Chapter # 06 Security Technology

Chapter # 06
Security Technology
Access Controls
Firewalls
VPNS
Access Control
 Access control is the method by which
systems determine whether and how to
admit a user into a trusted area of the
organization.
Access Control
Access Control
 Discretionary access controls (DACs)
provide the ability to share resources in a
peer-to-peer configuration that allows users to
control and possibly provide access to
information or resources at their disposal.
 The users can allow general, unrestricted
access, or they can allow specific people or
groups of people to access these resources.
Access Control
 Nondiscretionary access controls
(NDACs) are managed by a central
authority in the organization.
 A form of nondiscretionary access controls
is called lattice-based access control
(LBAC), in which users are assigned a
matrix of authorizations for particular areas
of access.
Access Control Mechanism
What is a Firewall?
 a choke point of control and monitoring
 interconnects networks with differing trust
 imposes restrictions on network services
 only authorized traffic is allowed
 auditing and controlling access
 can implement alarms for abnormal behavior
What is a Firewall?
Firewall Limitations
 cannot protect from attacks bypassing it
 eg sneaker net, utility modems, trusted
organisations, trusted services (eg SSL/SSH)
 cannot protect against internal threats
 eg disgruntled or colluding employees
 cannot protect against access via WLAN
 if improperly secured against external use
 cannot protect against malware imported
via laptop, PDA, storage infected outside
Types of Firewalls / Firewall
Processing Modes
 packet filters
 Application-level gateways, &
 Circuit-level gateways.
Firewalls – Packet Filters
 simplest, fastest firewall component
 foundation of any firewall system
 examine each IP packet (no context) and
permit or deny according to rules
 hence restrict access to services (ports)
 possible default policies
 that not expressly permitted is prohibited
 that not expressly prohibited is permitted
Attacks on Packet Filters
 IP address spoofing
 fake source address to be trusted
 add filters on router to block
 source routing attacks
 attacker sets a route other than default
 block source routed packets
Firewalls - Application Level
Gateway (or Proxy)
 have application specific gateway / proxy
 has full access to protocol
 user requests service from proxy
 proxy validates request as legal
 then actions request and returns result to user
 can log / audit traffic at application level
 need separate proxies for each service
 some services naturally support proxying
 others are more problematic
Firewalls - Application Level
Gateway (or Proxy)
Firewalls - Circuit Level Gateway
 relays two TCP connections

 imposes security by limiting which such
connections are allowed
 once created usually relays traffic without
examining contents
 typically used when trust internal users by
allowing general outbound connections
 SOCKS is commonly used
Firewalls - Circuit Level Gateway
Hybrid Firewalls
 Combine the elements of other types of
firewalls.
Bastion Host
 highly secure host system
 runs circuit / application level gateways
 or provides externally accessible services
 potentially exposed to "hostile" elements
 hence is secured to withstand this
 hardened O/S, essential services, extra auth
 proxies small, secure, independent, non-privileged
 may support 2 or more net connections
 may be trusted to enforce policy of trusted
separation between these net connections
Firewall Configurations
DMZ Networks
o The use of a “screened subnet”.
o Also known as a demilitarized
zone (DMZ)
o Located between an internal and
an external firewall.
o External firewall is placed at the
edge of a local or enterprise
network.
o Systems that are externally
accessible but need some
protections are usually located on
DMZ networks.
o Typically, the systems in the DMZ
require or foster external
connectivity, such as a corporate
Web site, an e-mail server, or a
DNS (domain name system)
server.
o The external firewall provides a
measure of access control and
DMZ Networks
DMZ Networks
In this type of configuration, internal firewalls serve three purposes:
oThe internal firewall adds more stringent filtering capability, vs the
external firewall, to protect enterprise servers and workstations from
external attack.
oThe internal firewall provides two-way protection with respect to the
DMZ, as it protects the remainder of the network from attacks
launched from DMZ systems, and protects DMZ systems from
attack by internal hosts.
oMultiple internal firewalls can be used to protect portions of the
internal network from each other.
A common practice is to place the DMZ on a different network
interface on the external firewall from that used to access the
internal networks.
Virtual Private Network:
 In today's distributed computing environment, the virtual
private network (VPN) offers an attractive solution to network
managers.
 The VPN consists of a set of computers that interconnect by
means of a relatively unsecure network and that make use of
encryption and special protocols to provide security.
 At each corporate site, workstations, servers, and databases
are linked by one or more local area networks (LANs).
 The Internet or some other public network can be used to
interconnect sites, providing a cost savings over the use of a
private network and offloading the wide area network
management task to the public network provider.
 That same public network provides an access path for
telecommuters and other mobile employees to log on to
corporate systems from remote sites.
Virtual Private Network
 But the manager faces a fundamental requirement:
security. Use of a public network exposes corporate
traffic to eavesdropping and provides an entry point for
unauthorized users.
 To counter this problem, a VPN is needed.
 In essence, a VPN uses encryption and authentication
in the lower protocol layers to provide a secure
connection through an otherwise insecure network,
typically the Internet
 VPNs are generally cheaper than real private networks
using private lines but rely on having the same
encryption and authentication system at both ends.
Virtual Private Network:
 The most common protocol
mechanism used for this
purpose is at the IP level and is
known as IPSec.
 An organization maintains LANs
at dispersed locations. A logical
means of implementing an
IPsec is in a firewall, as shown
in Figure.
 If IPSec is implemented in a
separate box behind (internal to)
the firewall, then VPN traffic
passing through the firewall in
both directions is encrypted.
 In this case, the firewall is
unable to perform its filtering
function or other security
functions.
 IPSec could be implemented in
the boundary router, outside the
firewall.
VPN Technologies
VPNs Modes
 Transport Mode:
In transport mode, the data within an IP
packet is encrypted, but the header
information is not.
 Tunnel Mode: In tunnel mode, the entire
client packet is encrypted and added as the
data portion of a packet addressed from one
tunneling server to another. The receiving
server decrypts the packet and sends it to
the final address.

Chapter # 06 Security Technology

Uploaded by

Copyright:

Available Formats

Chapter # 06 Security Technology

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter # 06 Security Technology

Uploaded by

Copyright:

Available Formats

Chapter # 06

 relays two TCP connections

You might also like