Question? Leave a message!

What is Gateway Level security

what is gateway security in network and what is comprehensive gateway security suite, and what is web security gateway pdf free download
RogersMullis Profile Pic
RogersMullis,United States,Teacher
Published Date:13-08-2017
Your Website URL(Optional)
GATEWAY SECURITY DEVICES 26.1 INTRODUCTION. Onceconsideredsufficienttoprotectanentireorganiza- tionfromexternalthreats,thefirewallisstillperhapsthemostrecognizedanddeployed network-security devices for Internet-connected operations. However, earlier firewall generationsmadesecuritydecisionswithlittlecontextualsupportotherthantheorigin anddestination ofthepacketstraversingaparticular allowedpath. As communications capabilities and functionality demands increased, so too did thefirewall’sneedtoinspectandenforceallowedpathsusingmorecomplexprotocols and require ever-increasing throughput. This evolution transformed the firewall into a true gateway security device (GSD)—able to provide allowed path enforcement using a combination of techniques which once required additional security devices to accomplish. Properly selected and deployed GSDs are one security layer designed to handle these increasingly complex scenarios. The GSD is effective only with a full under- statingofthecapabilitiesandlimitations—bothoperationalandfailureconditions—of consolidating multiple security functions into a single device. By providing allowed path enforcement more intelligently and accurately, combined with the added rigor of genuinely understanding expected network flows, GSDs provide sufficient additional defense-in-depth layers throughout theorganization. Although this chapter focuses on the GSD as a combined security device, the con- ceptscoveredareusefulforunderstandingandevaluatingthefunctionalityofindividual network-security devices. Every organization must make risk and performance deci- sions by weighing this approach against maintaining independent devices that focus onaparticularsecurity function. 26.1.1 Business Requirements Outpacing Security. Technological ad- vancementcontinuestotransformanenterprise’sabilitytomanagethedatalifecycle. Thepervasivenessofmobiledevicesandmovetowardcloud-computingresourcesthat are no longer solely controlled or consumed by the organization continues to redefine the perimeter. Users are increasing demands for unfettered access to corporate data from anywhere on any device (including those not controlled by the organization).INTRODUCTION 26 · 3 This dynamic environment increases the need for layered security architectures with deeperawarenessofcontent andcontext. 26.1.2 Demand-Driven Processing. Enterprises not possessing the requi- site internal human or technological expertise to achieve the organization’s goals for information technology (IT) have long looked to outsourced solutions to meet their needs. Software as a Service (SaaS) provides offerings such as productivity applica- tions, collaboration, and email (e.g., Microsoft Office365) and customer relationship management (CRM) (e.g., Infrastructure- and Platform-as-a-Service (IAAS and PAAS, respectively) provide on-demand storage and computing (e.g., Amazon Web Services—S3/EC2or Rackspace Open Cloud). Outsourced offerings continue to mature and redefine how enterprises develop, manage, and present their information. Virtualizationtechnologycontinuestoprovideopportunitiestouseinternalprocess- ing capabilities more efficiently. Although providing better performance, it can also diminish security in that existing offerings are not necessarily as mature as dedicated securityinfrastructure.WheninternalandInternetfacingsystemsmustoperateonthe samevirtualarchitecture,thiscreatesadditionalriskassystemsnowinteractatthehy- pervisorandvirtualswitch(vSwitch)levelwheretraditionalnetwork-securitydevices areunabletoinspectandenforcetrafficatthislevel. SeeChapter 68inthisHandbook formoredetailsabout securityandoutsourcing. 26.1.3 Ubiquitous Mobility. Today’sbusinessclimatedemandstheabilityfor employeestoworkfromanywhere,andthisneedformobilityandflexibilitycontinues asignificantshiftinhoworganizationsdefineandprotecttheirperimeters.Employees may use a variety of systems whether at work, home, or on the road. The level of accessandfunctionalityrequiredextendswellbeyondemailintoenterpriseapplications and data. As functional mobility stretches from company-owned to personal devices, organizations must have a method to ensure a compromised mobile device does not weaken theexisting internaloroutsourced securitycontrols. 26.1.4 Regulatory and Industry Compliance. Federalregulatoryrequire- mentscontinuetohaveasignificantimpactonhoworganizationsmanageriskthrough dataprotection,retention,andprivacyactivities—manyhavingsignificantauditingand reporting requirements.  The Sarbanes-Oxley Act (SOX) focuses on controls and procedures designed to preservetheintegrity ofpublically tradedorganizations’ financialreporting.  The Gramm-Leach-Bliley Act (GLBA)—specific to financial institutions— concentratesontheprotection ofcustomerdataandprivacy.  The Health Information Portability and Accountability Act (HIPAA) requires protectionofindividuallyidentifiablehealthinformationsuchaspersonallyiden- tifiableinformation (PII)andprotected healthinformation (PHI). Industry-specificrequirementscontinuetoappearandevolveinanefforttoaddress the minimum security requirements to operate with or within a specific industry. The Payment Card Industry Data Security Standard (PCI DSS) establishes baseline requirements for the protection of cardholder data during processing, transmission, and storage. PCI DSS requires organizations to determine their level of involvement26 · 4 GATEWAY SECURITY DEVICES with the cardholder data. Once established, this determines which requirements are necessary todemonstrate compliance withthestandard. Eachcriticalinfrastructuresector—asdefinedintheUnitedStatesbytheDepartment of Homeland Security—has a Sector-Specific Plan (SSP), which provides representa- tiveorganizationsandagencieswiththerisk-managementtoolsandstrategiesspecific to the protection of each industry. One of the more mature programs is North Ameri- can Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP). NERC CIP addresses multiple physical and digital security elements of the North Americanpowersystem,includinggatewayprotectionthroughtheestablishmentofan electronic securityperimeter. SeeChapter 64ofthisHandbook formoredetailsonGLBA, SOX,andPCIDSS. 26.2 BASIC CONCEPTS AND TERMINOLOGY. Greater demands for mo- bility, new models for business interaction, and leveraging Internet-based processing capabilities continue toforcetheevolution oftraditionalperimeter protections. 26.2.1 General Capabilities. Withthesubstantialprocessingrequirementsof specialized network security systems (e.g., IPS or anti-spam), organizations tradition- ally architected security infrastructures that leveraged dedicated solutions/devices for each function. However, current generation GSD processing capabilities provide the opportunity tocombine manyoftheseoncededicated systemsinto asingle device. 26.2.2 Unified Threat Management. Unified threat management (UTM) combineselementssuchasanti-malware,anti-spam,IDS/IPS,VPN,applicationproxy, and content filtering—transforming the firewall into the original iteration of the GSD. These added capabilities allow the UTM to provide greater control and inspection at the application layer. However, typically there was only marginal management and performance integrationbetween featuresets. 26.2.3 Next-Generation Firewall. Thenext-generationfirewall(NGFW)is the latest evolution in stated capabilities that complements and surpasses those of the UTM. Instead of just bolting multiple security technologies on top of one another, the NGFW provides tighter integration of each level of security. These new capabilities include greater protocol awareness and more granular allowed path enforcement. The NGFWisabletoprofileprotocolsregardlessofportchosen.Thisincreasestheability todetectdeceptivebehaviorsuchasencryptedpayloadsoverprotocolsthatwouldnot normally use encryption. This generation of GSD also has the ability to adjust policy dynamically—extendingprotection tootherpartsofthesecurityinfrastructure. 26.2.4 Web Application Firewalls. GSDsprovideadditionalcapabilitiesto inspectandenforceallowedpathsforWeb-basedcommunications.However,thecom- plexity of the current and next-generation Web protocols may outpace the security provided by this device. The Web application firewall (WAF) provides more robust HTTP protocol inspection capabilities. The WAF provides customizable rules to pro- tect against common payload-based attacks such as SQL injection, XSS (cross-site scripting), and command injection. This platform can also serve as a virtual patch for Webapplications—legacy(nopatches possible)oronesawaiting unreleasedpatches. 26.2.5 Firewall Architectures Changing. Assecurityvendorsworktokeep pace with these changes with more functionality and higher performance, it is theBASIC CONCEPTS AND TERMINOLOGY 26 · 5 customer’s responsibility to understand the advantages and disadvantages each pro- posedprotectionsolution.Suchanalysisprovidesthenecessaryinsightfortheorgani- zation to deploy the most appropriate architecture to meet the necessary security and performance requirements. 26.2.6 Packet Filtering. Routing devices gave rise to first-generation fire- walling capabilities. Packet filtering is a set of explicit rules describing the allowed pathsnetworktrafficmaytravel.Therules,intheformofanaccesscontrollist(ACL), independently evaluate one or more portions of each packet’s header to make the allowedpathdecision. The packet filter acts on each packet as an individual entity without respect of the packet(s) that come before or after. Although this method provides the security with the least overhead of other firewall architectures, it is vulnerable to several network andtransportlayerattacks. Internet Protocol (IP)spoofing is specially crafting a packet in an effort to deceive the router into accepting traffic that appears legitimate. The attacker will configure a packettolooklikeitoriginatedfromtheinternalnetworkeventhoughitiscominginto the external interface. ALand attack sends a spoofed TCP SYN packet to a host with thesourceanddestinationIPandportbeingequalandcancauseadenialofserviceon a vulnerable network stack. TheTeardrop attack intentionally fragments a packet and manipulates the fragment offset where the preceding fragment’s offset overlaps with theoffsetofthenextfragment.Whenthereceivingsystemreassemblestheoverlapping fragments, thenetwork stackwillcrash, causingadenialofservice. AlthoughboththeLandandTeardropattacksrequireavulnerableend-device,initial packet filters did not have contextual understanding to stop such attacks. Mitigation for the Teardrop attack includes implementing packet reassembly—recombining the fragments into the original packet to ensure the recombined packet does not violate basicIPpacketspecifications—beforeforwarding toitsnexthop. For details of these and other denial-of-service attacks, see Chapter 18 in this Handbook. Current generations GSDs use stateful inspection (covered next) in an effort to overcome many of the limitations of packet filtering. However, many nonsecurity- related devices use packet filters to provide basic protection of their administrative interfaces andmonitoring functions. 26.2.7 Stateful Inspection. Statefulinspectionidentifiesandtracksadditional parameters within each packet, adding context by representing flows along allowed paths as network connections instead of individual packets. Even though IP and User Datagram Protocol (UDP) are connectionless protocols, the firewall creates a virtual connection to emulate its connection-oriented counterparts. Although the specific pa- rameterstrackedinthestatetablevaryacrossGSDvendors,thetableresidesinmemory formoreefficientprocessing. Since a packet filter inspects packets individually, it does not affect firewalls in a load-balanced or fail-over architecture. However, to ensure sustained connections in high availability architectures, stateful inspection must establish and maintain a synchronizedcopyofthestatetableineachofitshighavailabilitymembers.Although somevendorsstillmaintainthatadirectserialconnectionisthemostreliableconnection method,highlyavailablesolutionsareunlikelytobeinaphysicalproximitynecessary for serial connection and typically take advantage of existing network connections to maintain thestate synchronization.26 · 6 GATEWAY SECURITY DEVICES 26.2.8 Application Layer Gateway. As threats became more sophisticated acrossexistingallowedpaths,firewallsaddedapplication-layergateway(ALG)protec- tion. Each application-specific proxy (e.g., HTTP, RPC, FTP, etc.) acts as the allowed path broker for the connection, creating a separate, backend connection to the other host. Although the full connection is actually two independent sessions, this dual- ity is transparent to the requester and the server. Being a brokered connection adds an additional layer of defense by re-writing potentially malformed requests, validat- ing/enforcing protocol compliance, and not allowing direct communication between clientandserver. The detailed payload analysis increases the amount of time the firewall spends evaluating each packet potentially reducing throughput for other network traffic and increasingtheneedforsufficientprocessingresource.TheALGmayalsocreateissues such as poor performance for protocols requiring minimal overhead in addition to un- expectedcompatibilityissuesduetovendor-specificprotocolimplementations.Active reviewandmanagement willhelptominimize theALG’simpact onoperations. 26.2.9 Current Gateway Security Devices. Thefirewallevolvedyetagain as attacks continued to increase in complexity and scale. Stateful filtering and appli- cationlayergatewayfunctionalitybeingeffectiveatprotectingagainstspecificknown attack vectors. However, the sophistication of the newer generation attacks quickly revealed those two features were unable to provide the necessary level of protection. Theadditional capabilities integratedintothefirewall gaverisetotheGSD. TheinitialiterationofGSDisknownasunifiedthreatmanagement(UTM).UTMis the consolidation of the firewall with multiple additional security platforms (e.g., net- workintrusion-preventionsystems,contentfilter,anti-spam,etc.)intoasingledevice. UTMvendorsthatonlyhadastrongpresenceinoneortwooftheprotectionmeasures had to either integrate a third-party security product or build their own offering to fill out the full protection suite. This was also an opportunity to consolidate management and monitoring capabilities to create a unified platform. However, the UTM would prove somewhat inefficient, as each packet travels serially through the different se- curity engines, severely impacting performance as the number of protections enabled increases. The most current generation of GSDs—known as next generation firewalls (NGFWs)—providegreaterapplicationdetection,awareness,andenforcementinaddi- tiontotighterintegrationofallsecuritylayers.Increasingtheprocessingandinspection capabilitiesalonewerenotenoughtomeetthedemandsofthecurrentgenerationappli- cationprotocols.Theseprotocolsaremorecomplexinformandfunction,eventhough they may follow the traditional allowed path such as HTTP. The NGFW must also be able to decode and understand the application’s inner workings regardless of port andenforceonallorsubsetsoftheprotocol.NGFWsprocesspacketsthoughselected security engines in parallel to increase performance and focus the protection needs to thespecifictype oftrafficdetected. 26.2.10 Host Environment Context. Althoughthischapterfocusesongate- way security devices from a network perspective, comparable host-based protections warrant coverage, as they are an important defense-in-depth component and have certain capabilities that the network-based GSDs cannot provide. With mobility and ubiquitous information access being central themes surrounding today’s personal and business environments, the host-level protection is an ever-present fixture. The host’sBASIC CONCEPTS AND TERMINOLOGY 26 · 7 movement from relying on the network security measures to local context and envi- ronmentally aware security measures will provide more robust and flexible security whereverthehostgoes. Host-based security—aside from basic firewalling—has additional complexity and considerationsduetotheprotectionrequirementsoftheadditionalelements(software, services, etc.) running. The host’s ability to understand its local environment allows for more granular protection and visibility. Instead of focusing purely on port-based network access, the increase environmental context defines what applications and services can: access or receive network traffic, access or change other services, or executecodeinavirtualmachine (VM)toverifyexpectbehavior(s). 26.2.11 Firewall Platforms. GSDs continue to advance in form, function, and contextual understanding to provide allowed path enforcement at all layers of the networkstack.Maliciousactorscontinuetodevelopincreasinglytargetedandeffective codethattravelsonanotherwiseallowedpath.Thesemoredetailednetworkinspection requirements dictates that every organization select the most appropriate platform to meetitssecurityandperformance needs. 26.2.12 Routing Devices. As the need to transmit data within a network and beyond increased, routing device were adapted to provide native and then modular securityservices. AccessControlLists. RoutingdeviceACLstypicallyproviderudi- mentary allowed path enforcement with minimal performance impact. ACLs permit or deny individual network packets based on a combination of parameters from the headersuchassourceanddestination IPaddressesand/or TCP/UDP port. Routing device–based security services matured to provide enhanced capabilities based on their contextual understanding of the network. Routing devices can sup- port several stateful inspection techniques, the most rudimentary being the ability to trackconnectionsbasedsolelyontheacknowledgement(ACK)flagsofanestablished connection. However, this method is more susceptible to spoofed packets directed at the intended target than traditional stateful inspection based on a table of established connections. Routing platforms can also provide anti-spoofing capabilities based on network topology. When enabled, the routing device will make forwarding decisions based on its understanding of connected and learned routes and only allow source IPs tooriginatefromtheappropriate interface. Hardware Modules. With bandwidth increasing into the tens to hundreds of Gigabits per second (and beyond), routing device manufacturer needed to offload the security functions to a dedicated vendor-specific module (or line card). The module provides logical protection for one or more allowed paths while using the backplane to achieve higher data rates and provide protection based on one or moreofthefirewallarchitecturesdescribedabove.Someroutingvendorsalsosupport modules—similartoabladeserver—allowingothersecurityvendorstointegratetheir technology deeperintotheroutinginfrastructure. 26.2.13 Appliances. The GSD appliance emerged as a way to shed complex security decisions from routing devices onto a dedicated security platform. Appliance form factors, capabilities, and limitations vary among GSD vendors with the GSD application integratingintothechosen hardwareplatform.26 · 8 GATEWAY SECURITY DEVICES Proprietary. A proprietary hardware-based GSD appliance manu- facturer is able to establish and retain tight controls over all aspects of the platform. Thehardwareispurpose-builttointeroperatewiththeGSDsoftwareandprovidesdif- ferentlevelsofperformanceandfunctionality.High-performancecomponentssuchas application-specificinstructionsetsaretypicallyproprietary.However,thevendorwill balance the cost effectiveness of the platform by choosing commercial-off-the-shelf (COTS)hardware fortheutility components (e.g.,network interfaces andRAM). The accompanyingproprietary,hardware-specificoperatingsystem(OS)allowsthevendor tomaintain tightcontrolsoninteroperability, configuration, andsoftware revisions. HardwareIndependent. HardwareindependentGSDappliances transfer responsibility to the customer to procure hardware that meets a specific set of requirements while allowing the GSD vendor to retain responsibility for developing the GSD application and/or OS. The GSD uses either a customized version of an OS (typically Linux or Berkeley Software Distribution BSD) or installs directly onto a customer-provided baseOS. A GSD application installed on a proprietary (or premodified) OS reduces native security exposures through vendor custom hardening of OS mechanisms to remove nonessential features and functionality while maintaining the tight controls described inthesectionabove. TheGSDapplicationmayalsobeabletoinstallonspecificversionsofthecustomer’s native OS choice, providing the customer the most flexibility in choosing a GSD appliance. The GSD application will make some hardening changes but leaves much oftheoperatingsystemmanagementtothecustomer.Thisincreasestheriskofinsecure and/or underperforming implementations due to the GSD vendor not fully controlling OSconfigurations, patches, andinteroperability. Soft Appliance. The soft appliance augments the hardware inde- pendent/proprietaryOSGSDintoabootableplatformthatcanrunonconsumer-grade equipment. This platform is more suited for point-in-time protection needs, such as main GSD device failure, fast-turn deployments, and testing. Before deploying a soft appliance, the customer must temper the potential “flexibility” of this solution with other considerations such as manageability (configuration, logging, etc.), scalability, andrequiredfunctionality. Embedded Appliance. In addition to high-end, scalable devices, GSDvendorsalsorecognizedtheopportunitytoserviceothermarketssuchasproviding specializedcapabilitiesonplatformsscaledtomeettheneedsofconsumersandsmall- to-medium businesses (SMBs). SMBsarelesslikelytohavesufficientfundingordedicatedsecuritystafftopurchase, manage,andmonitormultiplesecuritydevices.TheSMB-gradeGSDsprovideamore economical all-in-one device, due to its smaller form factor, simplified user interface, andlowerperformancerequirements.Inadditiontoprovidingthestandardwiredand/or wirelessconnectivityoptions,thedevicetypicallyprovidesafullcomplementofUTM security functionality. 26.2.14 Virtualization. GSD vendors now provide solutions ranging from leveraging the virtual environment to provide independent network security capa- bilities to embedding granular protections at the hypervisor level. Instead of requiringNETWORK-SECURITY MECHANISMS 26 · 9 afullinstallation,someGSDvendorswillprovideapreinstalledvirtualappliancethat minimizes total deployment time. It is important to ensure that the virtualized GSD maintains itspriorityinobtaining andsustaining resourcesfromtheVMinstance. A VM-capable GSD acts as an independent network security entity. Instead of having dedicated hardware, the GSD leverages the hypervisor’s hardware abstraction layertogainaccesstothenecessaryresources.Thisimplementationprovideshardware appliance-like capabilities to control the allowed paths based on what networks route throughtheGSD VMinstance. AVM-embeddedGSDvirtualapplianceintegrateswiththehypervisortogainlow- levelaccesstotheentireVMhost/cluster.TheGSDnowhasvisibilityintopreviously inaccessiblecommunicationpathsandisabletoconductallowedpathenforcementfor bothinter-andintra-VM communications. 26.2.15 Host-Based Agents. Asmobiledevicesdemandgreaterinternalnet- work access—including data to be stored local to the device—so did the requirement for those host-based protections to be able to minimize the additional risk of allowing suchaccess.Antiviruscapabilities,althougharguablyonlymarginallyeffectiveagainst new and emerging threats, still maintain a necessary presence to filter known attacks vectors. Firewalling capabilities at the network and application level reduce the host’s network-facing threat profile. The Host Intrusion Prevention System (HIPS) provides protection against known and potentially unknown threats because of its ability to inspectuptotheapplication layer. When network-security devices fail to detect a threat, host-based protection has additionalmeasurestodetectlocalanomalousbehaviorduetoitsincreasedcontextual awarenessofhowthehost—theapplicationsandtheoperatingsystem—shouldbehave, thusallowingthehostanadvantageindetectingemergingthreats.However,organiza- tions should not underestimate the administrative overhead necessary to manage and monitor thisprotection. SeeChapter 27ofthisHandbook formoredetailsonhost-based protections. 26.3 NETWORK-SECURITY MECHANISMS. Networksecurity,oncesynony- mouswiththefirewall,continuesitsgrowthinbothscopeanddepth.Governmentand organizations are requiring security to be baked into the systems and solutions they produceorpurchase. It is entirely possible for an attack to originate from a system not coinciding with a direct perimeter attack. These attack vectors include likely exposures, such as an employee mobile device infected with malicious code while traveling; the new USB flash drive an employee receives at a conference; or a vendor providing legitimate supportthatplugs his/herlaptopinto theinternalnetwork. Those who are selecting network security systems must be able to decipher the hyperbole from reality to ensure the device(s) deployed realistically address(es) the specific risks pertinent to the organization. Gateway security devices maintain their basic allowed path control heritage but now are far more advanced in their ability to integrateprotection withinthepayloadandbeyond. 26.3.1 Allowed Paths. Network-security devices provide allowed-path pro- tections to ensure network traffic only flows in expected and intended ways. Unfortu- nately, this base level of enforcement is insufficient because application-layer attacks (e.g., client-side browser exploits) leverage these traditional allowed paths. Regula- tory and compliance security requirements are also driving the deployment of more26 · 10 GATEWAY SECURITY DEVICES capableallowed-pathenforcementmechanismsdeeperintotheinternalnetworktopro- tectintellectualproperty,customer/partnerdata,andindustrialcontrolsystems(ICSs). To manage allowed-path risk effectively, organizations must define and baseline theirexpectedtrafficflowsbothinternallyandexternally.Thebaselineisvitallyimpor- tant when the only indication of compromise may be an unusual—though apparently benign—interaction betweensystems thatdonottypically interactwithoneanother. 26.3.2 Tunneling. Tunneledaccessintotheinternalnetworkforthepurposesof remoteaccess,informationsharing,andcommerceisessentialformostorganizations. Thesetunnels,typicallyintheformofavirtualprivatenetwork(VPN),useencryption toprotecttheconfidentialityofthetransferreddata.IftheGSDdoesnotterminatethe tunnel,ittypicallyonlyprovidesnetworkandtransportlayerallowedpathenforcement through to the termination endpoint. This scenario fragments the inspection of the encapsulatedtraffic,requiringtheterminationendpointitselforanothersecuritydevice post-decryptiontoprovideadditionalprotectionthroughallowedpathenforcementand application layerinspection. SeeChapter 32formoreinformation onGSDVPNcapabilities 26.3.3 Anti-Spoofing. One of the most readily exploited vulnerabilities of the IP protocol is spoofing . Due to this inherent weakness in the IPv4 protocol, a host’s networkstackiscapableofproducingpacketsthatcanappeartooriginatefromanyIP addressand/orportchosen.Thisattackisanefforttodeceivethereceivinghostand/or any network protection in between into believing the originating host is following an allowed path. Due to the simplicity of executing spoofing attacks, GSD vendors developedandimplementedseveraleffectivemethodstothwartthesetypesofattacks. The network topology is a key element in the GSD’s ability to determine what traffic should beoriginated fromeachofitsphysical and/orlogicalinterfaces. One common anti-spoofing method is explicit definition of the network topology on a per-interface basis. This provides an efficient method for the GSD to determine whether the packet’s source IP address entering an interface matches what the GSD expects to be the source network. If not, the packet fails to meet the criteria and is dropped. Although simple and effective, the disadvantage is the manual management oftheper-interface networkdefinitions. Another method is to learn the network topology by leveraging the routing table to makethesametypeofper-interfaceanti-spoofingdecisions.Thefirewallgoesthrough thesameprocessofevaluatingifthepacket’ssourceIPmatcheswhatshouldbeorigi- natingfromthatinterface.However,thisdoesnotrequireongoingmanualintervention whennetworkchangesoccur,astheroutingengineupdatesthisinformation.Although this method creates less administrative overhead, two disadvantages include problems ifthenetwork usesasymmetric routingand/orfalls preytoaroutepoisoning attack. Both of these anti-spoofing measures are highly effective when evaluating whether network traffic is originating from the appropriate interface. However, the focus re- mains solely on preventing internal network address compromise. Since not all of the IP networks in existence are actually allocated and/or in use, these “bogon” networks are another method used to launch spoofing attacks. Since “bogon” network traffic is originating on the external interface, the GSD would not block this based on common anti-spoofing rules. Updated lists are readily available allowing the security adminis- trator to enforce “bogon” protections. Some GSDs have a feature that automatically updates thelist onarecurring basis,providing automatedprotection.NETWORK-SECURITY MECHANISMS 26 · 11 26.3.4 Network Address Translation. Network address translation (NAT) is a mechanism that maps internal (typically private RFC 1918) network addresses to one or more publicly routable IP addresses. This is an essential function in IPv4 due totheincreasingshortageofpublicallyroutableaddress.Duetoitsabilitytomaskthe internalnetworkaddressing,NATquicklybecamethoughtofasasecuritymechanism. Realistically,NATonlyensuresnetworktrafficmaintainstheirtranslations—butithas noinherentsecurity capabilities suchaspayload inspection. To ensure sustained connections in high availability architectures, NAT must es- tablish and maintain a synchronized copy of the translation table with each high availability member. This mechanism follows the same serial or network connection usedtomaintain thestate table. 26.3.5 Intrusion Detection. GSDs inherently provide detective controls at multiple layers. These distinct controls (e.g., firewall, intrusion detection/prevention system, etc.) provide greater visibility into the types and scopes of potential incidents whenproperlyconfiguredandmonitored.Theloggingandalertingcapabilitiesassoci- atedwitheachcontrolareimportantandnecessarymechanismsforsecuritypersonnel tousetounderstandthecurrentstateoftheperimeter.Withthisinformation,itispossi- bletodevelopactionableintelligencetodetectandactonanomalousand/ormalicious behaviorbefore, during, andafteranincident. RespondingtoalertsandreviewingalloftheinformationgeneratedbytheGSDcan beextraordinarilytimeconsuming.However,itisimportantthatthesecurityadminis- tratortakethenecessarystepstoensuretimelyandaccuratelogreviews.Withoutsuch reviews, it is easy to overlook issues such as pre- and post-attack-related traffic and systemmisconfigurations.LogsalsoprovideanexcellentopportunityforGSDtuning, including rule-baseoptimization andreducing falsepositives(postverification). Properly planned and configured alerting and logging mechanisms are essential. Whendonepoorly,thesemechanismscanoverloadthesupportstaffwithunnecessary orextraneousinformation,makingthemlessefficientandeffectiveataddressingactual securityissues. 26.3.6 Intrusion Prevention/Response. Although logs and alerts are use- ful for detecting and investigating security incidents, these mechanisms are passive and cannot provide threat protection. Firewalls evolved to include automated active mechanisms torespondtosecurity eventsandprovideactiveprotection. See Chapter 27 of this Handbook for more details on intrusion detection and pre- vention. Connection Termination. The essence of perimeter defense is to protect the internal network by blocking connection attempts that do not follow the establishedallowedpathpolicy.OnemethodforTCP-basedprotocolsistorespondto theinitiator(andsometimestheintendedrecipient)withareset(RST)packet,severing the connection. The most common method—which works for connection-oriented and connectionless protocols—is to drop the packet without a response. As firewalls evolved into richer functioning GSDs, this protection grew to include blocking based onmalicious activityoccurring attheapplication layer. Inversely,attackerscanuseconnectionterminationasamethodtodeterminewhere and what type of network-security devices are in use. This context may provide them additionalinsightonpotentialmethodstobypassand/oradverselyimpactthesecurity26 · 12 GATEWAY SECURITY DEVICES platform.Thoughthissituationisunavoidablenomatterwhatterminationmechanism isemployed, itisanother reasontoapplydefensesinlayers. Adaptive Threat Mitigation. AlthoughtheGSD’spolicyprovides the main enforcement mechanism, vendors quickly realized that this was insufficient, asattackerscontinuallydevelopadditionalmethodstothwarttheseprotections.GSDs include several enhanced capabilities that allow the device to adapt to specific threat conditions andprovidetargetedprevention. Sinceattackersemploymethodstochangeattacksourcestoavoiddetection,anditis notalwayspracticaltofollowarigidwhitelisting(leastprivilege)strategy,organizations typically opt to use blacklists as an additional level of protection. Some GSDs use dynamic object groups to update these lists on a predetermined schedule helping minimize administrative overhead. TheuseofthresholdsprovidestheGSDamoreefficientmethodtoaddressconsistent attacksthatwouldotherwisefollowthesamepolicy-basedevaluationforeveryattempt. One common threshold type is event quantity/type over a given set of time (e.g., total number of packets per second or x number of packets per second across multiple destination IP addresses). Once breached, the GSD will typically automatically block all traffic from the origin IP address for a predetermined time period. This type of adaptive technique requires additional processing resources and requires tuning to ensurethisdoes notimpactlegitimatenetwork flows. Being primarily perimeter devices, GSDs typically have minimal visibility into the internal, trusted network. However, modern security infrastructures can leverage multiple threat detection methods across the network to provide more comprehensive protection. Once detected, the device can leverage the security management infras- tructure to update other security device policies—automatically providing additional protection or containment. This capability is also integrating with host-based protec- tions to drive protection deeper into the network. If a host detects a threat while on an untrusted network, the infrastructure would learn about this and adapt network protections beforethedeviceconnects toaninternal network. System-Level Actions. As an added layer of defense, gateway se- curity devices typically have built-in mechanisms to detect and respond to threats against the platform itself. Following an implicit deny model, the excepted behavior is to fail secure (e.g., shutdown the firewall) and not pass traffic. However, as this automatic response affects the functionality of the security device, it is important for theadministratortounderstandandtestthisfunctionalitypriortodeploymenttoensure this response behavior is consistent with the protection and availability needs of the organization. Application Inspection. The ability to protect allowed paths based on IP and/or port combinations provides marginal benefit when matched against the growingprotocolcomplexityandconfigurability.AsGSDsevolved,sodidtheabilityto evaluateandenforceallowedpathsbasedontheapplicationlayer.Thiscapabilityranges frombasicprotocolevaluationssuchasanRFCconformancechecktofullapplication layergateways.Dependingonthetypeofapplicationlayerprotocol,adedicateddevice maybenecessaryinhighcapacity, security, and/or reliabilityenvironments. WAFs. Web application firewalls (WAFs) provide targeted enforcement within an HTTP(S)allowedpath.WAFscanmorereadilydetectandpreventcommonWebserver attackssuchasXSSandSQLinjectionandtypicallyhaveaddedcapabilitiestoprotectNETWORK-SECURITY MECHANISMS 26 · 13 morecomplexWeb2.0(e.g.,AJAX)andWebservices(e.g.,SOAPorJSON)protocols. ItisalsopossibletoprotectotherwisevulnerableWebserversfromexploitsbywriting protection rules that detect and nullify the application layer attack traffic. The WAFs granularruledevelopment isalsobettersuitedtoprotectcustom Webapplications. Proxy Servers. The forwarding proxy enforces outgoing Internet connections by intercepting and controlling access based on criteria such as user ID, time of day, and/or whitelist/blacklist. Depending on the type and configuration, the forwarding proxy can either broker the outbound connection and make requests on behalf of the client or just enforce the particular allowed path. Classic forwarding proxies requires client-side configuration to enforced Internet-bound communications. A transparent proxy is a forwarding proxy that operates as a “bump-on-the-wire”—sitting in-line or offaspanport—andtypically doesnotrequireclient-side configuration. Conversely, a reverse proxy provides protection to inbound allowed paths. The inboundconnectionterminatesattheproxy,andtheproxyitselfestablishesthesecond halfoftheconnectiondirectlywiththeapplicationserver.Beingabrokeredconnection, this adds an additional layer of defense for inbound traffic by rewriting potentially malformedrequestsand/ornotallowingdirectcommunicationtotheapplicationserver. ApplicationIdentity.InadditiontosourceanddestinationIPaddress,networkfire- walls typically rely on the destination port to make a final allowed path determination forcommonprotocols(e.g.,HTTP—TCPport80).However,itistrivialtoevadeupper layer inspection (e.g., proxy or WAF) by changing the destination port to something that bypasses the application layer inspection but still follows an allowed path. Cur- rent generation security devices must be able to profile all network traffic based on application typeinsteadofdestination port. Application identification must be able to dissect the traffic and understand the subsystems/protocols embedded within the main communication flow. For example, Skype not only inherently provides video conferencing but also file transfer and chat services. With add-ons, functionality can extend to remote desktop sharing/control. By having this detailed level of application understanding, it is possible for granular enforcementofoneormoreprotocolsubsets.Thisprofilingalsoincludesdetermining commonprotocolsonunexpectedportsandencryptedtrafficoveracommonclear-text protocol—whether encryptedornot. 26.3.7 Encryption. Confidentialityprotectionforsensitivedata-in-motioncon- tinuestogrowduetotheneedtominimizetheriskofcompromisingpersonal/personnel data and/or intellectual property. This creates a distinct need to provide allowed path enforcementwhenusingencryptionservicestoorthroughtheGSD.Duetothecompu- tationally complexity, encryption protocols can significantly reduce GSD throughput without offloading encryption services to an add-on, on-board device, or dedicated externaldevicestomeettheencryption needs. SeeChapter 7ofthisHandbook formoredetailsonencryption. Inspection. The integration of encryption into network and application flows in essential to protect the confidentiality of the data-in-motion. Although not necessarily malicious, these encrypted sessions reduce the effectiveness of any network-security device(s) attempting to inspect the protected payloads. In addition to the typical VPN and HTTPS Web traffic, the GSD must also be able to identify encrypted communi- cations regardless of port or service. The two main methods for inspecting encrypted trafficaredirecttermination andon-the-fly decryption. In the first method, the GSD terminates the encrypted connection. This provides an opportunity to inspect the once tunneled communication. Once inspected and if26 · 14 GATEWAY SECURITY DEVICES permitted, the GSD may pass the remained of the communication decrypted or re- encryptthesession tomaintaintheconfidentiality protectiontotheendpoint. In the second method, the GSD will use escrowed encryption keys to decrypt network flows passively. Besides meeting the additional performance requirements to conductpassivedecryption,anotherpossibleweaknessistheinabilitytoprovidefully synchronousresponsestodetectedthreat—potentiallyallowingsomemalicioustraffic acrossanallowedpath beforetheenforcementoccurs. VPN. A virtual private network (VPN) is an encapsulated network overlaying an existing set of physical and logical networks. A common VPN implementation is for a remote client connection—allowing an authorized user to access the internal networkthroughanencryptedtunnel.Onceestablished,VPNclientscanaccessinternal networks and/or systems while protecting the confidentiality of the connection. Site- to-site VPNs allow authorized remote locations to gain direct internal network access formultiple usersoverasingleconnection. Since there is little to no control when mobile systems leave the confines of the internalnetwork,thefidelityofthemobiledeviceisaconcern.Theriskofcompromise at every level—from physical to operating system to applications and beyond—can exposetheinternalnetworktoincreasedriskduringaVPNsession.Withoutterminating VPNsessionsdirectlyontheGSD,itisstillpossibletoincreasevisibilityandadditional allowed path enforcement once the unencrypted traffic leaves the VPN termination device—seetheDeployment section foradditional details andconsiderations. SeeChapter 32ofthisHandbook formoredetailsonVPNs. Acceleration. Using Secure Sockets Layer (SSL) and Transport Layer Security (TLS)toprotectWeb-basedtrafficorIPsectoprotectVPNtrafficcreatesapotentialbar- riertocomprehensiveallowedpathenforcement.Sincetheencryptedtrafficpotentially fragmentsallowedpathenforcements,GSDsevolvedtobecapableofterminatingthese connections to add an additional layer of inspection. However, encryption/decryption ismathematicallyintensiveandrequiressufficientprocessingresourcestoensurethese processes do not impact GSD throughput. When it is necessary for the GSD to termi- nateorinspectencryptedtraffic,theuseofahardwareencryptionmoduleisacommon methodtooff-loadthisprocessingburdenandminimizeimpacttoothertrafficflowing through theGSD. 26.3.8 Identity-Based Enforcement. By integrating with enterprise direc- tory services using mechanisms such as Lightweight Directory Access Protocol (LDAP) or Remote Access Dial-In User Service (RADIUS), GSDs are able to make identity-based decisions. Instead of allowing or denying access to an allowed path by source IP, the GSD can authorize access per user or based on group membership and include this authorization data in logs. This additional detail enhances reporting and auditing capabilities, providing more specific information about a particular connec- tion well beyond just the IP address or DNS name of the host requesting allowed path traversal. 26.3.9 Complex Protocol Engines. Complexprotocols,includingthoseused to deliver feature rich Web applications, IP telephony, or specialized protocols, such as those used by industrial control systems (ICSs), are an intrinsic necessity for many organizations.Duetotheever-increasingneedtoshareinformationandaccessregard- less of mobile device form factor or location, these complex protocols are traversing the GSD. Even with successful detection of an application in-use, it is a continualNETWORK-SECURITY MECHANISMS 26 · 15 development race for the GSD to be able to understand and enforce the intricacies of eachprotocol. Today’sWeb-basedapplicationscontinuallydevelopnewfunctionalitytomeetcus- tomerdemand.SocialmediaWebsitesofferviablebusinessmodelsandmaynecessitate someoralluserswithinanorganizationtoaccessthisservicetoconductbusiness.Due to ever-present personal elements (e.g., chat/comments, games, etc.), the GSDs must beabletodissecttheconnectionandselectivelypermitsomeorallofthefunctionality offeredbythehostapplication. IP telephony protocols such as session initiation protocol (SIP) and real-time pro- tocol (RTP) are typically intolerant to latency and jitter—which are introducible by GSDs. ICS protocols introduce vendor-specific protocol dependencies/intricacies and are even less tolerant to network variations. The loss or slowness of ICS commu- nications can be as severe as damage to equipment or death when impacting safety systems. Although an internal or external network perimeter is a logical point of inspection, the GSD is not necessarily the appropriate device to conduct such detailed protocol inspections. Instead, these situations may warrant additional security layers using specialized devicesfortheapplication layerorspecialty protocolenforcement. 26.3.10 Content Control and Data Leakage Prevention. Organiza- tional policies establish the behavioral expectations of its employees. The Acceptable UsePolicy(orsimilarly named) typicallycoversmatters specifictouseoftechnology resources;however,thepolicyitselfcannotprovideactiveprotection.Contentfiltering (CF) bridges the gap between technical and nontechnical policy enforcement. This enforcement typically focuses on internal users attempting to access information re- sources outside of the organization. By filtering heavily used protocols such as HTTP and SMTP, the organization can minimize user access to information not fitting the organization’s definition ofbusinessuse. This technology has several methods for inspecting, classifying, and filtering con- tent.Inspectiontakesmultipleforms,includingresidingin-line,out-of-bandtomonitor passingtrafficwithoutimpactingthephysicalconnection,orinconjunctionwithproxy redirection. Classification occurs through multiple methods, including vendor-defined categories,blacklists,and/orreputationscoringbasedonIPaddressand/orDNSname. Thisalsoallowstheorganizationtochoosetouseasubsetoftheprovidepolicyand/or selectively develop a whitelist to provide more granular enforcement. The filtering feature logs and/or severs the connections allowing the organization to customize its responsetodetectedpolicyviolations,includingredirectiontoa“notforbusinessuse” Web page and/or automatic administrative and/or managerial notification of repeated violations. SeeChapter 31ofthisHandbook formoredetailsoncontent filtering. InformationClassificationandEnforcement. Anoverlooked but important aspect of information assurance is the proper classification of informa- tion/data into categories. This allows the organization to determine the risk reduction efforts necessary to protect each information level/type. Similar to the classification processusedbygovernments,identifyingthesensitiveinformationincreasestheability to enforce not only who has access to the information but also where and how this information canbetransferred. Digital rights management (DRM) and data loss prevention (DLP) are two cur- rent generation technologies for addressing these information-specific risks. DRM26 · 16 GATEWAY SECURITY DEVICES focusesonthedefinitionandenforcementofdata-at-rest—typicallyattheinformation repositorylevel.GSDsmayincludeDLPprotectionssuchasenforcingdata-in-motion protections,includingdenyingthetransferoffilesbasedoncontent/designationand/or requiring encryptionforsensitivedata. Anti-malware. A contemporary attack vector is to target a com- monlyusedWebsite/serviceandinjectmalware.Althoughthecontentfiltermaymake an initial decision to allow the connection based on the specific site name, it may also have the added capability to intercept and block the malicious content before it ever reachesthehost.Thisfunctionalitymakesitpossibletoevaluatedifferenttypesoftraf- ficsuchasSMTPattachmentsandHTTPdownloads.Althoughthistypeofapplication layerprotectioncandramaticallyreducetheGSDthroughput,itispossibletoredirect thescanningtoanadditionalmodulewithintheGSDwithdedicatedprocessingpower ortoadedicated network anti-malware appliance. Active Content. Active code used on HTTP connections—such as Silverlight, Java, AJAX, and Flash—provides a foundation for a rich Web experi- ence but also increases security risk due to their application-focused functionality. Maliciousemailattachments—suchasdocumentswithembeddedcode—arecommon components ofphishing andspamcampaigns. In conjunction with host-based protections, the GSD can decrease the risk of ac- tive code by preventing specific types from ever reaching the endpoint and/or scan- ning the active code in a sandbox prior to allowing the active code to traverse the allowed path. SeeChapter 17ofthisHandbook formoredetailsonmobile code. Caching. Althoughtheaggregatecostofbandwidthcontinuestofall, organizationscontinuetolookforopportunitiestomanagethesefrequentlycongested circuits more efficiently. Proxy servers typically integrate caching mechanisms to storefrequentlyusedInternetcontentlocally, increasinglocalthroughputbyreducing Internet-bound traffic. The GSD may also be able to provide similar caching services, givensufficientstorage capacityandprocessing resources. 26.3.11 IPv6. TheallocationofthelastremainingavailableIPv4addressblocks to Regional Internet Registries (RIR) occurred in 2011—indicating the world is “out of IPv4 addresses.” Although one may argue that statement is overly dramatic, mass migrationtoIPv6isstilloccurringataslowerpacethanonemayexpect,eventhough IPv6 was developed in the late 1990s. While organizations continue to develop their individual transition plans, it is likely that IPv6 is already in their environment. Many modern operating systems and devices have dual IPv4 and IPv6 network stacks, with some enabled by default. IPv6 and its associated transition technologies have specific security implications thattheGSDmustunderstand andenforce. Perimeter Security Concerns. Addressing. IPv6 is more flexible in its approach to dynamic addressing. Instead of solely relying on DHCP, an IPv6 device can address itself through stateless ad- dress autoconfiguration (SLAAC). The host uses a unique identifier (typically its own Message Authentication Code (MAC) address) in addition to the Neighbor Discovery (ND) protocol to complete the automatic addressing. Since there is no authenticationNETWORK-SECURITY MECHANISMS 26 · 17 requirement, the GSD must prevent external devices from attempting to act as an internalrouter duringtheaddressing process. ThesignificantincreaseofavailableaddressesinanyparticularIPv6networkmakes it infeasible to discover devices and network topology using traditional port scanning methodologies. By using the multicast listener discovery (MLD) protocol, an attacker can send a probe to the link-local multicast address (ff02::1) and listen for responses. The GSD must block this capability at the perimeter to prevent external devices from attempting todiscoverinternal hostsandtopologies. Tunneling.Withoutubiquitousend-to-endIPv6connectivity,thereareseveralIPv6 transition technologies (such as 6to4 and Teredo) that allow IPv6 capable systems to tunnelcommunicationoverlegacyIPv4networks.Aswithothertunneledtraffic,tobe effective, the GSD must not only be able to enforce the appropriate allowed path for thetunneledtraffic butalsoinspect theencapsulated IPv6packet. IPv6 also has native support for IPsec (both AH and ESP). Configuration and use of IPsec in an IPv6 environment requires the same discipline in choosing and configuringcryptographicoptionsasIPv4.ItisalsopossibletouseIPv4IPsectoprotect IPv6transitiontechnologytunnelsasunencryptedtunnelsessionswouldotherwisebe vulnerable tointerception and/or manipulation. GlobalConnectivity.Networkaddresstranslation(NAT)isanessentialelementfor IPv4 Internet connectivity due to the relatively “small” number of publically routable 128 addresses. The size of the IPv6 address space (2 addresses) provides for global IP interconnectivity without the need (or definition) of a NAT replacement. IPv6 devices willnowcommunicatenativelyacrosstheInternet—changingperimeterdynamicsyet again. With IPv6 enabled, it is essential for GSD to enforce strict ingressand egress filtering. Mobility.MobileIPv6(MIPv6)allowshoststomaintainaccesstothehomenetwork while physically roaming to other locations and uncontrolled networks. A user would beabletoleavetheofficenetworkandtravelfromoneappointmenttoanotherwithout losing connectivity to the internal network. Since the device can move network to networkwithoutdroppingtheinternalconnection,MIPv6alsocreatespotentialissues withstatefulinspectioniftheGSDdoesnotunderstandtheprotocol.Iftheorganization chooses not to support MIPv6, the GSD should filter Type 2 Routing Header (RH2) packets. 26.3.12 Additional Considerations Host Protection. Although firewalls and GSDs play a crucial role inprotectingtheoverallnetworkinfrastructure,itisneithercostfeasiblenorpossibleto deploythesedevicesatallpointsinsidethenetwork.Individualhostsmusthaveaway to protect themselves from threats independent of network-security devices. Unlike the network, a host has a contextual understanding of what the system can, is, and/or should be doing. Beyond the simple allow and deny functionality, contextual security measurescandetectunexpectedsystemconfigurationchangessuchasservicechanges oranapplication behaving inanunexpected manner. When a host leaves the internal network, it becomes an extension of the network protection profile. By providing adequate local protections at the network and appli- cationlevels,themobileendpointhelpstomitigatepotentialissuesuponreconnecting totheinternalnetwork.Itisalsocrucialtodeterminethelevelofprotectionnecessary and how each of these additional levels of security will affect system performance, management, andend-user impact.26 · 18 GATEWAY SECURITY DEVICES Network. Hostsneedtobeabletodeterminethetypesandappropri- atenessofinboundandoutboundtraffic.Thesenetworkrestrictionsmayvaryfromthe internalnetworktouncontrollednetworks.Incertaincircumstances,allnetworktraffic maybesuspectandscrutinizedfurther.Forexample,whenontheinternalnetwork,the hostallowsmostinboundandoutboundtraffic.Ifthehostwereonanuncontrollednet- work,itwouldnotallowanynonestablishednetworkflows.Simplehost-basednetwork protections are not enough; additional host protection mechanisms such as intrusion preventioncandetectandstop networkandapplication-based attacks. Applications Access. The host’s contextual awareness also helps dictate the ability for applications to execute as well as send and/or receive data. The goalistoensureonlytheappropriateapplicationsand/orserviceshavenetworkaccess. The host protection policy may allow applications to establish outbound connections, but never listen (nor accept nonestablished inbound packets). For example, an HTTP serverusesadaemontolistenforconnectionattempts.TheHTTPclientwillattemptto makeaconnectiontotheHTTPserverdaemon.Byusingahostprotectionmechanism, itwould bepossible topreventoneorbothofthese actions. Hybrid Protections. The host intrusion prevention system (HIPS) functionssimilarlytoanetworkintrusionpreventionsystem(NIPS)bydetectingknown attackpatternsand/oranomalousbehaviors.Hybridhostprotectionsbuildonthehost’s contextualawarenessandprovidetheabilitytomonitorotherunusualapplicationlevel activity suchaschanges tobinaries, servicemanipulation, andspawnedlisteners. 26.4 DEPLOYMENT 26.4.1 Zoned Architecture. In a contemporary interpretation of the screened subnetarchitecture,zonesdefinedifferenttypesand/orsensitivitiesofnetworks,appli- cations,and/orservices.Thisprovidestheabilitytomanageallowedpathsatthemacro level(perzone)inadditiontothetraditionalallowedpaths(specifichostsorservices). As requirements drive security deeper into the network, the zoning concept is equally effectivewhenusedtomanageandprotect internalandexternalnetworks. PerimeterZones. Theborderroutermaintainsthearchitecture’sfirst line of defense against external attacks. The ACL(s) on this router should mirror the basic allowed-path configuration of the external (untrusted) firewall interface and providesseveralimportant benefits. The GSD is able to operate at optimal efficiency, since traffic rejected based on border router’s packet-filtering rules normally would never reach the firewall. This permits the firewall to focus, in terms of load, on protocol inspection. If, for example, thefirewallreceivesapacketthatshouldneverhavemadeitpassedtheborderrouter’s ACL, the firewall can assume that the router is not behaving normally. The firewall is then free to respond appropriately, with such actions as terminating all connections fromaspecifichost. ExternalServiceZones. Thenecessityformobilityandaccessibil- ityplacessignificantdemandsonInternet-facing systemsinadditiontoincreasingthe administrativeoverheadofmanagingexternalaccess.Thesectionsbelowprovideonly asampling ofpossible externalservicezonearchitectures.DEPLOYMENT 26 · 19 Utility. Instead of lumping systems such as Web, DNS, and email onto a single network, there may be an advantage by implementing zones. Utility servers such as DNSandemailcouldlogicallybeonthesamenetwork.Webserverstypicallydemand greaterbandwidth,andbyusingthisconcept,canprotecttheentirezonewithasimple inbound accessrule. Extranet.Extranetsystemscreateadditionalcomplexitysincetheyprovidetheuser interface, while internal systems may provide the relevant content. Zoning provides more flexibility by allowing external connections to reach the Extranet servers while providingthosesame serversaccesstointernal resources. VPN. VPN networks are also an opportunity to use zoning. Since the VPN con- nectiondevicemustbeInternetfacing,thisrequirestwodifferentnetworksconnected to the firewall. The external, Internet-facing (VPN untrusted) interface would only allowafewprotocolsforinboundandoutboundencryptedtraffic.Thesecondnetwork (VPN trusted) is for unencrypted network traffic moving to and from the internal net- work. This architecture also provides extra internal network protection in the event of a compromise of the VPN device as well as creating a traffic inspection point that is unimpeded byencryption. Internal Service Zones. With the increasing prevalence of non- company-owned assets and more complex data flows, organizations continue to look for better methods to protect internal networks. The sections below provide only a sampling ofpossible internalservice zonearchitectures. AdministrativeandMonitoringSystems.Organizationstypicallylimitdirectaccess tonetworkandsecuritydevices.Byrequiringalladministrativeandmonitoringtraffic to originate from a specific host and/or network, a zone can effectively reduce each device’s threat profile. This zone would not only allow minimal noninitiated inbound traffic but would also limit outbound connections to the managed and monitored systems. High-ValueSystems. Organizations relying heavily on intellectual property and/or other protect data types (e.g., personal and financial information) have an intrinsic need to provide higher level protections to protect their investments. Zoning provides anadditionallayerofprotectionbyminimizingunnecessaryinformationflowsto/from thesehigh-value systems. IndustrialControlSystems. Incidents such as Stuxnet and Night Dragon are stark remindersthateventhoughcertainsystemtypesareconsideredextremelycomplexand less accessible, it is only a matter of time before successful compromise is possible. Manufacturing organizations with significant investments in industrial control and supervisorycontrolanddataacquisition(SCADA)systemscan(orhaverequirements to)isolatetheseenvironments asanadditionallayerofprotection and/orcompliance. 26.4.2 GSD Positioning. The increased use of encrypted protocols such as SSL/TLS and IPsec can blind network protections. Certain GSDs have the ability to terminateencryptedsessions,thoughtheincreasedprocessingandbandwidthrequire- ments may exceed the limits of the device. If concerned, the security architecture should deploy appropriate countermeasures at strategic locations that avoid encrypted traffic. This way, the GSD can focus on its primary role of detecting and preventing malicious activity. Inline. Placing the GSD inline creates a choke point for active en- forcement on all network traffic that flows through it. When a malicious packet enters26 · 20 GATEWAY SECURITY DEVICES the GSD, protocol analysis will detect the anomaly and will not allow it to flow out the other interface. Although bandwidth limitations are a typical concern, improperly configured inline devices may also present a denial-of-service condition. With proper infrastructure planning anddeployment, itispossible tominimizethese risks. Controlling Encrypted Traffic. Since mobile devices frequently ventureoutsideofthecontrollednetwork,onelogicalplacetoevaluatetrafficisonthe unencrypted side of the connection. This may be on the backside of a SSL terminator (in some cases on the server itself) or on the unencrypted side of a VPN connection. The second option is to use the GSD to inspect (e.g., termination and/or passive de- cryption) the traffic before forwarding the traffic onto its final destination. This level offunctionalityrequiressubstantialprocessingresourcesbutmaybeanecessityifthe security layersdownstream areinsufficient. 26.5 MANAGEMENT AND MONITORING STRATEGIES. Regardless of vendor claims, network-security devices are never a plug-and-play endeavor. It is essential to take additional steps to define the security requirements for managing and monitoring GSD components. This approach helps ensure a well-rounded security posture. 26.5.1 Monitoring. Firewalls and GSDs provide complex functionality; moni- toringsuchsystemsmustgobeyondjustverifyingsystemavailabilityandcoverdevice health, availability, andintegrity. Health. Metrics such as processor utilization, available RAM, and number of connections all have an impact on overall functionality. A centralized management console may provide the ability to monitor and alert on these metrics. If this functionality is unavailable, it may be necessary to use monitoring protocols such as Simple Network Management Protocol (SNMP) and/or Remote Monitoring (RMON) to gather these statistics. The GSD must tightly restrict the systems able to poll using these methods because of the inherent insecurities of the aforementioned monitoringprotocols.Bytrendingthesemetrics,itmaybepossibletodeterminewhen it is time to increase bandwidth or purchase systems that are capable of meeting the newthroughput orprocessing needs. Availability. When GSDs are unavailable, the network functionality candramaticallydiminish.AsimpletestofsystemavailabilityisusingICMPto“ping” oneormoreinterfacestoensurethedeviceitselfisresponding.However,thisapproach can be deceptive. Just because the device itself responds, does not mean it is properly forwarding traffic. It is also advisable to send probes (e.g., ICMP, traceroute, or other queries) to something on the other side of each interface to ensure the other device is actually receiving the packets to ensure valid results. This approach provides a better overallpictureoftheGSDavailability. Integrity. Theabilitytotrustnetworksecuritysystemscomponentsis vital.ThepossibilityofarootkitcompromisingafirewallorGSDisnowareality.These systems must have the ability to protect against modification of system components such as ceasing operation and/or alerting the change. If this embedded functionality were unavailable, it is possible to write a script to generate cryptographic hashes of criticalsystem components andverifyagainstaknowntrusted version.MANAGEMENT AND MONITORING STRATEGIES 26 · 21 26.5.2 Policy. TheGSDpolicyisthecoredefinitionforprovidingandprotecting allowed paths. Most security systems process packets starting at the beginning of the policy and continue until there is either a match or reaching the end of the rule base (which should be an explicit “deny any”). As discussed later in this chapter, there are situations whererulesmayprocessbeforeorafterthemainrulebase. Centralized management consoles provide intuitive GUIs to configure and easily manage one or more firewall and GSD policies. Certain platforms also provide the abilitytomanage policiesdirectlyfrom thedevice. DefiningAllowedPaths. Allowedpathsidentifyspecificprotocols usedtoimplementcommunication.InatypicalInternetenvironment,businessservices requireallowedpathssuchasHTTP(S),SMTP,andDNS.Theserequirementswillvary, butforanenvironment,eachallowedpathshoulddirectlyrelatetotherequiredservice. Starting from an implicit or explicit (depending on the platform) “deny any” rule, allowed paths will be added as “allow” rules, such as PERMIT HTTP, with specifics determined bythefollowingsections. Although network addressing does not provide effective authentication of systems orusers,restrictiveendpointscanmakeitmuchmoredifficultforanattackertoexploit anotherwisestraightforwardvulnerability.Itisalsoimportanttoidentifytheendpoints carefully, particularly in cases where these endpoints might reside on internal rather thanextranetorutilityzones. The direction of traffic, indicated by the source of the connection initiation, is usefulfortheruledefinitionsforseveralreasons.First,rulescanbewrittensothatonly responsestointernallyoriginatedallowedpathsareallowedinfromtheuntrustedzone, rather than explicitly permitting the protocol bidirectionally. In addition, the firewall mayprocessrulesatdifferent timesbasedondesignand/orconfiguration. Complexity of GSD Policies. Standard firewall rules operate on simple Boolean principles. For example, allow or deny network traffic that is going from host or network X to Y on port Z. The complexities required of GSDs evalu- ating network traffic are dramatically higher. For example, this evaluation could be a combination of a Boolean test to verify an inbound email address is from a trusted source,verifymessagecontentsareacceptable,andscananattachmentforviruses.Ad- ministrators must understand the higher-level protocols to ensure that the GSD policy matchesthetypesofprotectionsexpectedandrequired.Asthenumberandcomplexity oftherulesincreases, sodotheprocessing requirements fortheGSD. Beyond the basic firewall capabilities, GSD policies typically include per-rule en- forcementoftheadditionalsecuritymeasures.Forexample,theGSDonlyusesnetwork and/ortransportlayerfilteringtorestrictaccesstotheorganization’sVPNterminators. The policy may include WAF protections, but only for the utility zones. Inbound and outbound Web and file transfer traffic may have the additional requirement for NIPS inspection. Although this level of customization adds some administrative overhead, selectively (rather than broadly) applying additional protections in this manner can reducetheperformance impactoftheaddedprotections. ChangeManagement. Whethermanagingoneoronehundredpoli- cies, an essential element is to have a process to track policy changes. Change man- agement can be cumbersome but has several advantages. First, this provides back-out information if a change were to cause issues. Second, it provides an audit trail of