Information Assurance and Security
Chapter Three
Network Firewall Security
December 2022
By: Getachew Maru Department of Information Technology December 2022 1 / 33
Network Firewall Security
Firewall is as a means of protecting local system or network of
systems from security threats.
A firewall is a network security device that monitors and filters in-
coming and outgoing network traffic based on an organization’s
previously established security policies.
By: Getachew Maru Department of Information Technology December 2022 2 / 33
Why Do We Need Firewalls?
Security problems in operating systems
Individuals can protect a single machine connected to the Internet
with a personal firewall.
Preventing access to information
National firewalls (attempt to) limit the activities of their users on
the Internet.
Preventing Information Leaks
Because all traffic leaving a network must pass through the firewall,
it can be used to reduce information leaks.
By: Getachew Maru Department of Information Technology December 2022 3 / 33
Cont’d
Enforcing Policy
Firewalls are one part of an overall security policy; they enforce
the rules about which network traffic is allowed to enter or leave a
network.
These policies restrict the use of certain applications, restrict which
remote machines may be contacted, and/or limit the bandwidth.
Auditing
If a security breach (which does not include the firewall) occurs,
audit trails can be used to help determine what happened.
By: Getachew Maru Department of Information Technology December 2022 4 / 33
Cont’d
Firewalls can act on previously set policies to better protect your
network and can carry out quick assessments to detect invasive or
suspicious activity, such as malware, and shut it down.
By: Getachew Maru Department of Information Technology December 2022 5 / 33
General Firewall Features
Port Control
Network Address Translation
Application Monitoring
Packet Filtering
Data encryption
Logging
E-mail virus protection
Spyware protection
By: Getachew Maru Department of Information Technology December 2022 6 / 33
Firewall Design goals
All traffic from inside to outside must pass through the firewall (phys-
ically blocking all access to the local network except via the fire-
wall).
Only authorized traffic (defined by the local security policy) will be
allowed to pass.
The firewall itself is immune to penetration (use of trusted system
with a secure operating system).
By: Getachew Maru Department of Information Technology December 2022 7 / 33
Firewall Features
Network Layer
Static packet filtering
This type of firewall decides whether to accept or deny individual
packets, based on examining fields in the packet’s IP and protocol
headers.
Dynamic packet filtering
Maintains a connection table in order to monitor requests and
replies.
Stateful inspection
It aims to monitor the active connections on a network.
Moreover, the process of stateful inspection determines which net-
work packets should be allowed through the firewall by utilizing the
information regarding active connections.
By: Getachew Maru Department of Information Technology December 2022 8 / 33
Cont’d
Packet filters are the crudest kind of firewall: they operate at the
network level, and generally look only at TCP, UDP, and IP headers.
One can also build firewalls that restrict traffic according to the con-
tents of the data fields; these are known as application-layer fire-
walls, or application firewalls for short.
By: Getachew Maru Department of Information Technology December 2022 9 / 33
Cont’d
Application Layer
Application firewalls, or application layer firewalls, use a series of
configured policies to determine whether to block or allow commu-
nications to or from an app.
A firewall at the Application Layer examines the requested session
for whether they should be allowed or disallowed based on where
the session requests are coming from and the purpose of the re-
quested sessions.
Such firewalls are built with the help of what are known as proxy
servers.
Proxy Services
Application that mediates traffic between a protected network and
the internet.
Able to understand the application protocol being utilized and imple-
ment protocol specific security.
Protocols include: FTP, HTTP, Telnet etc.
By: Getachew Maru Department of Information Technology December 2022 10 / 33
Hardware and Software firewall
Hardware firewall
A hardware firewall is a physical appliance that is deployed to en-
force a network boundary.
All network links crossing this boundary pass through this firewall,
which enables it to perform inspection of both inbound and out-
bound network traffic and enforce access controls and other secu-
rity policies.
it use one or more of three methods
Packet filtering
Proxy service
State full inspection
It protects from
Remote logins
SMTP session hijacking
Spam
Denial of service
E-mail bombs
By: Getachew Maru Department of Information Technology December 2022 11 / 33
Cont’d
Software Firewall
It is a firewall that operates at the Application Layer of OSI model
though filters packets at the network layer.
Monitors the communication type (TCP, UDP, etc.)
Monitors the origin of the packet, destination port of the packet.
Monitors where the packet is coming from or heading to.
By: Getachew Maru Department of Information Technology December 2022 12 / 33
Cont’d
Benefits Software Firewall
Easier to track when a potential vulnerability happens.
Protect against new vulnerabilities before they are found and
exploited.
Ability to "understand" applications specific information structure.
Incoming or outgoing packets cannot access services for which
there is no proxy.
Disadvantages Software Firewall
Slows down network access dramatically
More susceptible to distributed denial of service (DDOS) attacks
Not transparent to end users
Require manual configuration of each client computer
By: Getachew Maru Department of Information Technology December 2022 13 / 33
Cont’d
Bastion host
A bastion host is a server used to manage access to an internal
or private network from an external network - sometimes called a
jump box or jump server.
Placed outside the firewall or within a DMZ, the bastion host be-
comes the only ingress path to those internal resources.
Access control becomes easier to manage while minimizing the
potential attack surface.
They are also commonly used to proxy and log communications,
such as SSH sessions.
Network administrators often use bastion hosts to remotely man-
age networked assets.
By: Getachew Maru Department of Information Technology December 2022 14 / 33
Demilitarized Zone (DMZ)
Is a physical or logical subnet that separates a local area network
(LAN) from other untrusted networks – usually, the public internet.
DMZs are also known as perimeter networks or screened subnet-
works.
Any service provided to users on the public internet should be
placed in the DMZ network.
External-facing servers, resources and services are usually located
there.
Some of the most common of these services include web, email,
domain name system, File Transfer Protocol and proxy servers.
Servers and resources in the DMZ are accessible from the internet,
but the rest of the internal LAN remains unreachable.
This approach provides an additional layer of security to the LAN
as it restricts a hacker’s ability to directly access internal servers
and data from the internet.
By: Getachew Maru Department of Information Technology December 2022 15 / 33
Cont’d
Figure: how DMZ work
By: Getachew Maru Department of Information Technology December 2022 16 / 33
Types of Attack
Passive Attack
The attacker observes the content of messages or copy the content
of messages.
Passive Attack is a danger for Confidentiality.
Due to passive attack, there is no any harm to the system.
The most important thing is that In passive attack, Victim does not
get informed about the attack.
By: Getachew Maru Department of Information Technology December 2022 17 / 33
Cont’d
By: Getachew Maru Department of Information Technology December 2022 18 / 33
Cont’d
Active Attack
The attacker efforts to change or modify the content of messages.
Active Attack is danger for Integrity as well as availability.
Due to active attack system is always damaged and System re-
sources can be changed.
The most important thing is that, In active attack, Victim gets in-
formed about the attack.
By: Getachew Maru Department of Information Technology December 2022 19 / 33
Cont’d
By: Getachew Maru Department of Information Technology December 2022 20 / 33
Examples of Active Attack
E-mail bombing
A mail bomb is a form of a denial-of-service (DoS) attack designed
to overwhelm an inbox or inhibit a server by sending a massive
number of emails to a specific person or system.
Smurf attack
A Smurf attack is a form of a distributed denial of service (DDoS)
attack that renders computer networks inoperable.
Sending a “ping” multicast or broadcast with a spoofed IP of a vic-
tim.
By: Getachew Maru Department of Information Technology December 2022 21 / 33
Examples of Active Attack
Spoofing Attack
Spoofing is a technique through which a cybercriminal disguises
themselves as a known or trusted source.
IP spoofing
Putting a wrong IP address in the source IP address of an IP packet.
DNS spoofing
Changing the DNS information so that it directs to a wrong machine.
URL spoofing/Webpage phishing
A legitimate web page such as a bank’s site is reproduced in "look
and feel" on another server under control of the attacker
E-mail address spoofing
By: Getachew Maru Department of Information Technology December 2022 22 / 33
Examples of Active Attack
Session hijacking
When a TCP connection is established between a client and a
server, all information is transmitted in clear and this can be ex-
ploited to hijack the session.
In a session hijacking attack, a hacker takes control of a user’s
browsing session to gain access to their personal information and
passwords.
By: Getachew Maru Department of Information Technology December 2022 23 / 33
Internet Security Architecture
IPsec (Internet Protocol Security) is a suite of protocols and algo-
rithms for securing data transmitted over the internet or any public
network.
The Internet Engineering Task Force(IETF) developed the IPsec
protocols to provide security at the IP layer through authentication
and encryption of IP network packets.
IPsec originally defined two protocols for securing IP packets: Au-
thentication Header (AH) and Encapsulating Security Payload (ESP).
The former provides data integrity and anti-replay services, and the
latter encrypts and authenticates data.
By: Getachew Maru Department of Information Technology December 2022 24 / 33
Cont’d
The IPsec suite also includes Internet Key Exchange (IKE), which
is used to generate shared security keys to establish a security
association (SA).
SAs are needed for the encryption and decryption processes to
negotiate a security level between two entities.
A special router or firewall that sits between two networks usually
handles the SA negotiation process.
By: Getachew Maru Department of Information Technology December 2022 25 / 33
Application of IPsec
IPSec provides the capability to secure communications across a
LAN, across private and public WANs, and across the Internet.
Secure branch office connectivity over the Internet
A company can build a secure virtual private network over the Internet
or over a public WAN.
Secure remote access over the Internet
An end user whose system is equipped with IP security protocols can
make a local call to an Internet service provider (ISP) and gain secure
access to a company network.
Establishing extranet and intranet connectivity with partners
IPSec can be used to secure communication with other organizations,
ensuring authentication and confidentiality and providing a key ex-
change mechanism.
Enhancing electronic commerce security
Even though some Web and electronic commerce applications have
built-in security protocols, the use of IPSec enhances that security.
By: Getachew Maru Department of Information Technology December 2022 26 / 33
IP Security Scenario
By: Getachew Maru Department of Information Technology December 2022 27 / 33
Cont’d
IPSec can assure that:
A router or neighbor advertisement comes from an authorized
router.
A redirect message comes from the router to which the initial
packet was sent.
A routing update is not forged.
By: Getachew Maru Department of Information Technology December 2022 28 / 33
Cont’d
IP security (IPSec) services
Access Control
Integrity
Data origin authentication
Rejection of replayed packets
Confidentiality (encryption)
By: Getachew Maru Department of Information Technology December 2022 29 / 33
IPSec - Security Associations (SA)
SA is a one way relationship between a sender and a receiver that
provides security services (authentication and confidentiality).
SA is uniquely identified by:
Security Parameters Index (SPI) in the enclosed extension header
of AH or ESP.
AH: Authentication Header (Authetication)
ESP: Encapsulating Security Payload (both authentication and confi-
dentiality)
IP Destination address in the IPv4/IPv6 header
Both AH and ESP support two modes of use
Transport Mode: Protection for upper layer protocols (TCP, UDP)
Tunnel Mode: Protection to the entire IP packet
By: Getachew Maru Department of Information Technology December 2022 30 / 33
IPSec ESP Encryption and Authentication
IPSec provides authentication, confidentiality, and key manage-
ment at the level of IP packets.
IP-level authentication is provided by inserting an Authentication
Header (AH) into the packets.
IP-level confidentiality is provided by inserting an Encapsulating
Security Payload (ESP) header into the packets. An ESP header
can also do the job of the AH header by providing authentication in
addition to confidentiality.
Before ESP can be used, it is necessary for the two ends of a
communication link to exchange the secret key that will be used for
encryption. Similarly, AH needs an authentication key. Keys are
exchanged with a protocol named as the Internet Key Exchange
(IKE).
IPSec is a specification for the IP-level security features that are
built into the IPv6 internet protocol. These security features can
also be used with the IPv4 internet protocol.
IPSec is transparent to applications (functions below transport layer)
By: Getachew Maru Department of Information Technology December 2022 31 / 33
IPv6 Security Considerations
Neighbor Discovery Issues
IPv6 nodes use the Neighbor Discovery Protocol (NDP) to discover
other nodes on the link, to determine their link-layer addresses
to find routers, and to maintain reachability information about the
paths to active neighbors.
IPv6 Neighbor Discovery Attacks include the following
Neighbor Solicitation
Spoofed redirect-route packets to different link-layer address
By: Getachew Maru Department of Information Technology December 2022 32 / 33
IPv6 Security Consideration
DNS Issues
While security considerations in reference to with DNS (e.g., DNS
Security (DNSSEC)) are not specific to IPv6, improper
configuration and use with IPv6 can impact performance.
Local addresses should never be published.
Develop an IPv6 Security Plan
Create appropriate policy
Manage Routers/Switches appropriately
Disable IPv6/Tunnels
Develop Access Control Lists (ACL) to Block IPv6/Tunnels on
core/edge/outside enclave
Network protection devices/tools
Contact vendors for IPv6 advice
Enable IPv6 IDS/IPS features
By: Getachew Maru Department of Information Technology December 2022 33 / 33
By: Getachew Maru Department of Information Technology December 2022 33 / 33