“Cyber Attacks Hit 75% of Global Enterprises in 2009” [Symantec, Feb-2010] “IT Security spending to outpace other IT spending in 2010” [Gartner Research, Dec 2009] Today, increasing attention is paid to firewall rule-set quality due to regulations such as the Sarbanes-Oxley act, CobiT framework, the Payment-Card Industry Data Security Standard (PCI DSS) and the NIST standard 800-41. All these regulations include specific sections dealing with firewall configuration, management and audit. The document will begin with current analysis of Vulnerabilities in Internet Firewalls. Various types of firewalls which are operational today will be examined and cross reference each firewall operation with causes and effects of weaknesses in that operation, analyzing reported problems with available firewalls. Detailed analysis and comparison will be done in terms of cost, security, operational ease and implementation of Open source packet filter (PF) firewall, Checkpoint SPLAT and Cisco PIX. Various policy anomalies in Distributed firewalls will be studied to make firewall scalable. Packet filtering mechanisms in various firewalls will be studied and comparative analysis will be done. Various common configuration errors in installation/management of network firewall will be studied and summarized. Conclusion will be made to design a structured method for configuring firewall rulebase to be correct, consistent, complete, and compact. Introduction Network Firewalls protect a trusted network from an un-trusted network by filtering traffic according to a specified security policy. A firewall is often placed at the entrance of each private network in the Internet. The function of a firewall is to examine each packet that passes through the entrance and decide whether to accept the packet and allow it to proceed or to discard the packet. A firewall is usually designed as a sequence of rules. A firewall's basic task is to regulate some of the flow of traffic between computer networks of different trust levels. Typical examples are the Internet which is a zone with no trust and an internal network which is a zone of higher trust. A zone with an intermediate trust level, situated between the Internet and a trusted internal network, is often referred to as a "perimeter network" or Demilitarized zone (DMZ). A firewall’s configuration contains a large set of access control rules, each specifying source addresses, destination addresses, source ports, destination ports, one or multiple protocol ids, and an appropriate action. The action is typically “accept” or “deny.” Some firewalls can support other types of actions such as sending a log message, applying a proxy, and passing the matched packets into a VPN tunnel. For most firewalls, the rule set is order-sensitive. An incoming packet will be checked against the ordered list of rules. The rule that matches first decides how to process the packet. Due to the multidimensional nature of the rules (including source/destination addresses and ports), the performance of a firewall degrades as the number of rules increases. Commercially deployed firewalls often carry tens of thousands of rules, creating performance bottlenecks in the network. More importantly, the empirical fact shows that the number of configuration errors on a firewall increases sharply in the size of the rule set. A complex rule set can easily lead to mistakes and mal-configuration. Despite their critical role, firewalls have traditionally been tested without well-defined and effective methodologies. Currently, a diverse set of firewalls is being used. Because it is infeasible to examine each firewall separately for all potential problems, a general mechanism is required to understand firewall vulnerabilities in the context of firewall operations. The firewall data flow model we presented gives an overall description of firewalls by detailing the operations they perform (depicted in figure 1). When a packet is received by a firewall, it first undergoes link layer filtering. Then it is checked against a dynamic rule set. The packet then undergoes packet legality checks and IP and port filtering. Finally, network/port address translation is performed. Sophisticated firewalls also reassemble packets and perform application level analysis. After a routing decision is made on the packet, out-bound filtering may also be performed. Each of these operations is optional, and the order in which the packet traverses them may also differ in different firewalls. |
Read more... Add new comment
