Firewall Security

DoS Attack Prevention Methods

Just as hackers use many DoS attacks to hamper your network's performance, you can use many solutions to prevent or at least hinder a hacker's DoS attack. The following are common solutions used to detect and prevent DoS attacks Performing packet filtering Using an intrusion-detection system (IDS) Using routing protocols with authentication Running detailed audits and logs The first solution that you should implement is filtering. You can use something as simple as ACLs on a Cisco router, or...

Examining TCP Control Bits

The second approach is to examine transport layer information about the connection to determine whether it is part of an existing connection and, if so, allow the returning traffic back to 200.1.1.1. With TCP, this can be done by examining the control flags in the TCP segment header. These are shown in Table 2-4 and are defined in RFC 793. Note that multiple codes, commonly calleflags, can be sent in the same segment header, such as SYN and ACK (SYN ACK), or FIN and ACK (FIN ACK). Initiates a...

Authentication Process

One of the features of AGFs is that they typically allow you to authenticate connection requests before allowing the traffic to an internal or external resource. This enables you to authenticate the user requesting the connection instead of the device. This is one disadvantage that packet-filtering and stateful firewalls have They examine only Layers 3 and 4 information and, thus, can authenticate only the Layer 3 address of a device. Figure 2-16 shows a simple example of an AGF using an...

Enhanced Firewall System Design

The second firewall system design is shown in Figure 2-29. As you can see, it has more components and rectifies some of the security deficiencies in the simple firewall system design. I examine the perimeter router component first. As in the last example, the perimeter router packet-filtering firewall is performing basic filtering of traffic as it comes into the Internet. Nothing is different in this example except for what the bottom-right IDS device is doing monitoring both the external...

Figure 212 Stateful Firewall Filtering Example Part

Stateful Firewall Filtering Example Part 2 Figure 2-13. Stateful Firewall Filtering Example Part 2 Assume that 170.1.1.1 sends traffic to 200.1.1.10. As shown in Figure 2-12, this traffic is dropped. Now assume that 200.1.1.10 opens a web connection to 170.1.1.1, as shown in the bottom part of Figure 2-12. When 200.1.1.10 does this, it uses a TCP segment with a source port of 10,000 and a destination port of 80. It uses a SYN flag in the control field. When the stateful firewall...

Figure 28 Packet Filtering Firewall Example Initiating Connections

However, what happens if someone inside the network, such as 200.1.1.10, tries to access this external device (170.1.1.1) Assume that this is an HTTP request to 170.1.1.1, which has a web server running on it. HTTP uses TCP, and TCP goes through a three-way handshake to establish a connection before data is transferred SYN, SYN ACK, and ACK. Initially, 200.1.1.10 sends a SYN to establish a connection. With TCP (and UDP), a source port number is chosen that is greater than 1,023, which...

Figure 228 Simple Firewall System Design

In this example, a perimeter router with basic packet filtering screens traffic as it enters the network. A standalone IDS device is used to detect attacks that the perimeter packet-filtering firewall did not filter. The traffic then is processed by a stateful firewall. The stateful firewall has set up three security levels low for the Internet side, medium for the DMZ, and high for the internal network. A security rule was added on the stateful firewall to allow traffic from the Internet to...

Types of DoS Attacks

Hackers can use many types of DoS attacks against your network. Some of these affect the performance of a particular service running on a server, and some drastically can affect the performance of all the machines on a particular network segment. Because there are literally hundreds of DoS attacks, the following list is limited to some of the most common ones An application attack is simply an attack against an application running on a server.

Virus Trojan Horse and Worm Attacks

Viruses, worms, and Trojan horses are probably the most well-known attacks on computer systems because these are the most publicized, as well as the most likely to affect the general user public. Many different views actually exist regarding the definition of these three types of attacks. Generally, a virus is a program or a piece of code that is loaded onto and run on your computer without your knowledge. Many viruses also replicate themselves to spread their damage.

Unstructured and Structured Threats

General methods of security threats fall under two categories Unstructured threats Structured threats An unstructured security threat is one created by an inexperienced person who is trying to gain access to your network a wannabe hacker. A good security solution easily should thwart this kind of attack. Many tools available to anyone on the Internet can be used to discover weaknesses in a company's network. These include port-scanning tools, address-sweeping tools, and many others.

Figure 223 Security Level Example

In this example, a firewall is used to separate different areas of a network. The firewall has the following four interfaces A connection to the Internet, assigned a low security level A connection to the DMZ, where public servers are located, assigned a medium security level A connection to a remote company that is working on a project for them, assigned a low security level A connection to the internal network, assigned a high security level This company has assigned the following rules Low-...