Data Security Learning Module

Firewalls & Intrusion Detection Systems

Created By Eng. Eslam Osama

Security Objectives

Before diving into firewalls and IDS, it's crucial to understand the fundamental goals of information security:

Confidentiality

Protection of data from unauthorized disclosure.

Integrity

Assurance that data received is as sent by an authorized entity.

Availability

Assures that systems work promptly and service is not denied to authorized users.

Authenticity

The property of being genuine/able to be verified/trusted/confidence in the validity of a transmission/message/message originator.

Accountability

The security goal that generates the requirement for actions of an entity to be traced uniquely.

Information Security vs Network Security

Information Security

Information security means protecting data so that only the right people can access it (confidentiality), it stays accurate and unchanged (integrity), and it's available when needed (availability). It also includes user's identity can be identified (authenticity), actions can be tracked (accountability), no one can deny their actions (non-repudiation), and the system works reliably.

Network Security

Network security focuses on protecting networks and their devices from unauthorized access, changes, or damage. It ensures that data can move safely through the network and that everything connected (like routers or servers) works correctly and securely without causing harm or being exposed to threats.

Firewalls

What is a Firewall?

A firewall is like a security gate that controls what data can go in or out of your network. It helps protect your internal network from the dangers of the internet and is often the first layer of defense.

Main Purposes and Functions of Firewalls

Network Traffic Filtering

Firewalls control what data enters or leaves a network by checking each packet against a set of rules. They filter traffic based on details like:

Source IP address (where it's coming from)
Destination IP address (where it's going)
Port numbers (type of service like web or email)
Protocols (like TCP or UDP)

This helps block unwanted or harmful traffic and only allows approved connections to pass through.

Access Control

Firewalls help control who can access your network by using predefined rules, which are settings created by network administrators to decide what is allowed or blocked. These rules tell the firewall to either permit or deny network connections based on things like IP addresses, ports, or types of services.

Network Address Translation (NAT)

NAT lets many devices (like phones, laptops, smart devices) inside your private network use one public IP address to connect to the internet.

Purpose:

Hides internal IP addresses from the outside world for extra security
Helps the firewall control traffic coming in and going out

How It Works:

You have a router/firewall with NAT
Inside your network: devices use private IP addresses
When devices access internet, NAT changes the private IP into the public IP of the router
It keeps track of the requests, so when the response comes back, it knows which internal device should get it (using translation table)

Threat Prevention

Firewalls provide protection against various network threats, such as malware, viruses, and intrusion attempts.

VPN and Remote Access Security

Firewalls often support VPNs (Virtual Private Networks), which allow users to safely connect to a private network from a remote location (like from home or while traveling). A VPN encrypts the connection, keeping data private and secure from hackers, especially on public Wi-Fi. Firewalls help control and protect these remote connections by only allowing trusted users to access the network.

Logging and Auditing

Firewalls maintain logs of network traffic and security events. These logs can be used for monitoring and auditing purposes.

Intrusion Detection and Prevention (IDPS)

It is a security feature that monitors network traffic to detect and stop attacks or suspicious activity in real time and also Alert admins, so they know something suspicious is happening.

Virtual Segmentation

Means splitting a big network into smaller, separate zones or sections using a firewall. Each section is like a "mini-network" inside the main one.

Purpose:

Better security: Keep sensitive parts (like servers or admin systems) separate from general user traffic
Limit damage: If a hacker gets into one zone, they can't easily move to other zones

Design Goals for a Firewall

1. All traffic from inside to outside, and vice versa, must pass through the firewalls.
2. Only authorized traffic, as defined by the local security policy and rules, will be allowed to pass.
3. The firewall itself is immune to penetration. This implies the use of a hardened system with a secured operating system (OS).

Firewall Techniques

Service Control

Decides which Internet services (like email, web browsing, or file sharing) are allowed to enter or leave the network.

Direction Control

Controls whether service requests can flow into the network, out of the network, or both.

User Control

Controls access to a service according to which user is attempting to access it. This feature is typically applied to local users inside the firewall perimeter.

Behavior Control

Manages how certain services are used, such as limiting how much data can be transferred or which features of a service can be accessed.

Firewall Limitations

1. Bypass Attacks

If attackers find a way around the firewall (like using an unprotected network path), the firewall can't stop them.

2. Internal Threats

Firewalls don't fully protect against people inside the company who might cause harm, whether on purpose or by accident.

3. Wireless Network Risks

If the company's wireless network isn't secured well, outsiders might connect to it and cause problems.

4. Infected Devices

Devices like laptops or smartphones can get viruses or malware outside the company, and when brought back inside, they can infect the internal network.

Types of Firewalls

1. Packet Filtering Firewall

A network security tool that checks each data packet and decides if it should be allowed or blocked, based on rules. It works on Network layer to handles IP addresses and Transport layer to handles port numbers and protocols.

Packet Filtering Firewall Diagram