Perimeter defense: Firewalls, VPNs, and Intrusion Detection

• Chapter discusses perimeter-based defenses, starting with firewalls and technologies to secure network communications

Key points:

• Encrypted tunnels and virtual private networks (VPNs) are illustrated by SSH and IPsec
• Risks of network-accessible services and how to securely provide such services are considered
• Focuses on network defense options and their limitations
• Puts security design principles into practice
• Includes reminders of computer security goals: protecting data and passwords in transit, protecting resources from unauthorized network access, preserving integrity and availability of hosts against network-based threats
• Firewalls at enterprise perimeters keep out unauthorized traffic
• Intrusion detection systems provide awareness and opportunities to ameliorate breaches
• User traffic is cryptographically protected by technologies like IPsec VPNs, SSH, TLS, and encrypted email
• Authentication of incoming packets distinguishes authorized entities and data

Network-accessible services:

• The flexibility and functionality enables by network-accessible services come with security implications
• Remote access to network-based services should be over secured channels, complemented by mechanisms for monitoring traffic and partial control of flow

Encrypted network communications:

• Provide legitimate parties protection for transmitted data and remote access to trusted environments
• Intruders or malicious insiders can use the same tools, making their communications inaccessible
• Reinforces the importance of proper access control, authentication, policy enforcement, and intrusion detection

Packet-Filter Firewalls:

• A network security firewall provides access control functionality to allow/deny and modify data between two networks
• Designed to ensure traffic cannot bypass the firewall in either direction, in theory packets undergo complete-mediation
• Network firewalls serve in perimeter-based defenses, protecting a trusted private (internal) network from an untrusted public (external) network like the Internet

Inbound vs. Outbound Packets:

• Packets arriving from the private network viewpoint are inbound
• packets leaving are outbound
• Filtering inbound packets protects the internal network from the Internet
• Filtering outbound packets allows awareness and partial control of data sent/services accessed (e.g., to enforce security policy, detect unauthorized transfers or data exfiltration)

Packet-Filter Rules and Actions:

• A packet-filter firewall is configured
• Contains a list of rules in the form condition, action
• The action taken for a packet is that specified by the first rule whose condition it satisfies
• Primary Actions include ALLOW (permit), DROP (discard silently), and REJECT (drop and inform source)
• REJECT can send a TCP RST packet or an ICMP "destination unreachable" for UDP
• Additional logging of packets may occur
• Efficiency is based on five TCP/IP header fields (src_addr, src_port, dst_addr, dst_port, prot (protocol)), and ICMP type/code if ICMP

Stateless vs. Stateful Filters:

• Simple stateless packet filter: processes independently of others
• Stateful packet filter: tracks details as packets are processed for later use via a firewall state table
• Stateful filters track TCP connection states to treat packets from established connections differently
• Dynamic packet filters: track connection-related socket details or automatically change rules

Packet-Filtering Rules:

• Mitigate spoofed source IP addresses
• Deny packets from spam servers; allow/restrict incoming connections to mailservers
• Control outbound HTTP requests, allowing responses while rejecting unsolicited inbound packets
• Allow DNS queries and responses
• Address denial of service
• Default Deny - Block packets matching no other rules
• Stateful filtering allows SYN-ACK packets only if a SYN packet was recently sent

Default-Deny Rulesets:

• Motivates default-deny, allowing packets only on explicit accept rules constructed from security policies stating allowed access
• Default-allow, allows packets lacking explicit blocking rules, has tempting usability but is unnecessarily dangerous

Firewalls and Security Policy:

• Packet filter executes rules determining which packets may enter/exit an enterprise network
• Instantiates an internal security policy
• Practicality requires filtering outbound service requests based on destination ports in TCP headers if server ports were guaranteed to be bound to known services

Limitations & other details:

• Firewalls can be used to protect legacy applications within contained subnetworks
• Firewalls act as an enforcement point monitoring incoming access by remote adversaries
• Firewalls instantiate accepted defensive principles like defense-in-depth and isolation
• Traditional firewalls are not intrusion-detection systems
• Firewalls may be bypassed by tunneling, and content-based inspection is precluded by encryption without interception
• Packet filtering may involve dynamic (temporary) rule allowing the out-to-in connection to that port
• NAT allows for complementary services like VPN endpoints, network monitoring, and logging

Dedicated vs. Hybrid Firewalls:

• Dedicated firewalls - smaller attack surface, specialist expertise, architectural features
• Hybrid appliances reduce security boxes, provide multiple functions plus intrusion detection, and deep packet inspections

Personal and Distributed Firewalls:

• Host-based firewalls filter packets into/out of each individual host, supported by major OS
• Use case: End-user machines on untrusted networks
• One default-deny approach is user prompts on first access requests, building allowlists/denylists
• Distributed firewalls have centrally-defined policies distributed

Proxy Firewalls and Firewall Architectures:

• Proxy firewalls, including circuit-level and application-level filters, act as intermediaries between internal clients and external services
• Circuit-level proxy firewalls generically relay connections through a single proxy point and the primary mediation is to allow or deny the connection, and then relay bytes
• Application-level filters carry out application-specific processing through multiple specialized processors for a pre-determined set of authorized applications.

Proxy Firewall Requirements:

Must provide transparency and limited performance degredation

Circuit-Level Proxies:

• Delivered on the enterprise goal of safely facilitating outbound connections

Application-Level Filters:

• Filter traffic using specialized programs for a pre-determined set of applications
• May result in not only blocking packets entirely, but altering payloads

Bastion Hosts:

• A defensive host exposed to a hostile network
• Should be hardened (locked down) by disabling all interfaces
• Provide the function of facilitating controlled Internet access for internal hosts.

Dual-homed host:

• A computer with two distinct network interfaces, and correspondingly two network addresses
• If routing functionality between the two interfaces is disabled, a dual-homed host is suitable for a circuit-level proxy

Enterprise Firewall Architectures:

• A single screening router (router with packet filtering) offers basic protection but limited configurability
• DMZ provides an outer layer in a Defense-in-Depth strategy but must maintain Least-Privilege policies

SSH (Secure Shell):

• Internet Protocol (IP) lacks built-in security services
• SSH provides an encrypted tunnel to get to a shell (and other programs)
• Using TCP for reliable packet transport, SSH provides a security tunnel by its own transport layer protocol, protecting both login passwords sent to remote services, and other data to be transported by TCP
• Any program available on a remote host can be run through the security tunnel and can secure custom-built utilities

SSH Security:

• SSH server authentication, encryption, and integrity protection
• SSH client-to-server authentication
• Connection protocol enables use of a single SSH connection for multiple purposes
• Conformant software must support the client public-key option, but all clients need not have public keys 9TLS set-up (Chapter 9) similarly uses a recognized server public key to establish a fresh session key.

SSH Clients:

• During session negotiation, the SSH server declares which client authentication methods its SSH clients may use, including:
• client password
• Kerberos ticket
• client public key

SSH Servers

• Server authentication involves a server public key called the SSH host key with standard protocols for using a recognized public key for authenticated key establishment
• Clients recognize the host key using trust on first use but the end-user can cross-check the fingerprint

Trust Models for SSH Host Keys:

• Model 1 - client database of SSH server keys stored in a local client database for future use as a trusted SSH server key
• Model 2 - CA-certified SSH server keys uses a CA verification public key to verify offered SSH host keys

SSH Forwarding

• SSH uses port forwarding of TCP ports to redirect data from unsecured applications through a pre-established SSH connection

###VPNs and Encrypted Tunnels VPN Motivation: Plaintext Packets:

• Normal TCP/IP packets are plaintext, where content is visible and alterable
• Idea: Encrypt entire packets at origin devices before network transmission

Tunneling:

• One data stream's journey (the inner) being facilitated by another; the imagery is of a tunnel.
• Not all tunnels provide security, but security tunnels allow secure transit via public/untrusted channels

VPNs:

• A virtual private network unites physically distant users/subnetworks
• secured not by physical isolation but use of encrypted tunnels and special-purpose protocols
• It preserves packet header data used for routing by having encryption take place at the tail of the datagram

Encrypted Tunnels:

• Payload prevented via effective network monitoring and content-based filtering
• If the protocol is blocked by a firewall it may still be sent as the data protocol through an open firewall

VPNs:

• Transport Mode: Host to Host
• Tunnel Mode: Network to Network and Host to Network

IPsec:

• Provides a suite of security services delivered by IKE for key management, AH for authentication only, and ESP that includes encryption and authentication options

ESP

• Allows encryption of IPsec payload and services similar to AH, like MAC

Network and TCP/IP:

• Interconnected via the network
• The Internet Protocol (IP) is the main protocol in the TCP/IP protocol suite for packet-switched networks with a logical address used in network routing
• Packets are delivered through "hops" between intermediate network devices involving a datagram composed of a header to facilitate delivery, and a payload, the data intended for the recipient.
• Network and server communications secured through ports, numbers, TCP set ups and the three-way handshake