Defending Networks Firewalls and VPNs

Firewall Fundamentals

• Definition: A network firewall acts as a barrier between networks to block dangerous inbound and outbound communications.

• Implementations: Includes home wireless routers ($Netgear$), enterprise routers ($Cisco$), and dedicated hardware firewalls ($Watchguard$).

• Firewall Policy: A set of rules defined by five main criteria:

  • Direction: Inbound or outbound.

  • Source IP and Port.

  • Destination IP and Port.

  • Action: Allow or block.

• Default Policy: The safest configuration uses the wildcard character $*$ to block all traffic ($*\,*\,*\,*\,* \rightarrow allow/block$).

• Advanced Features: Modern firewalls support protocol filtering (TCP, UDP, or ICMP), deep packet inspection of data payloads, and application-specific bandwidth restrictions.

Personal Firewalls

• Integration: Part of the host operating system providing protection additional to the network firewall.

• Use Case: Ideal for mobile devices (laptops) that connect to untrusted networks.

• Management: Requires administrator privileges; company devices are often managed centrally to prevent attackers from disabling protection.

Virtual Private Networks (VPNs)

• Purpose: Provides a private network connection across untrusted networks like the Internet for mobile workforces.

• Components:

  • VPN Client: Software on the user's device.

  • VPN Server: Authenticates users and routes traffic; often a dedicated device or VPN concentrator.

  • Tunnel: An encrypted connection that treats the remote client as if it is on the local area network.

• Security Layers: Employs encryption, hashes, digital signatures, and Message Authentication Codes (MACs) to ensure authenticity and integrity.

Security Risks and TOR

• VPN Vulnerabilities: Remote machines bypass corporate firewalls; implementation flaws (e.g., $Microsoft$ vulnerabilities in $1998$); reliance on Internet reliability.

• Privacy Limits: VPNs provide limited anonymity as servers are easily identified and data may be seized by law enforcement.

• TOR (The Onion Router): Developed by the $US Naval Research Lab$ in $1995$. It uses onion routing to hide network exit points, aiding activists like those in the $Arab Spring (2010-)$ or individuals like $Edward Snowden (2013)$.

Questions & Discussion

• Guest Lecture: $Ethan King$ from $Bastion Security$ is scheduled for a Thursday guest session.

• Assignments: Assignment 3 is due Monday $4 \text{ May } 23.59$. Assignment 4 will be released by the end of the week, due $18 \text{ May } 23.59$.