1. CIS 6930 Report Presentation Schedule
Nov 7: Michael Goltz
Nov 7: Song Fang
Nov 9: Song Yang
Nov 9: Dakun Shen
Nov 14: Shamaria Engram
Nov 14: Joseph Fields
Nov 28: Exam

2. Enterprise Network Security
Perimeter control
Firewalls
Securing hosts
Host-based vulnerability scanner
Intrusion detection
Network-based and host-based

3. Firewalls Types of firewalls Host-based firewall
Network-based firewall
Packet filters
Gateways

4. Example Internet DMZ CORP Filtering interfaces portal firewall
dnsServer
CORP
workStation
fileServer

5. Typical format of a filter rule
<protocol, srcIP, srcPort, dstIP, dstPort, action>
e.g. <ip, blackListIP, -, *, -, drop>
<udp, dnsServerIP, *, *, 53, allow>
<tcp, *, *, portalIP, 80, allow>
<tcp, *, *, portalIP, 443, allow>
<nfs, portalIP, -, fileServerIP, -, allow>

6. Filtering Rulesets Order matters Default action
The first match determines the fate of the packet
Default action
Either drop or allow
Ingress and Egress filtering
Different rulesets for packets coming into the interface and those coming out of the interface

7. Requirement 1 Outbound http traffic from CORP zone should be allowed
<tcp, CORPIP, *, *, 80, allow>
<tcp, CORPIP, *, *, 443, allow>
Where should we put this rule?

8. <tcp, portalIP, *, *, 25, allow>
Requirement 2
Outbound smtp traffic from portal should be allowed
<tcp, portalIP, *, *, 25, allow>
Where should we put this rule?

9. Dynamic Packet Filtering
How do we let in the return packets?
Typical problems with packet-filtering
Solution: dynamic packet filtering, or “stateful inspection”
Option1: dynamically insert a new filtering rule to let in the return traffic
Option2: firewall acts as an transparent proxy between the communication parties

10. Option 2
firewall

11. Asymmetric Route H1 F1 F2 H2 X

12. Network Address Translation (NAT)
firewall

13. Requirement 3 Outbound FTP traffic from CORP zone should be allowed;
Inbound FTP traffic to portal should be allowed
<tcp, CORPIP, *, *, 21, allow>
<tcp, *, *, portalIP, 21, allow>
Where should we put this rule?

14. The FTP Problem Two channels: control channel and data channel
Port 21 is for control channel; two modes for establishing a data channel
Active mode: client issues a PORT command to tell the server which port number to connect back
Passive mode: client issues a PASV command and server responds with a port number for the client to connect to
Has to use dynamic filtering to allow the data channel traffic
Potential security problems

15. Use an Application Proxy
firewall

16. <nfs, portalIP, -, fileServerIP, -, allow>
Requirement 4
NFS traffic from portal to fileServer should be allowed
<nfs, portalIP, -, fileServerIP, -, allow>

17. Requirement 5 Inbound DNS query to portal should be allowed;
Outbound DNS query from dnsServer should be allowed;
DNS query from CORP zone to dnsServer should be allowed;
<udp, *, *, portalIP, 53, allow>
<udp, nameServerIP, *, *, 53, allow>
<udp, CORPIP, *, nameServerIP, 53, allow>

18. It is non-trivial to get the firewall rule-set right
Other requirements…
Inbound HTTP request to portal should be allowed;
Inbound SSH request to portal should be allowed;
Outbound IMAP traffic from CORP zone should be allowed; …
It is non-trivial to get the firewall rule-set right

19. Summary
Current enterprise network defense tools only provide “point-solutions”
Defenders need automated correlation from a number of monitoring/control devices to make the right decisions quickly