Impact to it security of incorrect configuration of firewall policies and third party vp ns

Impact to IT security of incorrect
configuration of firewall policies and
third-party VPNs
LECTURER: USMAN BUTT

Mistakes You Need to Avoid
A misconfigured firewall can be as dangerous as having no firewall at all. Here's a look at five
common firewall oversights that can leave any network open to attack.
Firewalls are a main line of defense against all types of network invaders, yet even after years of research
and experience, many organizations still make configuration mistakes that leave their networks vulnerable
to data theft, sabotage, and other types of mayhem.
Here's a rundown of five unsound firewall practices that should be avoided at all cost.

Firewall
A firewall is a network security device that monitors incoming and outgoing network traffic and
permits or blocks data packets based on a set of security rules. Its purpose is to establish a
barrier between your internal network and incoming traffic from external sources (such as the
internet) in order to block malicious traffic like viruses and hackers.

How does a firewall work?
Firewalls carefully analyze incoming traffic based on pre-established rules and filter traffic
coming from unsecured or suspicious sources to prevent attacks. Firewalls guard traffic at a
computer’s entry point, called ports, which is where information is exchanged with external
devices. For example, “Source address 172.18.1.1 is allowed to reach destination 172.18.2.1
over port 22."
Think of IP addresses as houses, and port numbers as rooms within the house. Only trusted
people (source addresses) are allowed to enter the house (destination address) at all—then it’s
further filtered so that people within the house are only allowed to access certain rooms
(destination ports), depending on if they're the owner, a child, or a guest. The owner is allowed
to any room (any port), while children and guests are allowed into a certain set of rooms
(specific ports).

Types of firewalls
Firewalls can either be software or hardware, though it’s best to have both. A software firewall is
a program installed on each computer and regulates traffic through port numbers and
applications, while a physical firewall is a piece of equipment installed between your network
and gateway.

Packet-filtering firewalls
the most common type of firewall, examine packets and prohibit them from passing through if
they don’t match an established security rule set. This type of firewall checks the packet’s source
and destination IP addresses. If packets match those of an “allowed” rule on the firewall, then it
is trusted to enter the network.
Packet-filtering firewalls are divided into two categories: stateful and stateless. Stateless
firewalls examine packets independently of one another and lack context, making them easy
targets for hackers. In contrast, stateful firewalls remember information about previously passed
packets and are considered much more secure.
While packet-filtering firewalls can be effective, they ultimately provide very basic protection
and can be very limited—for example, they can't determine if the contents of the request that's
being sent will adversely affect the application it's reaching. If a malicious request that was
allowed from a trusted source address would result in, say, the deletion of a database, the
firewall would have no way of knowing that. Next-generation firewalls and proxy firewalls are
more equipped to detect such threats.

Next-generation firewalls (NGFW)
combine traditional firewall technology with additional functionality, such as encrypted traffic
inspection, intrusion prevention systems, anti-virus, and more. Most notably, it includes deep
packet inspection (DPI). While basic firewalls only look at packet headers, deep packet
inspection examines the data within the packet itself, enabling users to more effectively identify,
categorize, or stop packets with malicious data

Proxy firewalls
filter network traffic at the application level. Unlike basic firewalls, the proxy acts an
intermediary between two end systems. The client must send a request to the firewall, where it
is then evaluated against a set of security rules and then permitted or blocked. Most notably,
proxy firewalls monitor traffic for layer 7 protocols such as HTTP and FTP, and use both stateful
and deep packet inspection to detect malicious traffic.

Network address translation (NAT)
firewalls
allow multiple devices with independent network addresses to connect to the internet using a
single IP address, keeping individual IP addresses hidden. As a result, attackers scanning a
network for IP addresses can't capture specific details, providing greater security against attacks.
NAT firewalls are similar to proxy firewalls in that they act as an intermediary between a group
of computers and outside traffic.

Stateful multilayer inspection (SMLI)
firewalls
filter packets at the network, transport, and application layers, comparing them against known
trusted packets. Like NGFW firewalls, SMLI also examine the entire packet and only allow them
to pass if they pass each layer individually. These firewalls examine packets to determine the
state of the communication (thus the name) to ensure all initiated communication is only taking
place with trusted sources.

Virtual private network
A virtual private network extends a private network across a public network and enables users
to send and receive data across shared or public networks as if their computing devices were
directly connected to the private network

Impact to it security of incorrect configuration of firewall policies and third party vp ns

More Related Content

What's hot (20)

Similar to Impact to it security of incorrect configuration of firewall policies and third party vp ns (20)

Recently uploaded (20)

Impact to it security of incorrect configuration of firewall policies and third party vp ns