Firewalls: Perimeter Defense in Network Security, Slides of Cryptography and System Security

Download Firewalls: Perimeter Defense in Network Security and more Slides Cryptography and System Security in PDF only on Docsity! Cryptography and Network Security Chapter 20 Docsity.com Chapter 20 – Firewalls The function of a strong position is to make the forces holding it practically unassailable —On War, Carl Von Clausewitz Docsity.com Firewall Limitations  cannot protect from attacks bypassing it  eg sneaker net, utility modems, trusted organisations, trusted services (eg SSL/SSH)  cannot protect against internal threats  eg disgruntled or colluding employees  cannot protect against transfer of all virus infected programs or files  because of huge range of O/S & file types Docsity.com Firewalls – Packet Filters  simplest, fastest firewall component  foundation of any firewall system  examine each IP packet (no context) and permit or deny according to rules  hence restrict access to services (ports)  possible default policies  that not expressly permitted is prohibited  that not expressly prohibited is permitted Docsity.com Firewalls — Packet Filters Security Perimeter Private Network Packet- * filtering »------------------ 4 router (a) Packet-filtering router Firewalls – Stateful Packet Filters  traditional packet filters do not examine higher layer context  ie matching return packets with outgoing flow  stateful packet filters address this need  they examine each IP packet in context  keep track of client-server sessions  check each packet validly belongs to one  hence are better able to detect bogus packets out of context Docsity.com Firewalls - Application Level Gateway (or Proxy)  have application specific gateway / proxy  has full access to protocol  user requests service from proxy  proxy validates request as legal  then actions request and returns result to user  can log / audit traffic at application level  need separate proxies for each service  some services naturally support proxying  others are more problematic Docsity.com Firewalls - Application Level Gateway (or Proxy) Application-level gateway , enedion TELNET _}¢y — SPONESHOn > Ld SMTP Inside host (b) Application-level gateway Bastion Host  highly secure host system  runs circuit / application level gateways  or provides externally accessible services  potentially exposed to "hostile" elements  hence is secured to withstand this  hardened O/S, essential services, extra auth  proxies small, secure, independent, non-privileged  may support 2 or more net connections  may be trusted to enforce policy of trusted separation between these net connections Docsity.com Firewall Configurations Bastion host Packet- filtering router Private Information network hosts server (a) Screened host firewall system (single-homed bastion hast} Firewall Configurations Bastion host Packet- filtering router Private Information network hosts server {b) Screened host firewall system (dual-homed bastion host} Access Control Matrix Program1 wee SepmentA SegmentB (a) Access matrix Trusted Computer Systems  information security is increasingly important  have varying degrees of sensitivity of information  cf military info classifications: confidential, secret etc  subjects (people or programs) have varying rights of access to objects (information)  known as multilevel security  subjects have maximum & current security level  objects have a fixed security level classification  want to consider ways of increasing confidence in systems to enforce these rights Docsity.com Bell LaPadula (BLP) Model  one of the most famous security models  implemented as mandatory policies on system  has two key policies:  no read up (simple security property)  a subject can only read/write an object if the current security level of the subject dominates (>=) the classification of the object  no write down (*-property)  a subject can only append/write to an object if the current security level of the subject is dominated by (<=) the classification of the object Docsity.com Common Criteria  international initiative specifying security requirements & defining evaluation criteria  incorporates earlier standards  eg CSEC, ITSEC, CTCPEC (Canadian), Federal (US)  specifies standards for  evaluation criteria  methodology for application of criteria  administrative procedures for evaluation, certification and accreditation schemes Docsity.com Common Criteria  defines set of security requirements  have a Target Of Evaluation (TOE)  requirements fall in two categories  functional  assurance  both organised in classes of families & components Docsity.com Common Criteria Requirements  Functional Requirements  security audit, crypto support, communications, user data protection, identification & authentication, security management, privacy, protection of trusted security functions, resource utilization, TOE access, trusted path  Assurance Requirements  configuration management, delivery & operation, development, guidance documents, life cycle support, tests, vulnerability assessment, assurance maintenance Docsity.com