1. 25/09/2016 1 Firewall, IDS & IPS basics

2. Summary Firewalls Intrusion detection system Intrusion prevention system

3. Firewalls A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications Firewalls can be implemented in either hardware or software, or a combination of both

4. Firewalls A typical firewall placement

5. Firewalls Firewalls analyze all incoming traffic from all interfaces and apply rules to it Easier rules look at source/destination IP addresses, source/destination ports, packet flags, etc. etc.

6. Firewalls Each rule has an associated action to perform if the packet matches the rule conditions.

7. Firewalls Usual actions are: ► Accept ► Deny ► Reject ► What is the difference amongst deny and reject? Personal firewalls have one more rule: ► Ask the user

8. Firewalls Most common firewall types: ► Packet filters Stateless (i.e. routers' ACLs) Stateful ► Proxy gateways 2 different connections, one for each side of the firewall (packets are not forwarded directly) i.e. web proxies ► NAT Changes IPs/ports/etc. of packets traversing it

9. Firewalls Personal firewall Windows Firewall ► a software component of Microsoft Windows that provides firewalling and packet filtering functions ► first included in Windows XP and Windows Server 2003

10. Firewalls Windows firewall ► Windows XP Enabled by default Built-in exceptions to allow connections from machines on the local network Cannot block outbound connections; it is only capable of blocking inbound ones

11. Firewalls Windows firewall ► Windows Vista Outbound packet filtering, reflecting increasing concerns about spyware and viruses that attempt to "phone home" With the advanced packet filter, rules can also be specified for source and destination IP addresses and port range ► Windows Seven Multiple firewall policies

12. Intrusion detection system A device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station

13. Intrusion detection system There is an analogy between IDS and alarm systems:

14. Intrusion detection system Kinds of IDS: ► Host based ► Network based ► Network node based ► Real time vs. non real time

15. Intrusion detection system How they work: ► Signature based ► Anomaly based ► Protocol based anomaly detection

16. Intrusion detection system Difference between an IDS and a firewall ► A firewall blocks potential intruders in order to stop them from carrying ou their bad activities, an IDS evaluates a suspected intrusion once it has taken place and signals an alarm ► Firewalls limit access between networks to prevent intrusion and usually do not block attacks from inside the network, an IDS also watches for attacks that originate from within a system

17. Intrusion prevention system A network security appliance (or software) that monitors network and/or system activities and blocks malicious ones Its main functions are ► identify malicious activity ► log information about said activity ► attempt to block/stop activity ► report activity

18. Intrusion prevention system An “extension” of intrusion detection systems ► they both monitor network traffic and/or system activities for malicious activity ► unlike intrusion detection systems, intrusion prevention systems are placed in- line and are able to actively prevent/block intrusions that are detected