Imagine that your office is at the end of a lane. You need to have parcels
and letters delivered and picked up by deliverymen all day long therefore, you
keep your lane in good maintenance.
One day a crowd of clowns swarms down your lane and into your house,
completely overrunning it. The deliverymen have to jostle with the clowns to
reach you. Your business starts to slow down as the deliveries and collections
are nowhere near as the usual and, eventually, your business gradually comes to
a halt. You've just had a denial of service attack on your business.
When you find out that the clowns are coming from a local circus, you resolve
to do something about it.
The
top of your lane opens on to a bigger road, and halfway up that road is a
checkpoint that stops all travelers and tells them the best route to get to
their destination. You tell the checkpoint to turn away any travelers coming
from the circus. This seems to work and life goes back to normal, with the
deliverymen resuming their normal work. You've just solved the denial of
service attack by getting someone 'upstream' to ignore any information
coming from the place that attacked you.
Then, one day, the clowns return and there are more of them than ever before.
They are again overrunning your house and blocking your lane. There are so many
of them that your deliverymen can't get anywhere near your house and your
business stop instantly.
You call the checkpoint and complain. But it says it has not allowed anyone
from the circus into your lane and doesn't know where these new clown are
coming from. You investigate and discover that the circus owners have broken
into 1,000 houses in the area, turned them into circuses, and have sent hundreds
of clowns to your house from each one. Now you despair, because there are far
too many points of origin for the checkpoint to check and your business can't
function with a lane full of clowns stopping the delivery men getting through.
You've just had a distributed denial of service attack on your business.
At this point, you have to take emergency action to stop your house falling
apart under the weight of clowns crowding into it, so you board up the front
door and all the windows. The clowns are still filling your lane, but now they
can't get into your house, though neither can any deliverymen though. But your
house is not in danger of collapsing anymore. You then call your delivery
companies and tell them that they shouldn't deliver for a few days; your
business is suspended till further notice.
The only way your business can start up again is if the circus owners stop
sending the clowns, or you manage to find the circus owners and get them
arrested.
Now step back to the real world. The house is a server in your office
connected to the Internet, the lane is the connection to your ISP, and the
bigger road is a larger connection to the rest of the Internet. The checkpoint
in our little story is a router-a machine that, quite literally, sends
information on the best route to its destination. The deliverymen are packets,
parcels of information traveling back and forth to the server. The clowns are
also packets, however they are sent maliciously and carry useless information
simply meant to fill your connection and grind your server to a halt with their
size and number. If all the malicious packets are coming from the same place, it
is sometimes possible for a router upstream from the server to stop the packets
from getting through. However, if the malicious packets are coming from hundreds
of different places-usually from home computers, which have been infected with
a trojan and are being controlled by a criminal mind-then it is almost
impossible to block them all. That results in the server being attacked and its
connection swamped. When that happens to your server, the rate at which
information goes back and forth to you slows (lags), and eventually stops...at
which point the server splits. All a server administrator can do then is to make
the server unreachable and wait for the attack to stop.
One of the basic forms of a denial of service (DoS) attack involves flooding
a target system with so much data, traffic, or commands that it can no longer
perform its core functions. When multiple machines are gathered together to
launch such an attack, it is known as a distributed denial of service attack, or
DDoS.
Firewalls
To help protect against DoS attacks or DDoS Attacks, you can use a firewall.
A firewall is a system designed to prevent unauthorized access to or from a
private network. Firewalls can be implemented in both hardware and software, or
a combination of both. Firewalls are frequently used to prevent unauthorized
Internet users from accessing private networks connected to the Internet,
especially intranets. All messages entering or leaving the intranet pass through
the firewall, which examines each message and blocks those that do not meet the
specified security criteria.
There are several types of firewall techniques.
-
Packet filter: Looks at each packet entering or
leaving the network and accepts or rejects it based on user-defined rules.
Packet filtering is fairly effective and transparent to users, but it is
difficult to configure. In addition, it is susceptible to IP spoofing.
IP Spoofing is a technique used to gain unauthorized access
to computers, whereby the intruder sends messages to a computer with an IP
address indicating that the message is coming from a trusted host. To engage in
IP spoofing, a hacker has to find an IP address of a trusted host and then
modify the packet headers of the malware so that it appears that the packets are
coming from that host.
Newer routers and firewall arrangements can offer protection
against IP spoofing.
-
Application gateway: Applies security mechanisms
to specific applications, such as FTP and Telnet servers. This is very
effective, but can impose performance degradation and slowdown of traffic.
-
Circuit-level gateway: Applies security mechanisms
when a TCP or UDP connection is established. Once the connection has been
made, packets can flow between the hosts without further checking.
-
Proxy server: Intercepts all messages entering and
leaving the network. The proxy server effectively hides the true network
addresses.
In practice, many firewalls use two or more of these
techniques in concert.
A firewall is considered a first line of defense in
protecting private information. For greater security, data can be encrypted,
however, encryption is a costlier method and the encryption device has to be
installed on both the ends to have a successful communication. A firewall
protects your network from unwanted Internet traffic. The primary functions of a
firewall are to let good traffic pass through while bad traffic gets blocked.
The most important part of a firewall is its access control feature that
distinguishes between good and bad traffic.
Software Firewall
These are programs that run on your computer and nestle themselves between
your network card software drivers and your operating system. They intercept
attacks before your operating system can even acknowledge them.
However, even the software firewalls can crash due to heavy
packet floods and can be disabled easily by malicious code or a trojan running
from within the computer intercepting and disabling the firewall. With the
absence of being able to detect malicious code, running on the system and as
Trojans and malicious codes are changing everyday; it's easy to disable
software firewalls.
Firewalls With Stateful Packet Inspection
A new trend in home networking firewalls is called stateful packet
inspection, an advanced form of firewall that examines each and every packet of
data as it travels through the firewall. This firewall scans for problems in the
packet that might be a symptom of a DoS or more advanced attacks.
Most people are never subjected to such attacks, but many
areas of the Internet invite these attacks. Most often, these attacks come from
involvement in certain kinds of competitive on-line gaming and questionable
websites.
However, these types of firewalls are available mostly with
cable modems or cable routers, ISDN routers etc, which are cheap and good for
networks of 2 to 20 computers. They are available for $30 to $2000.
High-speed networks have high-speed viruses and worms, which
are continually probing and trying to access your computer system. Firewall
protection has gone from a luxury to a requirement.
The largest problem with today's networks is spam and
viruses, with AOL reporting 80 percent of all its email being spam.
Large corporate website and network outages caused by viruses
and Internet are not uncommon and frequently make the news. What we don't hear
about is the ongoing problem on a personal level. Most people neglect to update
their workstations with patches. They have virus software that has not
been updated ever.
Once a problem strikes a network or home computer, software
is usually the first solution to be tried. Yes, some virus and firewall software
will assist your computer in removing the unwanted intruders. But they cannot
guarantee a 100 percent trouble-free environment.
Shopping for an enterprise firewall can be intimidating if
you've never done it before.
The process can become easier with a little background
knowledge, an understanding of firewalls' features, and knowing what questions
to ask the vendors.
Factors for Choosing Firewalls
One of the first things you need to figure out is what type of firewall best
suits your needs.
There are six basic types of firewalls.
All of these firewall types typically offer stateful packet
inspection or proxy capabilities. These are two techniques that firewalls use to
make decisions on what traffic to allow or deny into and out of your intranet.
In the early days of firewall development, most firewalls
offered only one of these types of traffic passing architectures. Today,
firewalls with hybrid architectures offer both techniques.
Stateful packet inspection firewalls examine protocol packet
header fields while proxy firewalls filter services at the application level.
These firewalls learn and remember connection states and evaluate new traffic
transactions against prior connection histories. Proxy firewalls are able to
create virtual connections and can hide the internal client IP address making it
more difficult to discern the topology of the protected intranet.
Embedded firewalls are embedded into either a router or a
switch and are sometimes referred to as choke-point firewalls. They come
standard with certain routers, and can also be purchase as add-on modules to be
installed into a router or switch. Due to the wide variety of different
protocols used on the Internet, not all services are handled efficiently by
embedded firewalls. Because embedded firewalls work at the IP level, they will
not be able to protect your network from application-level exploits such as
viruses, worms, and trojan-horse programs. In some cases, embedded firewalls
might offer greater performance gains, but they typically offer fewer features
for protecting your networks. Embedded firewalls are often stateless in nature
and pass packets without consideration of prior connection states.
Software-based firewalls are software packages containing
firewall software that you install on top of an existing operating system and
hardware platform. If you have a server with an enterprise-class operating
system that is available for use, purchasing a software-based firewall is a
reasonable choice.
Also, if you are a small organization and want to combine a
firewall with another application server (such
as your website server), adding on a software-based firewall is reasonable. If
you are a large organization, you will probably want to create a security
perimeter network, known as a DMZ (demilitarized zone), and will therefore
probably want to separate your firewall from all other applications.
Software-based firewalls come in both small office/home
office (SOHO) models and enterprise models. Hardware-based firewalls are the
same thing as appliance firewalls. The entire firewall is bundled into a turnkey
system and when you buy it, you get a hardware device that has the software
already inside it. Hardware-based firewalls, or appliance firewalls, also come
in both SOHO and enterprise models.
Specialty firewalls are firewalls with a certain application
focus. For example, there are some security servers with built-in, firewall-type
rules that are made particularly for filtering content, or security messaging
servers.
As security technologies become more advanced, sometimes the
product segments start to blur and you need to understand what the product
actually does, and not rely on its vendor-marketed product definition.
Users, Locations, and Numbers
A consideration that should be very high on your list is how many users do
you need to protect, and how many firewalls will you need? The number of users
you are going to protect will determine whether you need an enterprise-class
firewall or a SOHO firewall. (You can certainly use an enterprise firewall, even
for one user, but you might be paying a lot more than you need to pay, and might
end up with features you will never use.)
Most firewall vendors rate their firewalls for a certain
range of user connections. Typically, the more users you need to support, the
more RAM and processing power you will need in your firewall.
Gurpreet Singh Senior Technology Officer at Mantec
Consultants
Page(s) 1
