COMPUTER NETWORK SECURITY Module 4

Module 4
Chapter 1 – Network Security
1. Network Organization
Definition: The DMZ is a portion of a network that separates a purely internal network from
an external network.

• When information moves from the Internet to the internal network, confidentiality is not
but integrity is an issue.

• When information moves from the internal network to the Internet, confidentiality and
integrity are both at issue.

• The firewalls must ensure that no confidential information goes to the Internet and that
the information that reaches the Internet is correct and information not be altered in transit
from the internal network to the Internet.

• Assumption are made that the systems as deployed will not change any information in
transit (except delivery information, such as packet headers).

• If such changes are made, then the system has been compromised by an attacker. This
would require the attacker to gain access to the system.

• The arrangement and configuration of the firewalls provide the supporting access control
mechanisms used to implement the policy.

Sushmitha Gowda K R, ECE, MITT 2025-26 1

COMPUTER NETWORK SECURITY Module 4

Definition: A firewall is a host that mediates access to a network, allowing and disallowing certain
types of access on the basis of a configured security policy.

EXAMPLE: A company wishes to prevent any implementations of Back Orifice from allowing
outsiders to control their systems. Back Orifice is an attack tool that acts as a remote system
administration server, usually illicitly. It requires commands to be sent to a particular port (the
exact port number is a configuration parameter; for our purposes, suppose it is 25345). The
company can install a firewall that will not allow any messages with destination port number 25345
to pass from the Internet into the corporate network. This prevents messages from accessing any
installed copies of Back Orifice. (Of course, if Back Orifice were configured to use port 22222,
this particular firewall would not block such messages.)

Definition: A filtering firewall performs access control on the basis of attributes of the packet
headers, such as destination addresses, source addresses, and options.

Routers and other infrastructure systems are typical examples of filtering fire walls.

Definition: A proxy is an intermediate agent or server that acts on behalf of an endpoint without
allowing a direct connection between the two endpoints.

Definition: A proxy (or applications level) firewall uses proxies to perform access control. A
proxy firewall can base access control on the contents of packets and messages, as well as on
attributes of the packet headers.

EXAMPLE: A company wishes to check all incoming electronic mail for computer viruses. It
implements a mail proxy at the firewall between the Internet and the company intranet. The proxy
has a virus scanning program . When mail arrives at the firewall, the proxy mail daemon accepts
the mail. It then runs the virus scanner. If the scanner reports that there are no viruses in the mail
or in any associated attachments, the proxy forwards the mail to the desired recipient. If the virus
scanner reports that the mail or an attachment contains a virus, the mail is discarded.
Analysis of the Network Infrastructure
• The given network design is based on a corporate security policy and the principle of least
privilege.
• The objective of this design is to protect internal corporate resources while allowing limited and
controlled access to certain services for the public (such as email and web services).
• The design separates public and internal entities and ensures that public users cannot directly
access any system within the internal corporate network. This is achieved by creating a secure
network structure using two firewalls and a Demilitarized Zone (DMZ).

Sushmitha Gowda K R, ECE, MITT 2025-26 2

 COMPUTER NETWORK SECURITY Module 4

The network is divided into three logical areas:

• External Network (Internet) –

This is the untrusted public network. All users from outside the organization access
corporate resources through this layer.
• Demilitarized Zone (DMZ) –
The DMZ acts as a buffer zone between the external Internet and the secure internal
network. It contains servers that must interact with the public such as:
• Web servers
• Mail servers
• DNS servers (Domain Name System)
• Internal Network –
This is the highly secure area of the organization that holds sensitive corporate information,
databases, and internal user systems.
The internal network is not directly accessible from the Internet.
• The Outer Firewall separates the Internet from the DMZ, and the Inner Firewall separates
the DMZ from the internal network.
This layered approach ensures that even if one component is compromised, the others still
maintain protection.
• The key decision in this design is to limit the flow of information between the internal
network and the DMZ.
• Public users cannot directly communicate with internal systems.
• Internal systems cannot directly communicate with the Internet.
• All traffic must pass through the DMZ and the firewalls, which act as security guards.
• This setup is derived from the concept of a “pump”, which ensures that data moves only in
authorized directions and that every piece of communication is filtered and controlled.
Thus, firewalls and DMZ servers together form a security pump, filtering and
monitoring all traffic both inward and outward.
• To prevent attackers from discovering internal network structures, the internal IP
addresses are hidden from the public Internet.
This is achieved by using private IP address ranges, such as:
➢ 10.x.x.x
➢ 172.16.x.x – 172.31.x.x
➢ 192.168.x.x
• The inner firewall can use Network Address Translation (NAT) to map internal IP
addresses to the firewall’s own public IP.

Sushmitha Gowda K R, ECE, MITT 2025-26 3

 COMPUTER NETWORK SECURITY Module 4

• Alternatively, proxy services can be implemented on the outer firewall. In this case, all
external communication is handled by proxy servers, and internal addresses never appear
outside the network.
• This technique of address hiding protects the organization from direct attacks on internal
systems.
• Email services require communication between the internal network and the outside world.
To ensure this is done securely:
• The DMZ Mail Server communicates with external mail servers on the Internet.
• The Internal Mail Server communicates only with the DMZ Mail Server, not with the
Internet directly.
• Both mail servers are configured to recognize distinguished addresses (logical or alias
addresses) instead of revealing actual IPs.
• To manage these addresses efficiently:
• A DNS Server (Domain Name System) is maintained both in the DMZ and in the internal
network.
• As a backup measure, each DMZ server stores local copies of firewall addresses to
continue functioning even if the DNS fails.
• This configuration ensures that email services work smoothly while maintaining strict
isolation between internal and external mail flows.

This network design follows several classical security design principles proposed by Saltzer and
Schroeder:

➢ Principle of Least Privilege

➢ Principle of Complete Mediation
➢ Principle of Separation of Privilege
➢ Principle of Least Common Mechanism
➢ Principle of Confinement
➢ Access Control and Information Flow Control

• Each DMZ system keeps backup firewall addresses to maintain communication during
DNS failure.
• Failure of one DMZ service (e.g., mail) does not affect others (e.g., web).
• Ensures high reliability and availability of services.

Sushmitha Gowda K R, ECE, MITT 2025-26 4

COMPUTER NETWORK SECURITY Module 4

Outer Firewall Configuration

• The outer firewall controls communication between the Internet and the corporate network by
restricting inbound and outbound access.
• It enforces controlled information flow based on the duality of information flow, similar to
the Bell–LaPadula model.
• The Bell–LaPadula principles of no read up and no write down are applied, with only sanitized
exchanges permitted.
• The firewall implements access control using Access Control Lists (ACLs) that bind source
and destination IP addresses and ports to permissions.
• Only essential public services are allowed: HTTP, HTTPS for the Web server and SMTP for
the Mail server; all other services are blocked.
• The firewall functions as a proxy-based firewall, acting as an intermediary between external
users and internal DMZ servers.
• The SMTP proxy scans incoming emails for viruses and malicious content before forwarding
them to the DMZ mail server.
• The Web proxy inspects HTTP/HTTPS requests for malformed inputs and attack patterns
before forwarding them to the DMZ web server.
• The DMZ web and mail servers have separate internal IP addresses, which are hidden from
external Internet users.
• Security is strengthened using defense in depth and economy of mechanism, so even if the
firewall is bypassed, lack of internal address knowledge limits successful attacks.

Inner Firewall Configuration

• The internal network contains the organization’s most sensitive data, including proprietary
information that must not be exposed to external entities.
• To protect this data, the inner firewall blocks all traffic by default and permits only explicitly
authorized traffic, in accordance with the principle of fail-safe defaults.
• All traffic entering the internal network must originate from the DMZ and never directly from
the Internet, ensuring an additional layer of isolation.
• The Network File System (NFS), which transmits file contents across the network, poses a
risk if packets containing sensitive data leak outside the organization.
• While the outer firewall prevents NFS packets from leaking to the Internet, the principle of
least privilege requires that NFS packets should not reach the DMZ unless explicitly needed.

Sushmitha Gowda K R, ECE, MITT 2025-26 5

COMPUTER NETWORK SECURITY Module 4

• The principle of separation of privilege is applied by ensuring that multiple mechanisms,

including the inner firewall, independently block NFS traffic from reaching the DMZ.
• Similar to the outer firewall, the inner firewall allows only a limited set of traffic using access
control mechanisms and permits SMTP connections through proxies, with all mail directed to
the DMZ mail server.
• The inner firewall allows limited information transfer to the DNS server in the DMZ and
permits system administrators to access DMZ systems from a trusted administrative server.
• Administrative access uses the Secure Shell (SSH) protocol with direct connections restricted
to DMZ servers, providing confidentiality, integrity, and strong cryptographic authentication.
• Although administrative access violates the principle of least privilege, safeguards such as
restricting access to a trusted administrative server, limiting SSH destinations, and requiring
cryptographic keys significantly reduce the risk of compromise.

In the DMZ
Four servers reside in the DMZ,
1. Mail server
2. WWW server
3. DNS server
4. Log server

1. DMZ Mail Server

The mail server in the DMZ performs address and content checking on all electronic mail
messages. The goal is to hide internal information from the outside while being transparent
to the inside. When the mail server receives a letter from the Internet, it performs the
following steps.
1. The mail proxy reassembles the message into a set of headers, a letter, and any
attachments. The attachments are assembled into their native form. This allows the
mail server to work on the original mail, as opposed to a packetized form of the letter.
It simplifies the checking.
2. The mail proxy scans message headers, body, and attachments for viruses and known
malicious logic, restores and validates attachments, enforces SMTP compliance by
removing binary data and excessively long lines (splitting address lines to under 80
characters), and forwards only sanitized mail to the DMZ mail server.
3. The mail proxy sanitizes all header lines by rewriting internal host references to
the external firewall name “[Link],” removing all “Received” lines, and
modifying destination addresses that reveal internal details, thereby hiding the

Sushmitha Gowda K R, ECE, MITT 2025-26 6

COMPUTER NETWORK SECURITY Module 4

internal network structure before forwarding mail to the Internet in accordance

with the principle of least privilege.
The primary role of the DMZ mail server is to handle electronic mail and perform
comprehensive checking and sanitization, allowing the firewalls to carry out only basic
validation, and it additionally runs an SSH server configured to accept connections
exclusively from the trusted administrative host in the internal network.

2. DMZ WWW Server

• The Web server accepts and services requests from the Internet and does not communicate
with any systems in the internal network.
• This isolation ensures that even if the Web server is compromised, internal hosts remain
unaffected.
• The Web server runs CGI scripts, which are carefully checked and hardened to prevent
successful attacks.
• The server stores no confidential or sensitive information locally.
• The Web server identifies itself as “[Link]” and uses the IP address of the outer
firewall, hiding the actual DMZ configuration.
• Hiding the real server address enforces the principle of least privilege, as external users
do not need to know internal addressing details.
• Updates to the DMZ Web server are performed using an internal system called the
WWW-clone, which is accessible only to authorized users.
• Administrators periodically copy verified content from the WWW-clone to the DMZ Web
server, applying the principle of separation of privilege.
• Customer order data collected through the Web is encrypted using the public key of an
internal system and stored in a spooling area inaccessible to the Web server.
• Maintenance and data transfer are performed only through SSH connections from a
trusted internal administrative server, ensuring confidentiality, integrity, and
adherence to the fail-safe defaults principle.

3. DMZ WWW Server

The DMZ DNS host contains directory name service information about those hosts that the
DMZ servers must know. It contains entries for the following.
• DMZ mail, Web, and log hosts
• Internal trusted administrative host
• Outer firewall
Sushmitha Gowda K R, ECE, MITT 2025-26 7
 COMPUTER NETWORK SECURITY Module 4

• Inner firewall
• DNS server does not know the addresses of the internal mail server. The inner firewall will
forward mail to that server. The DMZ mail server need only know the addresses of the two
firewalls (for mail transfers), and the trusted administrative server.
• If the mail server knows the address of the DNS server, it can obtain these three addresses.
This gives the internal network the flexibility to rearrange its host addressing. The DMZ DNS
server must be updated only if the address of the internal trusted administrative host is
changed.
• The limited information in the DNS server reflects the principle of least privilege, because
those entries are sufficient for the systems in the DMZ.

4. DMZ Log Server

• The log server performs an administrative function by collecting and storing logs from all
DMZ machines.
• Logging is enabled on all DMZ servers so that, in the event of a compromise or attempted
attack, logs can be used to analyze the attack method, assess damage, and determine an
appropriate response.
• Since attackers may delete or modify logs on compromised systems, storing logs only on the
attacked machines is insecure.
• To address this risk, a dedicated log server is deployed as a separate system within the DMZ.
• All DMZ servers write log entries first to local files and then forward them to the log server.
• The log server records logs to local files and additionally writes them to write-once media,
preventing modification after writing.
• Writing logs to write-once media protects against log tampering even if both the target server
and the log server are compromised.
• This design applies the principle of separation of privilege by using multiple independent
mechanisms to protect log integrity.
• The log server is placed in the DMZ and never initiates connections to the internal network;
only the trusted administrative host can access the logs.
• Administrators can view logs through secure connections or by physically removing the write-
once media, applying the principles of least privilege and fail-safe defaults, since logs
cannot be altered and can be destroyed only with physical access.

Sushmitha Gowda K R, ECE, MITT 2025-26 8

COMPUTER NETWORK SECURITY Module 4

In the Internal Network

• The internal network may be divided into multiple subnets, each protected by its own firewall
and possibly its own servers, enforcing controls similar to the inner firewall.
• If the sole objective were to protect internal data from external attackers, the internal subnet
structure would be irrelevant; however, Drib’s policy requires protection against
unauthorized internal access as well.
• In this policy, read corresponds to fetching or retrieving information, and write corresponds
to depositing or storing information within the network.
• Information flow constraints determine the network layout, with firewalls enforcing
confinement at subnet boundaries.
• The developer subnet firewall allows read access from the corporate subnet but blocks write
access from all other subnets.
• The corporate subnet firewall disallows both read and write access from all other internal
subnets.
• The customer subnet firewall allows read access from the corporate subnet and restricted
write access mediated only through the DMZ Web server and the inner firewall, preventing
unrestricted public access.
• Firewalls protecting internal subnets may be implemented as proxy firewalls or packet-
filtering firewalls, depending on policy requirements.
• Internal mail delivery may be implemented using either separate subnet mail servers or a
centralized internal mail server; both approaches satisfy policy but differ in DNS complexity
and flexibility.
• An internal Web server acts as a staging and testing area for Web pages, allowing review and
approval before synchronization with the DMZ Web server via the trusted administrative host.
• The trusted internal administrative server enforces strict access control, allowing only
authorized administrators to access DMZ systems using SSH, and blocking all other internal
SSH access to DMZ servers.
• DMZ servers are configured to recognize only the inner firewall and the trusted administrative
server, following the principle of least privilege, and never communicate directly with
internal servers.
• All administrative access to the DMZ requires passing multiple security checks, implementing
the principle of separation of mechanism and limiting administrative authority to a small
group.

Sushmitha Gowda K R, ECE, MITT 2025-26 9

COMPUTER NETWORK SECURITY Module 4

• The only data written from the DMZ to the internal network consists of customer orders,
which are validated, encrypted, and transferred in a non-executable form.
• These measures collectively reduce the attacker’s ability to exploit internal systems and apply
principles of least privilege, separation of privilege, confinement, and fail-safe defaults.

2. AVALABILITY AND NETWORK FLOOODING :

Flooding attack : Attacker sends large no of packets or requests to target which consumes
more network bandwidth, CPU, memory resources that making it unable to handle the network
traffic.

• The SYN flood is the most common type of flooding attack.

• It occurs when incoming connections repeatedly refuse to execute the third part of
the TCP three-way handshake. This is a denial-of-service attack.
• If the packets come from multiple sources but have the same destination, this is an
example of a distributed denial of service attack.
• The source address of these SYN packets is typically set to some unreachable host.
This prevents the third part of the handshake from being executed, and prevents the
attacked systems from determining the attacker by reading the source address from
the SYN packet.
• Legitimate handshake - refers to a connection attempt that is not part of a SYN
flood (If the client in a legitimate handshake receives the SYN/ACK packet from
the server, it will respond with the appropriate ACK to complete the handshake and
begin the connection.)
• Attack handshake - refers to a connection attempt that is part of a SYN flood. (The
client in an attack handshake will never send an ACK packet to complete the
handshake)
• Server cannot distinguish between a legitimate handshake and an attack handshake.
• There are two aspects of SYN flooding.
1. Consumption of bandwidth: If the flooding is more than the capacity of the
physical network medium, or of intermediate nodes, legitimate handshakes
may be unable to reach the target.
2. Use of resources: If the flooding absorbs all the memory allocated for half-
open connections, then the target will discard the SYN packets from legitimate
handshake attempts.

Sushmitha Gowda K R, ECE, MITT 2025-26 10

COMPUTER NETWORK SECURITY Module 4

Intermediate Hosts
• This approach reduce the consumption of resources on the target by using routers
to divert or eliminate illegitimate traffic.
• SYN flood is handled before it reaches the firewall, at the infrastructure level -
The goal is to have only legitimate handshakes reach the firewall.

1. Cisco ROUTERS - TCP intercept mode

• When the router sees a SYN packet coming from the Internet, it does not forward the packet
to its destination.
• Instead, the router responds, and tries to establish the connection.
• If the SYN packet is part of a legitimate handshake and a connection is established, the router
establishes a connection with the intended destination and “merges” the two connections.
• If the SYN packet is part of an attack handshake, the router never sees a following ACK
packet, and times the pending connection out without ever contacting the putative destination.
• The router uses short time-outs to ensure it does not run out of space for pending connections.
The TCP intercept feature may be set either on a per-host basis or for all hosts on the Internet.

2. Synkill - A system monitor the network traffic and track the state of the
three-way handshake.
• It classifies IP addresses as never seen (null), not flooding (good), flooding (bad), or
unknown (new).
• Initially, a set of IP addresses may be put into these classes. As synkill monitors the
network, it adds addresses to each class.
• When synkill sees an SYN packet, it checks the IP address. If that address is bad, synkill
immediately sends an RST to the destination. This terminates the pending connection.
• If the IP address is good, synkill ignores the packet.
• If the IP address has not yet been seen, it is classified as new. A subsequent ACK or
RST packet from the new address will cause the address to be added to the list of good
addresses, because its behavior is correct, but if no such packet is seen for a specified
expiry period of time, the new address is assumed to be attempting a SYN flood and is
moved into the bad set of IP addresses, and an RST is sent to the destination.
• If no traffic from a good address is observed during a different time interval, called the
staleness time, the address is deleted from the list of good addresses.

Sushmitha Gowda K R, ECE, MITT 2025-26 11

COMPUTER NETWORK SECURITY Module 4

TCP State and Memory Allocations

• This approach springs from the way in which most TCP servers are implemented.
• When a SYN packet is received, the server creates an entry in a data structure of pending
connections and then sends the SYN/ACK packet. The entry remains until either a
corresponding ACK is received or a time-out occurs.
• The data structure contains the state of the pending connection. This information typically
includes the source IP address, a sequence number, and other (internal) information.
• When the client replies with an ACK packet to complete the handshake, the server uses
this information to verify that the ACK packet corresponds to the initial SYN packet.
• The SYN flood succeeds because the space allocated to hold this state information is filled
before any three-way handshakes are completed. Legitimate handshakes cannot obtain
space in the data structure.

Two techniques are used to make availability of space more likely :

1. Push the tracking of state to the client

The state can be encoded in the initial sequence number of the ACK, the server can
rederive the information from information in the client’s ACK packet. Then no state
needs to be kept on the server system. This approach is called the SYN cookie
approach.

EXAMPLE: The Linux kernel can be configured to use the SYN cookie approach when
the table of pending connections is full. Linux uses the SYN cookie formula developed
by Bernstein and Schenk :

where h is a hash function (either MD-5 or SHA-1), s1 and s2 are randomly generated
secrets, sA and sP are the source address and port, dA and dP are the destination address
and port, t is a counter incremented every minute, and n is the sequence number of the
received SYN packet. When the ACK is received, the SYN cookie is checked by
recomputing each part of the SYN cookie anew and subtracting that value from the
received SYN cookie.

Sushmitha Gowda K R, ECE, MITT 2025-26 12

COMPUTER NETWORK SECURITY Module 4

• When the ACK is received, the SYN cookie is checked by recomputing each part of the
SYN cookie anew and subtracting that value from the received SYN cookie.
• The SYN cookie formula minimizes the threat of an attacker guessing a SYN cookie value
and sending an ACK to which there has been no corresponding SYN or SYN/ACK.
2. Adaptive time-out
• Attacker assumes that there is a fixed amount of space for the state of pending connections.
• A SYN flood causes attack handshakes to fill this space.
• After some constant amount of time (usually 75 seconds), the server deletes the state
information associated with the attack handshake.
• This is called the “time out” of the pending connection.
• This approach simply varies the times before the time-outs depending on the amount of
space available for new pending connections.
• As the amount of available space decreases, so does the amount of time before the system
begins to time out connections.
Example : Freedman modified the kernel of a SunOS system to provide adaptive time-outs
of pending connections.
• First, he shortened the time-out period for pending connections from 75 to 15 seconds. He
then modified the formula for queuing pending connections.
if a + p > cb the current SYN message is dropped.
➢ a be the number of completed connections
➢ b pending connections on a given port
➢ c be a tunable parameter
➢ p be the number of pending connections

Sushmitha Gowda K R, ECE, MITT 2025-26 13