Firewall Security

1
Firewall Security

• Shamsi Moussavi

2
Firewall

• Devices that connect two networks
• Internal and Internet
• Allow or block information selectively
• Protect internal network from machines on
  untrusted network
• Crunchy on the outside and soft and chewy on the
  inside organization

3
Firewall
4
Firewalls

• Usually a combination of packet filtering routers
  and a computer that executes a set of proxies
• Proxies evaluate network requests based on a set
  of rules
• Well configured and maintained firewalls can
  prevent most of random attacks

5
Securing Firewall

• Should not be used for general purpose computing
• No user account on it
• Some firewalls have default accounts with weak or
  no password protection
• Unnecessary network services should be removed
• Remote login
• No Web or FTP server

6
Securing Firewall

• Firewall filtering routers must be secured too
• Errors in coding the rules for dropping or
  accepting packets sent to inside or outside can
  open holes
• Remote login to routers should be disabled
• Malicious attack can
• Rewrite rules
• Disable router

7
Securing Firewall and beyond

• A security policy must be developed to document
  what is permitted and what is not
• This helps to configure the firewall with maximum
  security
• Security of individual machines must be ensured
• i.e. A modem attached to a computer in the network

8
Firewall Security

• Restrict the number of network services available
  to outside connections
• Preventing threats such as port scanners to
  determine services running on different ports
• Successful attacks happen due to bugs in the
  service, configurations errors, or lack of access
  control
• However, data driven attacks occur by exploiting
  bugs and features in unrestricted services

9
Data Driven Attacks

• Firewalls can not prevent these attacks but can
  limit the damage
• Proxies can impose restriction around executing
  application server
• i.e. a bug in sendmail that allows shell access
  on the server can be contained by limiting the
  file system
• Web server data driven vulnerability