Professional Documents
Culture Documents
3com - A Simple Guide To Firewalls
3com - A Simple Guide To Firewalls
Network Security
A Simple Guide to Firewalls
Loss of irreplaceable data is a very real threat for any business owner whose network connects to the outside world. Remote access for employees and connection to the Internet may improve communication in ways youve hardly imagined. Access to the Internet can open the world to communicating with customers and vendors, and is an immense source of information. But these same opportunities open a local area network (LAN) to the possibility of attack by thieves and vandals and abuse by your own employees.
There are experts who say, If you are connected to the Internet, you need a firewall. The decision may not be more complicated than that. However, youll probably consider a combination of factors. Start with the basic questions youd ask about any other security system.
CONTENTS
Why a FirewallAm I Really at Risk? . . . . . . . . . . . . . . . . . . . 1 What Is a Firewall? . . . . . . . . . 2 Types of Attack . . . . . . . . . . . . 2 Firewall Technologies . . . . . . . . 3 Additional Firewall Features and Functionality . . . . . . . . . . . 4 Choosing a Firewall . . . . . . . . . 5 Designing a Firewall into Your Network . . . . . . . . . . . . . 6 Conclusion . . . . . . . . . . . . . . . 6
Figuring out the right amount of security for your network takes some consideration. The first thing to consider is what your data is worth. A quick answer is, Maybe more than you think. When you consider the value of your data, remember risks such as legal liability and loss of competitive edge, or the effect of lost production if your network is compromised. Many analysts say very bluntly, If you are on the Internet, you need a firewall. The benefits of connecting to the Internet are clear. This paper discusses the risks you face when you connect to the Internet, describes the types of attacks that can occur, and offers an overview of firewall technology, which can protect your network from hackers. Specifically, the paper discusses the implementation of a firewall and what you should consider in choosing the type of firewall you require.
If he does, he can run software programs to break your passwords. If you have valuable data on your network and the network is exposed to outside computers, chances are very good you need a firewall.
It screens outgoing traffic to limit Internet use and/or access to remote sites.
Screening Levels
A firewall can screen both incoming and outgoing traffic. Because incoming traffic poses a greater threat to the network, its usually screened more closely than outgoing traffic. When you are looking at firewall hardware or software products, youll probably hear about three types of screening that firewalls perform: Screening that blocks any incoming data not specifically ordered by a user on the network Screening by the address of the sender Screening by the contents of the communication Think of screening levels as a process of elimination. The firewall first determines whether the incoming transmission is something requested by a user on the network, rejecting anything else. Anything that is allowed in is then examined more closely. The firewall checks the senders computer address to ensure that it is a trusted site. It also checks the contents of the transmission.
What Is a Firewall?
A firewall is a system that enforces an access control policy between two networkssuch as your private LAN and the unsafe, public Internet. The firewall determines which inside services can be accessed from the outside, and vice versa. The actual means by which this is accomplished varies widely, but in principle, the firewall can be thought of as a pair of mechanisms: one to block traffic, and one to permit traffic. A firewall is more than the locked front door to your networkits your security guard as well. Firewalls are also important because they provide a single choke point where security and audits can be imposed. A firewall can provide a network administrator with data about what kinds and amount of traffic passed through it, how many attempts were made to break into it, and so on. Like a closed circuit security TV system, your firewall not only prevents access, but also monitors whos been sniffing around, and assists in identifying those who attempt to breach your security.
3DES Data Encryption Standard (168-bit) DMZ demilitarized zone DoS denial of service FTP File Transfer Protocol HTTP Hypertext Transfer Protocol ICSA International Computer Security Association LAN local area network NAT Network Address Translation POP3 Post Office Protocol, Version 3 SMTP Simple Mail Transfer Protocol TCP/IP Transmission Control Protocol/Internet Protocol VPN virtual private network WAN wide area network
Types of Attack
Basic Purpose of a Firewall
Basically, a firewall does three things to protect your network: It blocks incoming data that might contain a hacker attack. It hides information about the network by making it seem that all outgoing traffic originates from the firewall rather than the network. This is called Network Address Translation (NAT). Before determining exactly what type of firewall you need, you must first understand the nature of security threats that exist. The Internet is one large community, and as in any community it has both good and bad elements. The bad elements range from incompetent outsiders who do damage unintentionally, to the proficient, malicious hackers who mount deliberate assaults on companies using the Internet as their weapon of choice.
NETWORK SECURITY
Generally there are three types of attack that could potentially affect your business: Information theft: Stealing company confidential information, such as employee records, customer records, or company intellectual property Information sabotage: Changing information in an attempt to damage an individual or companys reputation, such as changing employee medical or educational records or uploading derogatory content onto your Web site Denial of service (DoS): Bringing down your companys network or servers so that legitimate users cannot access services, or so that normal company operations such as production are impeded
Denial-of-Service Attacks
DoS attacks are purely malicious. They dont result in any gain for the hacker other than the joy of rendering the network, or parts of it, unavailable for legitimate use. DoS attacks overload a system so that it isnt availablethey deny your ability to use your network service. To overload the system, the hacker sends very large packets of data or programs that require the system to respond continuously to a bogus command. To launch a DoS attack, a hacker must know the IP address of the target machine. A good firewall doesnt reveal its own IP address or the IP addresses on the LAN. The hacker may think he has contacted the network when he has only contacted the firewalland he cant lock up the network from there. Furthermore, when a hacker launches an attack, some firewalls can identify the incoming data as an attack, reject the data, alert the system administrator, and track the data back to the sender, who can then be apprehended.
Firewall Technologies
Firewalls come in all shapes, sizes, and prices. Choosing the correct one depends mainly on your business requirements and the size of your network. This section discusses the different types of firewall technologies and formats available. Above all, no matter what type of firewall you choose or its functionality, you must ensure that it is secure and that a trusted third party, such as the International Computer Security Association (ICSA), has certified it. The ICSA classifies firewalls into three categories: packet filter firewalls, application-level proxy servers, and stateful packet inspection firewalls.
address. A packet filter firewall checks the address of incoming traffic and turns away anything that doesnt match the list of trusted addresses. The packet filter firewall uses rules to deny access according to information located in each packet such as: the TCP/IP port number, source/destination IP address, or data type. Restrictions can be as tight or as loose as you want. An ordinary router on a network may be able to screen traffic by address, but hackers have a little trick called source IP spoofing that makes data appear to come from a trusted source, even from your own network. Unfortunately, packet filter firewalls are prone to IP spoofing and are also arduous and confusing to configure. And any mistake in configuration could potentially leave you wide open to attack.
incoming communication to see if it was requested, and rejects anything that wasnt. Requested data proceeds to the next level of screening. The screening software determines the state of each packet of data, hence the term stateful packet inspection.
Content Filtering
A Web site filter or content filter extends the firewalls capability to block access to certain Web sites. You can use this add-on to ensure that employees do not access particular content, such as pornography or
NETWORK SECURITY
racially intolerant material. With this functionality you can define categories of unwelcome material and obtain a service that lists thousands of Web sites that include such material. You can then choose whether to totally block those sites, or to allow access but log it. Such a service should automatically update its list of banned Web sites on a regular basis.
the most pernicious forms of computer hacking. Users can quickly damage entire networks by unknowingly downloading and launching dangerous computer viruses. Companies have lost enormous amounts of money due to resulting lost productivity and network repair costs. Firewalls are not designed to remove or clean viruses, but they can assist with virus detection, which is an important part of an overall virus protection plan. It is important to note that a firewall can only protect the network from the wide area device to which it is attached. A remote access server or a PC with a modem could provide a back door into your network that circumvents the firewall. The same is true if an employee inserts a virusinfected floppy disk into a PC. The ultimate place for antivirus software is on every users PC; however, a firewall can assist in virus detection by requiring that every users PC have the latest antivirus software running and enabled before the firewall permits that user to access the Internet or download e-mail.
Choosing a Firewall
Firewall functions can be implemented as software or as an addition to your router/gateway. Alternatively, dedicated firewall appliances are increasing in popularity, mainly due to their ease of use, performance improvements, and lower cost.
Router/Firmware-Based Firewalls
Certain routers provide limited firewall capabilities. These can be augmented further with additional software/ firmware options. However, great care must be taken not to overburden your router by running additional services like a firewall. Enhanced firewallrelated functionality such as VPN, DMZ, content filtering, or antivirus protection may not be available or may be expensive to implement.
Antivirus Protection
Everyone should be concerned about the threat of viruses, which are among
Software-Based Firewalls
Software-based firewalls are typically sophisticated, complex applications that run on a dedicated UNIX or Windows NT server. These products become expensive when you account for the costs associated with the software, server operating system, server hardware, and continual maintenance required to support their implementation. It is essential that system administrators constantly monitor and install the latest operating system and security patches as soon as they become available. Without these patches to cover newly discovered security holes, the software firewall can be rendered useless.
your firewall policy. For example, will the firewall explicitly deny all services except those critical to the mission of connecting to the Internet? Or is it intended to provide a metered and audited method of queuing access in a nonthreatening manner? Decisions like these are less about engineering than politics. The next decision is what level of monitoring, redundancy, and control you want. This involves juggling needs analysis with risk assessment, and then sorting through the often conflicting requirements in order to determine what to implement. Where firewalls are concerned, the emphasis should be on security rather than connectivity. You should consider blocking everything by default, and only allowing the services you need on a case-by-case basis. If you block all but a specific set of services, you make your job much easier.
Conclusion
Security breaches are very real and very dangerous. Every company now recognizes how easily it can become the victim of deliberate or random attacks, and how much damage these attacks can cause. The good news is that 3Com Corporation is just as aware of the threats, and is developing better and stronger security solutions. Small and midsize companies and remote offices in particular can take advantage of new 3Com firewall solutions that are less costly and complicated to administer than traditional firewalls. While firewalls are only one component of an overall security system, they are a vital component, and companies must invest the time required to evaluate the best system for their needsand then deploy it as quickly as possible. Security breaches are an ever-present danger, and theres no time like the present to protect your companys valuable data.
NETWORK SECURITY
3Com Corporation, Corporate Headquarters, 5400 Bayfront Plaza, Santa Clara, CA 95052-8145 To learn more about 3Com solutions, visit www.3com.com. 3Com Corporation is publicly traded on Nasdaq under the symbol COMS. The information contained in this document represents the current view of 3Com Corporation on the issues discussed as of the date of publication. Because 3Com must respond to changing market conditions, this paper should not be interpreted to be a commitment on the part of 3Com, and 3Com cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only; 3Com makes no warranties, express or implied, in this document. Copyright 2000 3Com Corporation. All rights reserved. 3Com is a registered trademark and the 3Com logo is a trademark of 3Com Corporation. Windows NT is a trademark of Microsoft. UNIX is a trademark of UNIX Laboratories. Other company and product names may be trademarks of their respective companies. 503090-001 9/00