Department of Computer Science and Engineering
Punjabi University
Patiala
ADVANCED NETWORK SECURITY
(CSEM1104T)
Masters in Computer Science and Engineering
(Semester-1)
Section-B (Part-4)
Copyright © 2024 Dr. Gurjit Singh Bhathal
ADVANCED NETWORK SECURITY SYLLABUS
(CSEM1104T)
Firewalls:
Firewall Design principles, Characteristics, Types of Firewall, trusted systems, Virtual Private
Networks, DMZ, and Intrusion Detection Systems: Vulnerability Assessment, Misuse
Detection, Anomaly Detection, Network-Based IDS, Host-based IDS and Honeypots.
Copyright © 2024 Dr. Gurjit Singh Bhathal
What is Firewall?
A firewall is a security device, either hardware or software, that monitors and controls incoming
and outgoing network traffic based on predefined security rules. It acts as a barrier between a
trusted internal network and untrusted external networks, such as the internet, to prevent
unauthorized access while allowing legitimate communication. By filtering traffic and enforcing
security policies, firewalls play a critical role in protecting sensitive data and maintaining the
integrity of network systems.
Key Points:
• Traffic Filtering: Controls access based on security rules.
• Network Segmentation: Separates internal and external networks.
• Access Control: Blocks unauthorized access, allows legitimate traffic.
• Policy Enforcement: Ensures compliance with security policies.
• Threat Mitigation: Protects against various types of cyber threats
Copyright © 2024 Dr. Gurjit Singh Bhathal
Firewall Design Principles
Firewall design principles are centered on creating a robust security barrier that
controls the flow of traffic between trusted and untrusted networks. The primary
goal is to prevent unauthorized access while allowing legitimate
communications. Effective firewall design adheres to the principles of the
default-deny policy, least privilege, and defense in depth, ensuring
comprehensive protection against potential threats.
Key Points:
• Default-Deny Policy: Block all traffic unless explicitly permitted.
• Least Privilege: Grant minimal access necessary for functions.
• Defense in Depth: Implement multiple layers of security measures.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Firewall Characteristics
Firewalls are defined by their ability to enforce security policies through various
mechanisms, such as packet filtering, stateful inspection, and proxy services.
These characteristics determine how a firewall monitors and controls traffic to
protect network resources from unauthorized access and attacks.
Key Points:
• Packet Filtering: Filters packets based on headers (e.g., IP addresses, port numbers).
• Stateful Inspection: Tracks the state of active connections and makes decisions based on
connection state.
• Proxy Services: Acts as an intermediary, processing requests on behalf of the client,
hiding internal network details.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Types of Firewalls
Firewalls come in various types, each providing different levels of security based
on the needs of the network. From basic packet-filtering firewalls to advanced
next-generation firewalls, choosing the right type depends on the complexity of
the security requirements and the specific threats faced by the network.
Key Points:
• Packet-Filtering Firewall: Inspects and filters individual packets at the network layer.
• Stateful Inspection Firewall: Considers the state of connections, offering more security
than simple packet filtering.
• Application-Level Gateway (Proxy Firewall): Filters traffic at the application layer,
providing deep inspection.
• Next-Generation Firewall (NGFW): Integrates traditional firewall capabilities with
advanced features like intrusion prevention, deep packet inspection, and application
awareness.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Packet Filter
• Work at the network level of the OSI model
• Each packet is compared to a set of criteria before it is forwarded
• Packet filtering firewalls is low cost and low impact on network
performance
Packet Filtering
Circuit level
• Circuit level gateways work at the session layer of the OSI model, or
the TCP layer of TCP/IP
• Monitor TCP handshaking between packets to determine whether a
requested session is legitimate.
Application Level
• Application level gateways, also called proxies, are similar to circuit-
level gateways except that they are application specific
• Gateway that is configured to be a web proxy will not allow any ftp,
gopher, telnet or other traffic through
Application Level
Stateful Multilayer
• Stateful multilayer inspection firewalls combine the aspects of the other three
types of firewalls
• They filter packets at the network layer, determine whether session packets are
legitimate and evaluate contents of packets at the application layer
General Performance
Virtual Private Networks (VPN)
A Virtual Private Network (VPN) is a secure tunnel between two or more
devices that allows data to be transmitted over the internet as if it were on
a private network. VPNs provide privacy, security, and access to restricted
content by encrypting internet traffic and masking the user’s IP address.
Key Features:
• Encryption: Encrypts data to prevent unauthorized access.
• Privacy: Hides the user’s IP address, enhancing anonymity.
• Remote Access: Allows secure access to corporate networks for remote employees.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Virtual Private Networks (VPN)
The diagram depicts a Virtual Private Network (VPN) where a user connects to a VPN provider through
an encrypted tunnel over the internet.
Copyright © 2024 Dr. Gurjit Singh Bhathal
VPN Working
A VPN works by encrypting the data transmitted from a user's device and securely routing
it through a virtual tunnel to a VPN server. This server decrypts the data and forwards it
to the intended destination, while masking the user's real IP address with the server's IP.
The process ensures both privacy and security, preventing external parties from
intercepting the data or identifying the user's location. VPN technology is commonly used
for secure remote access and bypassing geographic restrictions.
Key Points:
• Encryption: Data is encrypted before leaving the device.
• Tunneling: Data is routed through a secure virtual tunnel to the VPN server.
• Decryption: The server decrypts the data before sending it to its destination.
• IP Masking: The user’s IP address is replaced by the VPN server’s IP for privacy.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Demilitarized Zone (DMZ)
A DMZ (Demilitarized Zone) is a physical or logical subnetwork that separates an
organization's internal local area network (LAN) from untrusted external networks, such as
the internet. It serves as a buffer zone to enhance security by hosting public-facing
services in the DMZ, while keeping the internal network isolated.
Key Features:
• Isolation: Separates public services (e.g., web servers, email servers) from the
internal network.
• Enhanced Security: Limits access to the internal network by placing services in the
DMZ.
• Controlled Access: Allows external users to access specific resources without
exposing the internal network.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Demilitarized Zone (DMZ)
The diagram depicts DMZ, local network and untrusted external network zones
Copyright © 2024 Dr. Gurjit Singh Bhathal
Demilitarized Zone (DMZ)
A DMZ creates an additional layer of security between an organization's internal network and the
external internet. Public-facing servers (such as web, email, and DNS servers) are placed in the
DMZ, allowing external users to access them without exposing sensitive internal resources.
Firewalls manage traffic between the DMZ and the internal network, ensuring that only
authorized traffic can pass. This setup helps prevent attacks from spreading from compromised
public servers to the internal network, isolating threats in the DMZ.
Key Points:
• Segmentation: Public-facing services are hosted in the DMZ, isolated from the internal
network.
• Firewalls: Firewalls control traffic between the internet, DMZ, and internal network.
• Protection: The internal network remains secure even if a DMZ server is compromised.
• Limited Access: Strict rules govern communication between the DMZ and internal systems.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Introduction to Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) are tools and technologies designed to detect and
prevent unauthorized access and misuse of computer systems and networks. They provide
real-time monitoring and analysis of network traffic and system activities to identify
potential security threats.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Network-Based IDS
Network-Based IDS monitors network traffic for signs of intrusions. Positioned at strategic
points within the network, it analyzes passing traffic on networks and looks for suspicious
activities.
Key Points:
• Monitors all network traffic.
• Can detect intrusions in real-time.
• Does not affect system performance.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Host-Based IDS
Host-Based IDS is installed on individual computers or servers to monitor inbound and
outbound traffic from the device as well as system interactions. It provides detailed
information about specific host activities.
Key Points:
• Monitors individual host or device.
• Detects internal threats.
• Can impact host performance.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Misuse Detection
Misuse Detection is an IDS technique that relies on specific signatures of known threats to
identify malicious activity. It matches patterns in data traffic against a database of
signature definitions to detect intrusions.
Key Points:
• Highly effective against known attacks.
• Dependent on regularly updated signature databases.
• Limited in detecting zero-day exploits.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Anomaly Detection
Anomaly Detection identifies unusual patterns or deviations from normal operations,
which might indicate a security threat. This method relies on behavioral baselines to flag
potential threats.
Key Points:
• Detects previously unknown attacks.
• Uses statistical models and machine learning.
• May result in higher false positive rates.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Honeypots
Honeypots are security mechanisms designed to lure attackers by mimicking vulnerable
systems. They appear as legitimate parts of a network but are isolated and monitored.
When attacked, honeypots capture valuable information about attacker methods, tools,
and behaviors, helping to enhance security measures without risking actual network
resources.
Key Points:
• Attracts attackers to monitor their activities.
• Helps in understanding attack techniques.
• No real data is at risk in honeypots.
Copyright © 2024 Dr. Gurjit Singh Bhathal
Honeypots
Honeypots are security resources whose value lies in being probed, attacked, or
compromised. They act as decoys to attract attackers away from legitimate
targets.
Copyright © 2024 Dr. Gurjit Singh Bhathal
TCP/IP vs OSI
Copyright © 2024 Dr. Gurjit Singh Bhathal
TCP/IP Layers Function
Copyright © 2024 Dr. Gurjit Singh Bhathal
Thank You !
Copyright © 2024 Dr. Gurjit Singh Bhathal