Firewall Management Best Practices

Introduction to Firewalls

• Firewalls are critical for protecting networks when connecting to the internet.
• They prevent unauthorized intrusion.
• Firewalls can be hardware, software, or a combination.
• They are configured according to an organization's security needs.
• Firewalls ensure all communication between the organization's network and the internet complies with the organization's security policy.

Learning Outcomes

• Firewall Best Practices
• Types of Firewalls

Concept of a Firewall

• Protecting a network against intrusion is crucial.
• Effective internet security involves placing a Firewall between the local network and the internet.

Firewall Best Practices

• Labs will cover common best practices.
• Best practices are defined procedures for optimal results.
• Firewall best practices focus on increasing security and reducing risk.
• Consider best practices before implementing a firewall.
• ISO 27002 provides a reference for best practices in implementing security controls.

Firewall Best Practices - While Working with Firewalls

• Be aware of the principle of Least Privilege for firewall administration.
• Firewalls allow for multiple admins with varying access levels.
• Grant only necessary privileges to admins.
• Example: Helpdesk users need read-only access to DHCP logs for troubleshooting.
• Solution: Create a user role with limited access.

Firewall Best Practices - Principle of Least Privilege

• Firewall traffic rules and exceptions should be implemented with the principle of Least Privilege.
• Allow only necessary hosts, ports, and applications for a specific business requirement.
• Consult application/system documentation for complete understanding of service implications.
• Allow only necessary traffic for higher security.
• Consider incoming and outgoing traffic.

Firewall Best Practices - Example: Windows Server, Certificate Services

• Example: Windows Server, Certificate Services, and ports.
• Application protocol (RPC, SMB), TCP, Ports (ex. 135, 445/239).

Applications

• By reviewing documentation, proper firewalling requirements can be understood.
• Avoid guesswork or mistakes to prevent vulnerabilities.

Firewall Best Practices - Often Software and Hardware Vendors

• Vendors often provide network diagrams showing traffic flow and port requirements.
• Example: Microsoft Office Communication Server 2007, external user access.
• More on DMZs later in the course.
• Firewall vendors provide requirements documentation.

Firewall Best Practices - FortiGate open ports

• Various services and their associated ports used by FortiGate products.

Firewall Best Practices - Outgoing ports

• FortiAnalyzer, FortiAuthenticator, FortiCloud, FortiGate, and their associated outgoing ports.

Firewall Best Practices - Perform regular risk assessments

• Attackers exploit mistakes and oversights in firewall changes.
• Scanning the firewall before and after changes ensures they work as intended.
• Regular vulnerability assessments should also be conducted for changes.
• Use nmap (in labs) to scan before/after changes to verify expected outcome.

Firewall Best Practices - Change Management

• Firewall changes can increase risk to organizations.
• A formal change management process can manage these risks while allowing necessary changes.
• Changes involve addition, modifications, or removals of services impacting IT services.

Firewall Best Practices - Best Practices for Firewall Changes

• Leadership, security, and service stakeholders; and auditors should evaluate the changes.
• Testing in a test network verifies change effectiveness.
• A backout plan for unexpected outcomes is required.
• Confirm safe rollback procedures.
• Document all changes and details (comments/notes in the firewall itself).

Firewall Best Practices - Rule Cleanup

• Firewall exceptions accumulate over time.
• Regularly review and remove unnecessary rules to reduce attack surface.
• Clean up ports opened during troubleshooting and revert unused changes.

Firewall Best Practices - Logging

• Ensure firewall logging is enabled and logs are reviewed.
• Preserve logs to facilitate forensic investigations of potential attacks.
• Logs are often sent externally (e.g., using SYSLOG).

Firewall Best Practices - Alerting

• Configure alerts for suspicious traffic or patterns for quick investigation.
• Tune alerts to avoid "alert fatigue" for incident responders.

Firewall Best Practices - Patches and Updates

• Security devices (like firewalls) can have vulnerabilities in their software.
• Stay updated on disclosed/patched vulnerabilities.
• Subscribe to vendor security email lists.

Firewall Best Practices - Palo Alto Networks Security Advisories

• Palo Alto Networks provides security advisories on vulnerabilities and mitigations.
• Specific advisories mentioned include vulnerabilities (memory corruption, mitigation bypass) in PAN-OS for various versions.
• Details about fixed versions, affected versions, and associated CVE numbers are provided for each advisory.

Firewall Best Practices - Secure remote management

• Ensure remote management is only possible over encrypted protocols (HTTPS or SSH).
• Require two-factor authentication for remote admin interfaces.
• Only expose remote admin interfaces to trusted networks such as internal IT network segments or a VPN.

Next Generation Firewall (NGFW)

• NGFWs are part of the third generation of firewall technology.
• They serve the same purpose as traditional firewalls, acting as network gateways.
• NGFWs are stateful for TCP connections and can operate at multiple OSI layers to apply security.
• NGFWs often include application awareness.

Next Generation Firewall (NGFW) - Filtering decisions

• NGFWs make filtering decisions using source/destination IP, source/destination port, applications, protocols, and users.
• Specific examples of how NGFWs filter traffic are given (e.g., block peer-to-peer, allow only HTTP/HTTPS, block TLS without valid certificates).

Next Generation Firewall (NGFW) - Resources

• NGFWs typically require more resources for their functions, security features affecting performance.
• Hardware tiers and software licensing can limit throughput.
• High cost for specific hardware and licensing options

Next Generation Firewall (NGFW) - Unified Threat Management (UTM)

• A single gateway device combining multiple security controls is called UTM.
• Features like Intrusion Detection Systems (IDS) which detect malicious behavior, Intrusion Prevention Systems (IPS) which take action, and inline antivirus for file inspection.

Next Generation Firewall (NGFW) - Additional Features

• DLP (Data Loss Prevention) prevents sensitive data breaches
• Web proxy and web content filtering for categorized websites; including blocking inappropriate web sites.
• Email filtering for removing spam/malicious attachments and DoS attacks.

Next Generation Firewall (NGFW) - Palo Alto Networks Single-Pass Architecture

• Palo Alto Networks' firewall architecture (single-pass design) is detailed.
• The policy engine, content-ID, app-ID, and user-ID features, in conjunction with traffic classification and user/group mapping.

Web Application Firewall (WAF)

• Web Application Firewall (WAF) is a firewall designed to protect web applications.
• WAFs examine HTTP traffic for attacks like buffer overflows, XSS, and SQL injection.
• Often deployed as a reverse proxy.

Zero Trust Security Model

• Zero Trust security shifts away from perimeter security towards a more comprehensive approach where every resource and interaction is evaluated and authorized.
• It inspects all possible traffic, identifies users and applications, and keeps trust close to the resources.
• Traffic from North to South and East to West is monitored.
• Internal resources are protected against lateral attacks.

Summary - Firewall Best practices

• Principle of least privilege
• Trust but verify security
• Rule cleanup
• Change management
• Logging and alerting.
• Patches and updates.
• Secure remote management.

Summary - Types of Firewalls

• Static Packet filtering describes a very basic firewall functionality.
• State full Packet Inspection (SPI) is an advanced approach tracking the state of network connections..
• Next Generation Firewall (NGFW) extends functionality beyond traditional traffic control.
• Web Application Firewall (WAF) protects web applications by filtering specific web traffic.
• The Zero Trust security approach emphasizes always verifying/authenticating.

Lab 1

• Download, configure, and power on the VM for Lab1.
• This lab is cumulative.
• VM LAN segments will be used in subsequent labs.
• The VMware LAN segment is a private network shared for lab network simulation.

Lab 1 - Branch Office

• Information on the LAN, and the corresponding Devices used in the given lab. IPv4 addresses IP, DNS, and DHCP client information are given.