Module 2

OSI Security Architecture

The OSI Security Architecture is internationally recognized and provides a standardized

technique for deploying security measures within an organization. It focuses on three major
concepts: security attacks, security mechanisms, and security services, which are critical in
protecting data and communication processes.

OSI Security

OSI (Open Systems Interconnection) security refers to a set of protocols, standards, and
techniques used to ensure the security of data and communications in a network environment
based on the OSI model. The International Organisation for Standardisation (ISO) established
this model to provide a conceptual framework for understanding how different networking
protocols interact within a layered architecture.

Classification of OSI Security Architecture

The OSI (Open Systems Interconnection) Security Architecture defines a systematic approach
to providing security at each layer. It defines security services and security mechanisms that
can be used at each of the seven layers of the OSI model to provide security for data transmitted
over a network. These security services and mechanisms help to ensure the confidentiality,
integrity, and availability of the data. OSI architecture is internationally acceptable as it lays
the flow of providing safety in an organization. OSI Security Architecture focuses on these
concepts:

1. Security Attack
2. Security mechanism
3. Security Service
1. Security Attacks

A security attack is an attempt by a person or entity to gain unauthorized access to disrupt or

compromise the security of a system, network, or device. These are defined as the actions that
put at risk an organization's safety. They are further classified into 2 sub-categories:

(1.1) Passive Attack: Attacks in which a third-party intruder tries to access the message/
content/ data being shared by the sender and receiver by keeping a close watch on the
transmission or eave-dropping the transmission is called Passive Attacks. These types of
attacks involve the attacker observing or monitoring system, network, or device activity
without actively disrupting or altering it. Passive attacks are typically focused on gathering
information or intelligence, rather than causing damage or disruption. Here, both the sender
and receiver have no clue that their message/ data is accessible to some third-party intruder.
The message/ data transmitted remains in its usual form without any deviation from its usual
behavior. This makes passive attacks very risky as there is no information provided about the
attack happening in the communication process. Passive attacks are further divided into two
parts based on their behavior:

(1.1.1)Eavesdropping: Eavesdropping involves the attacker intercepting and listening to

communications between two or more parties without their knowledge or consent.
Eavesdropping can be performed using a variety of techniques, such as packet sniffing, or man-
in-the-middle attacks.

(1.1.2)Traffic analysis: This involves the attacker analyzing network traffic patterns and
metadata to gather information about the system, network, or device. Here the intruder can't
read the message but only understand the pattern and length of encryption. Traffic analysis can
be performed using a variety of techniques, such as network flow analysis, or protocol analysis.

(1.2)Active Attacks: Active attacks refer to types of attacks that involve the attacker actively
disrupting or altering system, network or device activity. Active attacks are typically focused
on causing damage or disruption rather than gathering information or intelligence. Here, both
the sender and receiver have no clue that their message/ data is modified by some third-party
intruder. The message/ data transmitted doesn't remain in its usual form and shows deviation
from its usual behavior. This makes active attacks dangerous as there is no information
provided of the attack happening in the communication process and the receiver is not aware
that the data/ message received is not from the sender. Active attacks are further divided into
four parts based on their behavior:
(1.2.1)Masquerade: Masquerade is a type of attack in which the attacker pretends to be an
authentic sender in order to gain unauthorized access to a system. This type of attack can
involve the attacker using stolen or forged credentials, or manipulating authentication or
authorization controls in some other way.

(1.2.2)Replay: Replay is a type of active attack in which the attacker intercepts a transmitted
message through a passive channel and then maliciously or fraudulently replays or delays it at
a later time.

(1.2.3)Modification of Message: Modification of Message involves the attacker modifying

the transmitted message and making the final message received by the receiver look like it's
not safe or non-meaningful. This type of attack can be used to manipulate the content of the
message or to disrupt the communication process.

(1.2.4)Denial of service (DoS): Denial of Service attacks involve the attacker sending a large
volume of traffic to a system, network, or device in an attempt to overwhelm it and make it
unavailable to users.

2. Security Mechanism

The mechanism that is built to identify any breach of security or attack on the organization, is
called a security mechanism. Security Mechanisms are also responsible for protecting a system,
network, or device against unauthorized access, tampering, or other security threats.

Encipherment (Encryption): Encryption involves the use of algorithms to transform data into
a form that can only be read by someone with the appropriate decryption key. Encryption can
be used to protect data it is transmitted over a network, or to protect data when it is stored on a
device.

Digital signature: Digital Signature is a security mechanism that involves the use of
cryptographic techniques to create a unique, verifiable identifier for a digital document or
message, which can be used to ensure the authenticity and integrity of the document or
message.

Traffic padding: Traffic Padding is a technique used to add extra data to a network traffic
stream in an attempt to obscure the true content of the traffic and make it more difficult to
analyze.
Routing control: Routing Control allows the selection of specific physically secure routes for
specific data transmission and enables routing changes particularly when a gap in security is
suspected.

3. Security Services

Security services refer to the different services available for maintaining the security and safety
of an organization. They help in preventing any potential risks to security. Security services
are divided into 5 types:

Authentication: Authentication is the process of verifying the identity of a user or device in

order to grant or deny access to a system or device.

Access control: Access Control involves the use of policies and procedures to determine who
is allowed to access specific resources within a system.

Data Confidentiality: Data Confidentiality is responsible for the protection of information

from being accessed or disclosed to unauthorized parties.

Data integrity: Data Integrity is a security mechanism that involves the use of techniques to
ensure that data has not been tampered with or altered in any way during transmission or
storage.

Non- repudiation: Non-repudiation involves the use of techniques to create a verifiable record
of the origin and transmission of a message which can be used to prevent the sender from
denying that they sent the message.

Benefits of OSI Security Architecture

● Providing Security: OSI Architecture in an organization provides the needed security

and safety preventing potential threats and risks.
● Organising Task: The OSI architecture makes it easy for managers to build a security
model for the organization based on strong security principles.
● Meets International Standards: Security services are defined and recognized
internationally meeting international standards.
● Interoperability: The OSI model divides network functions into multiple levels makes
it easier for different hardware and software components to work together.
● Scalability: The layered method makes networks scalable. New technologies and
protocols can be seamlessly added without interrupting the overall system.
 ● Flexibility: Each layer can evolve separately and provide flexibility for technology and
application changes.

A Model for Network Security- Access Control Models:

Access control models define the rules and mechanisms that determine who (subject)
can access what (object) in a system, and under what conditions.
These models are used for maintaining goals of security, i.e. Confidentiality, Integrity,
and Availability.
Models
1. Chinese wall model
2. Clark Wilson
3. Bell-LaPadula
4. Non-Interference
5. Role Base Model.

Chinese Wall Model (Brewer-Nash Model)

Introduction
• Proposed by David F.C. Brewer and Michael J. Nash in 1989.
• Designed for organizations like financial institutions, law firms, and consulting
companies where employees often handle sensitive data from competing clients.
• The model focuses on avoiding conflicts of interest while still allowing access
to necessary information.
Main Objective
• Prevent conflict of interest (COI) when a person accesses data from multiple
competing organizations.
• Ensure that confidentiality of sensitive information is not breached due to
insider knowledge.
Core Concepts
1. Company Dataset (CD)
• A set of all confidential data belonging to a single company.
 • Example: All records, files, and documents of Bank A.
2. Conflict of Interest Class (COI Class)
• A group of companies that are in competition.
• Example: Bank A, Bank B, Bank C → all in the Banking COI Class.
• If a user accesses one company’s dataset within a COI class, they are restricted
from accessing competitors in the same class.
3. Access Rules
There are two key rules:
a) Simple Security Rule (No-Read Rule)
• A subject (user) can access a dataset only if:
1. They have not previously accessed data from another company within
the same COI class.
2. Or, the data belongs to the same company they already accessed.
✔ Example:
• If a consultant accesses Bank A’s data, they cannot later access Bank B’s data
(since both are in the same COI class).
b) *-Property (No-Write Rule)
• A subject can write data only if they can read it under the Simple Security Rule,
and no conflict of interest occurs.
• Prevents a subject from writing information from one company into another
company’s dataset (avoiding “information leakage”).
✔ Example:
• A consultant who worked with Bank A cannot write data into Bank B’s files.
Comparison with Bell-LaPadula
• Bell-LaPadula: Protects confidentiality using "no read up, no write down".
• Chinese Wall: Protects against conflicts of interest (insider misuse) using "no
conflicting access".
Real-Life Example
Imagine a consultant in a firm:
• They advise Bank A on financial strategies.
• Because of Chinese Wall rules, they cannot access Bank B’s confidential data
since Bank B is a competitor.
• However, they may still access Airline Company X’s data, since that’s a
different COI class (banking ≠ airline).
Advantages
• Prevents misuse of insider knowledge.
• Practical for commercial consulting, legal, and auditing firms.
• Dynamically adjusts access rules based on a user’s past activity.
Limitations
• Over-restriction: Once a user accesses one dataset, they may be permanently
blocked from others in that COI class.
• Complexity: Requires careful classification of companies into COI classes.
• Dynamic policy changes are harder to manage in large organizations.

Clark–Wilson Model (Integrity Model)

Introduction
• Proposed by David D. Clark and David R. Wilson in 1987.
• Focuses on data integrity rather than confidentiality.
 • Widely applied in banking, accounting, and commercial environments where
it is essential that transactions are performed correctly and without fraud.
Main Objective
• Ensure that data in a system remains accurate, consistent, and trustworthy.
• Prevent unauthorized modification, fraudulent activity, or accidental
corruption of data.
Core Concepts
1. Constrained Data Items (CDIs)
• Sensitive data items that require strict integrity controls.
• Example: A bank account balance.
2. Unconstrained Data Items (UDIs)
• Data that is not directly protected by integrity controls but may become CDIs
after validation.
• Example: Customer input entered in an online form (not trusted yet).
3. Transformation Procedures (TPs)
• Trusted programs that can manipulate CDIs in a controlled manner.
• Example: Deposit/withdrawal transaction program in a bank.
• Only TPs can change CDIs; users cannot directly manipulate data.
4. Integrity Verification Procedures (IVPs)
• Programs that verify CDIs are in a valid state.
• Example: A program that checks whether the total credits = total debits in
accounting records.
Core Principles (Rules)
The Clark–Wilson model defines rules for integrity enforcement:
A) Certification Rules (C-Rules)
• Ensure the system is correctly set up.
• Examples:
o C1: IVPs must ensure that CDIs are in a valid state.
o C2: Each TP must ensure CDIs are transformed from one valid state to
another.
 o C3: Separation of duties: No single user should have authority to certify
their own work.
B) Enforcement Rules (E-Rules)
• Ensure the system enforces the rules at runtime.
• Examples:
o E1: System must maintain and enforce allowed relations between
subjects (users), TPs, and CDIs.
o E2: Users can only access CDIs through certified TPs.
Example in Banking
Imagine a bank transaction system:
1. CDIs: Customer’s account balances.
2. UDIs: Deposit request from a customer form.
3. TPs: Bank’s deposit/withdrawal programs.
o A withdrawal TP ensures the account has enough balance.
o A deposit TP ensures the amount is correctly added.
4. IVPs: Auditing program checks total credits = total debits.
5. Separation of Duties:
o One clerk enters a transaction request.
o Another clerk verifies/authorizes it.
This prevents fraud (e.g., one clerk cannot both create and approve their own fake
transaction).
Advantages
• Strong protection of integrity, especially for financial systems.
• Supports auditing and accountability.
• Enforces separation of duties to reduce insider fraud.
Limitations
• Focuses only on integrity, not confidentiality or availability.
• Requires careful design of TPs and IVPs.
• Can be expensive to implement in complex environments.
 Bell–LaPadula Model (BLP)

Introduction
• Proposed by David Bell and Leonard LaPadula in 1973.
• Developed for the U.S. Department of Defense (DoD).
• One of the earliest and most influential Mandatory Access Control (MAC)
models.
• Main focus: Confidentiality of data, i.e., keeping secrets secret.
Main Objective
• Prevent unauthorized disclosure of information.
• Protect classified data by restricting how information flows between security
levels.
Core Concepts
1. Subjects
• Active entities (e.g., users, processes) that request access to objects.
2. Objects
• Passive entities (e.g., files, databases) that contain information.
3. Security Levels (Lattice Structure)
• Data is classified into security levels such as:
o Top Secret (TS)
o Secret (S)
 o Confidential (C)
o Unclassified (U)
Each subject and object is assigned a clearance level.
Access Control Rules
The BLP model defines three rules:
1. Simple Security Property ("No Read Up")
• A subject cannot read data at a higher classification level.
• Prevents unauthorized access to sensitive information.
✔ Example:
• A user with Secret clearance cannot read Top Secret documents.

2. Star (*) Property ("No Write Down")

• A subject cannot write information to a lower classification level.
• Prevents leakage of confidential data.
✔ Example:
• A Top Secret officer cannot save a report into a Confidential file, since it may
expose sensitive data to lower-level users.

3. Discretionary Security Property

• Access rules can also be based on an Access Control Matrix (ACM) where
owners specify who has permissions.
• Works alongside MAC policies.

Example in Military
Let’s say we have three users:
• Alice → Top Secret clearance.
• Bob → Secret clearance.
• Carol → Confidential clearance.
And three files:
• File A → Top Secret.
 • File B → Secret.
• File C → Confidential.
According to BLP:
• Alice (Top Secret) can read A, B, C (she has higher clearance).
• Bob (Secret) cannot read File A (No Read Up), but can read B and C.
• Carol (Confidential) cannot read A or B, can read C.
• Alice cannot write Top Secret info into File C (No Write Down).

Advantages
• Strong protection of confidentiality.
• Prevents information leakage between levels.
• Suitable for government/military where secrecy is critical.

Limitations
• Focuses only on confidentiality, not integrity or availability.
• Too rigid for commercial/business use (where integrity is often more important).
• Doesn’t prevent internal misuse (e.g., if a Top Secret user intentionally leaks
data).

Non-Interference Model
Introduction
• Proposed by Joseph Goguen and José Meseguer in 1982.
• Unlike Bell–LaPadula (confidentiality) or Clark–Wilson (integrity), the Non-
Interference Model focuses on information flow security.
• Key idea: Activities of high-level users (sensitive operations) must not interfere
with what low-level users can observe.
In other words:
“A low-level user should not be able to infer anything about high-level operations from
system behavior.”
 Main Objective
• Prevent indirect leakage of information through covert channels (timing,
resource usage, system responses).
• Ensure complete isolation of high-level and low-level activities.

Core Concepts
1. High-Level Subjects (H)
• Users/processes with access to classified or sensitive data.
• Example: Military commander, admin process.
2. Low-Level Subjects (L)
• Users/processes with lower clearance.
• Example: Normal soldiers, ordinary users.
3. Non-Interference Principle
• Actions of H must not alter what L can observe.
• There should be no causal link between H’s activities and L’s view of the
system.

Rules of the Model

1. No Direct Flow:
o L cannot read H’s data directly.
2. No Indirect Flow (No Interference):
o L should not be able to deduce H’s activity through side effects such as:
▪ Response time differences.
▪ Error messages.
▪ System resource usage (CPU, memory).

Example Scenarios
1. Military Example
• H: Commander runs secret operations (launching missiles).
• L: Regular soldier using the same system.
 • If system performance slows when H runs a secret program, L might infer
something is happening.
• Non-Interference prevents this — L’s experience must remain unchanged.
2. Banking Example
• H: Bank manager checks VIP account balances.
• L: Normal clerk accessing the system.
• If clerk notices system response times change when manager queries VIP
accounts, they may infer sensitive activity.
• Non-Interference ensures clerk cannot observe such side effects.

Advantages
• Prevents covert channel attacks (timing, resource usage).
• Provides strong confidentiality guarantees.
• Useful in military, defense, critical systems.

Limitations
• Difficult to implement fully — modern systems often leak information
indirectly.
• Performance impact — making systems completely non-interfering requires
heavy isolation.
• Practicality issue — sometimes too strict for real-world commercial systems.

Role-Based Access Control (RBAC)

Introduction

• Introduced in the 1990s (formalized by NIST – National Institute of Standards

and Technology).

• Designed to simplify permission management by assigning rights based on

roles, not individuals.

• Follows the Principle of Least Privilege: Users only get the access they need to
perform their job.
 Main Objective

• Make access control manageable, scalable, and secure in organizations.

• Instead of granting permissions to each user individually, permissions are

grouped into roles, and users are assigned roles.

Core Concepts

1. Users

• Human beings or system accounts.

• Example: Alice, Bob, IT service account.

2. Roles

• Job functions or responsibilities within the organization.

• Example: Doctor, Nurse, System Admin, Accountant.

3. Permissions

• Approval to perform certain operations on resources.

• Example: Read patient records, Update employee salary, Access server logs.

4. Sessions

• Mapping between a user and activated roles during a login session.

• Example: A doctor logged in as “Researcher” may only see anonymized patient

data, but in “Doctor” role can see real patient records.

Rules of RBAC

1. Role Assignment

• A user can only perform operations if they have been assigned a role.

2. Role Authorization

• Users can activate only the roles they are authorized for.

3. Permission Authorization
 • Users can execute operations only if their role has the required permissions.

Types of RBAC

1. Flat RBAC

o Simple roles with permissions.

o Example: Teacher role → access student records; Student role → view

their grades.

2. Hierarchical RBAC

o Roles can inherit permissions from other roles (like organizational

hierarchy).

o Example:

▪ Manager role inherits Employee permissions + extra approval

rights.

3. Constrained RBAC

o Adds Separation of Duties (SoD).

o Example:

▪ A user cannot both request and approve a financial transaction.

Example in a Hospital

• Roles:

o Doctor → Read/write patient medical records.

o Nurse → Update patient vitals, view medication chart.

o Receptionist → View appointment schedule, register patients.

o Admin → Manage user accounts, not patient records.

✔ A Doctor role has access to medical records, but a Receptionist cannot.

✔ An Admin role manages the system, but cannot read patient data.
 Advantages

• Scalability: Easy to manage thousands of users.

• Least Privilege: Users only get necessary permissions.

• Security: Reduces insider misuse.

• Flexibility: Supports organizational hierarchies and separation of duties.

Limitations

• Defining roles and permissions can be complex in large organizations.

• If too many roles exist, it may cause role explosion (hard to manage).

• Doesn’t natively address contextual factors (e.g., location, time → handled by

ABAC instead).

Intruders in network security

In network security, "intruders" are unauthorized individuals or entities who want to obtain
access to a network or system to breach its security. Intruders can range from inexperienced
hackers to professional and organized cyber criminals.

Intruders are often referred to as hackers and are the most harmful factors contributing to
security vulnerability. They have immense knowledge and an in-depth understanding of
technology and security. Intruders breach the privacy of users and aim to steal the confidential
information of the users. The stolen information is then sold to third parties, aiming to misuse
it for personal or professional gains.

Types of Intruders
● Masquerader: The category of individuals that are not authorized to use the system
but still exploit users' privacy and confidential information by possessing
techniques that give them control over the system, such category of intruders is
referred to as Masquerader. Masqueraders are outsiders and hence they don't have
direct access to the system, they aim to attack unethically to steal data.
 ● Misfeasor: The category of individuals that are authorized to use the system, but
misuse the granted access and privilege. These are individuals that take undue
advantage of the permissions and access given to them, such category of intruders
is referred to as Misfeasor. Misfeasors are insiders and they have direct access to
the system, which they aim to attack unethically for stealing data/ information.
● Clandestine User: The category of individuals who have
supervision/administrative control over the system and misuse the authoritative
power given to them. The misconduct of power is often done by superlative
authorities for financial gains, such a category of intruders is referred to as
Clandestine Users. A Clandestine User can be any of the two, insiders or outsiders,
and accordingly, they can have direct/ indirect access to the system, which they aim
to attack unethically by stealing data/ information.

Intrusion Detection System (IDS)

Intrusion is when an attacker gets unauthorized access to a device, network, or system. Cyber
criminals use advanced techniques to sneak into organizations without being detected.

Intrusion Detection System (IDS) observes network traffic for malicious transactions and sends
immediate alerts when it is observed. It is software that checks a network or system for
malicious activities or policy violations. Each illegal activity or violation is often recorded
either centrally using an SIEM system or notified to an administration. IDS monitors a network
or system for malicious activity and protects a computer network from unauthorized access
from users, including perhaps insiders. The intrusion detector learning task is to build a
predictive model (i.e. a classifier) capable of distinguishing between ‘bad connections’
(intrusion/attacks) and ‘good (normal) connections’.

Common Methods of Intrusion

● Address Spoofing: Hiding the source of an attack by using fake or unsecured proxy
servers making it hard to identify the attacker.
● Fragmentation: Sending data in small pieces to slip past detection systems.
● Pattern Evasion: Changing attack methods to avoid detection by IDS systems that
look for specific patterns.
 ● Coordinated Attack: Using multiple attackers or ports to scan a network, confusing
the IDS and making it hard to see what is happening.

Working of Intrusion Detection System(IDS)

● An IDS (Intrusion Detection System) monitors the traffic on a computer network to
detect any suspicious activity.
● It analyzes the data flowing through the network to look for patterns and signs of
abnormal behavior.
● The IDS compares the network activity to a set of predefined rules and patterns to
identify any activity that might indicate an attack or intrusion.
● If the IDS detects something that matches one of these rules or patterns, it sends an
alert to the system administrator.
● The system administrator can then investigate the alert and take action to prevent
any damage or further intrusion.
Classification of Intrusion Detection System(IDS)
Intrusion Detection System are classified into 5 types:

● Network Intrusion Detection System (NIDS): Network intrusion detection

systems (NIDS) are set up at a planned point within the network to examine traffic
from all devices on the network. It performs an observation of passing traffic on the
entire subnet and matches the traffic that is passed on the subnets to the collection
of known attacks. Once an attack is identified or abnormal behavior is observed,
the alert can be sent to the administrator. An example of a NIDS is installing it on
the subnet where firewalls are located in order to see if someone is trying to crack
the firewall.
● Host Intrusion Detection System (HIDS): Host intrusion detection systems
(HIDS) run on independent hosts or devices on the network. A HIDS monitors the
incoming and outgoing packets from the device only and will alert the administrator
if suspicious or malicious activity is detected. It takes a snapshot of existing system
files and compares it with the previous snapshot. If the analytical system files were
edited or deleted, an alert is sent to the administrator to investigate. An example of
HIDS usage can be seen on mission-critical machines, which are not expected to
change their layout.
● Hybrid Intrusion Detection System: Hybrid intrusion detection system is made
by the combination of two or more approaches to the intrusion detection system. In
the hybrid intrusion detection system, the host agent or system data is combined
with network information to develop a complete view of the network system. The
hybrid intrusion detection system is more effective in comparison to the other
intrusion detection system. Prelude is an example of Hybrid IDS.
● Application Protocol-Based Intrusion Detection System (APIDS): An
application Protocol-based Intrusion Detection System (APIDS) is a system or
agent that generally resides within a group of servers. It identifies the intrusions by
monitoring and interpreting the communication on application-specific protocols.
For example, this would monitor the SQL protocol explicitly to the middleware as
it transacts with the database in the web server.
 ● Protocol-Based Intrusion Detection System (PIDS): It comprises a system or
agent that would consistently reside at the front end of a server, controlling and
interpreting the protocol between a user/device and the server. It is trying to secure
the web server by regularly monitoring the HTTPS protocol stream and accepting
the related HTTP protocol. As HTTPS is unencrypted and before instantly entering
its web presentation layer then this system would need to reside in this interface,
between to use the HTTPS.
● Signature-Based Detection: Signature-based detection checks network packets for
known patterns linked to specific threats. A signature-based IDS compares packets
to a database of attack signatures and raises an alert if a match is found. Regular
updates are needed to detect new threats, but unknown attacks without signatures
can bypass this system.

Intruders - Password Management

Passwords are the most common authentication mechanism. Weak password practices make
systems vulnerable to intruders.

Threats to Passwords:

• Password guessing (dictionary/brute force attacks)

• Phishing or social engineering

• Stolen password databases

• Keyloggers

Good Password Management Practices:

1. Strong Passwords

o At least 8–12 characters, with uppercase, lowercase, numbers, symbols.

o Avoid dictionary words & personal info.

2. Password Hashing & Storage

 o Store passwords in hashed form (e.g., bcrypt, SHA-256 with salt).

o Never store plain-text passwords.

3. Password Expiration & Rotation

o Change passwords periodically (but not too frequently to avoid weak choices).

4. Multi-Factor Authentication (MFA)

o Combine passwords with OTP, biometrics, or tokens.

5. Account Lockouts & Monitoring

o Lock accounts after multiple failed login attempts.

o Alert admins of unusual login activity.

6. Password Managers

o Securely store and generate strong passwords.

Firewall in Computer Network

A firewall is a network security device, either hardware or software-based, which monitors all
incoming and outgoing traffic and, based on a defined set of security rules, accepts, rejects, or
drops that specific traffic. It acts like a security guard that helps keep your digital world safe
from unwanted visitors and potential threats.

Need for a Firewall

A firewall is essential because networks are constantly exposed to both safe and harmful traffic
from the internet or other networks. Without a firewall, your systems would have no protection
against unwanted access, malicious activity, or accidental data leaks.

1. Preventing Unauthorized Access

Imagine your house door is always open. Anyone passing by could walk in and take your
things. A firewall is like a locked door with a guard, letting only trusted people in and keeping
strangers out.

2. Blocking Malicious Traffic

Think of your email inbox. Without a spam filter, you’d get flooded with scam and spam
messages. A firewall works like that spam filter it blocks harmful data before it reaches you.

3. Protecting Sensitive Information

It’s like keeping your bank PIN in a safe instead of leaving it on the table where anyone can
see it. A firewall ensures your personal and business data stays hidden from cyber criminals.

4. Preventing Cyber Attacks

If you leave your car unlocked in a parking lot, thieves can steal it. A firewall locks your
network so attackers can’t hijack it.

5. Controlling Network Usage

Just like parents set parental controls so kids can’t visit unsafe websites, firewalls control where
your computers are allowed to connect.

Working
A firewall works like a security guard for your network, standing between your internal
systems, such as computers, servers, and devices and the outside world, like the internet or
other networks. It carefully inspects all data entering or leaving to ensure only safe traffic is
allowed through.

• When data tries to enter or leave your network, it passes through the firewall first.

• The firewall examines the data packets (small chunks of information) using predefined
rules.

• Rules can be defined on the firewall based on the necessity and security policies of the
organization.

• Firewall allows decision making, such as: Allow → If the packet matches safe rules, or
Block → If the packet is suspicious, from a blacklisted source, or contains malicious
code.

• The firewall records blocked or unusual traffic for security teams to review.

• Alerts can be sent in real time if a major threat is detected.

Characteristics

1. Traffic Filtering: Examines packets entering or leaving the network. Decides whether
to allow or block traffic based on rules (IP, port, protocol, etc.).
2. Policy Enforcement: Enforces the organization’s security policy (e.g., “block social
media sites” or “allow only HTTPS traffic”).

3. Access Control: Controls which users, devices, or applications can access certain
resources.

4. Types of Inspection

• Packet Filtering: Filters based on IP, port, and protocol.

• Stateful Inspection: Tracks active connections and only allows valid traffic.
• Application Layer Filtering: Understands specific protocols (e.g., HTTP, FTP)
and blocks malicious activity.

5. Logging and Auditing: Records details of allowed and blocked traffic. Useful for
troubleshooting and forensic analysis.

6. Network Segmentation: Divides networks into zones (e.g., internal, external, DMZ).
Limits the spread of attacks between segments.

7. Intrusion Detection and Prevention (Optional): Some firewalls include IDS/IPS

features to detect and block suspicious activity.

8. NAT (Network Address Translation) Support: Hides internal private IP addresses

from external users. Provides an additional layer of security.

9. VPN Support: Many firewalls allow secure remote access using Virtual Private
Networks.

10. Scalability and Performance: Should handle high volumes of traffic without
becoming a bottleneck.

11. Default-Deny Rule: Most firewalls operate on a principle: “That which is not
explicitly allowed is denied.”

Types of Firewalls

1. Packet-Filtering Firewall

• Oldest and simplest type of firewall.

 • Works at the Network Layer (Layer 3) and Transport Layer (Layer 4) of the OSI
model.

• Inspects packets based on:

o Source IP

o Destination IP

o Source Port

o Destination Port

o Protocol (TCP/UDP/ICMP)

• Advantages: Fast, simple, low resource usage.

• Disadvantages: Limited security (does not inspect payload).

• Use Case: Small networks, basic traffic control.

2. Stateful Inspection Firewall

• More advanced than packet filtering.

• Keeps track of active connections (state table).

• Decides whether a packet is part of an existing session or a new one.

• Works at Network and Transport Layers.

• Advantages: More secure than simple packet filtering, protects against spoofing.

• Disadvantages: Higher resource consumption, can be slower.

• Use Case: Enterprise networks.

3. Proxy Firewall (Application-Level Gateway)

• Works at the Application Layer (Layer 7).

 • Acts as an intermediary (proxy) between users and resources.

• Inspects application-level data (HTTP, FTP, SMTP, etc.).

• Can cache web pages, filter content, and prevent direct connections.

• Advantages: Strong security, hides internal systems.

• Disadvantages: Slower, resource-heavy.

• Use Case: Web filtering, corporate networks.

4. Next-Generation Firewall (NGFW)

• Combines traditional firewall functions with advanced features, such as:

o Deep Packet Inspection (DPI)

o Intrusion Prevention System (IPS)

o Application Awareness & Control

o Malware filtering

• Works across multiple layers (3–7).

• Advantages: High security, detects modern threats.

• Disadvantages: Expensive, requires skilled administration.

• Use Case: Large enterprises, data centers, cloud security.

5. Circuit-Level Gateway

• Works at the Session Layer (Layer 5).

• Monitors TCP handshakes and session rules to ensure connections are valid.

• Does not inspect actual data, only session integrity.

 • Advantages: Faster than proxy firewalls.

• Disadvantages: Limited protection, cannot inspect payload.

• Use Case: Adds session security in combination with other firewalls.

6. Cloud Firewalls (Firewall-as-a-Service – FWaaS)

• Hosted in the cloud instead of on-premises hardware.

• Scales easily with cloud services.

• Provides centralized control across multiple sites.

• Advantages: Scalable, flexible, cost-effective.

• Disadvantages: Depends on internet connectivity.

• Use Case: Organizations with hybrid or cloud infrastructure.

7. Software Firewalls

• Installed on individual devices (endpoints).

• Examples: Windows Firewall, Linux iptables, host-based firewalls in antivirus

software.

• Advantages: Easy to deploy, protects individual devices.

• Disadvantages: Hard to manage in large networks.

• Use Case: Personal computers, small businesses.

8. Hardware Firewalls

• Dedicated physical devices placed between internal and external networks.

• Provide high performance and centralized protection.

• Advantages: Strong, reliable, not easily tampered with by malware.

 • Disadvantages: Costly, requires IT staff to manage.

• Use Case: Enterprise perimeters, data centers.

Firewall Basing, Location, and Configurations

Firewall Basing

Firewall basing refers to where the firewall software or hardware is implemented or installed.

Types of Firewall Basing:

1. Bastion Host

o A dedicated computer hardened against attacks, running the firewall

application.

o Often exposed to the internet, so it must be well protected.

o Example: Proxy firewall server.

2. Router-Based Firewalls

o Implemented in network routers.

o Provides packet filtering and sometimes basic stateful inspection.

o Advantage: Combines routing + security in one device.

3. Separate Network Appliance

o Dedicated firewall device (hardware firewall).

o More secure and powerful than software on a host.

4. Software-Based Firewalls (Host-Based)

o Installed directly on a computer/server (e.g., Windows Firewall, Linux

iptables).

o Protects that specific host.

 5. Cloud-Based Firewalls (FWaaS)

o Hosted by third-party providers.

o Used in cloud and hybrid networks for scalable security.

Firewall Location

Firewall location depends on the network architecture and what needs protection.

Common Locations:

1. Between Internal Network and Internet

o Most common location.

o Protects the private LAN from external threats.

2. At Network Perimeter

o Placed at the border of the enterprise network and outside world.

o First line of defense.

3. Between Internal Network Segments

o Used for internal segmentation (e.g., HR department vs Finance department).

o Limits lateral movement of attackers.

4. Demilitarized Zone (DMZ)

o A firewall separates internal network from servers that are accessible to external
users (web servers, mail servers).

o Often requires two firewalls:

▪ One between the internet and DMZ.

▪ One between DMZ and internal network.

 5. Cloud/Remote Access Gateways

o Firewalls placed at VPN endpoints or cloud access points to secure remote

connections.

Firewall Configurations

How firewalls are set up within a network to control traffic.

Types of Firewall Configurations:

A) Packet-Filtering Configuration

• Rules based on IP address, port, protocol.

• Simple, fast, but less secure.

B) Dual-Homed Host Configuration

• A firewall with two network interfaces:

o One connected to the internal network.

o One connected to the external network (internet).

• Traffic must pass through the host, enabling strict control.

C) Screened Host Configuration

• Uses a bastion host behind a packet-filtering router.

• Router filters most traffic, bastion host handles application-level filtering.

D) Screened Subnet (DMZ) Configuration

• Strongest setup.

• Uses two firewalls (or routers) to create a DMZ:

o One between the internet and DMZ.

 o One between DMZ and internal LAN.

• Public servers (web, mail, DNS) live in DMZ, while internal network stays protected.