There's no scaling a secure firewall
- By John McCormick
- Jun 21, 2004
Firewalls are an essential element of network protection, though they're not the whole package. Selecting the most appropriate firewall for a network configuration is only part of the job; you must also configure it correctly and maintain it properly by updating it to reflect newly disclosed vulnerabilities and closing ports against new network threats.
The first step is to set a policy for firewall use. The policy you choose is far more important than the brand of firewall, as long as the firewall is sufficiently robust to handle your policy rules and the traffic load.
It's critical to specify and maintain an up-to-date policy based on threat levels, including newly discovered or emerging threats, the value of your information and the specific network configuration. Despite the fact that each firewall configuration is specific to your installation, there are some general rules:
- Block all inbound traffic that isn't permitted. This is more difficult than allowing everything in and then filtering out what shouldn't get through, but it is by far the more effective strategy.
- Block any unnecessary protocols.
- Block e-mail attachments that may contain an executable function.
Blocking or filtering inbound traffic to the known vulnerable ports should be the baseline configuration for protecting a network. It will block a high percentage of attacks, but it is only the beginning.
If the firewall runs on a host operating system, that OS must be hardened as completely as possible, or hackers will simply go around the firewall through known or newly disclosed OS vulnerabilities.
The National Institute of Standards and Technology's Special Publication 800-41 recommends the following types of network traffic always should be blocked:
- Inbound traffic from a nonauthenticated source system with a destination address of the firewall system itself
- Inbound traffic with a source address indicating that the packet originated on a network behind the firewall
- Inbound traffic from a system using a source address that falls within the address ranges set aside in RFC 1918 as reserved for private networks
- Inbound traffic from a nonauthenticated source system containing Simple Network Management Protocol traffic
- Inbound traffic containing IP Source Routing information
- Inbound or outbound network traffic containing a source or destination address of 127.0.0.1 (localhost)
- Inbound or outbound network traffic containing a source or destination address of 0.0.0.0
- Inbound or outbound traffic containing directed broadcast addresses.
There is no such thing as a set-and-forget firewall. New threats emerge all the time, and often the best ? or only ? way to protect a network is to block some specific port until vendors release patches, and you have time to apply them. This is no rare event; it occurs at least every month for many networks.
Finally, there must be a fixed schedule for verifying that the firewall is applying the written policy. This should probably be a combination of regularly checking hard-copy printouts of the actual firewall settings against the stated policy and actual testing.
No system can be considered secure without periodic real-world tests of firewall policies, in which you attempt to penetrate the firewall, confirming not only that policies are programmed but also that the firewall is able to properly apply them in every instance. This physical test should be made after any vulnerability in the security software is discovered and patched.
For any agency permitted to use outside tests, Gibson Research Corp. (www.grc.com
) makes ShieldsUP, a free firewall-testing program that can run online to test the first 1,056 TCP ports. You might want to bookmark this even if you only use it as a quick reference, because moving the cursor over the map generated by the site produces a quick report on each port's function.
ShieldsUP also displays your browser's Web server requests, which may be revealing information you don't want freely disseminated, such as your server's software and version.
If nothing else, the GRC site provides a lot of basic security-related information.
Many agency installations will need to purchase commercial test software to verify firewall protection. It would be nice if you could simply install a firewall and feel secure. But even properly configured firewalls are far from perfect, especially since they have been found to contain bugs or vulnerabilities.
Check Point Software Technologies Ltd. has reported vulnerabilities in its VPN-1 and FireWall-1 products so far this year. All of these vulnerabilities were patched, but the threats were highly critical because most would allow a remote attacker to run arbitrary code.
Zone Labs' ZoneAlarm firewall was discovered to have a highly critical vulnerability in February, one that would allow an attacker to bypass the firewall and take control of the network.
Every firewall or other security tool is likely to have some hidden vulnerability that will someday surface with greater or lesser impact, so administrators need to monitor new threats not just to operating systems and applications but also to their security software itself.
John McCormick is a freelance writer and computer consultant. E-mail him at firstname.lastname@example.org