COMPUTER SECURITY
Cha
Security Mechanisms and
pter Techniques
5
Table of Contents
Section 1 Firewall — Concepts & Architecture
Section 2 Firewall Types & Rules
Section 3 Proxy Servers
Section 4 Intrusion Detection Systems (IDS)
01 Firewalls — Concepts and Architecture
1.1 What Is a Firewall?
A firewall is hardware, software, or a combination of both that is used to prevent unauthorized programs or Internet
users from accessing a private network and/or a single computer. It acts as a security guard between a trusted
internal network and an untrusted external network (such as the Internet), allowing only legitimate traffic to pass
through.
■ Example — Bank Security Analogy
Think of a firewall as the security checkpoint at a bank entrance. Every person (packet) must pass through the
metal detector (firewall rules). Authorized staff and customers with valid ID (permitted traffic) enter freely;
suspicious individuals (malicious packets) are turned away.
1.2 Hardware Firewalls vs. Software Firewalls
Aspect Hardware Firewall Software Firewall
Scope Protects an entire network Protects a single computer
Layer Implemented on the router level Runs as an OS process
Example Cisco ASA, pfSense router Windows Defender Firewall, ZoneAlarm
Cost Higher upfront hardware cost Often free or low cost
Maintenance Managed centrally by admin Must be installed on every host
■ Example — Hardware Firewall Example
A company's router inspects all traffic entering/leaving the corporate LAN. Every laptop, desktop, and server behind
that router is protected automatically — no configuration needed on individual machines.
■ Example — Software Firewall Example
Windows Defender Firewall on a laptop blocks incoming port-3389 (RDP) connections from the Internet, preventing
remote-desktop attacks even when the user works from a café Wi-Fi hotspot.
1.3 How a Software Firewall Works — Packet Inspection
A software firewall inspects each individual packet of data as it arrives at either side of the firewall and determines
whether it should be allowed to pass through or blocked. A packet contains a header (source/destination IP, port,
protocol) and a payload (the actual data).
■ Note: Every communication on the Internet is broken into small chunks called packets. For example,
downloading a 1 MB file may involve thousands of individual packets, each inspected independently by the firewall.
1.4 Firewall Rules
Firewall rules define what the firewall does with traffic it encounters:
• Allow — Traffic flows automatically because it has been deemed safe (e.g., HTTP on port 80 from known IPs).
• Block — Traffic is discarded because it is deemed dangerous (e.g., incoming Telnet on port 23 from the
Internet).
• Ask — The firewall prompts the user to decide whether the traffic should be allowed (common in
personal/desktop firewalls).
■ Example — Rule Example — ipchains (Linux)
The Linux ipchains tool below accepts TCP from [Link] to port 80 (web) but denies the same source using
UDP, and denies traffic to port 23 (Telnet): ACCEPT tcp [Link] → [Link]:80 DENY udp [Link] →
[Link]:80 DENY tcp [Link] → [Link]:23
1.5 What Can a Firewall Do (and NOT Do)?
✔ CAN do:
• Stop hackers from accessing your computer remotely
• Enforce an organisation's security policy
• Protect personal information and limit exposure
• Block pop-up ads and certain tracking cookies
• Log Internet activity for later audit
• Determine which programs can access the Internet
✘ CANNOT do:
• Protect against malicious insiders (employees already inside the network)
• Protect against connections that bypass the firewall entirely
• Defend against completely new/unknown (zero-day) threats
1.6 Security Strategies Implemented by Firewalls
Default Deny
Prohibit all communication that is not expressly permitted. This is the safest approach: everything is blocked
unless you explicitly allow it. Example: a new server is deployed with all ports blocked; the admin opens only port
443 (HTTPS) and 22 (SSH).
Default Permit
Permit all communication that is not explicitly prohibited. Easier to manage but riskier. Example: home router that
blocks only a known list of malicious IPs but allows everything else.
Least Privilege
Each service or user is given the minimum access rights needed. Example: A web-server process is allowed to
receive on port 80 only — it cannot initiate outbound connections or read system files.
Defense in Depth
Multiple security layers so that if one fails, others still protect. Example: firewall + IDS + antivirus + encrypted storage
all working together.
Choke Point
Force all traffic through a single narrow channel where it can be inspected. Example: a DMZ that requires all
external traffic to pass through one gateway firewall before reaching internal servers.
02 Firewall Types and Filtering Rules
2.1 Three Main Firewall Types
Firewalls can be designed to operate at different layers of the TCP/IP stack. The three primary types are:
Type Layer Inspects Example
Packet Filtering Network / Transport IP headers, port numbers iptables, ipchains
Application Gateway (Proxy)Application Full payload + protocol logic Squid, HAProxy
Circuit-Level Gateway Between App & Transport TCP handshake validity SOCKS proxy
2.2 Packet Filtering Firewalls / Routers
A packet-filtering router applies a set of rules to each incoming and outgoing IP packet and then forwards or
discards it. It works at the network layer. Filtering rules are based on:
• Source IP address (e.g., [Link])
• Destination IP address (e.g., [Link])
• Source and destination port (defines the application — e.g., port 80 = HTTP, port 23 = Telnet)
• Protocol (TCP or UDP)
■ Example — Packet Filtering Rule Table
Rule 1: ALLOW TCP from ANY:* to [Link]:80 → Permit web traffic to the web server Rule 2: DENY TCP from
ANY:* to ANY:23 → Block Telnet entirely Rule 3: ALLOW TCP from [Link]/24:* to ANY:443 → Allow internal
HTTPS Rule 4: DENY ALL → Default deny everything else
■ Note: Egress Filtering restricts outbound traffic (e.g., drop packets leaving with an internal source address but
going out on the external interface — a sign of spoofing). Ingress Filtering does the same for inbound traffic,
verifying that packets actually originate from the address they claim.
2.3 Application Level Gateway (Proxy Server Firewall)
Also called a proxy server, this type acts as a relay of application-level traffic. Unlike packet filters that only read
headers, an application gateway understands the full protocol (HTTP, FTP, SMTP, Telnet) and can apply
protocol-specific security checks.
The workflow is:
Step 1: User requests a web page.
Step 2: Request goes to the proxy server, not the real server.
Step 3: Proxy validates the request against its rule base.
Step 4: Proxy re-originates the request to the actual destination.
Step 5: Destination replies to the proxy.
Step 6: Proxy inspects the reply and forwards a clean copy to the user.
■ Example — HTTP Proxy Example
An employee in an office requests [Link] Instead of the browser connecting directly, the request
goes to the company's Squid proxy on port 3128. Squid checks: Is this URL allowed? Is the content type permitted?
Then it fetches the page, caches it, and returns it. The web server only ever sees the proxy's IP address — the
employee's real IP is hidden.
■ Note: A separate proxy service is needed for each protocol (HTTP proxy, FTP proxy, SMTP proxy, etc.).
2.4 Circuit-Level Gateway
A circuit-level gateway operates between the application layer and transport layer. It monitors TCP handshaking
to confirm that a requested session is legitimate, without inspecting the payload content of each packet.
It stores session state information:
• Unique session identifier
• Connection state (handshake established / closing)
• Sequencing information
• Source and destination IP address
• Physical network interface used
The gateway sets up two separate TCP connections: one between itself and the internal host, and one between
itself and the external host. Once the session is verified, packets are relayed without further inspection.
■ Example — SOCKS Proxy (Circuit-Level Gateway)
SOCKS is the most common circuit-level gateway protocol. When a browser is configured to use a SOCKS5 proxy:
1. Browser opens a TCP connection to the SOCKS server. 2. SOCKS authenticates the user and validates the
destination. 3. SOCKS opens a second TCP connection to the target server. 4. All data is relayed transparently —
but the SOCKS server never reads it. Used widely by Tor and corporate proxy environments.
03 Proxy Servers — Deep Dive
3.1 What Is a Proxy Server?
A proxy server is a computer program that acts as an intermediary between a web browser (client) and a web
server. The client never communicates directly with the origin server; all traffic passes through the proxy.
Two main reasons organisations deploy proxy servers:
• Performance (Web Cache): Store frequently requested pages locally so subsequent requests are served
from cache rather than re-fetching from the Internet. Example: ISPs cache popular news sites to reduce
bandwidth usage.
• Security and Control: Monitor, filter, and log all outbound traffic; conceal internal IP addresses from external
parties.
3.2 How Proxy Servers Work
A proxy server functions as software that forwards data between internal and external hosts. Key operations:
• Focuses on the port each service uses (e.g., 80 for HTTP)
• Screens all traffic into and out of each port
• Allows or blocks traffic based on configurable rules
• Conceals clients (replaces client IP with proxy IP)
• Can translate network addresses (NAT)
• Filters or modifies content
3.3 Steps in a Proxy Transaction
1. Internal host requests access to a website (e.g., [Link]
2. Request goes to proxy server, which examines header and data against rule base
3. Proxy recreates the packet with a different source IP address (the proxy's own IP)
4. Proxy sends packet to destination; the website sees the proxy's IP, not the client's
5. Response arrives at proxy, which inspects it against the rule base again
6. Proxy rebuilds the response packet and sends it to the originating client
3.4 Proxy vs. Packet Filter — Key Differences
Feature Packet Filter Proxy Server
Inspection depth Headers only (IP, port) Full packet including payload
Source IP Passes original IP Replaces with proxy IP
Content filtering Not possible Can filter URLs, MIME types, scripts
Caching No Yes — improves performance
Speed Very fast Slight added latency
Authentication Not typically Yes — username/password
Logging Basic Detailed per-request logs
3.5 Key Proxy Server Features
■ Concealing Internal Clients
The internal network appears as a single machine to the outside world. External attackers cannot identify individual
internal hosts, making targeted attacks much harder. Example: a company with 500 PCs all appear to browse from
one IP (the proxy's IP).
■ DMZ — Demilitarized Zone
A DMZ is a separate network segment hosting servers that must be accessible from both inside and outside (e.g.,
web servers, mail servers). The DMZ is sandwiched between two firewalls — it is never connected directly to the
internal LAN. Example: [Link] lives in the DMZ; the HR database lives on the internal LAN.
■ Blocking URLs
Proxy servers can prevent employees from visiting certain websites by domain name. However, users can
sometimes bypass this by using the numeric IP address directly. Example: Block '[Link]' — but a user who
knows '[Link]' can bypass it.
■ Blocking and Filtering Content
Can strip Java applets, ActiveX controls, and executable file attachments from web pages and emails before they
reach the user's browser. Rules can filter by time, IP, port, or content type. Example: block .exe downloads during
business hours.
■ E-Mail Proxy Protection
An SMTP proxy ensures that external email users never interact directly with internal mail servers, preventing direct
exploitation. The proxy validates and relays messages.
■ Security with Log Files
Log files record every request, allowing administrators to detect intrusions, audit behaviour, uncover weaknesses,
and provide legal documentation. Best practice: log only critical services to avoid information overload.
■ User Authentication
Most proxy servers can require a username and password before allowing a user to browse. This also enables
per-user policies: certain users may access the Internet only at certain times, or only for certain protocols.
3.6 Proxy Server Configuration Considerations
When deploying a proxy server, administrators must address:
• Scalability: Add multiple proxy servers or load-balance across servers for large networks.
• Client configuration: Every client machine must be configured to point its browser at the proxy (can be
automated via WPAD or GPO).
• Protocol coverage: Need a separate proxy for each protocol: HTTP, HTTPS, FTP, TELNET, SMTP, etc.
• Packet filter rules: Accompanying packet-filter rules are needed to force all traffic through the proxy.
• Security vulnerabilities: The proxy itself is a single point of failure and could be subject to buffer overflow
attacks.
3.7 Well-Known Proxy Server Products
• Squid (open source, Linux/Windows)
• WinGate (Windows)
• TIS Firewall Toolkit
• [Link]
• SOCKS
• Symantec Enterprise Firewall
• Microsoft ISA Server (Internet Security & Acceleration)
04 Intrusion Detection Systems (IDS)
4.1 What Is an IDS?
An Intrusion Detection System (IDS) collects information from a variety of system and network sources, then
analyzes the symptoms of security problems. It serves three core security functions: monitor, detect, and respond
to unauthorized activity.
Unlike firewalls (which prevent), an IDS detects attacks that:
• Come from internal users (firewalls don't block these)
• Bypass the firewall through encrypted tunnels or VPNs
• Exploit vulnerabilities in systems already inside the perimeter
An IDS can also respond automatically in real-time:
• Log off a user
• Disable a user account
• Launch a script (e.g., block an IP at the firewall)
• Send an alert email/SMS to the administrator
4.2 IDS Functions
• Monitor and analyze both user and system activities
• Analyze system configurations and vulnerabilities
• Assess system and file integrity (detect unauthorised changes)
• Recognize patterns typical of known attacks (intrusion signatures)
• Analyze abnormal activity patterns
• Track user policy violations
4.3 Intrusion Detection Approaches
A) Signature-Based (Misuse) Detection
The IDS holds a database of known attack signatures — patterns of packets or bytes that are known to represent
specific attacks. When traffic matches a signature, an alert is raised.
How it works:
• The IDS is programmed to look for specific byte strings, port patterns, or protocol anomalies.
• Pattern matching is done against a stream of network packets.
• When the pattern is found, it is identified as an attack.
■ Example — Signature Example — CGI Attack Detection
An IDS watching a web server is programmed to look for the string 'phf' in URLs. If it sees 'GET /cgi-bin/phf?' in a
packet, it knows this is a known CGI exploit attempt and raises an alert. Another signature rule (pseudo-code): if
(traffic contains '\x90+de[^\r\n]{30}') then 'Buffer Overflow Attack Detected' This rule looks for NOP sleds (\x90)
which are a hallmark of buffer overflow exploits.
Advantage: Very accurate for known attacks — low false-positive rate.
Disadvantage: Cannot detect new (zero-day) attacks. Must be updated whenever a new attack pattern is
discovered.
B) Anomaly-Based (Statistical) Detection
Instead of matching known signatures, an anomaly-based IDS learns what normal looks like during a training
phase, then raises alerts when observed behaviour deviates from that baseline.
How it works:
• Training phase: the IDS observes normal traffic for days or weeks to build a baseline model.
• Testing phase: live traffic is compared to the baseline using statistical or AI techniques.
• Deviations beyond a threshold trigger an alert.
■ Example — Anomaly Detection Examples
• Normal: user 'alice' logs in weekdays 8am-6pm from IP [Link]. Anomaly: alice logs in at 3am from an IP in a
foreign country → ALERT. • Normal: web server serves ~500 requests/minute. Anomaly: suddenly 50,000
requests/minute → potential DDoS → ALERT. • Normal: DNS queries are small (< 100 bytes). Anomaly: DNS
responses of 10,000 bytes → possible DNS amplification attack → ALERT.
Primary strength: Can detect novel attacks never seen before.
Disadvantage: Higher false-alarm rate — legitimate unusual behaviour (e.g., a sales event causing traffic spikes)
may trigger alerts.
4.4 Comparison: Signature-Based vs. Anomaly-Based IDS
Criteria Signature-Based Anomaly-Based
Detection of known attacks Excellent Good (may miss without anomaly)
Detection of new/zero-day attacks
Poor — cannot detect Good — can detect deviations
False positive rate Low Higher
Maintenance Regular signature updates needed Baseline must be kept current
Technique Pattern matching Statistics / Machine Learning / AI
Example systems Snort (rule-based) UEBA tools, ML-based IDS
4.5 IDS Deployment: Network-Based vs. Host-Based
Host-Based IDS (HIDS)
Runs on individual computers and uses OS auditing and monitoring mechanisms to detect malware and abuse:
• Executes full static and dynamic analysis of programs on that host
• Monitors shell commands and system calls made by applications and OS processes
• Has the most comprehensive information available → most accurate detection
Problems with HIDS:
• Must be installed and updated on every single user machine
• If an attacker takes control of the machine, they can tamper with the IDS binaries and audit logs
• Only provides a local view — cannot see the full network-level attack picture
■ Example — HIDS Example
Tripwire monitors critical system files (e.g., /etc/passwd, Windows registry keys). If any file is modified
unexpectedly, it raises an alert — indicating a possible rootkit or privilege escalation.
Network-Based IDS (NIDS)
Deployed at strategic network locations (e.g., on routers, at the network perimeter). Uses packet sniffing to monitor
all traffic on the network segment:
• Inspects network traffic for protocol violations and unusual connection patterns
• Looks into packet payloads for malicious code (e.g., known exploit signatures)
Limitations of NIDS:
• Cannot execute the payload or perform deep code analysis
• Must record and process enormous amounts of network traffic
• Easily defeated by encrypted traffic (cannot read payload) — though this can be mitigated by placing
decryption at the gateway/proxy
■ Example — NIDS Example — Snort
Snort is the most widely used open-source NIDS. It is placed on a network tap and monitors all traffic. A sample
Snort rule: alert tcp any any -> [Link]/24 80 (content:'/cgi-bin/phf'; msg:'CGI Attack';) This rule fires an alert
whenever any packet destined for the internal web server contains the string '/cgi-bin/phf', indicating a known CGI
exploit attempt.
4.6 Summary — IDS vs. Firewall
Aspect Firewall IDS
Primary role Prevent unauthorised access Detect attacks/intrusions
Position in network Perimeter (entry/exit point) Inside + perimeter
Action Block/allow traffic Alert, log, and optionally respond
Handles internal threats? No Yes
Handles zero-day? Partially (rules) Anomaly IDS can detect deviations
Complements IDS (detection layer) Firewall (prevention layer)
■ Note: Firewalls and IDS are complementary, not alternatives. Best practice is to deploy both: the firewall
prevents most attacks from reaching the internal network, while the IDS monitors for attacks that slip through or
originate internally. This embodies the Defence in Depth principle.