Coursehero >> New York >> Rochester >> CSC 257

Course Hero has millions of student submitted documents similar to the one below including study guides, homework solutions, papers, exam answer keys and textbook solutions.

hackers Curious Vandals Industrial spies Accidental data disclosure Solution? A computer or computer software that prevents unauthorized access to private data (as on a company s local area network or intranet) by outside computer users (as of the Internet) By definition, firewall is a combination of hardware and software. Architecture Functions Single Layer functions concentrated on one host, small number of networks inter-connected cost-effective, easy to maintain susceptibility to implementation flaws or configuration errors Multi-Layer firewall functions distributed on a number of hosts Greater security, can use different tech in different hosts to reduce implementation flaws and configuration errors Costly, difficult to design, configure and operate packet filtering : simple, fast application proxies : complex, slow combination of above two (stateful inspection packet filters) Packet filtering Executed by routers (or host acting as router) Checking packet headers(e.g. source IP, destination IP, protocol, port) High level performance coming from low layer configuration IP address filtering TCP/UDP port filtering Client TCP/UDP port filtering Stateful inspection packet filters Filtering decision based on inspection of both header and payload Provide more complex access control General purpose computer Unlimited functional extensibility Special purpose router Highest performance Large number of interfaces Minimal functional extensibility May require more memory Moderate performance Small number of interfaces OS Application vulnerabilities Proxy Proxy forward traffic in two/one direction Proxy running on proxy machines or general purpose computers TIS Trusted Information System A set of programs and configuration practices Designed to run on UNIX systems using TCP/IP with Berkeley-style socket interface The host connected to Internet and private network Routing between Internet and private network disabled Private network invisible to Internet except host, which provides proxies to services Packet screening capability of router Traffic permitted only to bastion host Most common, most flexible Screening router can be configured to permit nodes on private network to directly access Internet via TELNET or FTP A sandbox network between Internet and private network Nodes on Internet and private network can only communicate with sandbox network Application gateways handle store and forward traffic and some types of interactive traffic Log/audit traffic Tn-gw : TELNET protocol proxy Rlogin-gw : Rlogin Ftp-gw : FTP protocol proxy Plug-gw : Generic TCP plug-board proxy Netacl manages network access control Permit access based on client s network address and service requested No support for UDP security, disabled System call chroot before invoking service so that service is performed in an empty directory and no executables are available for attackers Rely on IP address and/or host names Susceptible to IP spoofing via sourcerouting Router capable of screening source routed packets is necessary

Find millions of documents here - Study Guides, Homework Solutions, Papers, Exam Answer Keys and more. Course Hero has millions of course related materials that will enable you to learn better, faster and get an A in all your courses.
Below is a small sample set of documents: