Firewall, IDS & IPS

basics

25 ottobre 2018 1
Summary

 Firewalls
 Intrusion detection system
 Intrusion prevention system
Firewalls

 A firewall is a part of a computer

system or network that is designed
to block unauthorized access while
permitting authorized
communications
 Firewalls can be implemented in
either hardware or software, or a
combination of both
Firewalls

 A typical firewall placement

Firewalls

 Firewalls analyze all incoming

traffic from all interfaces and apply
rules to it
 Easier rules look at
source/destination IP addresses,
source/destination ports, packet
flags, etc. etc.
Firewalls

 Each rule has an associated action

to perform if the packet matches
the rule conditions.
Firewalls
 Usual actions are:
► Accept
► Deny
► Reject

► What is the difference amongst deny and

reject?

 Personal firewalls have one more

rule:
► Ask the user
Firewalls
 Most common firewall types:

► Packet filters
• Stateless (i.e. routers' ACLs)
• Stateful
► Proxy gateways
• 2 different connections, one for each side of the
firewall (packets are not forwarded directly)
• i.e. web proxies
► NAT
• Changes IPs/ports/etc. of packets traversing it
Firewalls

 Personal firewall
 Windows Firewall
►a software component of Microsoft
Windows that provides firewalling and
packet filtering functions
► first included in Windows XP and Windows
Server 2003
Firewalls

 Windows firewall
► Windows XP
• Enabled by default
• Built-in exceptions to allow connections from
machines on the local network
• Cannot block outbound connections; it is only
capable of blocking inbound ones
Firewalls

 Windows firewall
► Windows Vista
• Outbound packet filtering, reflecting increasing
concerns about spyware and viruses that
attempt to "phone home"
• With the advanced packet filter, rules can also
be specified for source and destination IP
addresses and port range
► Windows Seven
• Multiple firewall policies
Intrusion detection system

 A device or software application

that monitors network and/or
system activities for malicious
activities or policy violations and
produces reports to a Management
Station
Intrusion detection system
 There is an analogy between IDS
and alarm systems:
Intrusion detection system

 Kinds of IDS:
► Hostbased
► Network based
► Network node based

► Real time vs. non real time

Intrusion detection system

 How they work:

► Signature based
► Anomaly based
► Protocol based anomaly detection
Intrusion detection system
 Difference between an IDS and a
firewall
►A firewall blocks potential intruders in order
to stop them from carrying ou their bad
activities, an IDS evaluates a suspected
intrusion once it has taken place and
signals an alarm
► Firewalls limit access between networks to
prevent intrusion and usually do not block
attacks from inside the network, an IDS
also watches for attacks that originate from
within a system
Intrusion prevention
system
 A network security appliance (or
software) that monitors network
and/or system activities and blocks
malicious ones
 Its main functions are
► identify malicious activity
► log information about said activity
► attempt to block/stop activity
► report activity
Intrusion prevention
system
 An “extension” of intrusion
detection systems
► they both monitor network traffic and/or
system activities for malicious activity
► unlike intrusion detection systems,
intrusion prevention systems are placed in-
line and are able to actively prevent/block
intrusions that are detected