How can firewalls secure a network?

Firewalls in computer systems are either software based or hardware based. But they have the same purpose of keeping a control over the incoming as well as the outgoing traffic. 

In this article we discuss about how the network is secured by the firewalls. 

- This control is maintained through the analyzation of the data packets. 

- After analyzation, the firewall’s work is to determine whether to allow these packets to pass or not. 

- This decision is taken based up on some set of rules.

- With this set of rules, a barrier is established by the firewall between the external network that is not considered as secure and trusted and the internal network which is secure and trusted. 

- Most of the personal computer’s operating systems come with a built-in software based firewall for providing protection against the threats from external networks. 

- Some firewall components might also be installed in the intermediate routers in the network. 

- Also some firewalls have been designed to perform routing as well.

There are different types of firewalls which function differently.This classification of the firewalls is based up on the place where the communication is taking place i.e., whether at the network layer or the application layer.

Packet filters or network layer: 

- Firewalls used at the network layer are often termed as the packet filters. 

- This firewall operates at low level of the protocol stack of the TCP/ IP and so does not allow the packets to pass through it unless they satisfy all the rules. 

- These rules might be defined by the administrator of the firewall. 

- These firewalls can also be classified in to two categories namely the stateless firewalls and the state-ful firewall. 

- The former kind use less memory and operates faster in the simple filters, thus taking less time for filtering. 

- These firewalls are used for filtering the stateless network protocols i.e., the protocols which do not follow the session concept. 

- These firewalls are not capable of making complex decisions based up on the state of the communication. 

- The latter kind maintains the context of the active sessions. 

- This state info is used by these firewalls for speeding up the packet processing. 

- A connection is described using any of the properties such as the UDP or TCP ports, IP addresses and so on. 

- If a match is found between an existing connection and the packet, it is allowed to pass. 

- Today firewalls have capabilities of filtering the packets based up on attributes like IP addresses of source and destination hosts, protocols, originator’s netblock, TTL values and so on.

Application layer Firewalls: 

- Firewalls of this type work on the TCP/ IP stack’s application level. 

- All the packets traveling in and out of the application are intercepted by this firewall. 

- This leads to blocking of the other packets also. 

- Firstly, all the packets are inspected for any malicious content for preventing the outspread of the Trojans and worms. 

- Some additional inspection criteria might be used for adding some extra latency to the packet forwarding. 

- This firewall determines whether a given connection should be accepted by a process. 

- This function is established by the firewalls by hooking themselves in to the socket calls for filtering the connections. 

- These application layer firewalls are then termed as the socket filters.

- There way of working is somewhat similar to the packet filters except that the rules are applied to every process rather than connections. 

- Also, the rules are defined using the prompts for those processes that have not been provided with a connection. 

- These firewalls are implemented in combination with the packet filters.

What are the security problems faced by a network?

Making mistakes concerning the network security is very common. The same mistakes are repeated again and again. These problems cannot be solved without changing our working methods. In this article we discuss about some common security problems that are faced by a network.

ØUsing weak and non-complex passwords for accessing the network: 

- Brute forcing is an old school exploit to which many of the system network administrators are open to. 

- The very famous captcha technology has been implemented for correcting this vulnerability of the network security passwords. 

- In the common captcha, the user is required to type in the digits or the letters that are displayed on the screen in some sort of distorted image. 

- This technology has been designed to prevent the network to be accessed by unwanted internet bots.

- However, this is not as safe as it looks. 

- It just gives a false sense to the network admins for countering the brute forcing. 

- Complex password is the solution for this problem. 

- For creating a complex password, more than seven characters need to be combined with special characters and numbers. 

- Apart from the creation of the complex passwords, a password expiration system has to be implemented. 

- This system is for reminding the users for changing their passwords. 

- Also, care should be taken regarding the reuse of the passwords. 

- Cycling of the passwords should not be allowed.

Ø Using server application or software that is outdated: 

- The patches are released by the companies from time to time for ensuring that the system does not become vulnerable to the various threats. 

- Also, new exploits and threats are posed by the hackers that can harm the network if the patches are not properly used. 

- For ensuring the network administrator is kept informed of the new threats, the software or the applications have to be updated regularly.  

Ø Web cookies: 

- Even though the viruses and malware cannot be introduced in to the network through cookies, these cookies can be tracked by some third party cookies for compiling the records of the browsing histories of the individuals. 

- The cookies that are not encrypted pose a major threat because they make the system vulnerable to the cross site scripting (XSS) attacks, thus putting your privacy at risk. 

- The open cookies can provide access to the cookies with the log-in data which can be used by hackers for intruding in to your systems. 

- The solution to this problem is to use the encrypted cookies along with an encoded expiration time. 

- The admins might ask the users to re-log-in before accessing important network directories.

Ø Plain hashes: 

- Hashing is the technique used for indexing and retrieval purposes in the database. 

- In most of the encryption algorithms, the plain hashes are mostly used. 

- A type of encryption is the salt that might be added to the hashes for making the creation of a look-up table that might assist the brute force or directory attacks extremely difficult or let’s say almost impractical. 

- But this works only when large salt is used. 

- Usually a pre-computed look up table might not be used by the attacker in exploitation of the network. 

- This makes the network security system even more complex.

- So even if the attacker is able to break into your system, he won’t be able to access the information from the database. 

- The encryption key should be kept hidden.

Ø Shared web hosting: 

- This service is used by the websites that reside on one same server. 

- Each site is given its own partition. 

- This is economically feasible for most of the systems. 

- But here if the attacker breaches in to system of one website, he can get into other website’s security systems too. 

Explain the concepts of Directory traversal attacks?

Another name for directory traversal attack is path traversal attack and there is quite unfamiliarity among people regarding this security threat. We have dedicated this entire article to make you aware of this security threat.

What is meant by Directory Traversal Attacks?

- Directory traversal attacks involve the exploitation of the insufficient sanitization or validation of the security regarding the input data supplied by the end user.
- This results in the passing of the characters representing the traverse to parent directory to the API files.
- The directory traversal attacks are aimed at accessing a computer file that is not intended to be accessible by ordering an application to do so.
- The application acts to the commands of the attacker.
- Here, in such situations there is no fault in the program code and it works perfectly fine but, it lacks in security and that is what that is taken advantage of by the attackers.
- He/ she takes an advantage of the lack of the security of the software system or application.
- This is completely opposite to the exploitation of the bugs of a code.
- Some times directory traversal attacks are also denoted as the “_ _ / attack” (pronounced as dot dot slash attack).
- One common form of such attacks is the canonicalization attacks.
- Some other rare forms are back tracking and directory climbing etc.
- In every operating system there exists a common file that is often used by the hackers to crack the passwords.
- In some operating systems like UNIX, no such password file exists.
- Rather the passwords are stored in some shadow file which is not accessible to the users that are recognized as the unprivileged by the machine. - Password  files are useful in another way also i.e., for enumeration of the accounts on that particular machine and displays whatever are the user accounts present on the system.
- Many variations are observed in the directory traversal attacks based on the directory traversal attack strings used in different operating systems.
- Directory traversal attacks create quite a menace these days which becomes quite difficult to manage.

How to prevent directory traversal attacks?

Software engineers have formulated an algorithm for the prevention of directory traversal attacks which is like this:
- Process URI requests such that they do not invoke any file request. For example, execution of a hook in to the code.
-  Always specify the full path to the directory or file if any exists while normalizing all the characters whenever you have to process a URI request. For example, normalize %20 to spaces.
-  Assume the length of the string to be N and a normalized path exists for a document root that is fully qualified and that no files outside this are accessible.
-  Ensure that the first n characters of the string match exactly with the document root of the requested file.
-  If the above condition proves to be true allow the file to be served.
-  If the above condition is proved false, an error should be returned since the requested file is inaccessible.

An efficient control over the accessing of the web content is highly required for the effective running of the web server in a secure mode. Mostly the web servers employ either of the two security mechanisms listed below: 

1. Root directory:
This directory keeps the users bounded to the specific limits outside which nothing can be accessed. It is created in order to avoid the unauthorized access of the files containing sensitive data by unprivileged users.
2. Access control lists (ACLs): 
These lists find their use in the process of authorization.  The lists contain the information of the users who can legally access the files.

What are different kinds of security threats?

Security vulnerabilities and security threats are one of the biggest issues of today in the field of software engineering. As more sophisticated is the today’s software is, the more critical security issues it struggles with.

Any software is bombarded with one compulsory question that how safe and secure it is? Does it have any possibilities of keeping the attackers at bay from interfering with the security of the software system or application? Has any effective strategy been designed for dealing with any possible security issues and keep sensitive data out of the reach of the attackers and strengthen the security programs of the software system or application? 

Today as the technology is advancing; it is being misused in the creation of new methods or strategies for breaking out in to the security system of a system or application. Attackers are being influenced by the chances of financial gain and are always involved with the exploitation of the various software systems and applications over the years. This article gives a glance about all such security threats that our software systems and applications face today.

How are security threats categorized?

The security threats are categorized in to many categories:

1.        Validation of input: It faces threats like:

(a)      cross site scripting

(b)      SQL injection attacks

(c)       buffer overflow

(d)      Ccnonicalization

2.        Authentication:

(a)      Brute force attack

(b)      Network eavesdropping

(c)       Dictionary attacks

(d)      Credential theft

(e)      Cookie repay

3.        Authorization:

(a)      Disclosure of confidential data

(b)      Elevation of privilege

(c)       Luring attacks

(d)      Data tempering

4.        Configuration management: It faces following threats:

(a)     Unauthorized access to interfaces

(b)      Retrieval of configuration data

(c)      Over privileged process

(d)      Lack of individual accountability

5.        Session management:

(a)      Man in the middle

(b)      Session hijacking

(c)      Session replay

6.       Sensitive information:

(a)      Network eavesdropping

(b)      Access of sensitive data in the storage

(c)       Data tempering

7.        Cryptography:

(a)     Weak encryption

(b)      Poor key management

8.        Parameter manipulation:

(a)      Form field manipulation

(b)      Cookie manipulation

(c)      Query string manipulation

(d)      HTTP header manipulation

9.        Exception management:

(a)     Denial of service

(b)     Information disclosure

10.     Auditing and logging:

(a)      User denial for performing an operation

(b)      Exploitation of an application without trace

(c)      Covering of the attacks by the attacker

Usually security is often either thought of as an operational IT issue that is concentrated up on building defending systems or strategies for the softwares to protect them from the malicious security breaches and attackers or as an issue concerned with the protection of the personal, critical and sensitive data.  

Importance of Security

- Lack of security is what makes a software vulnerable to such issues.

- The security needs to be addressed in some more elaborate way since the attackers are far more ingenious and creative people.

- A software security must be aimed at building a defect free software system or application.

- Out of all the defects of the software system, few tend to become the source of security vulnerabilities. 

- Softwares that have been built with more concentration on the system security are found to be more resistive to the security threats and if in case they are struck with some security issue they have the capability of recovering as soon as possible. 

- It is important to incorporate security in to the software systems are from the initial phase to the last and final phase.

- This can start right from implementing secure software coding and testing methodologies. 

- The software developers, programmers and testers can be trained to implement language specific secure coding practices.

- Conducting a risk based security testing yields greater benefits. It adequately highlights the weaknesses of the software system or application.

Program Threats

There are many ways a program can fail and many ways to turn the underlying faults into security failures. When a user writes a program, there is a possibility that it can be misused by some other user and lead to an unexpected behavior. The two most common methods by which such behavior may occur are Trojan horses and trap doors.

Trojan Horse

One of the most serious threats to computer security is Trojan horse attack. A Trojan horse is a nasty program to break security that is hidden as something harmless such as a screen saver or game. The Trojan -horse problem is exacerbated by long search paths. The search path lists the set of directories to search when an ambiguous program name is given. The path is searched for a file of that name and the file is executed.
One can end such program by ending the interactive session with a sequence of key pressing such as control-alt-delete combination in Windows 95/98/NT systems.

Trap Door

A trap door is basically a program where the programmer might illegally or legally write the code to avoid normal security procedures for specific user. The designer of a program might leave a hole in the software that only the designer is capable of using.
A clever trap door can be included in a compiler. The compiler could generate standard object code as well as a trap door, regardless of the source code being compiled.

Antivirus Software - Signature based detection

Antivirus software is a computer program that detects, prevents, and takes action to disarm or remove malicious software programs, such as viruses and worms. Computer viruses are software programs that are deliberately designed to interfere with computer operation, record, corrupt, or delete data, or spread themselves to other computers and throughout the Internet.

There are several methods which antivirus software can use to identify malware :

Signature Based Detection

It is the most common method that anti-virus software uses to identify malware. This method is somewhat limited by the fact that it can only identify a limited amount of emerging threats, e.g. generic, or extremely broad, signatures.
Advantages :
- The signatures are easy to develop and understand if you know what network behavior you're trying to identify.
- The events generated by a signature-based IDS can very precisely inform you about what caused the alert.
- Signature based rules are based on Pattern matching, and with modern day systems pattern-matching can be performed very quickly.
- If your network is only having DNS, HTTP and SMTP traffic, all other signatures can be removed from the policy files.

Disadvantages :
- Signature based IDS can only detect known attacks, a signature must be created for every attack, and 0-day attacks cannot be detected.
- Signature based IDS systems are also prone to false positives since they are commonly based on regular expressions and string matching.
- Since they are based on pattern match, signatures usually don't work that great against attacks with self-modifying behavior.

Database Integrity

Database Integrity is the preservation of data correctly & implies the process of keeping the dbase away from accidental deletion or alteration.
There are following types of integrity constraints:-
• Entity integrity constraints
• Referential integrity constraints
• Domain integrity constraints

DATABASE SECURITY: - Database security is a measurement of confidence that the integrity of a system and its data will be preserved.
Database security is assigned to address the following issues:-
• Privacy of data elements
• Preserving policies of organization
• System related security level
• Maintaining integrity of the database

Data integrity can be compromised in a number of ways:
- Human errors when data is entered.
- Errors that occur when data is transmitted from one computer to another.
- Software bugs or viruses.
- Hardware malfunctions, such as disk crashes.
- Natural disasters, such as fires and floods.

There are many ways to minimize these threats to data integrity. These include:
- Backing up data regularly.
- Controlling access to data via security mechanisms.
- Designing user interfaces that prevent the input of invalid data.
- Using error detection and correction software when transmitting data.

* Declarative Ease
Define integrity constraints using SQL statements. For these reasons, declarative integrity constraints are preferable to application code and database triggers. The declarative approach is also better than using stored procedures, because the stored procedure solution to data integrity controls data access, but integrity constraints do not eliminate the flexibility of ad hoc data access.
* Centralized Rules
Integrity constraints are defined for tables (not an application) and are stored in the data dictionary. Any data entered by any application must adhere to the same integrity constraints associated with the table.
* Maximum Application Development Productivity
If a business rule enforced by an integrity constraint changes, then the administrator need only change that integrity constraint and all applications automatically adhere to the modified constraint.
* Superior Performance
The semantics of integrity constraint declarations are clearly defined, and performance optimizations are implemented for each specific declarative rule.
* Flexibility for Data Loads and Identification of Integrity Violations
You can disable integrity constraints temporarily so that large amounts of data can be loaded without the overhead of constraint checking.
* The Performance Cost of Integrity Constraints
The advantages of enforcing data integrity rules come with some loss in performance.