-: Network perimeter security.
So, when we talk about network perimeter
security devices, the first one that comes to mind
for most people is a firewall.
And a firewall is the most common one that you're
gonna come across in the field.
Firewalls are always usually found
at the network boundaries,
so you want them right on the edge of your network,
so they can stop things from coming
into your network that are bad or prevent things
going out of your network that you don't want.
They are generally set up as triple-homed devices.
You'll find them attached to three different networks
The internet, the intranet,
and the DMZ or demilitarized zone.
You want to remember that if you're going to be taking
the CSA+ exam because they will ask you questions
about these triple-homed devices called firewalls.
Now, when I talk about a triple-homed firewall,
what does it look like?
Well, here is an example for you.
You can see I have my web server and my database server
hanging off of my DMZ and right there in the center,
between the intranet,
the internet and the DMZ is my firewall.
That's the idea of a triple-homed firewall
because it is home to three different types of networks;
External, internal and the semi-trusted zone called the DMZ.
Now, when we talk about the DMZ,
it is the demilitarized zone.
It is a special network zone that hosts servers
that can get traffic from the internet
and provide those services back out.
So, as you saw in the diagram that's shown
here at the bottom and in the last slide,
it's a semi-trusted zone where this database server
and this web server are going to hang out.
Things from the internet can get to them
and they can get out to the internet
but that still prevents things from the internet
from getting back to our intranet,
which is our trusted network.
We do all of that by using ACLs or Access Control Lists.
Access Control Lists are going to check all traffic
passing through the firewall and say what is allowed
and what is denied.
Access Control Lists contain these rules that will define
what traffic can go through the firewall and
go from the internet to the intranet or from
the internet to the DMZ or vice versa.
All of these rules and these ACLs are important
to understand if you're going to be sitting for
something like the CSA+ exam because you're gonna
see questions where they give you a sample of a firewall
log and you'll have to look at that and find out based on
that what is being blocked and what is being allowed
because that's an important skill to have.
Now, here's an example of doing that.
Firewalls should always be denied by default.
You should have everything denied unless you
explicitly say it can be allowed.
If no rule says allowed, all the traffic
is going to be denied.
So, in the case of this firewall log that I have,
you'll see here we have seven rules and it's going to start
every time a piece of traffic comes in.
It's going to start at rule one and
move all the way down to rule seven.
The first thing is, if it comes from a source IP,
where is it coming from?
Anybody can come in rule one, three, five and six
and they can come on any port in all of these rules
as you see with the word any.
Now, where are they going?
The destination.
In this case, 192.168.120.0
and if the destination port is above 1023,
so it's a not a registered port, but it's
not a well-known port, but it's a registered port,
it's going to be allowed, okay?
If it's coming from the 120.1,
it can go to any destination and any IP, that is denied,
it's not going to allow that to happen.
The next thing, any coming in that's going
to 120.1 is going to be denied.
So, as you can see here, 120.1 on rule two and three,
it's not getting any traffic in
and it's not getting any traffic out, it's just denied.
No internet access at all.
Now when you look at 120.0, which was allowed any port,
any source IP was able to reach it in rule one,
it now is going to say everything else is allowed
as well, okay?
Anything coming from that, going out to the internet
or out to anywhere else is going to be allowed
and you can see as we follow down.
Now, the next one, port 25, that's an SMTP server.
The next one after that, line six, port 80
is an HTTP or web server.
Those are both going to be allowed.
From any source to those two servers, on that port only.
And then at the end, any, any, anything coming in,
anything going out is going to be denied that
wasn't explicitly allowed in this ACL.
And that's just a way that you can see
these ACLs and how they run through.
Now, you're going to want to look at some other examples
of this and play with this more as you go through
if you're going to sit for the CSA+ exam,
if you're not already comfortable with Access Control Lists
because I promise you will see at least one question
on the test asking about Access Control Lists
and asking you to read through them
and go what is and what is not allowed.
Now, when you look at firewall types,
there are several types of firewalls out there.
There are packet filtering, stateful inspection,
next-generation firewalls, and web application firewalls.
Let's start with packet filtering.
What are those?
Well, they simply check a packet against rules
for the IP and the port associated with it.
The ACL I showed you in the last slide,
that's an example of a packet filtering firewall.
It's all based on what packets
are coming in and out of the network.
A stateful inspection firewall, on the other hand,
adds a little bit more intelligence to it.
It's going to maintain information about
the state of each connection and this
is the most basic firewall that's sold today.
So, in addition to looking at the IP and the port,
it's also going to ask what things were asked for.
So, for example, if I have a stateful firewall
and my laptop goes through that firewall,
out to the internet and makes a request,
when the data comes back from the internet,
it keeps track of that and says,
"Oh, Jason asked for that data,
"I'll let it back in through the firewall."
And it hands it to me.
Now, next-generation firewalls or NGFWs,
they're going to use contextual information about the users,
the applications, and the processes to make their decisions.
These are very intelligent devices.
Generally called layer seven firewalls
or application layer firewalls
because they take information about the users
and the apps and the processes
and operate at layer seven of the OSI model.
Web application firewalls are a very specialized firewall
that should be placed in front of your web servers.
These are going to protect web applications from
attacks like SQL injection and cross-site scripting attacks.
And because they're specific to a web application firewall,
they are specific to web application servers or web servers.
So, if you're trying to figure out where to place these
on a simulation or on a question, in front of the web server
is a great place for a web application firewall.
So, when we talk about firewalls,
a lot of them operate based on the concept of ports
as you saw on the ACL slide.
And so if you're gonna sit for the CSA+ exam,
I hope you already know your ports.
If you don't, you need to review them, right?
Things like FTP and SSH and Telnet and SMTP
and all the ones you see up here on the screen,
these are common ports.
These are what are known as well-known ports.
Anything between zero and 1,023 is in our well-known ports.
Anything above 1,024 and above
is called a registered port, okay?
You need to know those terms and you need to understand
these ports at a minimum and these ports at a minimum
which gives give you IMAP, SNMP, LDAP, HTTPS, SQL Servers,
Oracle, H.323, PPTP, RDP; these are all very common ports
you've got to be familiar with for the exam
because you're gonna see them in the log files on the exam
for the simulations and you're gonna see them
out in the real world because these are the common things
that people are using and are well-known ports and services.
That's the idea here when we talk about firewalls
as so far as perimeter security.