Firewalls

A firewall is a network device that operates at the network layer to permit or deny access to a network. Firewalls are important since they are often the first line of defense against network-based attacks.

As shown on the right, firewalls are usually deployed at the perimeter of an internal network, where the internal network connects to the untrusted Internet.

Firewalls are usually effective to centrally turn off servers that are running but should not be. It may be because

  • The server is buggy or
  • The server is running by default with no reason.

General Attributes

The general attributes of firewalls are as follows: (if any one of the aspects is broken, the firewall becomes much less effective)

Types of Firewalls

Note: A host-based firewall runs on a user's computer. Unlike network-based firewalls, a host-based firewall can associate network traffic with individual applications. Its goal is to prevent malware from accessing the network.

Stateless Firewalls

Security policy

The purpose of a firewall is to keep bad things out from the internal network. In order to accomplish this goal, the system needs a good security policy that well defines "what is bad".

A firewall can act on packets following through in one of the following ways:

  • Allow: The packet passes through the firewall.
  • Block: The packet is dropped at the firewall.
Typically, the firewall applies different rules depending on:
  • Incoming packets: from the external Internet to the internal network.
  • Outgoing packets: from the internal network to the external Internet.
Rules for incoming packets
Action Source addrDestination addrSource port Destination port Type
Block *.usma.edu * * * *
Allow * * * 25 TCP
Block * * * * *

Example rules

Firewall rules for incoming packets are shown above as an example:

Let's consider some scenarios.

DMZ

The above rules can be applied to the firewall FB (the bottom one) in the following network architecture.

The outbound email server smtp.usna.edu is outside the internal firewalls FA and FB, i.e., in a place called DMZ (demilitarized zone). This is OK since the this server doesn't contain any sensitive information, and it needs to freely connect to the external hosts.

Let's check your understanding!

Suppose that a network administrator wrote the following rules:
Rules for incoming packets
Action Source addrDestination addrSource port Destination port Type
Block *.usma.edu * * * TCP
Allow * * * 25 TCP
Allow * * 25 * TCP
Block * * * * TCP
That is, rule 3 is quite similar to rule 2, but in rule 3, the source port is 25. To see the implications of the change, we need to answer the following question:
Question: Will this change allow a new vulnerability, e.g., allowing the attacker to access a buggy webserver running inside the network?
The answer: 
Yes!

Attacker: source port 25, destination port 80  -------- FW: OK -------->  email server: destination port 80 (HTTP)

Stateful packet inspection (SPI) firewalls

To see why it is sometimes beneficial for a firewall to remember states, supposea the following:

The SPI firewalls are useful for the following scenarios:

Deep packet inspection (DPI)

More sophisticated firewalls perform deep packet inspection (DPI); that is, the firewalls examine not only headers but also application data and make decisions based on its contents. For example, DPI firewalls can monitor HTTP traffic in order to block access to suspicious URLs or to disallow the download of certain web plugins.

This DPI technique is often used with the intrusion detection systems (IDS) and the intrusion prevention systems (IPS) to come up with more sophisticated policies.

Great Firewall of China (From Wiki)

The Great Firewall (GFW) is the combination of legislative actions and technologies enforced by China to regulate the Internet domestically which include

Some techniques deployed by the Chinese government include:

Firewalls: Limitations and Cautions

Firewalls are not complete solutions to all computer security problems. A firewall protects only the perimeter of its environment against attacks from outsiders who want to penetrate the machines in the protected environment.

Intrusion Detection Systems (IDSes)

Using firewalls and IDS in tandem

We stress that both mechanisms should be used in tandem. Depending on how to detect the bad behavior, an IDS can be either signature-based or anomaly-based.

Signature-based IDS (Rule-based IDS)

A signature-based IDS defines a set of rules for bad patterns of behavior (e.g., known exploit characteristics, known bad events).

Example rules include:

Signature-based detection is simple and very effective at detecting known threats but largely ineffective at detecting previously unknown threats, threats disguised by the use of evasion techniques, and many variants of known threats.

Snort

Snort is a famous IDS/IPS (intrusion prevention system). It's open source, and you can install it for free in Ubuntu. An example of Snort IDS Rule is shown below. Possible rule actions are as follows: 
alert, log, pass, drop, reject, sdrop
The rule options are formatted as follows: 
(keyword_1:argument_1; ...; keyword_n:argument_n)

Snort can inspect the http traffic as well. See an example below. 
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(
 msg: "PDF File Detected";
 file_type: PDF;
 sid:8;
)

Anomaly-based IDS (Statistical IDS)

Anomaly-based detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations. An IDS using anomaly-based detection has profiles that represent the normal behavior of such things as users, hosts, network connections, or applications. The profiles are developed by monitoring the characteristics of typical activity over a period of time.

Some possible metrics are given in the following:

Metric Reasoning
Frequency of login by date and time Intruders are more likely to login during off-hours
Frequency of login at different locations Intruders may login from a location that a legitimate user doesn't
Length of session Attackers may run a much shorter or longer session
Amount of data copied to some location Detect attempt to copy large amounts of sensitive data
The major benefit of anomaly-based detection methods is that they can be very effective at detecting previously unknown threats.

Inadvertently including malicious activity as part of a profile is a common problem with anomaly-based IDS products. Another problem with building profiles is that it can be very challenging in some cases to make them accurate, because computing activity can be so complex. Anomaly-based IDS products often produce many false positives because of benign activity that deviates significantly from profiles, especially in more diverse or dynamic environments.

False Positives and Negatives

An IDS is based on the assumption that attacker behavior is (sufficiently) different from legitimate user behavior. However, in reality, there will be overlap:
  • Some legitimate behavior may appear malicious.
  • Intruders can attempt to disguise their behavior as that of an honest user.

Due to the aforementioned overlap, it's inevitable that IDS have false positives and false negatives.
  • True positives (TP) correspond to the following events:
    • The events are actual attacks ("positive events")
    • The IDS correctly issues alarm ("positive alarm").
  • False negatives (FN) correspond to the following events:
    • The events are actual attacks ("positive events")
    • The IDS falsely issues no alarm ("falsely negative alarm").
  • True negatives (TN) correspond to the following events:
    • The events are authorized behaviors ("negative events")
    • The IDS correctly issues no alarm ("negative alarm").
  • False positive (FP) correspond to the following events:
    • The events are authorized behaviors ("negative events")
    • The IDS falsely issues alarm ("falsely positive alarm").

FPR and FNR

Important

Quick check

Tradeoff Between FNR and FPR

Quick check

The above example question shows that there is always a tradeoff between these rates.

Quality of IDS and the Rate of Attacks

The quality of your detector also depends on the rate of attacks.
Question

Suppose that there is an IDS system A with the following feature: Is Detector A good enough to be deployed?
The answer is "it depends".

False positive rates as an annoyance level

FPR tells you how many cases were just annoying false alarms out of all alarms. The higher the false positive rate is, the more annoying the IDS is.

The above example shows that accurate detection is very challenging when there are so many events while attacks are rare.