1

Content

1. Secure Network Design

2. Cyber Attack Lifecycle

3. Implement Firewalls

4. Next-generation firewall architecture

5. Initial Access to the Firewall

6. Configuration Management

Secure Network Design

The following are some weaknesses to mitigate in a network design/architecture

• Single points of failure

• Complex dependencies

• Availability over confidentiality and integrity

• Lack of documentation and change control

• Overdependence on perimeter security

Zones

• Zones are isolated segments that have the same security requirements.

• Traffic between zones are subject to filtering but a firewall.

Main Types of zones:

• Intranet (private)

• Extranet

• Internet (public)

Demilitarized Zones

• DMZs isolate hosts that are Internet-facing, acts as an public facing gateway

• Ideally used to rebuild packets for forwarding

• The easiest way to set this up is using bastion hosts

• There are many different types of DMZs for different functions

This is so good!!! 😋🤤 (straightforward and love it!!)

Bastion Hosts

• Run minimal services

• Do not store local network account credentials

• Not fully trusted by internal network

Topology #1 - Screened Subnet DMZ

• Uses 2 firewalls placed on either side of the DMZ, one being the internal firewall, and the other being the edge firewall

• Internal firewall has more rules than the edge firewall, as the internal firewall filters communications between hosts in the DMZ (Extranet) and hosts on the LAN

• Internal firewall is also described as the choke firewall, which facilitates: ✔️ Better Access Control ✔️ Easier Monitoring

Topology #2 - Triple-Homed Firewall DMZ

• Manages 3 interfaces - One firewall, three network interfaces

• One interface is public facing one, another is the DMZ and the last interface connects to the LAN

• Can achieve the same sort of configuration as a screened subnet using routing and filtering rules to determine what forwarding is allowed between the interfaces

Topology #3 - Dual-Homed Firewall DMZ

• Uses a firewall/router to connect a dual-homed proxy/gateway server to the internet

Dual-homed gateway

• System fitted with two network interfaces (NICs) that sits between an untrusted network and a trusted network to provide secure access

Summary of the Topologies

Topology	✔️Pros	❌Cons
Screened Subnet	Secure as monitoring and access control is centralized	Requires two firewalls, meaning that cost might be an issue
Triple-Homed, Dual-Homed	Requires only one firewall	Single Point of Failure due to having one firewall

Proxies and Gateways

Proxy Server
Forward Proxy Server	Proxy opens connections with external servers on behalf of internal clients
Reverse Proxy Server	Proxy open connections with internal servers on behalf of external clients

Cyber Attack Lifecycle

Attackers strategize their way to infiltrate an organization's network and exfiltrate date, they follow a series of stages that comprise the attack lifecycle. Similar to the cyber kill chain.

1. Reconnaissance

2. Weaponization

3. Delivery

4. Exploitation

5. Installation

6. Command & Control

7. Act on Objective

1.Reconnaissance

In this phase, attackers research, identify and select vulnerable network, service or application targets to exploit. OSINT is also conducted at this stage.

2.Weaponization

In this phase, attackers choose their method of attack and develop the malware used to exploit the vulnerability discovered in the previous stage , so as to initiate the attack. At this stage, network or security administrators cannot act as these activities cannot be detected.

3.Delivery

In this phase, malware created in the previous stage is sent to the victim using various methods - by phishing/impersonation..etc At this stage, end users can act on these and be the first layer of defence. A firewall can also be another form of first layer defence to prevent the delivery from reaching end users.

4.Exploitation

In this phase, the malware runs the attack code that exploits the vulnerabilities on the victims devices. The code may also include opening an entry point for other intrusive code to be installed and increase the scale of the damage. At this stage, a firewall can discover and prevent the delivery of detected malware that passes through its network stack. If a trusted user brings the malware into the company knowingly/unknowingly (eg. through an infected USB), the detection and blocking of this malware is left to any endpoint protection (eg. anti-virus)

5.Installation

In this stage, attackers will seek to establish privileged operations. One way in doing so is to install a backdoor to allow attackers to obtain permanent access to the device even if passwords are changed/services are disabled. Back doors are likely created through use of a kernel, firmware-based rootkit or remote administration tool. At this point, network/ security administrators can definitely see the impacts of the attacker's actions. As such, detection, containment and prevention actions can be executed at this stage.

6.Command & Control (C2)

In this phase, attackers establish a command channel back to the victim via a specific server so that data or more malicious code can be passed over and back between the infected devices and the attacker's server. The C2 channel can also be used to update the malware with new functionality if the attackers objective change, and further maintain persistence on the infected device.

7.Act on Objective

Attackers in this phase may resort to data exfiltration, destruction of critical infrastructure, deface web property, ...etc. These actions lie in what motivations the attackers has planned for the attack - the victim device might not be a target of the attacker, but a point of attack to the intended target.

Implement Firewalls

There are two types of firewalls (very high level) that can be implemented:

1. Firewall appliances - Routed (Layer 3) - Bridged/transparent (layer 2) - Router/firewall

2. Application-based firewalls - Host-based (personal) - Application firewall - Network operating system (NOS) firewall - A software-based firewall running under a network server OS, such as Windows or Linux. - Server would function as a gateway or proxy for a network segment

Packet Filtering Firewalls

• Enforces a network access control list (ACL) that is configured on principle of least access

  • This means that only the minimum amount of traffic that is required for any valid network service operation is allowed, and no more

• Act to deny (block/drop), log or accept a packet

• Works by inspecting headers of individual inbound, outbound or both packets for either :

  • Source/Destination IP address

  • Protocol ID/type

  • Source and destination port numbers

• Its operation is considered a stateless operation

  • This means that the firewall does not preserve information about any network session

  • Each packet is analyzed independently with no record of previously processed packets.

  • ✔️Filtering requires least processing effort

  • ❌ Vulnerable to attacks that are spread over a sequence of packets
• Use iptables to edit rules enforced by Linux kernel firewall

Next-generation firewall architecture

Zero Trust Architecture

• Conventional security models assume that everything inside an organization's network can be trusted, protecting the perimeters of the architecture

• Insider threats are not secured against, meaning the possibility of compromise to sensitive, valuable business data is high

• This architecture is based on the principle of "never trust, always verify"

• Each step a user makes through the infrastructure must be validated and authenticated across all locations

• Accomplish inbound and outbound inspection by locating a firewall between LAN and WAN.

• Accomplish internal traffic inspection by locating a firewall between your internal subnets and VLANs.

Initial Access to the Firewall

• Performed using either:

  • Dedicated out-of-band management ethernet interface (MGT interface)

  • Serial console connection

• Local admin password is stored in the firewall's XML configuration file, encrypted using firewall's master key

Reset to Factory Configuration

1. From CLI with known admin user password

request system private-data-reset

• The above erases all logs, resets all settings, including IP addressing (causes loss of connectivity

• Saves a default configuration after the MGT IP address is changed

1. During bootup with an unknown admin user password:

• Type the following command from the console port during bootup:

maint

• Choose 'Reset to Factory Default'

Configuration Management

Running Configuration

Configuration settings currently active on the firewall

Candidate Configuration

Configuration changes in progress but not active on the firewall

To apply the candidate configuration changes, a commit must be done. A commit activates pending changes from the candidate configuration tot he firewalls running configuration

Commit warnings do not prevent a successful commit.

However, a commit errors do prevent a successful commit.