Firewalls
The Internet has become a necessary place for us to be. Unfortunately, the Internet harbors many potential threats to our computers, our data, and even our personal information. The first line of defense, and thus the first topic we will discuss in this guide, is firewalls.
Firewalls are the number one device most likely installed by network administrators to prevent malicious attacks. That’s because firewalls are network-based (or host-based) devices that operate by comparing (inspecting) incoming or outgoing network traffic, and they can allow or deny network traffic based on a previously determined set of rules. This is a very powerful form of access control.
Firewall rules are the mechanism by which firewalls identify permitted or blocked traffic. Rules can be based on four different traffic components: port, protocol, address, or direction of traffic (inbound or outbound). For example, if you want to block a specific program from connecting over the Internet, such as Telnet, you can create a firewall rule that blocks telnet.exe or port 23, which is what Telnet uses. If you wanted to block remote access to databases, you would create a rule that blocks port 1433, which is a port most commonly used for Microsoft SQL Server connections. (We will cover firewall rules in another section.)
Firewalls can be software- or hardware-based. Often, individual personal computers have software-based firewalls, such as the built-in Windows Firewall, while companies employ hardware-based firewalls for network protection, ease of administration, and single point of entry. Software-based firewalls are commonly called “host-based firewalls”.
Routers
Routers are devices that forward traffic between networks using an internal routing mechanism called a routing table (or some other routing methodology), which is stored on the router, and the packet header, which contains IP address information for the intended recipient. Simply put, a router works by reading the information in the packet header of the data, consulting its routing table to find the recipient (or some other intermediary network), and then sending it on its way. You can think of the packet header as a shipping label for the packet package and the router as a shipping mechanism that reads the label and diverts it to New York, or wherever its ultimate destination happens to be.
As far as network hardware is concerned, a router is a “smart” device that is capable of understanding the packets that pass through it. Some devices, such as hubs, are “dumb” devices that are unaware of the packets traveling through them, forwarding all traffic without abandon. Other network devices, such as switches, are “smart” devices as well, although they perform a slightly different function.
Switches
Switches are another type of network component, and they are commonly confused with routers. The difference between switches and routers is that while routers connect different networks, switches connect computers within a network. (Hubs, mentioned previously in the Routers section, are “dumb” versions of switches that simply forward traffic to all hosts connected to it.) A switch can be used to control traffic and forward certain packets to select recipients (rather than to everyone, as in the case of a hub), which is far more useful in the realm of security.
To secure a switch and ensure it is not accessed physically, you should be sure to disable unused ports by configuring it to do so. But be careful! Don’t disable the port you’re using to configure it!
Load Balancers
Often, it is vital for a computer system to be able to handle the traffic of many users accessing services all at once. If a system cannot handle the amount of traffic, it will deny users access, provide unacceptably slow service, or even crash. That is where load balancers come in.
Load balancers distribute traffic across multiple systems to provide redundancy. This is especially important in the case of web servers that host popular websites, where traffic can spike during massive sales or even attacks. Load balancers are usually found in server clusters where software provides the load balancing service; however, load balancing can be hardware-based as well, as in the form of multilayer switches.
Proxies (Proxy Server)
When browsing the Internet at work, you might find you cannot access some websites. There may be many reasons for this, but one of them (and the most likely) is that your web content is being delivered to you through something called a proxy server.
Many corporations have rules that require content filtering of some sort when browsing the Internet. A proxy, or proxy server, is used mainly as an intermediary to provide web proxy services. What does this mean? When users browse the Internet, they request web pages through the proxy server (since it is an intermediary or a “go-between” between the user’s computer and the Internet) and the proxy server checks its filtering rules to ensure the user is able to access the resource. Then, if the user has sufficient permissions, the proxy delivers the page or content. This is a method of filtering and access control: if, perhaps, all social networking sites at your workplace are blocked for security reasons, and you were sitting at a work computer behind that proxy server trying to browse to a well-known site, such as Facebook or Twitter, those websites would come back to you as blocked sites.
Proxy servers have many alternate uses: web proxies are the most common today. Proxy servers may also be used to cache content for later requests for the same content by different users. In addition, computers using proxy servers are anonymous – open proxies allow any user to connect to it over the Internet and thus make requests through it (browse) anonymously.
Web Security Gateways
While proxy servers typically filter URLs that users access over the Internet, it is also important to consider the potential security problems inherent in the content being delivered by those websites.
Web security gateways, or secure web gateways, can help prevent malware attacks that originate from websites. You may wonder, “Why would I need a web security gateway? Don’t my anti-virus product and proxy server protect me?” The increasingly apparent problem with relying on only anti-virus products and proxy servers to provide protection against web-based threats is three-fold, as follows:
- Anti-virus products update their definitions on a cycle, usually daily, which does not guarantee protection against real-time threats;
- Trusted websites can be compromised and converted into “drive-by” malware depositories at any time; and
- Some web pages can include dynamic content to bypass website categorization (and therefore filtering) and present users with undesirable content.
Web security gateways work by performing content filtering and real-time content scanning for both inbound and outbound traffic. This means that when users visit websites, create secure connections (SSL), or encounter dynamic content on the Internet, such as user-generated content on a social networking site, users’ computers and data are always protected against potential threats.
VPN Concentrators
When many users need to connect to corporate resources while away from the office, companies may find it useful to employ VPN concentrators, or VPN gateways. These devices allow remote users to create a connection to the corporate office that encrypts all data that flows between the remote user and the office. This link can function regardless of the physical location, and it protects data even as it travels over unsecured public networks. The encrypted links require no special equipment for the remote client. As these connections are virtual, rather than physical, the connections are known as Virtual Private Network (VPN) connections.
VPN concentrators are network appliances that provide multiple secure connection points for remote users. The device is exposed to the Internet using only one port (443) and supports multiple concurrent VPN connections, usually 25 or more, up to approximately 500 users each, depending on the hardware. While connected to the secure VPN connection, users can then access their company resources as if they were sitting at their computers at work. The connection is encrypted so users do not have to worry about sensitive information being lost over the Internet.
VPN concentrators usually support authentication mechanisms, such as Active Directory, LDAP, and RADIUS, and provide database support.
NIDS and NIPS
It is vital that attacks are caught and stopped before they can happen, if possible. That is why many companies use NIDS or NIPS (network intrusion detection systems and network intrusion prevention systems, respectively).
NIDS provide a mechanism for detecting (and only detecting, not preventing) network-based attacks, and alerting administrators to said attacks, by examining network traffic. Such attacks can occur in the form of port scanning, packet flooding, etc. NIDS come in the following two forms:
- Anomaly-based
- Signature-based
Anomaly-based NIDS monitor network traffic and detect whether certain traffic patterns fall outside the accepted limits. Signature-based NIDS compare network traffic with known attack “signatures” (i.e., patterns) and analyze it to determine whether there are any recognized attacks occurring. All forms of NIDS log information about anomalous network activity. A few important distinctions are as follows:
- NIPS provide all the same services as NIDS, but they also attempt to stop an attack from happening.
- NIDS and NIPS can come in software-based or hardware-based forms.
- NIDS is not the same as HIDS (host-based intrusion detection systems).
Protocol Analyzers
Administrators sometimes find it necessary to intercept traffic en route and review it for potential attacks. Certain devices (or software) called protocol analyzers allow this. Protocol analyzers can be software- or hardware-based, and they intercept, decode, and analyze network packet information, such as IP address. Protocol analyzers help detect network intrusions and Internet and network abuse, and log network traffic information for later use. Protocol analyzers are also called packet sniffers.
Spam Filters
E-mail is a critical function of a corporation, and spam e-mails simply waste time and productivity, and may contain malicious threats. Spam filters can help cut down on the amount of junk e-mail and malware infesting company mailboxes.
Spam filters are software-based and they operate by analyzing e-mail messages for specific data that indicates unwanted mail. Such indicators include the following:
- Suspicious subject lines
- Suspicious image content
- Common phrases indicative of advertisements
- E-mail messages originating from blacklisted domains or suspicious senders
- Multiple e-mail messages from the same origin or with the same content, indicating a malware infection
Spam filters can remove an e-mail entirely or replace its contents, depending on its configuration. A unique balance must be carefully determined between aggressive filtering and ensuring that minimum false positives occur.
Web Application Firewalls
Many companies have web-facing applications that can present vulnerabilities if not programmed or configured correctly. Web application firewalls (WAFs) help to assist in mitigating this issue. WAFs differ from regular network firewalls in that WAFs monitor network traffic and apply firewall rules to HTTP traffic (where network firewalls control many types of traffic) to help prevent attacks such as cross-site scripting and SQL injections.
URL Filtering
When administrators need to control the websites users visit while on company computers, they can implement URL filtering. URL filtering is either software- or hardware-based. It is usually performed at a proxy server (see Proxies section).
Content Filtering
Content filtering is a major component of e-mail and web security on any network. When filtering e-mail – specifically using spam filters – content filtering is the most common type. Content filters can use the following e-mail fields and information to identify spam:
- Mail header (Subject)
- Body
Web content filtering is used to keep users from viewing inappropriate content or sites, thus improving productivity and computer security. Web content filtering is software-based, usually implemented on proxy servers.
Content Inspection
Similar to content filtering, content inspection examines information and determines its suitability according to preset rules or signatures. However, content inspection can analyze files and attachments and determine whether they are malicious, rather than block files due to simple rules such as file type.
Content inspection differs from protocol analyzers (packet sniffers) in that content inspection can inspect a file, whereas packet sniffers only read network packet information. Content inspection can occur in many places on a network, such as the following:
- Web security gateways
- Proxy servers with anti-virus
- Firewalls