INTERNET FIREWALLS
INTRODUCTION :
The Internet has made large amount of information available to the average computer user at home, in business and education. For many people, having access to this information is no longer just an advantage, it is essential.
By connecting a private network to the Internet can expose critical or confidential data to malicious attack from anywhere in the world. The intruders could gain access to your sites private information or interfere with your use of your own systems. Users who connect their computers to the Internet must be aware of these dangers, their implications and how to protect their data and their critical systems.
Therefore, security of network is the main criteria here and firewalls provide this security. The Internet firewalls keep the flames of Internet hell out of your network or, to keep the members of your LAN pure by denying them access the all the evil Internet temptations.
DEFINITION:
A firewall is a hardware device or a software program running on the secure host computer that sits between the two entities and controls access between them.
Here the two entities are nothing but a private network and the public network like Internet.
The firewall can be a software firewall and the hardware firewall.The first computer firewall was a non-routing Unix host with connections to two different networks. One network card connected to the Internet and the other to the private LAN. To reach the Internet from the private network, you had to logon to the firewall (Unix) server. You then used the resources of the system to access the Internet. For example, you could use X-windows to run Netscape's browser on the firewall system and have the display on your workstation. With the browser, running on the firewall it has access to both networks.
This sort of dual homed system (a system with two network connections) is great if you can TRUST ALL of your users. You can simple setup a Linux system and give an account accounts on it to everyone needing Internet access. With this setup, the only computer on your private network that knows anything about the outside world is the firewall. No one can download to his or her personal workstations. They must first download a file to the firewall and then download the file from the firewall to their workstation.
Firewalls are mainly used for two purposes.
To keep people (worms/crackers) out.
To keep people (employees/children) in.
NEED OF Firewalls:
The general reasoning behind firewall usage is that without a firewall, a subnet's systems expose themselves to inherently insecure services such as NFS or NIS and to probes and attacks from hosts elsewhere on the network. In a firewall-less environment, network security relies totally on host security and all hosts must, in a sense, cooperate to achieve a uniformly high level of security. The larger the subnet, the less manageable it is to maintain all hosts at the same level of security. As mistakes and lapses in security become more common, break-ins occur not as the result of complex attacks, but because of simple errors in configuration and inadequate passwords.
A firewall approach provides numerous advantages to sites by helping to increase overall host security. The following sections summarize the primary benefits of using a firewall.
Protection from Vulnerable Services
Controlled Access to Site Systems
Concentrated Security
Enhanced Privacy
Logging and Statistics on Network Use, Misuse
Policy Enforcement
1.Protection from Vulnerable Services:
A firewall can greatly improve network security and reduce risks to hosts on the subnet by filtering inherently insecure services. As a result, the subnet network environment is exposed to fewer risks, since only selected protocols will be able to pass through the firewall.
For example, a firewall could prohibit certain vulnerable services such as NFS from entering or leaving a protected subnet. This provides the benefit of preventing the services from being exploited by outside attackers, but at the same time permits the use of these services with greatly reduced risk to exploitation. Services such as NIS or NFS that are particularly useful on a local area network basis can thus be enjoyed and used to reduce the host management burden.Firewalls can also provide protection from routing-based attacks, such as source routing and attempts to redirect routing paths to compromised sites via ICMP redirects. A firewall could reject all source-routed packets and ICMP redirects and then inform administrators of the incidents
2. Controlled Access to Site Systems :A firewall also provides the ability to control access to site systems. For example, some hosts can be made reachable from outside networks, whereas others can be effectively sealed off from unwanted access. A site could prevent outside access to its hosts except for special cases such as mail servers or information servers. This brings to the fore an access policy that firewalls are particularly adept at enforcing: do not provide access to hosts or services that do not require access. Put differently, why provide access to hosts andservices that could be exploited by attackers when the access is not used or required? If, for example, a user requires little or no network access to her desktop workstation, then a firewall can enforce this policy.
3. Concentrated Security:A firewall can actually be less expensive for an organization in that all or most modified software and additional security software could be located on the firewall systems as opposed to being distributed on many hosts. In particular, one-time password systems and other add-on authentication software could be located at the firewall as opposed to each system that needed to be accessed from the Internet.
Other solutions to network security such as Kerberos [NIST94c] involve modifications at each host system. While Kerberos and other techniques should be considered for their advantages and may be more appropriate than firewalls in certain situations, firewalls tend to be simpler to implement in that only the firewall need run specialized software.
4. Enhanced Privacy :
Privacy is of great concern to certain sites, since what would normally be considered innocuous information might actually contain clues that would be useful to an attacker. Using a firewall, some sites wish to block services such as finger and Domain Name Service. Finger displays information about users such as their last login time, whether they've read mail, and other items. But, finger could leak information to attackers about how often a system is used, whether the system has active users connected, and whether the system could be attacked without drawing attention.
Firewalls can also be used to block DNS information about site systems, thus the names and IP addresses of site systems would not be available to Internet hosts. Some sites feel that by blocking this information, they are hiding information that would otherwise be useful to attackers.
5. Logging and Statistics on Network Use, Misuse:
If all access to and from the Internet passes through a firewall, the firewall can log accesses and provide valuable statistics about network usage. A firewall, with appropriate alarms that sound when suspicious activity occurs can also provide details on whether the firewall and network are being probed or attacked.
It is important to collect network usage statistics and evidence of probing for a number of reasons. Of primary importance is knowing whether the firewall is withstanding probes and attacks, and determining whether the controls on the firewall are adequate. Network usage statistics are also important as input into network requirements studies and risk analysis activities.
6. Policy Enforcement:
Lastly, but perhaps most importantly, a firewall provides the means for implementing and enforcing a network access policy. In effect, a firewall provides access control to users and services. Thus, a network access policy can be enforced by a firewall, whereas without a firewall, such a policy depends entirely on the cooperation of users. A site may be able to depend on its own users for their cooperation, however it cannot nor should not depend on Internet users in general.
Types of firewalls : Firewalls fall into different categories.
They are mainly,
1. packet filtering firewalls
2. circuitlevel gateways
3. application gateways
4. stateful multilayer inspection firewall
1.Packet Filtering Firewalls:
These firewalls work at the network layer of OSI model, or IP layer of TCP/IP. They are usually part of a router. A router is a device that receives packets from one network and forwards them to another network. In a packet filtering firewall, each packet is compared to a set of criteria before it is forwarded. Depending on the packet and the criteria, the firewall can drop the packet, forward it or send a message to the originator. Rules can include source and destination IP addresses, source and destination port number and type of the protocol embedded in that packet. These firewalls often contain an ACL (Access Control List) to restrict who gains access to which computers and networks.
Advantages of packet filtering:
It is cost effective to simply configure routers that are already a part of the network to do additional duty as firewalls.
Network layer firewalls tend to be very fast and tend to be very transparent to users.
3 Cost: Virtually all high-speed Internet connections require a router. Therefore, organizations with high- speed Internet connections already have the capability to perform basic Packet Filtering at the Router level without purchasing additional hardware or software.
Drawbacks of packet filtering:
They don’t provide for password controls.
Users can’t identify themselves
3. The person who configures the firewall protocol for the router needs a thorough knowledge of IP packet structure.
4. There is no user authentication.
5. Remains vulnerable to attacks such as spoofing source address.
2. Circuit-level Gateway:
These firewalls work at the session layer of the OSI model, or TCP/IP layer of the TCP/IP. They monitor TCP handshaking between packets to determine whether a requested session is legitimate. Traffic is filtered based on the specified session rules, such as when a session is initiated by the recognized computer. Information passed to remote computer through a circuit level gateway appears to have originated from the gateway. This is useful for hiding information about protected networks. Circuit level gateways are relatively inexpensive and have the advantage of hiding information about the private network they protect. On the other hand, they do not filter individual packets.Unknown traffic is allowed up to level 4 of network stack. These are hardware firewalls and apply security mechanisms when a TCP or UDP connection is established.
3. Application Gateways:
These are the software firewalls. These are often used by companies specifically to monitor and log employee activity and by private citizens to protect a home computer from hackers, spy ware to set parental controls for children.
Application gateways also called proxies are similar to circuit level gateways expect that they are application specific. They can filter packets at the application layer of OSI or TCP/IP model. Incoming or outgoing packets can’t access services for which there is no proxy. In plain terms, an application level gateway is configured to be a web proxy will not allow all ftp, gopher, telnet or other traffic through. Because they examine packets at the application layer, they can filter application specific commands such as http: post, get etc;
It works like a proxy. A proxy is a process that sits between a client and a server. For a client proxy looks like a server and for a server, the proxy looks like a client.Example Application layer firewall: In Figure 3, an application layer firewall called a ``dual homed gateway'' is represented. A dual homed gateway is a highly secured host that runs proxy software. It has two network interfaces, one on each network, and blocks all traffic passing through it.
Dual Homed Gateway
Advantages of application gateways:
Since application proxies examine packets at the application program level, a very fine level of security and access control may be achieved.
These reject all inbound packets contain common EXE and COM files.
The greatest advantage is that no direct connections are allowed through the firewall under any circumstances.
Proxies provide a high level of protection against denial of service attacks.
Disadvantages of application gateways:
1.Proxies require large amount of computing resources in the host system, which can load to performance bottlenecks or slow downs the network.
2. Proxies must be written for specific application programs and not all applications have proxies available.
4.Stateful Multilayer Inspection Firewall:
They combine the aspects of other three types of firewalls. This firewall keeps track of all packets associated with a specific communication session. A typical communication session between two computers will consists a several thousand packets, each of which is identified by a unique source and destination address and a sequence number that allows all of the packets to be reassembled into the correct data file at destination computer. Each packet of data is checked to ensure that it belongs to proper session. Any packets that are not part of an existing session are rejected. In addition to checking and validating the communication session ensuring that all packets belong to the proper session, these are further screens the packets at the application layer also.
Filtering at the s/w application port level provides an additional layer of control for the network administrator to ensure that only authorized transactions are allowed through the firewall. These firewalls close off ports until connection to the specified port is requested.
Advantages of stateful inspection:
These will typically offer much higher performance than proxies.
These ensure that all packets must be a port of an authorized communication session. Therefore, a higher level of protection is provided to users communicating with systems external to the trusted network.
Stateful Inspection provides a greater level of security control by enforcing security policies at the "application socket" or port layer as well as the protocol and address level.
Disadvantages of stateful inspection:
1. stateful inspection functionality currently requires the purchase of additional hardware and/or software and is not typically "bundled" with another existing network device.
A simple example of firewall:
CISCO developed 500 series firewall as better because they use a cut-through protocol in packet examination and an ACL that compares connections based on past connections with the same client. In other words, based on the first connection with a client, a kind of fingerprint is created using source and destination addresses, ports, TCP sequence numbers, and other TCP flags. So, instead of examining every client connection packet stream, the packets are first compared to the ACL.matches an authorized fingerprint, then the data stream is allowed without further examination. Both the cut-through protocol and the use of an ACL is said to greatly enhance speed.
1. Firewalls create barriers in order to prevent unauthorized access to a network.
2. They are the security doors through which some people (i.e. data) may pass and others may not.
3. It adds another layer of security to your systems.
4. It protects networked computers from intentional hostile intrusion that could compromise confidentiality or result in data corruption or denial of service.
5.It is is a choke point through which all the traffic flows between two network.
Advantages of firewall:
Concentration of security, all modified software and logging is located on the firewall system as opposed to being distributed on many hosts;
Protocol filtering, where the firewall filters protocols and services that are either not necessary or that cannot be adequately secured from exploitation;
Information hiding, in which a firewall can ``hide'' names of internal systems or electronic mail addresses, thereby revealing less information to outside hosts;
Application gateways, where the firewall requires inside or outside users to connect first to the firewall before connecting further, thereby filtering the protocol;
Extended logging, in which a firewall can concentrate extended logging of network traffic on one system;
Centralized and simplified network services management, in which services such as ftp, electronic mail, gopher, and other similar services are located on the firewall system(s) as opposed to being maintained on many systems.
Disadvantages of firewall :
Given these advantages, there are some disadvantages to using firewalls. 1.The most obvious being that certain types of network access may be hampered or even blocked for some hosts, including telnet, ftp, X Windows, NFS, NIS, etc. However, these disadvantages are not unique to firewalls; network access could be restricted at the host level as well, depending on a site's security policy.
2. A second disadvantage with a firewall system is that it concentrates security in one spot as opposed to distributing it among systems, thus a compromise of the firewall could be disastrous to other less-protected systems on the subnet. This weakness can be countered, however, with the argument that lapses and weaknesse in security are more likely to be found as the number of systems in a subnet increase, thereby multiplying the ways in which subnets can be exploited.
3. Another disadvantage is that relatively few vendors have offered firewall systems until very recently. Most firewalls have been somewhat ``hand-built'' by site administrators, however the time and effort that could go intoconstructing a firewall may outweigh the cost of a vendor solution. There
Is also no firm definition of what constitutes a firewall; the term ``firewall'' can mean many things to many people.
FOR WHICH FIREWALLS CAN’T PROVIDE SECURITY :In addition, Firewalls can’t provide security for the following.
1. A firewall can’t protect against attacks that don’t go through the firewall. Many corporations that connect to Internet are very concerned about confidentially date leaking out of company through route. However, a magnetic tape can just export data.
2. Many organizations that are terrified of Internet connections have no coherent policy about how dial-in access via modems should be protected. There are many organizations out there buying expensive firewalls and neglecting the numerous other back doors into their network.
3. Another thing a firewall can’t really protect you against is traitors or idiots inside the network. An industrial spy might leak information or export it through a telephone, FAX or floppy disk. Firewalls can’t protect you against this stupidity.
4. Firewalls can't protect very well against things like viruses. There are too many ways of encoding binary files for transfer over networks, and too many different architectures and viruses to try to search for them all. In other words, a firewall cannot replace security-consciousness on the part of your users. In general, a firewall cannot protect against a data-driven attack--attacks in which something is mailed or copied to an internal host where it is then executed.
Organizations that are deeply concerned about viruses should implement organization-wide virus control measures. Rather than trying to screen viruses out at the firewall, make sure that every vulnerable desktop has virus-scanning software that is run when the machine is rebooted. Blanketing your network with virus scanning software will protect against viruses that come in via floppy disks, modems, and Internet. Trying to block viruses at the firewall will only protect against viruses from the Internet--and the vast majority of viruses are caught via floppy disks.
Conclusion:
In conclusion, the Internet has become a dangerous place. Thirteen-year-old kids on dial-up accounts can crash a site supported by two T-1 connections by using hundreds of zombies (PCs hacked and uploaded with a Trojan) to flood with UDP and ICMP traffic. This is simply a malicious attack meant to consume all of the bandwidth of a connection to the Internet. Yahoo was recently crashed by what is called a 'smurf' attack. In this attack, ping requests are sent to several Internet broadcast addresses with a spoofed return address aimed at the victim (yahoo in this case). The resulting storm of packets consumes all bandwidth and disconnects or makes the site unusable for normal traffic. Hackers attack networks to destroy and/or steal information. They attack PCs so they can use them in zombie attacks, to hide their identity when trying to gain illegal entry to secured networks, or for nothing more than malicious purposes. While on the internet my firewall typically gets 1 to 3 hits an hour, primarily port scanners looking for a specific Trojan or a vulnerability to exploit. No one should be on the Internet without a firewall. All networks are protected by firewalls. However, it is always a trade-off. The whole point of the Internet is communication and exchange of information. The question is how much do we restrict access without losing all the advantages of speed and openness.
