1. Software Firewalls © N. Ganesan, Ph.D.

2. Module Objectives Explore the features of a software firewall such as Zone Alarm Pro

3. Introduction

4. Features Inbound traffic protection Outbound traffic protection Optional e-mail protection Optional antivirus monitoring

6. Types of Protection and Control Firewall Protection Program Control Privacy Protection Identity Protection

8. Protection Alerts Program alerts Firewall alerts

12. Program Alert Example In the following example, program alert for the ping command will be demonstrated

17. Firewall Event Informs intrusion efforts

19. Zoning for Access Control Internet zone –All computers fall into this category –They are generally unknown computers Trusted zone –Permission is automatically given to access computers in the trusted zone Bad zone –Access to computers in this zone are explicitly denied

21. Disconnecting from Internet Stop button Internet lock

23. Additional Information Use the help feature

25. Overview of ZoneAlarm Pro

27. Firewall Zone Settings High –Explicit permission must be given for access Medium –Access must be blocked explicitly

28. 1 2 3

32. Blocked Zone Advanced control is possible for blocked zones

35. Adding and Removing Networks to and from Zones

36. Assigning Networks Networks can be assigned to trusted and internet zones based on: –Host/site –IP address –IP range –Subnet

43. Computers with Access In the previous example, the computers with the following range of IP address will have network access privilege –130.182.215.0 to 130.182.215.254 The values defined could also be edited

45. Can be removed as well.

48. Rule Based Access Control

49. Purpose Traffic can be controlled based on source address, destination address, protocol and time of the day

51. Expert Firewall Access control (allow of blocks) can be exercised based on the following parameters: –Source –Destination –Protocol –Time

59. Auto-Lock Auto lock can be set to be involved when the computer is inactive for a given period of time

63. Program Access Control

64. Individual Program Control This is perhaps the most frequently used option Access to the network for a program can be set to the following –Allow –Block X –Ask ?

66. Program Control Properties Allow –Allows the program to access the network Ask –Ask each time the program tries to access the network Block –Block access without asking In general, one may want to block the program acting as a server Moreover, whenever in doubt, access could be set to “Ask” As seen in the next slide, new program could also be added to the list of programs that need to be controlled with respect to network access

69. Individual program security.

73. Antivirus Monitoring

75. Email Protection

78. New attachment types can be added.

79. Privacy

80. 1 2 3

81. Customizing cache cleaning.

84. Cookie Control, Ad Blocking and Mobile Code Control

85. 1 2 3

86. Cookie control.

87. Ad blocking.

88. Mobile code execution control.

89. Site Access Control

92. ID Lock

100. Alerts and Logs

107. The End