1. Cryptography and Network Security Chapter 20 Firewalls
Lecture slides by Lawrie Brown for “Cryptography and Network Security”, 4/e, by William Stallings, Chapter 20 – “Firewalls”.

2. Introduction seen evolution of information systems
now everyone want to be on the Internet
and to interconnect networks
has persistent security concerns
can’t easily secure every system in org
typically use a Firewall
to provide perimeter defence
as part of comprehensive security strategy
Information systems in corporations,government agencies,and other organizations have undergone a steady evolution from mainframes to LANs. Internet connectivity is no longer optional, with information and services essential to the organization. Moreover, individual users want and need Internet access. However, while Internet access provides benefits, it enables the outside world to reach and interact with local network assets, creating a threat to the organization. While it is possible to equip each workstation and server on the premises network with strong security features, this is not a practical approach in general. Firewalls can be an effective means of protecting a local system or network of systems from network-based security threats while at the same time affording access to the outside world via wide area networks and the Internet. However they need to be part of a wider security strategy including host security.

3. What is a Firewall? a choke point of control and monitoring
interconnects networks with differing trust
imposes restrictions on network services
only authorized traffic is allowed
auditing and controlling access
can implement alarms for abnormal behavior
provide NAT & usage monitoring
implement VPNs using IPSec
must be immune to penetration
A firewall is inserted between the premises network and the Internet to establish a controlled link and to erect an outer security wall or perimeter, forming a single choke point where security and audit can be imposed. A firewall:
defines a single choke point that keeps unauthorized users out of the protected network, prohibits potentially vulnerable services from entering or leaving the network, and provides protection from various kinds of IP spoofing and routing attacks.
2. provides a location for monitoring security-related events
3. is a convenient platform for several Internet functions that are not security related, such as NAT and Internet usage audits or logs
4. A firewall can serve as the platform for IPSec to implement virtual private networks.
The firewall itself must be immune to penetration, since it will be a target of attack.

4. Firewall Limitations cannot protect from attacks bypassing it
eg sneaker net, utility modems, trusted organisations, trusted services (eg SSL/SSH)
cannot protect against internal threats
eg disgruntled or colluding employees
cannot protect against transfer of all virus infected programs or files
because of huge range of O/S & file types
Firewalls have their limitations, including that they:
cannot protect against attacks that bypass the firewall, eg PCs with dial-out capability to an ISP, or dial-in modem pool use
2. do not protect against internal threats, eg disgruntled employee or one who cooperates with an attacker
3. cannot protect against the transfer of virus-infected programs or files, given wide variety of O/S & applications supported

5. Firewalls – Packet Filters
simplest, fastest firewall component
foundation of any firewall system
examine each IP packet (no context) and permit or deny according to rules
hence restrict access to services (ports)
possible default policies
that not expressly permitted is prohibited
that not expressly prohibited is permitted
Have three common types of firewalls: packet filters, application-level gateways, & circuit-level gateways.
A packet-filtering router applies a set of rules to each incoming and outgoing IP packet to forward or discard the packet. Filtering rules are based on information contained in a network packet such as src & dest IP addresses, ports, transport protocol & interface. Some advantages are simplicity, transparency & speed.
If there is no match to any rule, then one of two default policies are applied:
• that which is not expressly permitted is prohibited (default action is discard packet), conservative policy
• that which is not expressly prohibited is permitted (default action is forward packet), permissive policy

6. Firewalls – Packet Filters
Stallings Figure 20.1a illustrates the packet filter firewall placement in the border router, on the security perimeter, between the external less-trusted Internet, and the internal more trusted private network.

7. Firewalls – Packet Filters
Stallings Table 20.1 gives some examples of packet-filtering rule sets. In each set, the rules are applied top to bottom.
A. Inbound mail is allowed to a gateway host only (port 25 is for SMTP incoming
B. explicit statement of the default policy
C. tries to specify that any inside host can send mail to the outside, but has problem that an outside machine could be configured to have some other application linked to port 25
D. properly implements mail sending rule, by checking ACK flag of a TCP segment is set
E. this rule set is one approach to handling FTP connections

8. Attacks on Packet Filters
IP address spoofing
fake source address to be trusted
add filters on router to block
source routing attacks
attacker sets a route other than default
block source routed packets
tiny fragment attacks
split header info over several tiny packets
either discard or reassemble before check
Some of the attacks that can be made on packet-filtering routers & countermeasures are:
• IP address spoofing: where intruder transmits packets from the outside with internal host source IP addr, need to filter & discard such packets
• Source routing attacks: where source specifies the route that a packet should take to bypass security measures, should discard all source routed packets
• Tiny fragment attacks: intruder uses the IP fragmentation option to create extremely small fragments and force the TCP header information into a separate fragments to circumvent filtering rules needing full header info, can enforce minimum fragment size to include full header.

9. Firewalls – Stateful Packet Filters
traditional packet filters do not examine higher layer context
ie matching return packets with outgoing flow
stateful packet filters address this need
they examine each IP packet in context
keep track of client-server sessions
check each packet validly belongs to one
hence are better able to detect bogus packets out of context
A traditional packet filter makes filtering decisions on an individual packet basis and does not take into consideration any higher layer context. A stateful inspection packet filter tightens up the rules for TCP traffic by creating a directory of outbound TCP connections, and will allow incoming traffic to high-numbered ports only for those packets that fit the profile of one of the entries in this directory. Hence they are better able to detect bogus packets sent out of context.

10. Firewalls - Application Level Gateway (or Proxy)
have application specific gateway / proxy
has full access to protocol
user requests service from proxy
proxy validates request as legal
then actions request and returns result to user
can log / audit traffic at application level
need separate proxies for each service
some services naturally support proxying
others are more problematic
An application-level gateway (or proxy server), acts as a relay of application-level traffic. A user contacts the gateway to access some service, provides details of the service, remote host & authentication details, contacts the application on the remote host and relays all data between the two endpoints. If the gateway does not implement the proxy code for a specific application, then it is not supported and cannot be used. Note that some services naturally support proxying, whilst others are more problematic. Application-level gateways tend to be more secure than packet filters, &can log and audit traffic at application level.

11. Firewalls - Application Level Gateway (or Proxy)
Stallings Figure 20.1b illustrates an application-level gateway (or proxy server), emphasizing that it only supports a specific list of application services.

12. Firewalls - Circuit Level Gateway
relays two TCP connections
imposes security by limiting which such connections are allowed
once created usually relays traffic without examining contents
typically used when trust internal users by allowing general outbound connections
SOCKS is commonly used
A circuit-level gateway relays two TCP connections, one between itself and an inside TCP user, and the other between itself and a TCP user on an outside host. Once the two connections are established, it relays TCP data from one connection to the other without examining its contents. The security function consists of determining which connections will be allowed. It is typically used when internal users are trusted to decide what external services to access.
One of the most common circuit-level gateways is SOCKS, defined in RFC It consists of a SOCKS server on the firewall, and a SOCKS library & SOCKS-aware applications on internal clients.

13. Firewalls - Circuit Level Gateway
Stallings Figure 20.1c illustrates a circuit-level gateway, showing how it relays between 2 TCP connections. Note that it can be implemented in a stand-alone system or can be a specialized function in an application-level gateway for certain applications. Note also that relaying UDP packets is more problematical, because of the lack of connection context, and require a parallel TCP connection to provide these details.

14. Bastion Host highly secure host system
runs circuit / application level gateways
or provides externally accessible services
potentially exposed to "hostile" elements
hence is secured to withstand this
hardened O/S, essential services, extra auth
proxies small, secure, independent, non-privileged
may support 2 or more net connections
may be trusted to enforce policy of trusted separation between these net connections
A bastion host is a critical strong point in the network’s security, serving as a platform for an application-level or circuit-level gateway, or for external services. It is thus potentially exposed to "hostile" elements and must be secured to withstand this. Common characteristics of a bastion host include that it:
• executes a secure version of its O/S, making it a trusted system
• has only essential services installed on the bastion host
• may require additional authentication before a user is allowed access to the proxy services
• is configured to support only a subset of the standard application’s command set, with access only to specific hosts
• maintains detailed audit information by logging all traffic
• has each proxy module a very small software package specifically designed for network security
• has each proxy independent of other proxies on the bastion host
• have a proxy performs no disk access other than to read its initial configuration file
• have each proxy run as a nonprivileged user in a private and secured directory
A bastion host may have two or more network interfaces (or ports), and must be trusted to enforce trusted separation between these network connections, relaying traffic only according to policy.

15. Firewall Configurations
In addition to the use of a simple configuration consisting of a single system, more complex configurations are possible and indeed more common. Stallings Figure 20.2 illustrates three common firewall configurations.
Figure 20.2a shows the “screened host firewall, single-homed bastion configuration”, where the firewall consists of two systems:
a packet-filtering router - allows Internet packets to/from bastion only
a bastion host - performs authentication and proxy functions
This configuration has greater security, as it implements both packet-level & application-level filtering, forces an intruder to generally penetrate two separate systems to compromise internal security, & also affords flexibility in providing direct Internet access to specific internal servers (eg web) if desired.

16. Firewall Configurations
Stallings Figure 20.2b illustrates the “screened host firewall, dual-homed bastion configuration” which physically separates the external and internal networks, ensuring two systems must be compromised to breach security. The advantages of dual layers of security are also present here. Again, an information server or other hosts can be allowed direct communication with the router if this is in accord with the security policy, but are now separated from the internal network.

17. Firewall Configurations
Stallings Figure 20.2c shows the “screened subnet firewall configuration”, being the most secure shown. It has two packet-filtering routers, one between the bastion host and the Internet and the other between the bastion host and the internal network, creating an isolated subnetwork. This may consist of simply the bastion host but may also include one or more information servers and modems for dial-in capability. Typically, both the Internet and the internal network have access to hosts on the screened subnet, but traffic across the screened subnet is blocked.
This configuration offers several advantages:
• There are now three levels of defense to thwart intruders
• The outside router advertises only the existence of the screened subnet to the Internet; therefore the internal network is invisible to the Internet
• Similarly, the inside router advertises only the existence of the screened subnet to the internal network; hence systems on the inside network cannot construct direct routes to the Internet

18. Access Control given system has identified a user
determine what resources they can access
general model is that of access matrix with
subject - active entity (user, process)
object - passive entity (file or resource)
access right – way object can be accessed
can decompose by
columns as access control lists
rows as capability tickets
Following successful logon, a user has been granted access to one or a set of hosts and applications. Associated with each user there can be a profile that specifies permissible operations and file accesses, which the operating system can then enforce.
A general model of access control is that of an access matrix, the basic elements of which are:
• Subject: An entity (typically a process) capable of accessing objects
• Object: Anything to which access is controlled, eg files, portions of files, programs, memory segments
• Access right: The way in which an object is accessed by a subject, eg. read,write,and execute
One axis of an access matrix consists of identified subjects that may attempt data access, the other lists objects that may be accessed, & each entry in the matrix indicates the access rights of that subject for that object. In practice, an access matrix is usually sparse and is implemented by decomposition in one of two ways. If decomposed by columns, you have access control lists, which list users & their permitted access rights for each object. If decomposed by rows it yields capability tickets, which specify authorized objects & operations for a user.

19. Access Control Matrix
Stallings Figure20.3a illustrates an an access control matrix.

20. Trusted Computer Systems
information security is increasingly important
have varying degrees of sensitivity of information
cf military info classifications: confidential, secret etc
subjects (people or programs) have varying rights of access to objects (information)
known as multilevel security
subjects have maximum & current security level
objects have a fixed security level classification
want to consider ways of increasing confidence in systems to enforce these rights
Another widely applicable requirement is to protect data or resources on the basis of levels of security, as is commonly found in the military where information is categorized as unclassified (U), confidential (C), secret (S), top secret (TS), or higher. Here subjects (people or programs) have varying rights of access to objects (information) based on their classifications. This is known as multilevel security. A system that can be proved to enforce this is referred to as a trusted system.

21. Bell LaPadula (BLP) Model
one of the most famous security models
implemented as mandatory policies on system
has two key policies:
no read up (simple security property)
a subject can only read/write an object if the current security level of the subject dominates (>=) the classification of the object
no write down (*-property)
a subject can only append/write to an object if the current security level of the subject is dominated by (<=) the classification of the object
The general statement of the requirement for multilevel security is that a subject at a high level may not convey information to a subject at a lower or incompatible level unless that flow accurately reflects the will of an authorized user. This can be implemented using the Bell LaPadula Model, in which a multilevel secure system must enforce:
• No read up: A subject can only read an object of less or equal security level - Simple Security Property
• No write down: A subject can only write into an object of greater or equal security level - * (star) Property
These two rules, if properly enforced, provide multilevel security.

22. Reference Monitor
Stallings Figure20.4 illustrates the reference monitor as a controlling element in the h/w & O/S of a computer. It regulates access of subjects to objects on the basis of their security parameters. It has access to the security kernel database, which lists the access privileges (security clearance) of each subject & the protection attributes (classification level) of each object. The reference monitor enforces the security rules (no read up,no write down). It must have properties of:
• Complete mediation: security rules are enforced on every access
• Isolation: reference monitor & database are protected from unauthorized modification
• Verifiability: reference monitor’s correctness must be provable
These are stiff requirements, usually met only by a trusted system.

23. Evaluated Computer Systems
governments can evaluate IT systems
against a range of standards:
TCSEC, IPSEC and now Common Criteria
define a number of “levels” of evaluation with increasingly stringent checking
have published lists of evaluated products
though aimed at government/defense use
can be useful in industry also
Trusted systems need to be evaluated against a suitable set of criteria by an approved government agency. The original standard developed by the US DoD & NSA was TCSEC in the early 80’s. Later standards were developed by other countries, harmonized in the EU with IPSEC (which was also used in Australia), and now internationally with the Common Criteria. These standards define a number of “levels” of evaluation with increasingly stringent checking, to which an evaluation center evaluates commercially available products as meeting the security requirements specified, within a given functionality area. These evaluations are needed for Defense procurements but are published and freely available, & can serve as guidance to commercial customers for the purchase of commercially available,off-the-shelf equipment.

24. Common Criteria
international initiative specifying security requirements & defining evaluation criteria
incorporates earlier standards
eg CSEC, ITSEC, CTCPEC (Canadian), Federal (US)
specifies standards for
evaluation criteria
methodology for application of criteria
administrative procedures for evaluation, certification and accreditation schemes
The Common Criteria (CC) for Information Technology and Security Evaluation is an international initiative by standards bodies in a number of countries to develop international standards for specifying security requirements and defining evaluation criteria. It provides standards for the evaluation criteria, the methodology forthe application of these criteria, & the administrative procedures used for evaluation, certification and accreditation schemes.

25. Common Criteria defines set of security requirements
have a Target Of Evaluation (TOE)
requirements fall in two categories
functional
assurance
both organised in classes of families & components
The CC defines a common set of potential security requirements for use in evaluation. The term target of evaluation (TOE) refers to that part of the product or system that is subject to evaluation. The requirements fall in two categories:
• Functional requirements: define desired security behavior, have a set of security functional components that provide a standard way of expressing the security functional requirements for a TOE
• Assurance requirements: basis for gaining confidence that the claimed security measures are effective and implemented correctly
Both functional requirements and assurance requirements are organized into classes, being a collection of requirements that share a common focus or intent. Each of these classes contains a number of families which share security objectives, & in turn contain one or more components.

26. Common Criteria Requirements
Functional Requirements
security audit, crypto support, communications, user data protection, identification & authentication, security management, privacy, protection of trusted security functions, resource utilization, TOE access, trusted path
Assurance Requirements
configuration management, delivery & operation, development, guidance documents, life cycle support, tests, vulnerability assessment, assurance maintenance
The CC defines the broad functionality requirements to be addressed as shown, taken from Stallings Table It also defines the assurance requirements, taken from Stallings Table 20.4.

27. Common Criteria
The CC also defines two kinds of documents that can be generated using the CC-defined requirements
• Protection profiles (PPs): define an implementation-independent reusable set of security requirements and objectives for a category of products or systems that meet similar consumer needs for IT security, reflecting user security requirements
• Security targets (STs): contain the IT security objectives and requirements of a specific identified TOE and defines the functional and assurance measures offered by that TOE to meet stated requirements, and forms the basis for an evaluation
Stallings Figure 20.6 illustrates the relationship between requirements and profiles and targets.

28. Common Criteria
Stallings Figure 20.7 shows the security functional requirements paradigm. It is based on the reference monitor concept but makes use of the terminology and design philosophy of the CC.

29. Summary have considered: firewalls types of firewalls configurations
access control
trusted systems
common criteria
Chapter 20 summary.