Guidelines in Firewalls and Firewall Policies: Recommendation of The National Institute of Standards and Technology Released On 2009

3.
1 Introduction:
Connecting two or more networks together has had numerous of threats for
both of the networks especially if one of these networks is the Internet.
As it an open network that anyone can access and place his files on it
(Software, photos, documents… etc); the Internet form a big buggy for the
organization networks (mean LANs) unless these networks are well protected
against malicious attacks.
3.2 The main six threats that the internet can causes is:
1- Weak or no authentication required.
2- Sniffer programs.
3- Cracker Programs.
4- Port scanner Programs.
5- Insecure software.
Because of all these threats and the vulnerabilities that may be made by the
internet attackers there is the need to somehow of protection mechanism to
stand at the line of defiance against this threats.
Firewalls are the appropriate front defiance line. It is devices or programs

that control the flow of network traffic between networks or hosts that employ
differing security postures.⁽1⁾
1
⁽⁾ Guidelines in Firewalls and firewall policies : recommendation of the national institute of standards and
technology ; released on 2009
3.3 The Advantages of the firewalls:
1- They can stop incoming requests to inherently insecure services.
2- They can control access to other services.
3- They are more cost effective than securing each host on the corporate
network since there is often only one or a few firewall systems to
concentrate on.
4- They are more secure than securing each host.
As like any security system the firewalls are not totally secure, so
unfortunately it is had own disadvantages.
3.4 The disadvantages of the firewall:

1. They are a central point for attack, and if an intruder breaks through the
Firewall they may have unlimited access to the corporate network.
2. They may restrict legitimate users from accessing valuable services.
3. They do not protect against back door attacks.
3.5 Firewalls Technologies:

Normally, firewalls combined with other technology in order to perform well,
most notably routing and e.g. NAT (Network Address Translation) is sometimes
thought as a firewall technology.
Firewalls are often placed at the perimeter of a network. Such a firewall can be
said to have an external and internal interface, with the external interface being
the one on the outside of the network. These two interfaces are sometimes
referred to as unprotected and protected, respectively. However, saying that
something is or is not protected is often inappropriate because a firewall’s
policies can work in both directions.
3.5.1 Packet Filtering:

The most basic feature of a firewall is the packet filter. In their most basic form,
firewalls with packet filters operate at the network layer. This provides network
access control based on several pieces of information contained in a packet,
including:
 The packet’s source IP address—the address of the host from which the
packet originated.
 The packet’s destination address—the address of the host the packet is
trying to reach.
 The network or transport protocol being used to communicate between
source and destination hosts, such as TCP, UDP, or ICMP
 Possibly some characteristics of the transport layer communications
sessions, such as session source and destination ports (e.g., TCP 80 for the
destination port belonging to a web server, TCP 1320 for the source port
belonging to a personal computer accessing the server)
 The interface being traversed by the packet, and its direction (inbound or
outbound).
3.5.2 Stateful Inspection:

Stateful inspection improves on the functions of packet filters by tracking the
state of connections and blocking packets that deviate from the expected state.
This is accomplished by incorporating greater awareness of the transport layer. As
with packet filtering, stateful inspection intercepts packets at the network layer
and inspects them to see if they are permitted by an existing firewall rule, but
unlike packet filtering, stateful inspection keeps track of each connection in a
state table. While the details of state table entries vary by firewall product, they
typically include source IP address, destination IP address, port numbers, and
connection state information.
3.5.3 Application Firewall:

A newer trend in stateful inspection is the addition of a stateful protocol
analysis capability, referred to by some vendors as deep packet inspection.
Stateful protocol analysis improves upon standard stateful inspection by adding
basic intrusion detection technology—an inspection engine that analyzes
protocols at the application layer to compare vendor-developed profiles of benign
protocol activity against observed events to identify deviations. This allows a
firewall to allow or deny access based on how an application is running over the
network.
3.5.4 Application-Proxy Gateways:
An application-proxy gateway is a feature of advanced firewalls that

combines lower-layer access control with upper-layer functionality. These
firewalls contain a proxy agent that acts as an intermediary between two hosts
that wish to communicate with each other, and never allows a direct
connection between them.
Linux Firewall:

Guidelines in Firewalls and Firewall Policies: Recommendation of The National Institute of Standards and Technology Released On 2009

Uploaded by

Copyright:

Available Formats

Guidelines in Firewalls and Firewall Policies: Recommendation of The National Institute of Standards and Technology Released On 2009

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Guidelines in Firewalls and Firewall Policies: Recommendation of The National Institute of Standards and Technology Released On 2009

Uploaded by

Copyright:

Available Formats

3.

Firewalls are the appropriate front defiance line. It is devices or programs

3.4 The disadvantages of the firewall:

3.5 Firewalls Technologies:

3.5.1 Packet Filtering:

3.5.2 Stateful Inspection:

3.5.3 Application Firewall:

3.5.4 Application-Proxy Gateways:

An application-proxy gateway is a feature of advanced firewalls that

You might also like