FIREWALLS: JUMPSTART FOR NETWORK AND SYSTEM ADMINISTRATORS
CONTENTS SECTION I—OVERVIEW OF FIREWALL TECHNOLOGY FIREWALLS: WHAT ARE THEY? CHAPTER OBJECTIVES FIREWALL DEFINED WHY FIREWALLS? THE NEED FOR FIREWALLS BENEFITS OF FIREWALLS PROTECTION FROM VULNERABLE SERVICES CONTROLLED ACCESS TO SITE SYSTEMS CONCENTRATED SECURITY ENHANCED PRIVACY LOGGING AND STATISTICS ON NETWORK USE AND MISUSE POLICY ENFORCEMENT LIMITATIONS OF FIREWALLS WHAT ABOUT VIRUSES? SUMMARY REFERENCES TYPE OF FIREWALL SECURITY POLICY FIREWALL PROTECTION FIREWALL ARCHITECTURES MULTI-HOMED HOST SCREENED HOST SCREENED SUBNET TYPES OF FIREWALLS PACKET-FILTERING GATEWAYS APPLICATION GATEWAYS HYBRID OR COMPLEX GATEWAYS ISSUES AUTHENTICATION ROUTING VERSUS FORWARDING SOURCE ROUTING IP SPOOFING DNS AND MAIL RESOLUTION INTRANET NETWORK TRUST RELATIONSHIPS HIGH LOW TO MEDIUM VIRTUAL PRIVATE NETWORKS FIREWALL ADMINISTRATION QUALIFICATION OF THE FIREWALL ADMINISTRATOR REMOTE FIREWALL ADMINISTRATION USER ACCOUNTS FIREWALL BACKUP SYSTEM INTEGRITY DOCUMENTATION PHYSICAL FIREWALL SECURITY FIREWALL INCIDENT HANDLING RESTORATION OF SERVICES UPGRADING THE FIREWALL LOGS AND AUDIT TRAILS: AUDIT/EVENT REPORTING AND SUMMARIES 2 10 REVISION/UPDATE OF FIREWALL POLICY 2 11 EXAMPLES OF SERVICE-SPECIFIC POLICIES 2 12 SUMMARY 2 13 REFERENCES FIREWALL TYPES SIMPLE PACKET FILTERING: IP OR FILTERING FIREWALLS APPLICATION-LAYER FIREWALLS: PROXY SERVERS STATEFUL MULTILAYER-INSPECTION FIREWALLS UNDERSTANDING FIREWALL TYPES FIREWALL TYPES DRAWBACKS SECTION II—FIREWALL TOPOLOGIES CHOOSING THE RIGHT FIREWALL CONVERGENCE THE CRIMINAL MEAGERMIND CONSIDERATIONS PRODUCTS ABOUT PACKET INSPECTION SELECTING A FIREWALL FIREWALL SOLUTIONS DEFENSE IN DEPTH: FIREWALL TOPOLOGIES VIRTUAL PRIVATE NETWORK REMOTE OFFICE VPN REMOTE USER VPN POINT-TO-POINT TUNNELING PROTOCOL VPN AUTHENTICATING WITH A REMOTE ACCESS DIAL-IN USER FIREWALL POLICIES HOW SECURE IS VPN TECHNOLOGY? DOCUMENT ACCESS SETTING UP A DEMILITARIZED ZONE:A VPN ALTERNATIVE? USES THEORY OF OPERATION MANAGING PORTS IN A DMZ DMZ TOPOLOGY SECTION III—FIREWALL INSTALLATION AND CONFIGURATION INSTALLATION PREPARATION UNBREAKABLE WALLS SELECTING AN OPERATING SYSTEM MICROSOFT UNIX SCANNING FOR VULNERABILITIES SEARCHING FOR WEAKNESSES FIREWALL CONFIGURATION DEFINING FIREWALL SECURITY OBJECTS OBJECT DISCOVERY PROCESS POST OBJECT DISCOVERY EVALUATION SCANNING THE FIREWALL AND FIXING VULNERABILITIES TRACING THE ROUTES PERIMETER PACKET ANALYSIS IDENTIFYING TRUSTED AND UNTRUSTED NETWORKS THE FIREWALL STOPS HERE CREATING TRUSTED NETWORKS SECTION IV—SUPPORTING OUTGOING SERVICES THROUGH FIREWALL CONFIGURATION SIMPLE POLICY IMPLEMENTATION POLICY CONFIGURATION INTERFACE SOURCE DESTINATION SERVICES SUPPORTING HTTP WEB ACCESS CONTROL HTTP AS A POLICY DYNAMIC CONTENT COMPLEX WEB SERVICES MANAGEMENT TELNET FTP THE ROLE OF FTP FTP ACCESS FTP SESSIONS FTP AND FIREWALLS NETSTAT FTP SECURITY ALTERNATIVES HANDLING PORT NUMBERS DEPLOYING REAL AUDIO OUTGOING VERSUS INCOMING FLEXIBILITY 10 CONTENT FILTERING 10 1 CHAPTER OBJECTIVES 10 2 FILTERING OUT DANGEROUS CONTENT SCANNING E-MAIL WEB FILTERING APPLICATION FILTERING 10 3 SUMMARY SECTION V—SECURE EXTERNAL SERVICES PROVISION 11 PUBLICLY ACCESSIBLE SERVERS IMPLEMENTATION 11 1 CHAPTER OBJECTIVES 11 2 SECURING YOUR ORGANIZATION’S INTERNET SITE PROS AND CONS SPECIAL CONCERNS 11 3 SEPARATING YOUR INTERNET SITE FROM YOUR INTRANET 11 4 SUPPORTING SMTP MAIL ARCHITECTURES INTERNAL E-MAIL 11 5 SUMMARY 12 ARCHITECTURE SELECTION 12 1 CHAPTER OBJECTIVES 12 2 TYPES OF SCREENED SUBNET ARCHITECTURES THE PERIMETER TWO ROUTERS SINGLE ROUTER MULTIPLE SCREENED SUBNET ARCHITECTURE DUAL-HOMED HOST 12 3 SINGLE-BOX ARCHITECTURE 12 4 SUMMARY 13 EXTERNAL SERVERS PROTECTION 13 1 CHAPTER OBJECTIVES 13 2 SITING EXTERNAL SERVERS ON A PERIMETER NET SECURITY OF SQL AND WEB SERVERS SEARCH ENGINES SQL SERVER SECURITY 13 3 DEPLOYING PACKET FILTERING TO CONTROL ACCESS TO YOUR SERVERS 13 4 ROUTER PACKET FILTERING 13 5 USING ROUTER ACCESS CONTROL LISTS 13 6 SUMMARY SECTION VI—INTERNAL IP SERVICES PROTECTION 14 INTERNAL IP SECURITY THREATS: BEYOND THE FIREWALL 14 1 CHAPTER OBJECTIVES 14 2 NETWORK THREATS BEHAVIOR OF EMPLOYEES E-MAIL VIRUSES SPYWARE HACKERS 14 3 ORGANIZATION RISK ASSESSMENT 14 4 EXAMINING INSIDE ATTACKS SABOTEURS LEAKY E-MAIL 14 5 HANDLING NEW THREATS 14 6 ANTIVIRUS SOFTWARE TECHNOLOGY: BEYOND THE FIREWALL LAYERED APPROACH INTRUSION DETECTION TOOLS PUBLIC KEY INFRASTRUCTURE SECURITY CONTENT 14 7 SUMMARY 14 8 REFERENCES 15 NETWORK ADDRESS TRANSLATION DEPLOYMENT 15 1 CHAPTER OBJECTIVES 15 2 PERSON-TO-PERSON COMMUNICATION 15 3 INTERNET PROTOCOL TELEPHONY 15 4 ROUTERS, FIREWALLS, AND NATS 15 5 HANDLING SIP 15 6 FIREWALL TRAVERSAL/SIP NAT 15 7 EMPLOYING A LINUX-BASED SOHO FIREWALL SOLUTION WITH REALITIES OF SECURING SOHOS WITH FIREWALL PROTECTION HARDWARE AND SOFTWARE SOLUTIONS OPTIONS EMPLOYING A LINUX-BASED SOHO FIREWALL SOLUTION PLUGGING THE SOHO FIREWALL LEAKS 15 8 SUMMARY 15 9 REFERENCES SECTION VII—FIREWALL REMOTE ACCESS CONFIGURATION 16 PRIVACY AND AUTHENTICATION TECHNOLOGY 16 1 CHAPTER OBJECTIVES 16 2 SELECTING CRYPTOGRAPHIC ALGORITHMS THROUGH ENCRYPTION DATA ENCRYPTION STANDARD 3DES ADVANCED ENCRYPTION STANDARD MESSAGE DIGEST AND SECURE HASH ALGORITHM ASYMMETRIC KEY ALGORITHMS ADDITIONAL CRYPTOGRAPHIC OPTIONS: MODES AND OPTIONS IN PADDING 16 3 KEY MANAGEMENT ADMINISTRATION AND STORAGE CENTRALIZATION SPECIALIZED HARDWARE IMPORTING A KEY EXPORTING A KEY ROTATING KEYS 16 4 AUDITING, AUTHENTICATION, AND AUTHORIZATION AUTHORIZATION AUDITING SECURE THE CREDENTIALS DISASTER RECOVERY, BACKUP, AND RESTORE 16 5 HIGH AVAILABILITY AND LOAD BALANCING KEY REPLICATION SERVICES 16 6 TRANSPORT AND NETWORK FIREWALLS 16 7 ENCRYPTION OF MULTIPLE COLUMNS: DATABASE CONSIDERATIONS CREATING INDEXES PRIMARY KEY ENCRYPTION FOREIGN KEY CONSTRAINT RANDOMLY GENERATED INITIALIZATION VECTORS EXACT MATCH SEARCHING ENCRYPTED DATA ENCODING ADDITIONAL SPACE BACKUPS DURING PRE-MIGRATION 16 8 SUMMARY 16 9 REFERENCES 17 TUNNELING: FIREWALL-TO-FIREWALL 17 1 CHAPTER OBJECTIVES 17 2 INCREASING RISK ON EXTRANETS AND INTRANETS 17 3 OPENNESS WITH PROTECTION OF FIREWALL TUNNELING AND INTERNET SECURITY SOLUTIONS 17 4 FIREWALL TUNNELING AND INTERNET SECURITY ARCHITECTURE TECHNOLOGIES PROTECTION SOLUTIONS FOR THE INTRANET PROTECTION SOLUTIONS FOR THE EXTRANET AND INTERNET 17 5 FIREWALL TUNNELING TECHNOLOGIES APPLICATION PROXIES ENCRYPTION WITH VIRTUAL PRIVATE NETWORK MANAGEMENT CENTER STATEFUL IP FILTERING STATIC IP FILTERING 17 6 DEMILITARIZED ZONE FOCUS ISOLATING THE MACHINE CONTROLLING THE FLOW CONTROLLING REMOTE ACCESS AUTHENTICATION MECHANISMS 17 7 KEEPING THE FIREWALL TUNNELING SECURITY RULES UP-TO-DATE THROUGH ENTERPRISE INTRANETS 17 8 SUMMARY A HIGH LEVEL OF TRUST CENTRALIZED SECURITY MANAGEMENT ENTERPRISE-CLASS SCALABILITY HIGH-END FIREWALL TUNNELING PROTECTION 17 9 REFERENCES SECTION VIII—FIREWALL MANAGEMENT 18 AUDITING AND LOGGING 18 1 CHAPTER OBJECTIVES 18 2 AUDITING YOUR FIREWALL METHODOLOGY 18 3 LOGGING CONFIGURATION OF FIREWALL LOGGING FIREWALL MONITORING 18 4 SUMMARY 18 5 REFERENCES 19 FIREWALL ADMINISTRATION 19 1 CHAPTER OBJECTIVES 19 2 SYSTEM ADMINISTRATION 19 3 MANAGING YOUR FIREWALL REMOTELY ACHIEVING HIGH UPTIME EXTERNAL AND INTERNAL SOLUTION MONITORS 19 4 MAINTENANCE OF A FIREWALL PERFORMING FIREWALL MAINTENANCE 19 5 MANAGING FIREWALL SECURITY FIREWALL PRODUCTS COMMON FUNCTIONALITY ANALYSIS AND ACTIVITY REPORTING OF FIREWALLS ENTERPRISE FIREWALLS: AUTOMATED EVENT RESPONSE AND REAL-TIME MONITORING 19 6 SUMMARY 19 7 REFERENCES 20 SUMMARY, CONCLUSIONS, AND RECOMMENDATIONS 20 1 CHAPTER OBJECTIVES 20 2 SUMMARY 20 3 CONCLUSIONS 20 4 RECOMMENDATIONS PURCHASING, LEARNING, CONFIGURING, AND MAINTAINING EFFECTIVE FIREWALL SECURITY: BASELINE DESIGN PRINCIPLES FINAL RECOMMENDATION: PURCHASE A HIGH-SPEED FIREWALL 20 5 REFERENCES SECTION I OVERVIEW OF FIREWALL TECHNOLOGY