NETWORK SECURITIES
Security was not an important issue in the early days of computing,where companies or universities had a single computer centre which was not connected.Here security meant placing a guard at the door.The guard made sure that no one removed any tapes,disks or cards from the room.
Since the advent of Networking the importance of security has changed radically.No one can manually monitor the millions of bytes of data that move between computers on the internet.
Network Security is concerned with the following aspects:
1.Protecting data from being read by unauthorized persons
2.Preventing unauthorized persons from inserting or deleting messages
3.Verifying the sender of each message
4.Making it possible for users to send signed documents electronically
The above goals can be achieved with Encryption and Firewalls.
Now I will be taking up Firewalls and will later talk about Encryption,which is related to the project work we are doing.
Most of you have seen sensational headlines about sophisticated hackers breaking into corporate and government networks.
Who are these people?
What do they do?
They range from clever students and thrill-seekers to professional cyber-criminals.
They install sniffer softwares on network nodes to monitor transmissions. They listen in and copy email, files or logon sequences. They crack into computers to gain lists of credit card numbers or passwords which are then used for illicit activity.
The Internet is emerged as an absolute paradise for intruders or hackers. By definition, the Internet is an un-trusted network, while your internal network is normally considered a trusted network. By establishing a connection to the Internet, you may compromise the trust of your internal network.
Possible Threats to Networks
These are the nastiest, because they're very easy to launch, difficult (sometimes impossible) to track. The premise of a DoS attack is simple: send more requests to the machine than it can handle. If the host is able to answer 20 requests per second, and the attacker is sending 50 per second, obviously the host will be unable to service all of the attacker's requests.
``Unauthorized access'' is a very high-level term that can refer to a number of different sorts of attacks. The goal of these attacks is to access some resource that your machine should not provide the attacker. For example, a host might be a web server, and should provide anyone with requested web pages. However, that host should not provide command shell access without being sure that the person making such a request is someone who should get it, such as a local administrator.
A firewall is a single device or a series of specialised servers and routers that will control network usage by user, by location and by application.
Network firewalls are concerned with :
1.Privilege definition within the trusted network
2.Audit
3.User Authentication
4.Encryption
Figure of Packet Filtering Firewall-Router
Definition of Firewall:
A network firewall is a set of software and hardware components designed to secure the trusted network from outside intrusion through the assignment and monitoring of privilege by user and by location.
What does a firewall do?
A firewall examines all traffic routed between the two networks to see if it meets certain criteria. If it does, it is routed between the networks, otherwise it is stopped.
A firewall filters both inbound and outbound traffic.
How does Firewalls work?
Firewalls operate at different layers to use different criteria to restrict traffic. The lowest layer at which a firewall can work is layer three. In the OSI model this is the network layer. In TCP/IP it is the Internet Protocol layer.
At this layer a firewall can determine whether a packet is from a trusted source, but cannot be concerned with what it contains or what other packets it is associated with.
Firewalls that operate at the transport layer know a little more about a packet, and are able to grant or deny access depending on more sophisticated criteria.
At the application level, firewalls know a great deal about what is going on and can be very selective in granting access.
From this it appears that the firewalls operating in higher layers are more superior in every respect.But this is not necessarily true,the lower the layer in which the packets are intercepted,more secure the firewall is.
If the intruder cannot get past layer three,it is impossible for him to gain control of the operating system.
Types of Firewalls:
Firewalls fall into four broad categories
1.Packet Filters
Packet filtering firewalls work at the network level of the OSI model, or the IP layer of TCP/IP. They are usually part of a router. A router is a device that receives packets from one network and forwards them to another network. In a packet filtering firewall each packet is compared to a set of criteria before it is forwarded.
The advantage of packet filtering firewalls is their low cost and low impact on network performance.
2.Circuit Level Gateways
Circuit level gateways work at the session layer of the OSI model, or the TCP layer of TCP/IP. They monitor TCP handshaking between packets to determine whether a requested session is legitimate.
They hide information about the network they protect but do not filter individual packets.
3.Application Level Gateways
Application level gateways, also called proxies, are similar to circuit-level gateways except that they are application specific. They can filter packets at the application layer of the OSI model.
Application level gateways can also be used to log user activity and logins. They offer a high level of security, but have a significant impact on network performance.
4.Stateful Multilayer Inspection Firewalls
Stateful multilayer inspection firewalls combine the aspects of the other three types of firewalls. They filter packets at the network layer, determine whether session packets are legitimate and evaluate contents of packets at the application layer.
They offer a high level of security, good performance and transparency to end users. However they are expensive very complicated.