Post on 18-Oct-2020
IT E74 WEB TECHNOLOGY
Department Of Information Technology 1
UNIT V
Internet Security: The Internet-Understanding Firewalls-Hackers-TCP/IP from a security
view point –sockets and services-Encryption. Firewall Technology-packet filtering-Network
Address Translation-application level proxies-VPN- ideal firewall.
INTERNET SECURITY
5.1 THE INTERNET – UNDERSTANDING FIREWALLS
In today‟s world, there are number of threats like viruses, Trojans, hackers etc.
To protect our system from all the above mentioned threats we use firewalls.
A firewall limits the access which software applications have to the operating
system services, and consequently to the internal hardware resources found in a
computer, much as a car firewall limits access of heat, or even fire, to the
passengers of the vehicle.
The reason that application firewalls are needed in today's internet and data-sharing
world is that the other types of firewalls in existence do not control the execution of data,
only of the flow of data to the computer's processor.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.1.1 Hardware firewalls
The computer's hardware resources are essentially: the processor, the RAM,
and the hard disk. Virtual memory is the content of RAM that is temporarily
written onto the hard disk in order to free the RAM chips to hold other
content or to supply other data for mathematical processing. For this reason,
the virtual memory is open to internet attack just as the RAM is.
Since several ports of a computer need to be open at various times in
order for applications to be allowed to bring data in to the user and send it
out from the user, (applications such as internet browsers (http - hyper-text
transfer protocol) , e-mail programs (smtp - simple mail transfer protocol)
and FTP programs (ftp - file transfer protocol) ), most types of firewalls are
necessarily unable to stop the flow of unwanted content via the ports that they
have been configured to allow.
Hardware firewalls are connected to the computer where the phone-line modem or
cable modem allows data into the computer and out of the computer. They
are external hardware. They can be configured such that only data bound for
designated ports (virtual ways in/out of the computer) are routed to the OS
services.
A port is essentially only an abstract address since the true data pathway is the
cable itself and the modem's jack. Ports are authorizations (in the OS) of data
flow to the OS.
The hardware firewall's function is, therefore, to filter out data coming from
restricted origins and thus keep it from accessing the Operating System's services.
The net result is that only data bound for ports which were set by the user to be
open (in the firewall's configuration) will always be passed on to the OS
services, and to the computer's hardware resources.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.1.2 Soft ware firewalls
Let us now contrast software firewalls (personal firewall). They attempt to
perform the function of a hardware firewall, but in the form of running software
which is configured to filter out data traffic designated for restricted ports.
Ideally, only the data bound for the desired ports would be passed on to the
processor.
An application layer firewall is a firewall software operating at the application
layer of a protocol stack. Generally it is a host using various forms of proxy
servers to proxy traffic instead of r outing it.
As it works on the application layer, it may inspect the contents of the traffic,
blocking what the firewall administrator views as inappropriate content, such as
certain websites, viruses, attempts to exploit known logical flaws in client
software, and so forth. An application layer firewall does not route traffic
on the network layer, but from the application to the OS.
In this context, the hardware resources are the bottom layer, the BIOS is the 2nd
layer,
the Operating System Kernel and OS ser vices are the 3rd layer, and the
application layer firewall is running as a 4th layer, at the same level as other
applications such as word processors or internet browsers.
5.1.3 Firewall vulnerabilities
An application layer firewall is, then, a software firewall. Unfortunately,
firewall-type applications developed for Microsoft Windows, Macintosh, or
other operating systems may contain the type of logical flaws exploited by
computer system hackers.
A vulnerability, or logical flaw, in the running firewall software might be
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
exploited in the very same way that internet browser code vulnerabilities or
e-mail software code vulnerabilities often are. What this amounts to is that
the software firewalls of descriptions, software- and application layer -,
might be circumvented by malicious software through exploitation of the
firewalls' own logical software coding flaws.
In that case, an attack written to exploit a software firewall's vulnerability
could also include an attack on the internet browser and make it through to the
browser despite the firewall. In that event there would normally not be any
protection against the attack on the Microsoft, the author of the Windows OS,
has included in its latest service pack ( SP2), for Windows XP, a feature which
they call Data Execution Prevention (DEP).
Since new data must be executed as instruction code, using system services, in
order to be harmful to the existing data or virtual memory on a hard disk,
preventing its execution would seem to be the protection needed against exploit
code.
A processor capable of enforcing DEP, (as of the time of writing, July 2005, being
64-bit processors only), would consider the data portion of RAM to be non-
executable, or NX (referred to as 'No-Execute' by AMD), or XD (referred to
as eXecution Disable by Intel). RAM designed for data only. Instruction
code is only intended by Windows and other operating systems to be run from
the instruction code area of RAM.
The DEP is a good start, but it only addresses the problem of buffer overflow
exploits of the logical software coding flaws which we refer to as
vulnerabilities. Such an exploit usually writes executable code in the data area
of RAM and then overwrites legitimate code in the protocol stack such that
when the system service returns to retrieve the next instruction, the substituted
instruction tells the processor to look in the data area for the details -- and the
details are malicious.
However, there still lie in the internet and computer arenas such other significant
threats to data and to privacy as viruses, keystroke logger s, Trojan horse
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
viruses, spying software, advertisement-generating software and other forms
of maliciously designed software code which DEP will not address.
If discretion could be given to the OS services to refuse to run code which
is either originating from a RAM buffer overflow, or is originating
from unwanted software not needing to exploit vulnerabilities in order
to achieve its damage or its theft of information, then perhaps the protection
loophole would close -- at least more tightly.
This is the purpose of an application firewall -- to close the loophole around the
OS more tightly and to make the chance of unwanted code execution extremely
slim.
Windows users have the benefit of one such application firewall software,
OSsurance, developed in 2005 by OS Security, which functions much as DEP
protection.
In addition, however, this software refuses to allow the system services to run
executable files which have not purposely been added to an inventory of accepted
programs by the user when the software was installed, it refuses the running
of DLLs which have been substituted or alter ed, and it refuses to allow the
running of a program which has changed itself in name or in content.
This more comprehensive type of firewall has not yet been made available to
the other major operating systems (see buffer overflow).
Various other combinations, or omissions, of components of this application
firewall approach exist, with varying degrees of success. Anti- Execute, developed
by Faronics, is one example of using selected components of an application
firewall. DEP, by Microsoft, is another.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.2 HACKERS
Hacker means someone who finds weaknesses in a computer or computer network,
though the term can also refer to someone with an advanced understanding of computers
and computer networks. Hackers may be motivated by a multitude of reasons, such as
profit, protest, or challenge. The subculture that has evolved around hackers is often
referred to as the computer underground but it is now an open community. While other
uses of the word hacker exist that are not related to computer security, they are rarely
used in mainstream context. They are subject to the long standing hacker definition
controversy about the true meaning of the term hacker. In this controversy, the term
hacker is reclaimed by computer programmers who argue that someone breaking into
computers is better called a cracker, not making a difference between computer
criminals (black hats) and computer security experts (white hats). Some white hat hackers
claim that they also deserve the title hacker, and that only black hats should be called
crackers.
5.2.1 Hacker Types
White Hat Hackers: These are the good guys, computer security experts who specialize
in penetration testing and other methodologies to ensure that a company‟s information
systems are secure. These IT security professionals rely on a constantly evolving arsenal
of technology to battle hackers.
Black Hat Hackers: These are the bad guys, who are typically referred to as just plain
hackers. The term is often used specifically for hackers who break into networks or
computers, or create computer viruses. Black hat hackers continue to technologically
outpace white hats. They often manage to find the path of least resistance, whether due to
human error or laziness, or with a new type of attack.
Hacking purists often use the term “crackers” to refer to black hat hackers. Black hats‟
motivation is generally to get paid.
Script Kiddies: This is a derogatory term for black hat hackers who use borrowed
programs to attack networks and deface websites in an attempt to make names for
themselves.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Hacktivists: Some hacker activists are motivated by politics or religion, while others
may wish to expose wrongdoing, or exact revenge, or simply harass their target for their
own entertainment.
State Sponsored Hackers: Governments around the globe realize that it serves their
military objectives to be well positioned online. The saying used to be, “He who controls
the seas controls the world,” and then it was, “He who controls the air controls the
world.”
Spy Hackers: Corporations hire hackers to infiltrate the competition and steal trade
secrets. They may hack in from the outside or gain employment in order to act as a mole.
Spy hackers may use similar tactics as hacktivists, but their only agenda is to serve their
client‟s goals and get paid.
Cyber Terrorists: These hackers, generally motivated by religious or political beliefs,
attempt to create fear and chaos by disrupting critical infrastructures. Cyber terrorists are
by far the most dangerous, with a wide range of skills and goals. Cyber Terrorists
ultimate motivation is to spread fear, terror and commit murder.
5.2.2 Hacking techniques
Hacking attacks progress in a series of stages, using various tools and techniques.
A hacking attack consists of the following stages
Dictionary attack A simple dictionary attack is by far the fastest way to break into a machine. A dictionary
file (a text file full of dictionary words) is loaded into a cracking application (such as
L0phtCrack), which is run against user accounts located by the application. Because the
majority of passwords are often simplistic, running a dictionary attack is often sufficient
to to the job.
Hybrid attack Another well-known form of attack is the hybrid attack. A hybrid attack will add
numbers or symbols to the filename to successfully crack a password. Many people
change their passwords by simply adding a number to the end of their current password.
The pattern usually takes this form: first month password is "cat"; second month
password is "cat1"; third month password is "cat2"; and so on.
Brute force attack A brute force attack is the most comprehensive form of attack, though it may often take a
long time to work depending on the complexity of the password. Some brute force
attacks can take a week depending on the complexity of the password. L0phtcrack can
also be used in a brute force attack.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.3 TCP/IP FROM A SECURITY VIEW POINT
IP datagram should be authenticated
IP datagram should be encrypted
IP datagram should be both encrypted and authenticated
Authenticity of IP connections.
In order to prevent IP spoofing and connection hijacking, as well as to
secure the content of IP datagram‟s against any unauthorized modifications,
all IP datagram‟s sent over the Internet should be authenticated.
Privacy of IP connections.
In order to guarantee privacy, all IP datagram‟s sent over the Internet
should be encrypted by employing strong cryptography.
Encryption and Authentication
It is desirable to have both encryption and authentication applied to IP
datagram‟s.
5.4 SOCKETS AND SERVICES
Secure socket layers
Secure socket layer protocol (SSL) is from Netscape. SSL is placed with
internet engineering task force. It is compatible and almost a standard for transport
layer security.
It provides security to the entire communication channel. SSL provides a new
method of public hey encryption. It provides options for caching the session
to reduce repeated network activities. It reduces the CPU load.
Security Achieved by the Secure Sockets Layer (SSL)
Confidentiality
Encrypt data being sent between client and server, so that passive wire
tappers cannot read sensitive data.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Integrity Protection
Protect against modification of messages by an active wire tapper.
Authentication
Verify that a peer is who they claim to be. Servers are usually
authenticated, and clients may be authenticated if requested by servers.
How SSL Achieves Confidentiality
Create a secret key
o Based on information generated by the client with a secure random number
generator
Use public keys to exchange the secret key
o The server sends its public key to the client
o The client encrypts the secret key with the server's public key and sends it
to the server
o The server decrypts the secret key information with the server‟s private key
Encrypt and decrypt data with the secret key
o The client and server use the negotiated algorithm
How SSL Achieves Integrity Protection
Client and server use their secret key, and an agreed-upon cryptographic hash
function to attach an HMAC to each message sent.
The receiver checks that each message has not been altered.
How SSL Works
1. Handshake
– a negotiation process that creates or rejoins a session
2. If (Handshake succeeds) then Encrypted data can be exchanged
Else The connection is aborted
The Handshake
Negotiate the cipher suite
Authenticate identities (optional)
Exchange secret key
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Negotiate the Cipher Suite
A cipher suite
o A set of cryptographic algorithms
An algorithm for exchanging a secret key
A secret key encryption algorithm and key length
A cryptographic hash function
The client tells the server which cipher suites it has available, and the server
chooses the best mutually acceptable cipher suite.
The SSL handshake protocol provides the following
Authentication between the server and the client
Communicating encrypting algorithm, and deciphering algorithms
Communicating encrypting algorithm, and deciphering keys
5.5 ENCRYPTION
Encryption is a process that takes information and transcribes it into a different form that
is unable to read by anyone who does not have the encryption code. Depending on the
type of encryption, information can be displayed as various numbers, letters, or symbols.
Those who work in cryptography fields make it their job to encrypt information or to
break codes to receive encrypted information.
The encrypted data are useful for the following reasons
1. To obtain added security when sending messages through the inter net
2. For verifying the authenticity of the sender or the receiver
3. While signing documents
4. For distributing the keys for an encryption algorithm.
Types
Symmetric key encryption
Asymmetric key encryption
Manual encryption
Transparent encryption
Email encryption
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Manual Encryption
Manual encryption is a type that involves the use of encryption software. These
are computer programs that encrypt various bits of information digitally. Manual
encryption involves the user's participation completely. The files he wants to encrypt are
chosen, and then an encryption type is chosen from a list that the security system
provides. This is great for personal computers because it allows a user to encrypt personal
files in a way that will suit him, thus protecting personal material on a computer.
Transparent Encryption
Transparent encryption is another type of computer software encryption. It can be
downloaded onto a computer to encrypt everything automatically. This is one of the most
secure types of encryption available because it doesn't leave out anything that might be
forgotten when using manual encryption. Every executable application and file created in
the computer has an encrypted copy that can withstand power surges and protects
information in case a computer is stolen.
Symmetric Encryption
Not all encryption is done via a computer software program. You can easily
encrypt information by yourself. One of the simplest ways to do this is through
symmetric encryption. Here, a letter or number coincides with another letter or number in
the encryption code. You can make the code up yourself--for example, a=1, b=2 and so
on. You can take any written text and substitute letters and numbers for their coded
counterpart, thus encrypting the text.
Asymmetric Encryption
Asymmetric encryption is a secure and easy way that can be used to encrypt data
that you will be receiving. It is generally done electronically. A public key is given out to
whomever you want or posted somewhere for the public to see. They can then encrypt
information using the key and send it to you. This is often done when writing emails.
However, to decipher the encrypted code, there is another key, a private one, that only
one person has. This means that while any can encrypt the data with the public key, it can
only be read again by whomever has the private key.
Email Encryption
As mentioned, email encryption typically uses asymmetrical encryption methods.
This entails that emails that are received cannot be read by others, such as hackers who
may be trying to get into an email inbox. There are two types of encryption methods used
with email. The first is when a central station, such as an email provider, has the sole
decision in who gets the private key to the email. This is usually given only to the user of
an email address. The second type gives the user control over who gets the key. This
means they can allow others to read encrypted emails with the private key they are given.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Terminologies Used:
Plaintext:
This is what you want to encrypt
Cipher text:
The encrypted output
Enciphering or encryption:
The process by which plaintext is converted into cipher text
Encryption algorithm:
The sequence of data processing steps that go into transforming plaintext into
cipher text. Various parameters used by an encryption algorithm are derived from a secret
key.
In classical cryptography for commercial and other civilian applications, the
encryption algorithm is made public.
Secret key:
A secret key is used to set some or all of the various parameters used by the
encryption algorithm. The important thing to note is that the same secret key is used for
encryption and decryption in classical cryptography.
It is for this reason that classical cryptography is also referred to as symmetric key
cryptography.
Deciphering or decryption:
Recovering plaintext from cipher- text
Decryption algorithm:
The sequence of data processing steps that go into transforming ciphertext back
into plaintext. Various pa- rameters used by a decryption algorithm are derived from the
same secret key that was used in the encryption algorithm.
In classical cryptography for commercial and other civilian applications, the
decryption algorithm is made public.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Cryptography:
The many schemes available today for encryption and decryption cryptographic
system: Any single scheme for encryption cipher: A cipher means the same thing as a
“cryptographic system”
Block cipher:
A block cipher processes a block of input data at a time and produces a cipher text
block of the same size.
Stream cipher:
A stream cipher encrypts data on the fly, usually one byte at at time.
Cryptanalysis:
Means “breaking the code”. Cryptanalysis relies on a knowledge of the encryption
algorithm (that for civilian applications should be in the public domain) and some
knowledge of the possible structure of the plaintext (such as the structure of a typical
inter-bank financial transaction) for a partial or full reconstruction of the plaintext from
cipher text. Additionally, the goal is to also infer the key for decryption of future
messages.
Building Blocks of Classical Encryption Techniques
Two building blocks of all classical encryption techniques are substitution and
transposition.
Substitution means replacing an element of the plaintext with an element of cipher
text.
Transposition means rearranging the order of appearance of the elements of the
plaintext.
Transposition is also referred to as permutation.
Caesar Cipher
This is the earliest known example of a substitution cipher.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Each character of a message is replaced by a character three position down in the
alphabet.
Example:
plaintext: are you ready
ciphertext: DUH BRX UHDGB
5.6 FIREWALL TECHNOLOGY
Motivation
Communication systems continue to be a fundamental infrastructure resource
Risks
o computation and communication resources
o data
o reputation
Note that firewall technology is only one piece of a large security puzzle
Model of communication and generic firewall model
A firewall guards and isolates an inside (private) network--an intranet--from an outside
(hence untrusted) network: the Internet, for instance. A firewall may also guard some
parts of an internal network against other parts.
Domains A and A*, though parts of one organization's network, are physically separate
and communicate through an outside (untrusted) network. Firewalls can only control
communication traffic to, from, or through that outside network, such as indicated by
arrows a, b, and c. They cannot control communication traffic d and d', which do not
leave the protected networks' boundaries, and communication traffic e, which simply
extends through the outside network. Note that arrow c indicates virtual private
networking (VPN) traffic.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.6.1 Definition of Firewall Technology
firewall technology as a set of mechanisms that collectively enforce a network domain
security policy on communication traffic entering or leaving a guarded network policy
domain.
5.6.2 Mechanisms for firewall technology
Packet filtering routers
Bastion hosts
Network address translators
Circuit-level gateways
Application-level proxies
In general, the various firewall security mechanisms address themselves to specific layers
in the open systems interconnection (OSI) network model. Several mechanisms can be
combined into a comprehensive firewall system, but the mechanisms should be chosen
and coordinated so that they do not work against each other.
5.6.3 Packet filtering routers and bastion hosts
All packet-filter firewalls deny access to traffic that does not meet a set of rules
[indicated by a red line with x] and pass traffic that does [green lines with
arrowheads].
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
In a screened-host firewall, a router at network level controls access to and from a
single host - called a bastion host - through which all traffic to and from the
protected network must travel. Direct access to the protected network is denied
and the bastion host does not forward packets. The bastion host is a highly
defended, secured strongpoint that - one hopes - can resist attack.
In a screened-subnet firewall, a pair of routers control access to a small network
of bastion hosts. The screened subnet is also called a "demilitarized zone" (DMZ).
5.6.4 Network address translators
A network address translator hides internal addresses from the outside world. Network
address translation (NAT) routers contain a table of outside and inside addresses. They
translate the outside address of an incoming message into the hidden inside address, and
do the reverse for an outgoing message.
5.6.5 Circuit-level gateways
Many firewalls now include built-in support for Socks (the name derives from
Unix Sockets), software that allows applications to access a variety of
communication protocols.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Thus Socks can handle many different types of traffic, routing packets between
compatible clients and servers in the untrusted network and the protected one.
In effect, it forms a circuit between a client and server; but it acts as a proxy, too,
forwarding only those packets deemed acceptable.
5.6.6 Application-level proxies
An application-level firewall uses application-specific proxies that can interact
with the source and destination of a message to determine whether it meets
security standards, and then allows or denies access on the basis of its evaluation.
Separate proxies are needed for each application.
Further, a so-called "dual-homed" application-level firewall can be built by
installing two interfaces, one on each network. So a popular location for such a
firewall is a bastion host, in either a screened-host or screened-subnet firewall.
5.6.7 Potential Advantages of Firewall Technology
Protection against external network based attacks (prevention)
Focus of security decisions
Additional services (e.g., authentication prior to network access)
Access control at the IP/port level
Privacy
o data
o infrastructure and topology information
Audit
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Manageability of security enforcement
Transparency to user (not always)
Technology is available for purchase
5.6.8 Shortcomings of Firewall Technology
Opaque to users
No replacement for internal/host security
Firewalls often geneate a false sense of security
Limited protection against:
o malicious insiders
o tunneled connections
o data driven attacks
o novel attacks
o denial of service
Operational difficulties
No protection against connections that circumvent the firewall!
Efficiency questions
Single point of failure
5.6.9 The Firewall Life Cycle
The phases of the firewall's life cycle, shown in blue rectangles, use the methods in the
brown hexagonal to the right to produce the results noted in the beige ovals. The life
cycle progresses diagonally, beginning with the all important definition of security policy
and arriving at implementation, review, and testing after high-level design, selection of
components, and detailed design. Even after the firewall is in use, periodic review and
testing during the system's lifetime may result in an earlier phase being revisited
(indicated by the upward-pointing blue arrows), as when a new, improved firewall
component becomes available or when defects in an earlier phase are discovered.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.7 PACKET FILTERING
Packet filtering is the process of passing or blocking packets at a network interface based
on source and
destination
addresses, ports, or
protocols. The
process is used in
conjunction with
packet mangling and Network Address Translation (NAT). Packet filtering is often part
of a firewall program for protecting a local network from unwanted intrusion.
In a software firewall, packet filtering is done by a program called a packet filter. The
packet filter examines the header of each packet based on a specific set of rules, and on
that basis, decides to prevent it from passing (called DROP) or allow it to pass (called
ACCEPT).
There are three ways in which a packet filter can be configured, once the set of filtering
rules has been defined. In the first method, the filter accepts only those packets that it is
certain are safe, dropping all others. This is the most secure mode, but it can cause
inconvenience if legitimate packets are inadvertently dropped. In the second method, the
filter drops only the packets that it is certain are unsafe, accepting all others. This mode is
the least secure, but is causes less inconvenience, particularly in casual Web browsing. In
the third method, if the filter encounters a packet for which its rules do not provide
instructions, that packet can be quarantined, or the user can be specifically queried
concerning what should be done with it. This can be inconvenient if it causes numerous
dialog boxes to appear, for example, during Web browsing.
5.8 NETWORK ADDRESS TRANSLATION
Overview
NAT is an acronym for Network Address Translation. It is a commonly
used IP translation and mapping technology.
It is a technology that allows your home network to share internet access. Using a
device or piece of software that implements NAT allows an entire home
network to share a single internet connection over a single IP address.
A single cable mode, DSL modem, or even 56k modem could connect all the
computers in your home to the internet simultaneously. Additionally, NAT keeps
your home network fairly secure from hackers.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
NAT is built in to the most common Internet Connection Sharing
technologies around. Microsoft has built their ICS around it and every Cable/DSL
Broadband Router on the market accomplishes its job with NAT.
How does it work?
NAT acts as an interpreter between two networks. In the case of a home network,
it sits between the internet and your home network.
The internet is considered the „public‟ side and your home network is
considered the „private‟ side.
When a computer in the private side, request data from the public side, (the
internet), the NAT device will open a little conduit between your computer
and the destination computer. When the public computer returns results from the
request, it is passed back through the NAT device to the requesting computer.
Security: Basic NAT is not a real firewall?
Basic NAT devices are not real firewalls, but they are usually considered „good
enough‟ for most home networks. By not forwarding requests or probes that
originate from the inter net to your LAN, a NAT device blocks most mischief.
A simple NAT device can not keep hackers from running DOS (Denial Of
Service) attacks on you, but individuals rarely get attacked like that.
It will keep out people looking for file shares, rogue mail servers and web
servers, and most port based exploits. Most also protect against SMURF and
WinNuke atatcks. With a NAT device and a good anti-virus program, you should
be safe from the most common kinds of internet attacks.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Stateful packet inspection (SPI)
Some NAT routers have an advanced form of firewall built in that does
'stateful packet inspection'. This allows the NAT devices to filter out specific
kinds of data on your router like SYN flood attacks, IP Spoofing, Teardrop
attacks and others.
SPI is a general term that can describe a router that filters more kinds of
attacks than basic NAT by closely examining packet data structures. Of
course, each manufacturer will implement different kinds of SPI so not all SPI
routers are equal. Routers with SPI can often log attacks.
What If I want to host a server?
Most NAT devices allow you to create maps between the internet and your
computer network - this is called port for warding.
Example: A request on port 80 from the Internet (looking for a web server
on your IP address) would normally be turned away by a NAT device.
A special mapping can be set up to send that request from the inter net to
a specific computer on your network. One of your LAN computers could host a
web server on the Internet, and another computer (or the same one) could host an
FTP server because the two services work on different ports. Only a few special
programs on the internet will not work using this port forwarding system.
Network Address Translation - the Need.
The reason why NAT is so important is that address space under IPv4 (in
the current version) is limited.
There are four octets, totaling 32 bits of address space. We‟ve tried classing the
address space, we‟ve tried using CIDR, but nevertheless address space will
eventually run out.
Our "stop gap" measures have, however, succeeded in preserving the address space
for longer than we all thought possible. RFC 1918 provides the rules for using a
set of reserved numbers guaranteed never to be in use on the Internet. The beauty
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
of it is that every company that connects can pick from the same set of reserved
numbers, and it doesn‟t matter. However, as these numbers are not routed
around the Internet at all we have to have a method of transmitting packets
around the Internet, and receiving the replies, and then sending the packets
inwards to our network to the correct computer on our LAN, and the correct
session on that computer. This is where NAT comes in.
To use NAT, the router which connects your LAN to the Internet will have two
addresses. On the LAN side, it will have an address from the particular RFC
1918 address range you chose to use and, on the Internet side, it will have an
address assigned to you by your current ISP.
Network Address Translation- Dynamic vs. Static
Finally a quick word on the difference between dynamic NAT and static NAT.
What has been defined so far is known as dynamic NAT - all packets leaving
your LAN for the Internet contain the same source IP address, which is the public one
assigned to your router.
There is one drawback with this. If the router is the only device with a
public address, then there is no way for you to provide information services on
any computer on your network.
Supposing that, despite being a good network citizen and using RFC 1918
addressing,
you nevertheless wish to provide a Web server, or an ftp repository, for
example. You can‟t, because no one on the Internet has any way of
specifying that they want to connect to the specific computer containing the
server.
However, static NAT allows this to happen. First, you will need to get your ISP to
allocate you a block of public addresses. Using CIDR, most ISPs will allocate you
a block of eight addresses. Because of certain rules which we won‟t go into
here, you will have five of these eight available for use for static mapping.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
5.9 APPLICATION LEVEL PROXIES
Proxy servers were originally developed to cache web pages that were
frequently accessed. In the early days of the internet, wide area links were
slow, the web was relatively small, and the web pages were static. By caching
that page on a local server, proxies could eliminate redundant internet access to
retrieve the same page over and over.
Proxy servers regenerate high-level service request on an external network
for their clients on a private network. This effectively hides the identity and
number of clients on the internal network from examination from the external
network.
Security advantages of proxies
Proxies hide private clients from the external exposure
It can block dangerous URLs
It can filter dangerous content such as viruses and torjan horses before passing it
to the client.
It can check the consistency of returned content.
It can eliminate the need for transport layer routing between networks
It provides a single point of access, control, and logging.
5.10 VIRTUAL PRIVATE NETWORKS
Virtual private network (VPN) technologies in Microsoft Windows using the
resources on this page. An extension of a private network, a VPN encompasses links
across shared or public networks. VPN connections use the connectivity of the Internet
plus a combination of tunneling and data encryption technologies, such as the Point-to-
Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol with Internet
Protocol security (L2TP/IPSec), to connect remote clients and remote offices.
VPNs are a cost effective way to extend your LAN over the internet to remote
networks and remote client computers. It uses the internet to route LAN
traffic from one private network to another by encapsulating the LAN traffic in
IP packets.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Virtual private networks solve the problem of direct internet access to servers
through a combination of the following fundamental security components
IP encapsulation
Cryptographic authentication
Data payload encryption
Characteristics of VPN
VPNs are cheaper than WANs
It is easier to establish
They are slower than LANs
It is less reliable
It is less secure
Types of VPN
Server based VPNs
Firewall based VPNs
Router based VPNs
5.11 IDEAL FIREWALL
The ideal firewall defines your security requirements and helps to figure out what general
type of security our business requires. It also explains exactly how to configure
your border gateways to achieve that level of security.
Defining your security requirements
No two networks have the exact same security requirements. to decide just
how much effort to expend in securing your network, you need to know the value
of the data in your network, the publicity or visibility of your organization and the
harm that could be caused by loss of services. You should also consider how
much disruption or imposition in the name of security you can live on with your
network.
WEB TECHNOLOGY
DEPARTMENT OF INFORMATION TECHNOLOGY UNIT V
Configuring the rules
Once you‟ve determined the determined degree of paranoia that is justified
for your network ,you can set up the fire walling rules that keep the crackers
out.
Every firewall allows you to establish a set of rules that will specify what
trans-firewall traffic will be allowed and what will not, as well as to establish
and manipulate these rules.
Rules about rules:
Apply to order
Per interface
Per type of packet (TCP,UDP,ICMP)
Per source and destination addresses
Per source and destination ports
Per options
Per ICMP message type
Per ACK bit for TCP
Protocols specific proxying rules
Logging
Graphical user interface
Rules for security level
There are five levels, they are
Aware
Concerned
Cautious
Strict
Paranoid