- As promised, this lesson, lesson 11.3,
is gonna be all about firewalls.
So let's think about firewalls as a control, right?
The primary objective of a traditional firewall
is to isolate network segments and traffic
by controlling ingress incoming and egress outgoing access.
But various types of firewalls incorporate additional
and or specialized features and functionalities.
So we're gonna be exploring those
different types of firewalls
and what else they bring to the table.
But thinking about firewall as a control itself, right?
Firewalls can be a deterrent control
because a hardened appearance
can discourage opportunistic attackers.
Firewalls are a preventative control
because they can be configured
to restrict ingress and egress traffic
and firewalls are a detective control
because they can be configured to log events
and to send alerts.
Well, before we start talking about the firewalls,
the different types, we have to stop
and talk about the OSI model.
Now, the OSI model is the
open systems interconnection reference model,
which is structured into seven layers.
It's really a network model
that describes layers of communication.
And I think I hear some of you groaning thinking, really,
I didn't think I'd ever have to study the OSI model again.
Well, yes, you do.
There are seven layers in the OSI model,
starting down at the bottom with layer one,
the physical layer, layer two, data link,
layer three, network, layer four, transport,
layer five, session, layer six, presentation,
and then layer seven, application.
So we're gonna talk a little bit more about
what's at each of these layers.
And the reason we're doing it is
because different firewalls
operate at different layers of the OSI model.
So firewalls might operate at layer three, right?
Being the network layer,
at layer four, being the transport layer
or up at a layer seven, the application layer
and depending on what layer they operate in,
means there's different functionalities they can offer.
So let's go through that OSI model,
starting with layer one, the physical layer,
that's down at the bottom, right?
The physical layer is often called the hardware layer.
That's a layer responsible for our electrical
and light and radio signals.
Then we get up to layer two, that's a data link layer
and that's a layer that is responsible for encoding
and decoding those electrical signals into bits.
Now we have two sublayers there.
We have the MAC sublayer, the media access control
and the logical link layer.
Now, the MAC access control layer
is responsible for really identifying
that the network device,
remember we said that every network device
has a unique MAC address,
where the logical link layer does a lot of error correction.
Going up to layer three, the network layer,
that's a layer that's responsible for switching and routing.
Layer four is responsible
for the transparent transfer of data between end systems,
also responsible for end-to-end error recovery
and flow control.
We go up to layer five, which is our session layer
and that's a layer responsible for establishment,
management and termination of connections
between applications.
Moving up to layer six, the presentation layer,
that's a layer responsible for what you see on your screen.
So the onscreen data representation,
as well as encryption and decryption.
And then we get up to the application layer
or layer seven, and that's where applications
and end user processes, as well as QOS, quality of service
and network services are supported.
So we're gonna talk about different types of firewalls
and we'll keep referring back to that OSI model,
as to what layer they operate at.
So our first two are stateless and stateful firewalls,
and these are probably the two
that you're most familiar with.
A stateless firewall is also referred to as a
packet filtering firewall.
The packet filtering firewalls
inspect each and every packet individually
and they decide whether a packet is allowed
or denied based on the header information.
So what do we find in the header information?
Protocol, source IP, destination IP, and the port.
Now packet filtering firewalls
are gonna operate at the network layer of the OSI model,
so at layer three.
Our use case for a stateless packet filtering firewall,
while they're fast, they're efficient,
they're low resource utilization, and they're low cost.
But next up, kind of going up the stack of complexity
and cost, is stateful.
Now, a stateful firewall is gonna inspect the header
and the packet payload,
and keeps track of the entire state of the connection
from start to end.
The stateful firewalls are going to filter packets
based on the full context of the given network connection.
Stateful firewalls operate at the transport layer
of the OSI model.
So they operate at layer four, our use case,
when we might need some more granular control,
then we could get from that stateless
or packet filtering firewall.
Then we wanna move into even more complex firewalls.
And the two we're gonna look at are next generation,
NGFW firewalls and unified threat management or UTM devices.
The NextGen firewalls inspect the entire packet
and they can do surface level
and really deep packet inspection
and they're gonna incorporate
a whole bunch of additional security features
and application controls.
The NextGen firewalls operate at the application layer
of the OSI model, up at layer seven.
Now, here's the caveat
when you're looking at next generation firewalls,
there is no standard right now
as to what the additional security features
or application controls are.
So when you're comparing one next generation firewall
to another, you know,
don't just assume it's an apples to apples comparison.
It could be apples to oranges easily, right?
You really wanna take a look at what are those features
that are being offered.
But what's our use case,
for next generation or NextGen firewall?
Well, suitable for businesses
that have compliance requirements like PCI DSS,
it's a payment card industry data security standard
or just need a very high level of protection.
Then we have a UTM, a UTM, unified threat management
is really the evolution of a firewall
into a more all-inclusive device
that can do multiple security functions.
Now, it depends right, on the UTM, what it actually does,
but it might be a firewall and a gateway.
It might also have anti-malware, right?
It may also be able to do spam filtering.
So really we're talking about UTM,
we're saying, let's take one device
and have it do multiple things.
Now, UTMs generally operate at multiple layers
of the OSI model, depending on what it's offering.
Could be layer three, layer four, and layer seven.
Advantages of a UTM,
well, we have reduced operational complexity, right?
'Cause we only have one device instead of maybe three,
four, or five, and overhead cost,
but our disadvantage, well, number one,
is going to be a single point of failure, right?
If we lost that device, well then we would lose
all of those associated services,
as well as vendor dependency, right?
If it's one vendor that's doing all those
and we have a problem with the vendor of any kind,
well, we're kind of outta luck.
And then we have some more specialized firewalls.
We have web application firewalls and virtual firewalls.
A web application firewall, sometimes referred to as a WAF,
inspects and protects web applications
from malicious attacks, such as cross-site scripting.
We talked about that earlier,
and SQL injection, we also looked at that one earlier.
And it works by analyzing incoming HTTP traffic
to a web application and attempting to filter out
any malicious traffic before it reaches the application.
Now, WAFs typically operate at the application layer
of the OSI model.
So up at layer seven, which allows them to inspect
and filter the application specific traffic.
Now, virtual firewalls are designed to protect
a virtualized environment such as a cloud infrastructure
or virtual machines.
Virtualized firewalls operate
within the virtualized environment
and provide security at the application layer
of the OSI model, again, that was layer seven,
to protect against attacks
that are targeting the virtualized environment.
So when we think about our firewalls,
we have to think about
how we're going to configure them appropriately,
strategically align, if you will,
with the needs of our organization.
So four key categories of planning are traffic filtering,
business rules, logging and assurance.
So in traffic filtering, we have to decide,
well are we going to be in allow by default mode, right?
Or default allow, which doesn't,
which if not explicitly denied, then access is allowed.
Or do we wanna be in default deny mode, right?
Or deny by default, which means that
if not explicitly allowed, then access is denied.
Well, you already know that answer, right?
We never wanna be in default allow or allow by default,
'cause that means all traffic can flow,
everything's going back and forth until we start denying it.
We really wanna choose to be in default deny
or deny by default, two different ways
to say the same thing mode,
but beware that not every firewall
comes out of the box, right?
In default deny mode,
some firewalls still might come in default allow.
So you wanna be very cognizant of that.
Then we have business rules.
We need to set up a bunch of rules
about who's allowed to do what.
Remember, in default deny
there's gonna be no ingress or egress traffic
until we set up these rules.
So we're gonna set up what's known as an access control list
but the access control list
should always be based on business requirements.
So we wanna make sure that all of our rules in our firewall
strategically align, right?
With the business, with the needs of the business
and that there should be a process
for approving a new rule an allow or deny rule
and or for any exceptions to that rule.
Then we wanna make sure that we're logging,
we definitely wanna be logging
everything that's happening at our firewalls.
So we wanna configure our logs,
we wanna have a process for log reviews
and we wanna make sure we're archiving those logs
because we may need to use those logs, you know,
sometime in the future if we're coming back
and doing any type of investigation or forensic analysis.
And we're gonna do a whole lesson on logging.
And then lastly, assurance.
We want to know that the firewall
which is such a critical device for us
is working the way we expect, that it's trustworthy.
So we want to be making sure that we have scheduled
and organized and paying attention to
configuration and rule set audits,
doing scanning and penetration testing.
So I just mentioned that we have rules, right?
Rules are what allows activity to happen, right?
And we often refer to 'em as either rules
or access control lists.
Important thing you need to know about rules
is that they are processed in order from top to bottom.
So when the system, the firewall is looking through rules,
should I allow this traffic?
It starts at the top of the rule set
and goes down and down and down and down and down
and it stops at the rule that is most applicable.
So in looking at these rules, well,
let me back up a minute for you
and tell you what's actually gonna be in these rules, right?
These rules will have information about permission
based on port, protocol, source IP, and destination IP.
So permissions would be either allow,
meaning, permit, or deny.
The protocol would be UDP, user datagram protocol.
TCP, transmission control protocol or IP.
IP would mean either UDP or TCP.
The port is the listening port.
So for example, the port 80 is for HTTP.
The source IP is where the traffic is coming from
and that could be a host, a range or a wild card,
or just any, literally could say any.
And then destination is where the traffic is going.
And again, that could be a host range, a wild card, or any.
So that's what's gonna be in the rules themselves.
But going back to this idea that rules are processed
in order from top to bottom,
you really wanna pay attention to that
because the system will stop at whatever rule,
right, applies, so if you have a rule that says,
all of our users, and I'm not gonna do it
in the correct syntax here,
but let's say we say all of our users can go out
to the internet or all machines, all systems,
all IP addresses can go out to the internet.
But then there's one that you don't wanna allow
to go out to the internet.
So maybe the next rule is, no, we're not gonna,
we're gonna not allow this particular machine
at this particular IP address to go out to the internet.
Doesn't matter, they've already been allowed
because the rule above it already said, they can do it.
So you really have to be very cognizant
of the order of the rules.
Now, the last rule of an ACL
is generally to block any traffic
that hasn't been previously allowed.
It's just kind of a catchall.
All right, so that's a lot about firewalls.
And now we have a three second challenge,
five challenge questions, three seconds each.
You know what to do.
This type of firewall is effective against XSS.
That's cross site scripting attacks.
One, two, three.
That's gonna be a web application firewall or a WAF.
Number two, this type of firewall evaluates
each packet individually.
One, two, three.
That's gonna be a stateless or a packet filtering firewall.
Number three, this principle is expressed as,
if not explicitly allowed, then access is denied.
If not explicitly allowed, then access is denied.
That's gonna be default deny or deny by default.
You can say it either way, it means the same exact thing.
Number four, NextGen firewalls operate at this OSI layer.
One, two, three.
I'm looking at layer seven, the application layer.
And lastly, number five, order that firewall ACL rules,
access control list rules are processed.
This is really important.
One, two, three, from top to bottom.
And the first rule it applies, that's what happens, right?
The system doesn't go check any further down.
That's why the order of rules is really, really critical.
Okay, that brings us to a security in action.
This one's about a firewall replacement.
One of the priority recommendations
from a recent security assessment
was for your organization to replace its very old
past end of life packet filtering firewalls
that are being used in home office environments.
Okay, so what are you gonna recommend for a replacement?
So again, this is a priority, right?
They say that it is really a priority recommendation.
We just had a security assessment.
So we had somebody spent a lot of time looking at it.
They said, you've got some very old,
meaning past end of life,
probably past end of support as well,
packet filtering firewalls that are being used
in a home office environment.
And they've asked you for recommendations
of what should replace them.
So what are you gonna say?
Feel free to put me on pause while you jot down some notes.
Well, what are you gonna replace them with,
really depends on specific needs, right?
Options would be to replace those end of life firewalls
with a new packet filtering or stateless firewall,
'cause it might just be all they need.
Fast, efficient, low cost,
doesn't have a lot of granular controls,
but maybe that's not needed.
Or maybe we'll upgrade to a stateful firewall
because maybe now is the time
to have a little bit more granular control
and be able to evaluate the entire state of the connection,
not just what's in a packet header.
Now, the advantages of the stateless firewall,
again, is they're efficient,
they're low resource utilization, and they're low cost.
But the advantages of that stateful firewall
can more granular control,
ability to potentially differentiate between legitimate
and malicious traffic and greater rule flexibility.
So the answer in this case really is gonna be,
well, it depends, other than we're pretty convinced
that yes, we need to replace those firewalls,
we do agree with that recommendation
because we know we never wanna be running any,
you know, past end of life, end of support software,
hardware operating system, or any type of device.
Being able to make these recommendations
and understand how to move forward,
that's security in action.
There you go, there's your word cloud,
you know what to do, when you're ready.
I'll see you at the next lesson.