INFO1200

1
INFO1200 Hardening the Infrastructure

• Selecting the Correct Firewall
• Understanding Firewall Basics
• Exploring Stateful Packet Firewalls
• Explaining Proxy-Based Firewalls
• Examining Various Firewall Vendors

2
INFO1200 Hardening the Infrastructure

• Understanding Firewall Basics
• Firewall Certification ICSA Labs
• Security Rules
• Hardware vs Software Firewalls
• Administrative Interfaces
• Traffic Interfaces
• Logging
• Optional Features

3
INFO1200 Hardening the Infrastructure

• Firewall Certification - ICSA Labs
• - Division of TruSecure Corporation
• - Provides firewall certification based on input
  from FWPD
• - ensures that vendor markets an actual firewall
  product
• - ICSA 4.0 criteria only tests firewalls against
  following services
• Telnet, Active Passive FTP, HTTP, HTTPS, SMTP,
  DNS, POP3, IMAP

4
INFO1200 Hardening the Infrastructure

• Security Rules
• - All firewalls pass traffic based on ordered set
  of rules
• - Rules specify both what comes into site as well
  as what goes out
• - Proper set of rules should consider what type
  of traffic needs to leave the organization
• - best practice is to follow most restrictive
  strategy allow only what users need and block
  everything else by default

5
INFO1200 Hardening the Infrastructure

• Hardware vs Software Firewalls
• - Software firewall Computer running common OS
  with Firewall software installed on top
• - Hardware firewall custom hardware appliance
  which runs a pre-hardened common OS or a
  customized, real-time OS
• - See Table 3.1 in textbook for list of vendors
  for each type
• Software Firewall
• Advantages
• - can run with general purpose OS on common
  server hardware
• - less cost than hardware firewall
• Disadvantages
• - underlying OS can be compromised if not
  properly hardened

6
INFO1200 Hardening the Infrastructure

• Hardware vs Software Firewalls (cont)
• Hardware Firewall
• Advantages
• - single purpose system
• - easy to install or replace plug play
• Disadvantages
• - more costly than software firewall

7
INFO1200 Hardening the Infrastructure

• Administrative Interfaces
• - All firewalls require admin interface for
  customizing configuration
• - admin interface can have different forms
• Hardware appliance
• - serial connection for setup telnet for
  ongoing admin
• - GUI installed on administrative computer
  either custom app or web browser
• Software firewall
• - interface directly on computer
• - remote access interface
• - admin interface must have special security
  surrounding it

8
INFO1200 Hardening the Infrastructure

• Traffic Interfaces
• - DMZ Interfaces
• - Contains resources that need protection but
  must be accessible by outside world ie. Web
  Mail servers
• - Can be isolated from internal network through
  firewall
• - Some firewall equipment supports MLS to allow
  DMZs with fast access
• - Additional Interfaces
• - Can have both software hardware firewalls
  with multiple interfaces to accommodate multiple
  DMZs
• - Can have auxiliary port to support modem or
  ISDN backup

9
INFO1200 Hardening the Infrastructure

• Logging
• - Required to keep track of what firewall sees
  happening on the network
• - Low-end firewalls only log security exceptions
• - High-end firewalls have richer logging features
  show both potential problems usage trends
• enhanced logs can
• -track traffic leaving site
• -track bandwidth usage, who's using it when

10
INFO1200 Hardening the Infrastructure

• Optional Features
• Network Addresss Translation
• Port Address Translation
• Advanced Routing
• Point to Point Protocol over Ethernet
• DHCP Client and Server
• VPNs
• Clustering and High Availability
• URL Filtering
• Content Filtering
• Antivirus Protection

11
INFO1200 Hardening the Infrastructure

• Exploring Stateful Packet Firewalls
• Definition of a Stateless Firewall
• Operation of a Stateful Firewall
• Effect of Traffic on Stateful Firewall
• Stateful Failover

12
INFO1200 Hardening the Infrastructure

• Explaining Proxy-Based Firewalls
• Gopher Servers Advent of Internet Proxy Server
• Modernization the Internet Server as
  Proxy-Based Firewall
• Explaining Packet Layers
• Employee Monitoring

13
INFO1200 Hardening the Infrastructure

• Examining Various Firewall Vendors
• 3Com Corporation SonicWall Inc.
• Check Point Software Technologies
• Cisco Systems Inc.
• CyberGuard
• Microsoft ISA Server
• NetScreen
• Novell
• Secure Computing
• Stonesoft Inc.
• Symantec
• WatchGuard Technologies Inc.

14
INFO1200 Hardening the Infrastructure