Chapter Three
Network Firewall Security
Contents:
Firewall Definitions
IP Sec Architecture
IPv6 Security Considerations
Host Security
Firewall
A firewall is hardware, software, or a combination of both that is used to
prevent unauthorized programs or Internet users from accessing a private
network.
Acts as a security gateway between two networks.
Tracks and controls network communications.
Decides whether to pass, reject, encrypt, or log communications (Access
Control)
Working architecture
A firewallis often installed away from the rest of the network so that no
incoming requests get directly to the private network resource.
Ifit is configured properly, systems on one side of the firewall are
protected from systems on the other side. Firewalls generally filter traffic
based on two methodologies:
A firewall can allow any traffic except what is specified as restricted. It
relies on the type of firewall used, the source, the destination addresses
and the ports.
A firewallcan deny any traffic that does not meet the specific criteria
based on the network layer on which the firewall operates
Firewall
Firewall
A firewall is a network security device that monitors
incoming and outgoing network traffic and decides whether
to allow or block specific traffic based on a defined set of
security rules
Types of Firewalls:
Firewalls are generally of two types: Host-based and Network-based.
Host- based Firewalls:
Host-based firewall is installed on each network node which controls each incoming and
outgoing packet. It is a software application or suite of applications, comes as a part of
the operating system.
Host-based firewalls are needed because network firewalls cannot provide protection
inside a trusted network. Host firewall protects each host from attacks and unauthorized
access.
Types of Firewalls:
Network-based Firewalls:
Network firewall function on network level. In other words, these firewalls filter all
incoming and outgoing traffic across the network.
It protects the internal network by filtering the traffic using rules defined on the firewall. A
Network firewall might have two or more network interface cards (NICs).
A network-based firewall is usually a dedicated system with proprietary software installed.
Advantages of using Firewall
Protection from unauthorized access
Prevention of malware and other threats
Control of network access
Monitoring of network activity
Regulation compliance
Network segmentation
Disadvantages of using Firewall
Complexity
Limited Visibility
False sense of security
Limited adaptability
Performance impact
Limited scalability
Limited VPN support
Cost:
IPSec Architecture
IPSec (IP Security) architecture uses two protocols to secure the traffic or data flow.
These protocols are
ESP (Encapsulation Security Payload) and
AH (Authentication Header).
IPSec Architecture includes protocols, algorithms, DOI, and Key Management.
All these components are very important in order to provide the three main services:
Confidentiality
Authentication
Integrity
IP Security Architecture:
Cont.……..
Architecture: Architecture or IP Security Architecture covers the general concepts,
definitions, protocols, algorithms, and security requirements of IP Security technology.
ESP Protocol: ESP (Encapsulation Security Payload) provides a confidentiality service.
Encryption algorithm: The encryption algorithm is the document that describes
various encryption algorithms used for Encapsulation Security Payload.
AH Protocol: AH (Authentication Header) Protocol provides both Authentication and
Integrity service. Authentication Header is implemented in one way only:
Authentication along with Integrity.
Cont.……
Authentication Algorithm: The authentication Algorithm contains the set of
documents that describe the authentication algorithm used for AH and for the
authentication option of ESP.
6. DOI (Domain of Interpretation): DOI is the identifier that supports both AH and
ESP protocols. It contains values needed for documentation related to each other.
7. Key Management: Key Management contains the document that describes how
the keys are exchanged between sender and receiver.
3.3. IPv6 Security Considerations:
IPv6 security concerns and recommendations To get a good start in implementing
IPv6 networks and their potential security concerns, NSA recommends the following:
Auto-configuration
Stateless address auto-configuration (SLAAC) is an automatic method to self-assign
an IPv6 address to a host.
NSA recommends assigning addresses to hosts via a Dynamic Host Configuration
Protocol version 6 (DHCPv6) server to mitigate the SLAAC privacy issue.
Cont.….
IPv6 education
A successfully secured IPv6 network requires, at a minimum, a fundamental knowledge of the
differences between the IPv4 and IPv6 protocols and how they operate. The lack of this knowledge could
lead to IPv6 misconfigurations.
Misconfigured IPv6-enabled devices (resulting from an error in the configuration) could introduce
vulnerabilities, making the devices more prone to compromise.
Learning the IPv6 protocol and knowing how to configure IPv6 effectively are the most critical things to
protect and enhance IPv6 security on a network.
NSA recommends ensuring all network administrators have received the proper training and education to
Host security
Host security is a term that includes a range of security tools that individuals and organizations
implement and deploy at the host level of their computers.
Organizations and individuals install host security tools on a single computer or server in order
to protect the computer’s or server’s host.
Host security works by employing a centralized-management function and an agent that work
together to provide automated protection.
It detects, responds to, and reports host-based attacks, vulnerabilities, potential risks, and other
similar incidents.
Authentication vs. Authorization: Differences, Methods, and
Techniques
Authentication and authorization are two critical concepts in access control,
used in identity and access management (IAM).
They are essential components of any system or web application, which
determine the security of a system.
You cannot have a secure solution unless you have configured both
authentication and authorization correctly.
Authentication
Authentication is verifying the true identity of a user or entity, while
authorization determines what a user can access and ensures that a user or entity
receives the right access or permissions in a system. Authentication is a prerequisite to
authorization.
Authentication is the process of verifying that a user is who they claim to be. For
example, when you go through security at an airport, you show your ID to authenticate
your identity.
Authorization The End
Authorization is the process of determining if a user is allowed to perform certain
actions or access certain resources or data. For example, an airline needs to
determine which people can come on board.
Authentication and authorization work together to control access to protected
resources. They play separate but equally essential roles in securing applications
and data.
The End