Network Security Major Problems Network Security Major Problems Why Firewall? Why Firewall? Problems...
-
Upload
theodora-blankenship -
Category
Documents
-
view
229 -
download
0
Transcript of Network Security Major Problems Network Security Major Problems Why Firewall? Why Firewall? Problems...
Network Security Major ProblemsNetwork Security Major Problems Why Firewall?Why Firewall? Problems with FirewallsProblems with Firewalls What is an Intrusion Detector? What is an Intrusion Detector? Problems with Intrusion DetectorsProblems with Intrusion Detectors What is a Content Management Firewall?What is a Content Management Firewall? HACKTRAP FeaturesHACKTRAP Features Future TrendsFuture Trends DemoDemo
TopicsTopics
Network Security Major ProblemsNetwork Security Major Problems
Providing information confidentiality.Providing information confidentiality.
Providing data integrity.Providing data integrity.
Protecting network services Protecting network services availability.availability.
Why Firewall?Why Firewall?
Problems with FirewallsProblems with Firewalls
Checks packet headers ONLYChecks packet headers ONLY
Does NOT detect header intrusionsDoes NOT detect header intrusions
What is an Intrusion Detector?What is an Intrusion Detector?
A tool that detects intrusion A tool that detects intrusion attempts.attempts.
Alerts the network administrator with Alerts the network administrator with detected intrusions.detected intrusions.
Problems with Intrusion DetectorsProblems with Intrusion Detectors
Does NOT take permanent actionsDoes NOT take permanent actions
Does NOT block specific IPs and Does NOT block specific IPs and PORTsPORTs
Intrusion Detector
What is a Content Management What is a Content Management Firewall? Firewall?
A new approach of firewalls.A new approach of firewalls.
Combines the features of BOTH Firewalls Combines the features of BOTH Firewalls and Intrusion Detectors.and Intrusion Detectors.
Checks NOT ONLY packet’s header but Checks NOT ONLY packet’s header but contents as well.contents as well.
Blocks the source of the detected Blocks the source of the detected intrusions.intrusions.
HACKTRAPA content management firewall
IS OUR SOLUTION
HACKTRAP
HACKTRAP FeaturesHACKTRAP Features
Three Security LevelsThree Security Levels• FRA (FRA (Fast Response ActionFast Response Action) ) Firewall RulesFirewall Rules
• IDS (IDS (Intrusion Detection systemIntrusion Detection system) Alerts) Alerts
• ISS (Integrated security system) ISS (Integrated security system) feedback from IDS to FRAfeedback from IDS to FRA
External Network
External Network
Internal NetworkInternal Network
ISSISS
FRAFRA IDSIDS
1
2
3
1 3
HACKTRAP ModelHACKTRAP Model
Generate FRA
HACKTRAP FeaturesHACKTRAP Features
Dynamic Action GenerationDynamic Action Generation
FWRule
IDSPRule
IDMPRule
FRActions
• Administrator point of viewAdministrator point of view Add and Remove types of attacks.Add and Remove types of attacks. Different types of alerts : popup messages, Data Different types of alerts : popup messages, Data
base, XML format ,TCP dump format.base, XML format ,TCP dump format. Restrict and unrestrict hosts accessing firewall .Restrict and unrestrict hosts accessing firewall . Close and open different services (ports) for outside Close and open different services (ports) for outside
hosts. hosts.
• Developer point of viewDeveloper point of view Intrusions can be easily implementedIntrusions can be easily implemented
HACKTRAP FeaturesHACKTRAP Features
Future WorkFuture Work
Enhance for better performance.Enhance for better performance. Using iptables with the ipchains.Using iptables with the ipchains.
Using ACID to make a good analysis Using ACID to make a good analysis on the intrusion detection output to on the intrusion detection output to the data base and display neat the data base and display neat graphs representing it.graphs representing it.
Adding another output modules such Adding another output modules such as email & SMSas email & SMS..
InternetInternetLANLAN
Hacker
Web Server
Unix Server
InternetInternet
x y
yz
xy
Packet forwarding
And
NAT (Masquerading)
x y
x V
Z V
rule4
rule3
rule2rule1
Input
chain rule4
rule3
rule2
Forward
chain
rule4
rule3
rule2
Output
chainrouter
d
e
m
a
s
q
log host
Local process
DENY ACCEPT
ACCEPTACCEPT
+
preprocessor Attacks rules
Input chain
Forward chain
Output chain
Log file
Samba alert database Alert
file
DemoDemo
InternetInternetLANLAN
Hacker
Windows
Lunix
HACKTRAP