Chapter 7 - 06 - Understand Different Types of Proxy Servers and their Benefits - 02_ocred_fax_ocred.pdf

Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls Proxy Servers vs Packet Filters QO Proxy...

Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls Proxy Servers vs Packet Filters QO Proxy server examines the data payload Q Packet filters examine the routing of the packet information of the packet. Q Creates detailed log file listings, since OQ Logs only the header information of the | they scan the entire data of IP packets IP packets QO Restructures the packet with new Q Allows or blocks the data depending on R4 source |P data the packet filter rules Q In the case of failure of a proxy server, QO of failure In the case of failure of a packet filter, all { all network communications would packets may be allowed to pass through cease the internal network B T Copyright © by EC-{ All Rights Reserved. Reproduction ReproductionIs Strictly Prohibited Proxy Servers vs Packet Filters Proxy servers and packet filters are used together in a firewall and work in the application layer of the OSI model. They mainly differ in terms of the inspection of different parts of IP packets and the way they act on them. = A proxy server creates detailed log file listings because they scan the entire data part of the IP packets, whereas a packet filter logs only header information of the IP packets. = A packet filter simply allows the data packet to pass through to the destination if it matches the packet filter rules. On the other hand, a proxy server restructures the packet with new source IP data. = In the case of failure of a proxy server, all network communications would cease, whereas in the case of packet filter failure, all packets may be allowed to pass through to the internal network. Module 07 Page 883 Certified Cybersecurity Technician Copyright © by EG-Council Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls Types of Proxy Servers TB Transparent Transparent Non H= Non Transparent Transparent ©© SOCKS Proxy SOCKS Proxy Proxy Proxy PROXY SERVER__. N\ (AE) \ Anonymous Proxy Reverse Proxy Copyright © by by & Al Rights Reserved. Reproductionisis Strictly Prohibited Reproduction Types of Proxy Servers Discussed below are various types of proxy servers. Module 07 Page 884 EG-Council Certified Cybersecurity Technician Copyright © by EC-Council Certified Cybersecurity Technician Exam 212-82 Network Security Controls - Technical Controls Transparent Proxy Q @ A transparent proxy is a proxy through which a client system connects to a server without its knowledge It is configured to be entirely invisible to an end user With a transparent proxy, all the web clients must be configured manually Copyright © by Al Rights Reserved, ReproductionIs Strictly Prohibited. Transparent Proxy A transparent proxy is a proxy through which a client system connects to a server without its knowledge. It is configured to be entirely invisible to an end user. It is placed between two networks, similar to a router. A firewall tracks the outgoing traffic and directs it to a specific computer, such as a proxy server. Network administrators need not configure the client’s software with transparent proxies. With a transparent proxy, all the web clients must be configured manually. Module 07 Page 885 Certified Cybersecurity Technician Copyright © by EG-Council Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls Non-transparent Proxy O Require client software to be configured to use the proxy server g OQO The client is made aware of the proxy’s existence QO They are difficult to configure, as each client program must be set up to route all requests to a single port 01 02 03 Group An.notatmn An.notatxon Typfa Media Typfe BERTESEIR BYAIEEIiR o duction An?nyx:nxty A.n.onyx.mty Sexrvices Services Transformation Filtering Non-transparent Proxy Non-transparent proxies are also known as explicit proxies and require client software to be configured to use the proxy server. Non-transparent proxies are difficult to configure, as each client program must be set up to route all requests to a single port. However, these proxies provide a greater level of security than other types. A non-transparent proxy is one that modifies a request or response, and the client is made aware of the proxy’s existence. The entire requested URL is sent to the proxy that has the host name. It provides added services to the user agent such as group annotation services, media-type transformation, protocol reduction, and anonymity filtering. Module 07 Page 886 EG-Council Certified Cybersecurity Technician Copyright © by EC-Council Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls —— K U ) Y )y LT e SOCKS Proxy O The SOCKS is an Internet Engineering Task Force (IETF) standard O QO Itis a proxy server that does not have the special caching abilities of a caching HTTP proxy server O The SOCKS proxy server does not allow external network components to collect information on the client that generated the request —] !.m = Ea E N F - N \ The SOCKS package includes &2 “L e e, i comainst:he - o foll g A SOCK server for Q A client program Q A client library for SOIIpOOL LOIIpOTOL the specified such as FTP, Telnet, SOCKS operating system or an Internet (0s) browser Copyright © by All Rights Reserved. ReproductionisIs Strictly Prohibited SOCKS Proxy SOCKS, an Internet Engineering Task Force (IETF) standard, is a proxy server that does not have the special caching abilities of a caching HTTP proxy server. The SOCKS protocol internally uses “sockets,” which help track all the individual connections of clients. The function of a SOCKS server is to handle all clients’ requests inside the organization’s firewall; based on the requested Internet destination or user identification, it allows or rejects connection requests. If the requested connection is valid, then it “binds” the request, and information is exchanged with the usual protocol (e.g., HTTP). The SOCKS proxy server does not allow external network components to collect information on the client that generated the request. The SOCKS package contains the following components: = A SOCK server for the specified operating system (OS) = Aclient program such as FTP, Telnet, or an Internet browser = Aclient library for SOCKS Module 07 Page 887 Certified Cybersecurity Technician Copyright © by EG-Council Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls Anonymous Proxy O An anonymous proxy does not transfer information about the IP address of A~ ~— its user, thereby hiding information about the user and their surfing interests & e - [+ Pros Pros Cons eSS e ——— — ————— ] O Auser A user can surf the Internet OQO Using this type of proxy server privately by using an may decrease the speed of anonymous proxy loading a web page on to the Q with the help of an browser anonymous proxy server, a OQ Using anonymous proxy user can access even servers to bypass Internet censored websites censorship is illegal in some countries Anonymous Proxy An anonymous proxy does not transfer information about the IP address of its user, thereby hiding information about the user and their surfing interests. A user can surf the Internet privately by using an anonymous proxy. With the help of an anonymous proxy server, a user can access even censored websites. The use of this type of proxy server may decrease the speed of loading a web page on to the browser. Further, the use of anonymous proxy servers to bypass Internet censorship is illegal in some countries. Module 07 Page 888 EG-Council Certified Cybersecurity Technician Copyright © by EC-Council Certified Cybersecurity Technician Exam 212-82 Network Security Controls — Technical Controls Reverse Proxy A reverse proxy is usually situated closer to the server(s) and will only return a configured set of resources It can optimize content by compressing it to speed up loading @ The client is unaware of the presence of a reverse proxy A reverse proxy server is an intermediate server that is located between a client and the actual web server Copyright © by k l. All Rights Reserved. Reproductionis Strictly Prohibited. Reverse Proxy A reverse proxy is usually situated closer to the server(s) and will only return a configured set of resources. It can optimize content by compressing it to speed up loading. The client is unaware of the presence of a reverse proxy. A reverse proxy server is an intermediate server that is located between a client and the actual web server. Note: Transparent proxy and anonymous proxy are open proxies also known as forwarding proxies. Module 07 Page 889 Certified Cybersecurity Technician Copyright © by EG-Council