CIS 480 Chapter 9

Ace your homework & exams now with Quizwiz!

-Rules are numbered sequentially and displayed in a grid -Most important rules should be at the top of the list -Make the last rule a cleanup rule

How firewals process rules

Handles any other packets that have not been covered in preceding rules

cleanup rule

most user-friendly packet filter

Windows Firewall

-Do not depend on conventional OSs -Generally more scalable than software firewalls -Can handle more data with faster throughput

advantages of hardware firewalls

Located between the Ethernet adapter driver and the TCP/IP stack

commercial software-based firewalls

Hardware or software configured to block unauthorized network access

Firewall

Self-contained hardware devices added to a network

Firewall appliances

addition to security policy that describes how firewalls should handle application traffic

Firewall policy

-Identify network applications that are needed -Determine methods for securing application traffic •Must balance security, user requirements, and cost -Consider all firewalls in your network •Develop a traffic matrix for each location

General steps to create a firewall policy

How many rules is optimal in a rule base

About 30, no more than 50

sudden increase in dropped inbound/outbound packets

potential attack

usually installed on dedicated host for max security, centralized administration for large networks, real-time monitoring

advantages of commercial enterprise software firewalls

simple to install, economical, autoconfiguration allows novices to use though advanced users can fine-tune

advantages of commercial personal software firewalls

more scalable and offer faster throughput

advantages of firewall hardware appliances

small file size and easy installation

advantages of free software firewalls

sudden decrease in dropped inbound/outbound packets

attack stopped or they're already in

each connection increases the processing overhead

disadvantages of application proxy

can be difficult to install and configure and tend to be more expensive

disadvantages of commercial enterprise software firewalls

not as full featured and not as robust as hardware appliances, usually installed on single-computer systems, which reduces security

disadvantages of commercial personal software firewalls

can be expensive and difficult to patch if bugs or security alerts require it

disadvantages of firewall hardware appliances

only minimal features offered and lack of tech support

disadvantages of free software firewalls

-They do depend on nonconventional OSs -Tend to be more expensive than software products

disadvantages of hardware firewalls

-Include centralized management option -Some are capable of installing multiple instances from a centralized location -Some examples include •Check Point NGX •Proventia security products

enterprise software-based firewalls

Tells firewalls what to do when a certain kind of traffic attempts to pass

Rule base

layered defense strategy that includes an IDPS, firewalls, antivirus software, access control and auditing

Defense in depth (DiD)

Core functions of firewalls

Filtering, proxying, and logging

Most popular version of FTP

Passive mode

Advantage: Inexpensive Disadvantages: Hard to maintain, vulnerable to IP spoofing, and no form of authentication

Packet filetering firewalls

Acts as a relay of application-level traffic -user contacts gateway using a TCP/IP application -user is authenticated -gateway contacts application on remote host and relays TCP segments between server and user Tend to be more secure than packet filters

Application-Level Gateway (application proxy)

Packet filter placement

Between the Internet and a host or between a proxy server and the Internet

_______ packets have no authentication method

ICMPv4

function as housekeeping protocols for TCP/IP

ICMPv4 and ICMPv6

Select the information below that cannot be used by a stateless packet filter to allow or deny network traffic. -IP address -Last hop info -TCP flags -Ports

Last hop info

Palo Alto, Fortinet, Check Point Technologies

Leaders in enterprise network firewalls

Only used on IPv4 networks

Network Address Translation (NAT)

combination of multiple software and hardware components

Network firewall

cannot protect connections that do not go through it or against malicious insiders

Shortfalls of firewalls

Keeps a record of connections a host computer has made with other computers in state table and allows packets to pass through only from external hosts already connected

Stateful Packet Filtering

-Determines whether to allow or block packets based on information in the protocol headers -Filtering based on common IP header features -Intruders can get around these defenses

Stateless Packet Filtering


Related study sets

CH 17 Web Design Website Standards

View Set

4A2 - Motors Level 2 - Lesson 6: Motor Branch Circuits

View Set