compliance (GRC) granular access
control
graphical user interface (GUI)-based interface growth
scenario contingencies GUI-based interface. See graphical
user interface-based interface
H
hackers
hacking
hacktivism
hairpinning
handoff authentication
hard drives
hardening firewall
hardening host
hardening networks
hardening servers
hardening systems
hardware address
hardware failures
hardware firewalls
hardware VPNs
hardware/software platform
hashing
hash algorithm
hash value
hashing
headers
heat
HFS. See hierarchical file system hierarchical file system
(HFS) hijacking attack
home office wireless
home routers
honeynets
honeypots
host
host firewalls. See also software firewall host security
controls
host software firewall
host VPN software product
hosting
HOSTS file
host-to-gateway VPN
host-to-host VPN
host-to-site VPN
Hot Standby Router Protocol (HSRP) HotSpotShield
HotSpotVPN
HSRP. See Hot Standby Router Protocol HTTP Proxy
HTTPS. See Hypertext Transfer Protocol Secure hybrid attack
hybrid firewall
hybrid VPN
Hypertext Transfer Protocol (HTTP) Hypertext Transfer
Protocol Secure (HTTPS)
I
IAM. See identity and access
management
IANA. See Internet Assigned Numbers Authority ICMP. See
Internet Control Message Protocol ICMP redirect
identity
identity and access management (IAM) identity proofing
IDS. See intrusion detection systems IDS insertion
IEEE 802.1x
IEMI. See intentional electromagnetic interference IETF. See
Internet Engineering Task Force IKEv2. See Internet Key
Exchange v2
IM. See instant message IMS. See IP Multimedia Subsystem
inbound rules for firewall
inbound traffic
incident response
incident response plan
individual firewall
industry-standard protocol
information gathering. See reconnaissance information
security professionals Information Technology
Infrastructure Library (ITIL) infrastructure
ingress filtering
in-person policy training
insertion attacks
installer-induced security threats instant message (IM)
intangible costs and value
Integrated Services Digital Network (ISDN) integrity
intentional electromagnetic interference (IEMI) interception
attack
intermediary network
internal code planting
internal compliance audits
internal firewall
internal-only traffic
internal personnel
internally connected VPN
Internet Assigned Numbers Authority (IANA) Internet Café
VPNs
Internet Connection Sharing service Internet connectivity
Internet Control Message Protocol (ICMP) Internet
Engineering Task Force (IETF) Internet Key Exchange (IKE)
Internet Key Exchange v2 (IKEv2) Internet Protocol Security
(IPSec) Internet Protocol version
Internet Protocol version 4 (IPv4) Internet Protocol version 6
(IPv6) Internet relay chat (IRC) channel Internet service
provider (ISP) devices Internet threats
Internet-based Traceroute tools Internet-facing servers
Internetwork Packet Exchange/Sequenced Packet Exchange
(IPX/SPX) intranet
intranet VPNs
intruders
intrusion and incident response plan intrusion detection
systems (IDS) intrusion prevention systems (IPS)
inventory of communications
IP addresses
IP block
IP forwarding
IP Multimedia Subsystem (IMS) IP Network Address
Translator IPS. See intrusion prevention systems IPSec.
See Internet Protocol Security IPSec VPNs
IPSec-tools RPM package IPv4. See Internet Protocol version
4
IPv6. See Internet Protocol version 6
IPX/SPX. See Internetwork Packet Exchange/Sequenced
Packet Exchange IRC channel. See Internet relay chat
channel ISDN. See Integrated Services Digital Network ISP
devices. See Internet service provider (ISP) devices IT
infrastructure domains
IT infrastructure threats
ITIL. See Information Technology Infrastructure Library
J
JanusVM
job description
K
Keep It Simple: Security (KISS)
Kerberos
Kernel IP Security (KLIPS) key exchange key pairs
key space
keycard security
keystroke logger
knowledge-based detection
known addresses
L
laboratory tests
LAN. See local area network; wireless local area network
LAN Domain. See Local Area Network Domain LAN
infrastructure security
LANMAN hash
LAN-to-LAN VPNs
LAN-to-WAN Domain
latency
Layer 2 Forwarding (L2F)
Layer 3 of the OSI model
Layer 7 of the OSI model
Layer 2 Transport Protocol (L2TP) Layer 2 Tunneling Protocol
(L2TP) layered security approach
layers of OSI model
leased lines
leetspeak
Linksys access points
Linux firewalls
load balancers
load balancing
load-related performance
local area network (LAN)
Local Area Network (LAN) Domain local host
location of VPN
location-aware anti-theft software log contents
log file analysis
log file analysis tools
logging
logging on. See authentication logic bomb
logical address
logical security checklist
LogMeIn
Loki
loophole
M
MAC address. See Media Access
Control address
MAC addresses
MAC spoofing
Mac support
mainframe
malicious address
malicious code
malicious code scanner
malicious hackers
malicious traffic
malware
management
management interfaces
man-in-the-middle (MitM) attacks maximum transmission
unit (MTU) MBSA. See Microsoft Baseline Security
Analyzer mean time between failures (MTBF) mean time
to failure (MTTF)
Media Access Control (MAC) address metacharacters
metrics
Microsoft Baseline Security Analyzer (MBSA) Microsoft Point-
to-Point Encryption (MPPE) mission-critical issue
mission-critical process
MitM attacks. See man-in-the-middle attacks MITRE
mobile code
mobile devices
Mobile IP
mobile wireless
modeling
modems
module-based VPN
monitoring
monkey-in-the-middle attack
MPPE. See Microsoft Point-to-Point Encryption MSTSC
command
MTBF. See mean time between failures MTTF. See mean time
to failure MTU. See maximum transmission unit multicast
address
multifactor authentication
multi-homed firewall
multiple LANs
multiple-layered defense. See also defense in depth
Murphy’s Law
N
NAC. See network access control
NAC service. See network access/admission control service
NAS. See network access server NAT. See network
address translation NAT-compatible encryption protocols
National Information Infrastructure (NII) National Institute
of Standards and Technology (NIST) national security
National Security Agency (NSA) National Vulnerability
Database native firewall
native operating system firewall NAT-PT. See Network
Address Translation–Protocol Translation NAT-T. See NAT-
Traversal NAT-Traversal (NAT-T)
natural disasters
necessary business tasks
Nessus
Nessus vulnerability scanning NetBEUI. See NetBios
Extended User Interface NetBios Extended User Interface
(NetBEUI) NetBus
Netcat
Netscape. Version 1.0
Netstat
network access control (NAC) Network Access Protocol
network access server (NAS)
network access/admission control (NAC) service network
address translation (NAT) Network Address Translation–
Protocol Translation (NAT-PT) network and resource
availability threats network compartmentalization. See
compartmentalization network design
network infrastructures examples network interface card
(NIC) network interface controller (NIC) network issues,
internal and external Network Layer (Layer 3)
Network Layer of the OSI model Network News Transfer
Protocol (NNTP) network performance
network security
network security components
network security design
“Network Tools”
network topologies. See topologies network traffic access
control security policy new technology file system (NTFS)
NIC. See network interface card NII. See National
Information Infrastructure NIST. See National Institute of
Standards and Technology nmap
NNTP. See Network News Transfer Protocol node
node security
no-exceptions policy
non-authenticating query service non-content-filtering
firewalls non-dedicated connection
nonrepudiation
normal baseline
NSA. See National Security Agency NTFS. See new
technology file system N-Tier deployment
NTRconnect
O
OC line. See optical carrier line offsite storage
off-the-shelf firewall
one-time pad encryption systems one-way function
mathematical operation Onion Router application, The.
See Tor application onion routing
online remote VPN options
online storage
onsite storage
open source software
Open Systems Interconnection (OSI) Reference Model open-
source applications and tools open-source product
open-source software network firewall open-source VPNs
Openswan
operating system-based VPNs
operating systems (OSs)
OPM. See Other People’s Money, Inc.
opportunistic hackers
optical carrier (OC) line
OS/2
OSI model. See Open Systems Interconnection (OSI)
Reference Model OSs. See operating systems Other
People’s Money, Inc. (OPM) out of band communication
outbound rules for firewall
outbound traffic
overlapping
P
package filtering firewall
packet filtering
packet filtering firewall
packet header
packet payload
packet sniffer
PacketiX VPN
padded cells
partition
passive threats
password cracking
password-protected homegroup PAT. See port address
translation patch management
patches
payloads
PBX. See private branch exchange pcAnywhere
peer systems
peer-to-peer (P2P) communications peer-to-peer (P2P)
networks
penetration testing
performance
perimeter
perimeter network
permissions
personal communications
personal firewall
personal hardware firewall
personal software firewall
personal/individual VPN
personally identifiable information (PII) personnel activity
monitoring phishing
physical access
physical addresses
physical attacks
physical damage
Physical Layer (Layer 1)
physical security
physical threats
PII. See personally identifiable information piloting
PING
ping command
ping sweeps
PKI. See Public Key Infrastructure placement of firewalls
plaintext protocols
platform independence
play configuration
playback attacks
plug configuration
PNAC. See port-based network access control Point-to-Point
Protocol (PPP) Point-to-Point Tunneling Protocol (PPTP)
POP. See Post Office Protocol pop-up blockers
port address translation (PAT) port forwarding
port numbers
port scanning
port validation
portability of equipment
portal authentication port-based network access (admission)
control (PNAC) ports
POSIX
Post Office Protocol (POP)
post-attack activities
post-mortem assessment review power faults
power switch
PPP. See Point-to-Point Protocol PPTP. See Point-to-Point
Tunneling Protocol preparation, incident response
Presentation Layer (Layer 6) prevention
principle of least privilege privacy
private branch exchange (PBX) private IP address
private key
private messages
private networks
private VPN
privilege control
privilege escalation
privileged access
privileges
PRNG. See pseudo random number generator proactive
security management professional hackers
proprietary OSs
protocol encryption
protocols
proxies
proxy attack
proxy firewall
proxy manipulation
proxy servers
proxy-based encryption
pseudo random number generator (PRNG) public IP
addresses
public key
public key cryptography
Public Key Infrastructure (PKI) public networks
public wireless
public-key cryptography
PuTTY application
pwned
Q
QoS. See quality of service
quality of service (QoS)
R
rack mountable equipment
RADIUS-based authentication
RAID. See redundant array of independent disks random
challenge-response dialog RAS. See remote access server
RDC. See Remote Desktop Connection RDP. See Remote
Desktop Protocol reconnaissance
recovery
recreational hackers
redundancy
redundant array of independent disks (RAID) Regional
Internet Registry (RIR) regular self-assessment
rekeying processes
remote access
Remote Access Domain
remote access policy
remote access server (RAS)
remote access VPN
Remote Assistance
remote connection
remote control
Remote Desktop Connection (RDC) Remote Desktop Protocol
(RDP) Remote Desktop Services
remote hacking
remote or mobile host
remote printing
remote VPN connection
remote-to-home VPN
remote-to-office VPN
removable case
removable media
replay attacks
requests for comments (RFCs) research. See reconnaissance
reset button
resources
resources sites
response
return on investment (ROI)
reverse caching reverse proxy
reverse proxy firewall service RFC 791
RFC 1918
RFC 1918 addresses
RIR. See Regional Internet Registry risk
risk assessment
risk management
risk matrix
Rivest-Shamir-Adelman (RSA)
rogue access point
rogue device insertion
rogue DHCP
ROI. See return on investment roles
rootkits
round robin
round robin database tool (RRDtool) routers
RPM install of Openswan
RRDtool. See round robin database tool RSA. See Rivest-
Shamir-Adelman rule sets
rules
rule-set ordering
S
sabotage
sacrificial host
scalability
scanning
scope/binding nature statement screened IDS/IPS solution
screening routers
script kiddie
SDRAM. See synchronous dynamic random access memory
search engine
sectors
secure network design. See network design secure remote
access
Secure Shell (SSH) protocol
Secure Socket Tunneling Protocol (SSTP) Secure Sockets
Layer (SSL)
Secure Sockets Layer (SSL)–based tunneling protocols
Secure Sockets Layer (SSL)/Transport Layer Security (TLS)
secured VPN. See also virtual private network (VPN)
security
security assessment
security association (SA)
security assurance
security checklist
security goals
security infrastructure
security management
security mistakes
security objectives
security policies
security stance
security strategy
security suite firewall
Security Technical Implementation Guides (STIGs) security
technologies
security through obscurity
security troubleshooting
security zones
SED. See static electricity discharge segment
self-assessments
sender fragmentation
senior management
separation of duties
servers
service level agreement (SLA) service set identifier (SSID)
services tab of SmoothWall
session
session hijacking
Session Layer (Layer 5)
shell code
ShieldsUP! port scanning tool Shorewall firewall
Shrew Soft
sieve firewall
signature-based detection
Simple Mail Transfer Protocol (SMTP) simple network
management protocol (SNMP) simplicity
simulated firewall test
single-factor authentication single loss expectancy (SLE)
single point of failure
single sign-on (SSO)
site-to-site VPNs Skype
SLA. See service level agreement slack space
SLE. See single loss expectancy slideware
sliding window of recorded traffic small office/home office
(SOHO) SmoothWall firewall
SmoothWall software
SMTP. See Simple Mail Transfer Protocol SNA. See System
Network Architecture sniffer
SNMP. See simple network management protocol Snort
Snort intrusion detection software Snort intrusion detection
solution social engineering
socket
software coding errors
software firewall
software firewall products
software host firewalls
software VPNs
SOHO. See small office/home office Solera DS series of
network forensic appliances solid VPN policy
spam
split knowledge. See separation of duties split tunnel
spoofed addresses
spoofing
spyware
spyware scanner. See anti-malware scanners SQL injection
SSH protocol. See Secure Shell protocol SSID. See service
set identifier SSL. See Secure Sockets Layer SSL VPNs
SSO. See single sign-on SSTP. See Secure Socket Tunneling
Protocol stability of VPNs
state management
stateful inspection
stateful inspection filtering stateful inspection firewalls
static addressing
static electricity
static electricity discharge (SED) static filtering firewalls
static IP
static NAT
static packet filtering
steganography
STIGs. See Security Technical Implementation Guides
storage covert channel
strong authentication
strong encryption
subnet architecture
subnetting
sub-protocols
SubSeven
suite-member firewalls
sunk cost
switches
symmetric cryptography
symptoms
synchronous dynamic random access memory (SDRAM)
syslog
System Network Architecture (SNA) System/Application
Domain
system-by-system–based security Systems/Applications
Domain
T
TACACS+. See Terminal Access Controller Access-Control
System Plus tangible costs and value
targets of hackers
TCP. See Transmission Control Protocol tcpdump command
TCP/IP. See Transmission Control Protocol/Internet Protocol
TCPView
telcos. See telecommunication service providers
telecommunication service providers (telcos)
telecommuting
telnet
Terminal Access Controller Access-Control System Plus
(TACACS+) terminal services
testing
testing firewall
theft
thin client computing third-party software firewalls third-
party trust system
threats
time stamps
timing covert channel
TLS. See Transport Layer Security tools
topology
Tor application
TPM chip. See Trusted Platform Module chip traceroute
command
traceroute tools
traffic and trend analysis
traffic congestion
traffic generation
traffic inventory
traffic loads
training
transaction security
translation migration strategy Transmission Control Protocol
(TCP) Transmission Control Protocol/Internet Protocol
(TCP/IP) transparent network security Transport Layer
(Layer 4)
Transport Layer Protocol
Transport Layer Security (TLS) transport mode encryption
transport mode (host-to-host) of IPSec trapdoor
trapping intruders and violators triple-homed firewall
Trojan horse
troubleshooting
trust
Trusted Platform Module (TPM) chip trusted third party
trusted VPN
trustworthy
TS RemoteApp
TS Web Access
tunnel mode encryption
tunnel mode of IPSec
tunneling
tunneling migration strategy tunneling protocols
two-factor authentication
U
UAG. See Forefront Unified Access
Gateway
ubiquitous firewall
UDP. See User Datagram Protocol unauthorized software
unauthorized tunnels
unfiltered IDS/IPS installation unicast address
unified threat management (UTM) Uninterruptible Power
Supply (UPS) universal denial rule
universal participation
unknown zero-day attacks
unpartitioned space
updates
UPS. See Uninterruptible Power Supply upstream filtering
URL injectors
usability
USENET newsgroups
User Authentication Protocol user awareness
User Datagram Protocol (UDP) User Domain
user training
userland-only install
UTM. See unified threat management
V
Van Eck phreaking
vaporware. See slideware vendors
Verizon Data Breach Investigations Report violations of
security
violators
virtual firewall test
virtual firewalls
Virtual Local Area Network (VLAN) virtual private network
(VPN) virtual reassembly
Virtual Router Redundancy Protocol (VRRP) virtualization
virtualization security
virtualized firewall
virtualized network environment virtualized networks
virtualized SSL VPN
virus
VLAN. See Virtual Local Area Network VMware
voluntary compliance
VPN. See virtual private network VPN appliances
VPN authorization
VPN link
VRRP. See Virtual Router Redundancy Protocol vulnerabilities
vulnerability assessments
vulnerability management
vulnerability research
vulnerability scanning
W
wake-on-LAN
WAN. See distributed LAN; wide area network WAN Domain
WAN VPN connections
wardialing
wardriving
weakest link security stance Web browsers
Web server
Web-based GUI
Web-based policy training
well-known port numbers
white-list controls
whitelists
whois
whole hard drive encryption
wide area network (WAN)
Windows Firewall
Windows Server 2008 Network Access WinZapper tool
wired networks
wireless access points
wireless connectivity
wireless local area network (LAN) wireless networking
wireless technologies
Wireshark
wirespeed functions
workgroup
Workstation Domain
WORM storage device. See write-once read-many storage
device worms
wrappers
write-once read-many (WORM) storage device written
firewall policy
written security policy
X
XSS. See cross-site scripting
Z
zero-day attacks
zero-day exploits
zeroization
zombie army
zombies
zone file
zone of risk
zones of trust
- Cover
- Title Page
- Copyright
- Contents
- Preface
- Part One: Foundations of Network Security
- Chapter 1 Fundamentals of Network Security
- What Is Network Security?
- What Is Trust?
- Who—or What—Is Trustworthy?
- What Are Security Objectives?
- What Are You Trying to Protect?
- Seven Domains of a Typical IT Infrastructure
- Goals of Network Security
- How Can You Measure the Success of Network Security?
- Why Are Written Network Security Policies Important?
- Planning for the Worst
- Who Is Responsible for Network Security?
- Examples of Network Infrastructures and Related Security Concerns
- Workgroups
- SOHO Networks
- Client/Server Networks
- LAN Versus WAN
- Thin Clients and Terminal Services
- Remote Control, Remote Access, and VPN
- Boundary Networks
- Strengths and Weaknesses of Network Design
- Enhancing the Security of Wired Versus Wireless LAN Infrastructures
- Internal and External Network Issues
- Common Network Security Components Used to Mitigate Threats
- Hosts and Nodes
- IPv4 Versus IPv6
- Firewall
- Virtual Private Networks
- Proxy Servers
- Network Address Translation
- Routers, Switches, and Bridges
- The Domain Name System
- Directory Services
- Intrusion Detection Systems and Intrusion Prevention Systems
- Network Access Control
- Chapter Summary
- Key Concepts and Terms
- Chapter 1 Assessment
- Chapter 2 Firewall Fundamentals
- What Is a Firewall?
- What Firewalls Cannot Do
- Why Do You Need a Firewall?
- What Are Zones of Risk?
- How Firewalls Work and What Firewalls Do
- TCP/IP Basics
- OSI Reference Model
- Sub-Protocols
- Headers and Payloads
- Addressing
- Types of Firewalls
- Ingress and Egress Filtering
- Types of Filtering
- Static Packet Filtering
- Stateful Inspection and Dynamic Packet Filtering
- Network Address Translation (NAT)
- Application Proxy
- Circuit Proxy
- Content Filtering
- Software Versus Hardware Firewalls
- IPv4 Versus IPv6 Firewalls
- Dual-Homed and Triple-Homed Firewalls
- Placement of Firewalls
- Chapter Summary
- Key Concepts and Terms
- Chapter 2 Assessment
- Chapter 3 VPN Fundamentals
- What Is a Virtual Private Network?
- What Are the Benefits of Deploying a VPN?
- What Are the Limitations of a VPN?
- What Are Effective VPN Policies?
- VPN Deployment Models and Architecture
- Tunnel Versus Transport Mode
- The Relationship Between Encryption and VPNs
- Symmetric Cryptography
- Asymmetric Cryptography
- Hashing
- What Is VPN Authentication?
- VPN Authorization
- Chapter Summary
- Key Concepts and Terms
- Chapter 3 Assessment
- Chapter 4 Network Security Threats and Issues
- Hacker Motivation
- Favorite Targets of Hackers
- Threats from Internal Personnel and External Entities
- The Hacking Process
- Fallback Attacks
- Common IT Infrastructure Threats
- Hardware Failures and Other Physical Threats
- Natural Disasters
- Accidents and Intentional Concerns
- Malicious Code (Malware)
- Advanced Persistent Threat
- Fast Growth and Overuse
- Wireless Versus Wired
- Eavesdropping
- Replay Attacks
- Insertion Attacks
- Fragmentation Attacks, Buffer Overflows, and XSS Attacks
- Fragmentation Attacks
- Buffer Overflows
- XSS (Cross-Site Scripting) Attacks
- Man-in-the-Middle, Session Hijacking, and Spoofing Attacks
- Man-in-the-Middle Attacks
- Session Hijacking
- Spoofing Attacks
- Covert Channels
- Network and Resource Availability Threats
- Denial of Service (DoS)
- Distributed Denial of Service (DDoS)
- Hacker Tools
- Social Engineering
- Chapter Summary
- Key Concepts and Terms
- Chapter 4 Assessment
- Part Two: Technical Overview of Network Security, Firewalls, and VPNs
- Chapter 5 Network Security Implementation
- Seven Domains of a Typical IT Infrastructure
- Network Design and Defense in Depth
- Protocols
- Common Types of Addressing
- IPv6
- Controlling Communication Pathways
- Hardening Systems
- Equipment Selection
- Authentication, Authorization, and Accounting
- Communication Encryption
- Hosts: Local-Only or Remote and Mobile
- Redundancy
- Endpoint Security
- Clients
- Servers
- Routers
- Switches
- Firewalls and Proxies
- Chapter Summary
- Key Concepts and Terms
- Chapter 5 Assessment
- Chapter 6 Network Security Management
- Network Security Management Best Practices
- Fail-Secure, Fail-Open, and Fail-Close Options
- Physical Security
- Watching for Compromise
- Incident Response
- Trapping Intruders and Violators
- Why Containment Is Important
- Imposing Compartmentalization
- Using Honeypots, Honeynets, and Padded Cells
- Essential Host Security Controls
- Backup and Recovery
- User Training and Awareness
- Network Security Management Tools
- Security Checklist
- Network Security Troubleshooting
- Compliance Auditing
- Security Assessment
- Configuration Scans
- Vulnerability Scanning
- Penetration Testing
- Post-Mortem Assessment Review
- Chapter Summary
- Key Concepts and Terms
- Chapter 6 Assessment
- Chapter 7 Firewall Basics
- Firewall Rules
- Authentication, Authorization, and Accounting
- Monitoring and Logging
- Understanding and Interpreting Firewall Logs and Alerts
- Intrusion Detection
- Limitations of Firewalls
- Improving Performance
- The Downside of Encryption with Firewalls
- Firewall Enhancements
- Management Interfaces
- Chapter Summary
- Key Concepts and Terms
- Chapter 7 Assessment
- Chapter 8 Firewall Deployment Considerations
- What Should You Allow and What Should You Block?
- Common Security Strategies for Firewall Deployments
- Security Through Obscurity
- Least Privilege
- Simplicity
- Defense in Depth
- Diversity of Defense
- Chokepoint
- Weakest Link
- Fail-Safe
- Forced Universal Participation
- Essential Elements of a Firewall Policy
- Software and Hardware Options for Firewalls
- Benefit and Purpose of Reverse Proxy
- Use and Benefit of Port-Forwarding
- Considerations for Selecting a Bastion Host OS
- Constructing and Ordering Firewall Rules
- Evaluating Needs and Solutions in Designing Security
- What Happens When Security Gets in the Way of Doing Business?
- Chapter Summary
- Key Concepts and Terms
- Chapter 8 Assessment
- Chapter 9 Firewall Management and Security
- Best Practices for Firewall Management
- Security Measures in Addition to a Firewall
- Selecting the Right Firewall for Your Needs
- The Difference Between Buying and Building a Firewall
- Mitigating Firewall Threats and Exploits
- Concerns Related to Tunneling Through or Across a Firewall
- Testing Firewall Security
- Important Tools for Managing and Monitoring a Firewall
- Troubleshooting Firewalls
- Proper Firewall Implementation Procedure
- Responding to Incidents
- Chapter Summary
- Key Concepts and Terms
- Chapter 9 Assessment
- Chapter 10 Using Common Firewalls
- Individual and Small Office/Home Office (SOHO) Firewall Options
- Uses for a Host Software Firewall
- Examples of Software Firewall Products
- Using Windows 7’s Host Software Firewall
- Using a Linux Host Software Firewall
- Managing the Firewall on an ISP Connection Device
- Converting a Home Router into a Firewall
- Commercial Software Network Firewalls
- Open-Source Software Network Firewalls
- Appliance Firewalls
- Virtual Firewalls
- Simple Firewall Techniques
- Chapter Summary
- Key Concepts and Terms
- Chapter 10 Assessment
- Chapter 11 VPN Management
- VPN Management Best Practices
- Developing a VPN Policy
- Developing a VPN Deployment Plan
- Bypass Deployment
- Internally Connected Deployment
- DMZ-Based Implementation
- VPN Threats and Exploits
- Commercial or Open Source VPNs
- Differences Between Personal and Enterprise VPNs
- Balancing Anonymity and Privacy
- Protecting VPN Security to Support Availability
- The Importance of User Training
- VPN Troubleshooting
- Chapter Summary
- Key Concepts and Terms
- Chapter 11 Assessment
- Chapter 12 VPN Technologies
- Differences Between Software and Hardware Solutions
- Software VPNs
- Hardware VPNs
- Differences Between Layer 2 and Layer 3 VPNs
- Internet Protocol Security (IPSec)
- Layer 2 Tunneling Protocol (L2TP)
- Secure Sockets Layer (SSL)/Transport Layer Security (TLS)
- SSL/TLS and VPNs
- Secure Shell (SSH) Protocol
- Establishing Performance and Stability for VPNs
- Performance
- Stability
- Using VPNs with Network Address Translation (NAT)
- Types of Virtualization
- Desktop Virtualization
- SSL VPN Virtualization
- Differences Between Internet Protocol Version 4 (IPv4) and Internet Protocol Version 6 (IPv6)
- The TCP/IP Protocol Suite
- IPv4 Challenges
- IPv6
- IPSec and IPv6
- Chapter Summary
- Key Concepts and Terms
- Chapter 12 Assessment
- Part Three: Implementation, Resources, and the Future
- Chapter 13 Firewall Implementation
- Constructing, Configuring, and Managing a Firewall
- SmoothWall
- Examining Your Network and Its Security Needs
- What to Protect and Why
- Preserving Privacy
- Firewall Design and Implementation Guidelines
- Selecting a Firewall
- Hardware Requirements for SmoothWall
- Planning a Firewall Implementation with SmoothWall
- Firewalling a Big Organization: Application-Level Firewall and Package Filtering, a Hybrid System
- Firewalling a Small Organization: Packet Filtering or Application-Level Firewall, a Proxy Implementation
- Firewalling in a Subnet Architecture
- Installing a Firewall with SmoothWall
- Configuring a Firewall with SmoothWall
- Elements of Firewall Deployment
- Performing Testing with SmoothWall
- Firewall Troubleshooting
- Additional SmoothWall Features
- Firewall Implementation Best Practices
- Chapter Summary
- Key Concepts and Terms
- Chapter 13 Assessment
- Chapter 14 Real-World VPNs
- Operating System–Based VPNs
- VPN Appliances
- Configuring a Typical VPN Appliance
- Client-Side Configuration
- Remote Desktop Protocol
- Using Remote Control Tools
- Using Remote Access
- The Technology for Remote Use
- Choosing Between IPSec and SSL Remote Access VPNs
- Terminal Services
- TS RemoteApp
- TS Web Access
- Microsoft DirectAccess
- DMZ, Extranet, and Intranet VPN Solutions
- Intranet VPNs
- Extranet VPNs
- Internet Café VPNs
- Online Remote VPN Options
- Security
- Wake-on-LAN Support
- File Sharing
- Remote Printing
- Mac Support
- The Tor Application
- Planning a VPN Implementation
- Requirements
- Installation
- Deployment
- Testing and Troubleshooting
- VPN Implementation Best Practices
- Chapter Summary
- Key Concepts and Terms
- Chapter 14 Assessment
- Chapter 15 Perspectives, Resources, and the Future
- What the Future Holds for Network Security, Firewalls, and VPNs
- Threats
- Firewall Capabilities
- Encryption
- Authentication
- Metrics
- Focus
- Securing the Cloud
- Securing Mobile Devices
- Mobile IP
- Bring Your Own Device (BYOD)
- Resource Sites for Network Security, Firewalls, and VPNs
- Tools for Network Security, Firewalls, and VPNs
- Commercial Off-the-Shelf (COTS) Software
- Open Source Applications and Tools
- The Impact of Ubiquitous Wireless Connectivity
- Potential Uses of Security Technologies
- What Happens When There Is No Perimeter?
- Specialized Firewalls Available
- Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs)
- Effect of Honeypots, Honeynets, and Padded Cells
- Emerging Network Security Technologies
- IP Version 6
- VPNs, Firewalls, and Virtualization
- Steganography
- Anti-Forensics
- Chapter Summary
- Key Concepts and Terms
- Chapter 15 Assessment
- Appendix A: Answer Key
- Appendix B: Standard Acronyms
- Glossary of Key Terms
- References
- Index
