A fluid line of defense
Network firewalls have to change to keep up with evolving threats
- By John McCormick
- Jun 18, 2004
Firewalls are an essential element of network protection, though they're not the whole package.
Selecting the most appropriate firewall for your network configuration is only part of the job; you must also configure it correctly and maintain it properly, both by keeping it updated to reflect newly disclosed vulnerabilities and by closing ports against new network threats.
The first step is to set a policy for firewall use. The policy you choose is far more important than the brand of firewall, as long as the firewall is sufficiently robust to handle your policy rules and the traffic load.
Specifying and maintaining an up-to-date policy based on threat levels'including newly discovered or emerging threats'the value of your information and the specific network configuration is critical. Despite the fact that this is a moving target and each firewall configuration is specific to your installation, there are some general rules:
- By default, you should block all inbound traffic that isn't specifically permitted. This is more difficult than allowing everything in and then filtering out what shouldn't get through, but it is the only effective strategy.
- Block any protocol that isn't absolutely necessary.
- Block all e-mail attachments that could possibly contain an executable function.
- Blocking or filtering inbound traffic to the known dangerous ports should be the baseline configuration for protecting a network. It will block a high percentage of attacks, but it is only the beginning.
If the firewall runs on a host operating system, that OS must be hardened as completely as possible or hackers will simply go around the firewall through known or newly disclosed OS vulnerabilities.
The National Institute of Standards and Technology's Special Publication 800-41 recommends the following types of network traffic always should be blocked:
- Inbound traffic from a nonauthenticated source system with a destination address of the firewall system itself
- Inbound traffic with a source address indicating that the packet originated on a network behind the firewall
- Inbound traffic from a system using a source address that falls within the address ranges set aside in RFC 1918 as reserved for private networks
- Inbound traffic from a nonauthenticated source system containing Simple Network Management Protocol code,/li>
- Inbound traffic containing IP Source Routing information
- Inbound or outbound network traffic containing a source or destination address of 127.0.0.1 (localhost)
- Inbound or outbound network traffic containing a source or destination address of 0.0.0.0
- Inbound or outbound traffic containing directed broadcast addresses.
In addition, there is no such thing as a set-and-forget firewall. New threats emerge all the time and often the best or only way to protect a network is to block some specific port until vendors release patches and you have time to apply them. This is no rare event; it occurs every month or so for many networks.
Finally, there must be a fixed schedule for verifying that the written policy is actually being applied by the firewall. This should probably be a combination of regularly checking hard-copy printouts of the actual firewall settings against the stated policy and actual testing.Real-world tests
No system can be considered secure without periodic real-world tests of firewall policies, in which you attempt to penetrate the firewall, confirming not only that policies are programmed but that the firewall is able to properly apply them in every instance.
This physical test should certainly be made after any vulnerability in the security software is discovered and patched.
For any agency permitted to use outside tests, Gibson Research Corp., at www.grc.com
, makes ShieldsUP, a free firewall testing program you can run online to test the first 1,056 TCP ports. You might want to bookmark this even if you only use it as a quick reference , because moving the cursor over the map generated by the site gives a quick report on each port's function.
ShieldsUP also displays your browser's Web server requests, which may be revealing information you don't want freely disseminated'such as your server's software and version.
If nothing else, the GRC site provides a lot of basic security-related information.
Many agency installations will likely need to purchase commercial test software to verify firewall protection.
It would be nice if you could simply install a firewall and feel secure. But even properly configured firewalls are far from perfect, especially since they themselves have been found to contain bugs or vulnerabilities.
Check Point Software Technologies Inc. has reported vulnerabilities in its VPN-1 and FireWall-1 products so far this year. All of these vulnerabilities were patched, but the threats were highly critical because most would allow a remote attacker to run arbitrary code.
Zone Labs' ZoneAlarm firewall was discovered to have a highly critical vulnerability in February, one that would allow an attacker to bypass the firewall and take control of the network.
These aren't the only vulnerable firewalls, just a few recent threats that received wide publicity.
Every firewall or other security tool is likely to have some hidden vulnerability that will someday surface with greater or lesser impact, so administrators need to monitor new threats not just to operating systems and applications but also to their security software itself. John McCormick is a free-lance writer and computer consultant. E-mail him at firstname.lastname@example.org.