Juniper(r) Networks Secure Access SSL VPN Configuration Guide

Rob Cameron, Neil R. Wyler

• Publisher: Syngress
• Year: 2011
• Print ISBN: 9781597492003
• eBook ISBN: 9780080556635
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Juniper Networks Secure Access SSL VPN appliances provide a complete range of remote access appliances for the smallest companies up to the largest service providers. As a system administrator or security professional, this comprehensive configuration guide will allow you to configure these appliances to allow remote and mobile access for employees. If you manage and secure a larger enterprise, this book will help you to provide remote and/or extranet access, for employees, partners, and customers from a single platform. - Complete coverage of the Juniper Networks Secure Access SSL VPN line including the 700, 2000, 4000, 6000, and 6000 SP. - Learn to scale your appliances to meet the demands of remote workers and offices. - Use the NEW coordinated threat control with Juniper Networks IDP to manage the security of your entire enterprise.

Chapter 1 Defining a Firewall

Solutions in this chapter:

Why Have Different Types of Firewalls?

Back to Basics: Transmission Control Protocol/Internet Protocol

Firewall Types

Summary

Solutions Fast Track

Frequently Asked Questions

Introduction

When most people think about Internet security, the first thing that comes to mind is a firewall, which is a necessity for connecting online. In it’s simplest form, a firewall is a chokepoint from one network (usually an internal network) to another (usually the Internet). However, firewalls are also being used to create chokepoints between other networks in an enterprise environment. There are several different types of firewalls.

Why Have Different Types of Firewalls?

Before we delve into what types of firewalls there are, we must understand the present threats. While there are many types of threats, we only discuss a few of them in this chapter, paying the most attention to those that can be mitigated by firewalls.

Ensuring a physically secure network environment is the first step in controlling access to your network’s data and system files; however, it is only part of a good security plan. This is truer today than in the past, because there are more ways into a network than there used to be. A medium- or large-sized network can have multiple Internet Service Providers (ISP’s), virtual private network (VPN) servers, and various remote access avenues for mobile employees including Remote Desktop, browser-based file sharing and e-mail access, mobile phones, and Personal Digital Assistants (Pads).

Physical Security

One of the most important and overlooked aspects of a comprehensive network security plan is physical access control. This matter is usually left up to facilities managers and plant security departments, or outsourced to security guard companies. Some network administrators concern themselves with sophisticated software and hardware solutions to prevent intruders from accessing internal computers remotely, while at the same time not protecting the servers, routers, cable, and other physical components from direct access. To many “security-conscious” organization’s computers are locked all day, only to be left open at night for the janitorial staff. It is not uncommon for computer espionage experts to pose as members of cleaning crews to gain physical access to machines that hold sensitive data. This is a favorite ploy for several reasons:

Cleaning services are often contracted out and their workers are often transient, so your company’s employees might not know who is a legitimate member of the cleaning company staff.

Cleaning is usually done late at night when all or most company employees are gone, making it easier to surreptitiously steal data.

The cleaning crew members are paid little attention by company employees, who take their presence for granted and think nothing of them being in areas where the presence of others would normally be questioned.

Physically breaking into a server room and stealing a hard disk where sensitive data resides is a crude method of breaching security; nonetheless, it happens. In some organizations, it may be the easiest way to gain unauthorized access, especially for an intruder who has help “on the inside.”

It is beyond the scope of this book to go into detail about how to physically secure your network, but it is important for you to make physical access control the outer perimeter of your security plan, which means:

Controlling physical access to the servers

Controlling physical access to networked workstations

Controlling physical access to network devices

Controlling physical access to the cable

Being aware of security considerations with wireless media

Being aware of security considerations related to portable computers

Recognizing the security risk of allowing data to be printed

Recognizing the security risks involving floppy disks, CDs, tapes, and other removable media

There are also different types of external intruders who will physically break into your facility to gain access to your network. Although not a true “insider,” because he or she is not authorized to be there and do not have a valid account on the network, this person still has many of the advantages (refer to the “Internal Security Breaches” section.) Your security policy should take into account the threats posed by these “hybrid” intruders. Remember, someone with physical access to your servers has complete control over your data. Someone with physical access to your authentication servers owns everything.

Network Security

Virtual intruders can access your network from across the street or from halfway around the world. They can do as much damage as a thief that breaks into your company headquarters to steal or destroy data, and are much harder to catch. The following sections examine specific network security risks and ways to prevent them.

For a number of years, firewalls were used to divide an organization’s internal network from the Internet. There was usually a demilitarized zone (DMZ), which contained less valuable resources that had to be exposed to the Internet (e.g., Web servers, VPN gateways, and so forth), and a private network that contained all of the organization’s resources (e.g., user computers, servers, printers, and so forth). Perimeter defense is still vitally important, given the ever-increasing threat level from outside the network. However, it is no longer adequate by itself.

With the growth of the Internet, many organizations focused their security efforts on defending against outside attackers (i.e., those originating from an external network) who are not authorized to access the systems. Firewalls were the primary focus of these efforts. Money was spent building a strong perimeter defense, resulting in what Bill Cheswick from Bell Labs famously described years ago as, “A crunchy shell around a soft, chewy center.” Any attacker who succeeded in getting through (or around) the perimeter defenses, would have a relatively easy time compromising internal systems. This situation is analogous to the enemy parachuting into the castle keep instead of breaking through the walls. Perimeter defense is still vitally important, given the increased threat level from outside the network; however, it is simply no longer adequate by itself.

Various information security studies and surveys have found that the majority of attacks come from inside an organization. Given how lucrative the sale of information can be, people inside organizations can be a greater threat than people outside the organization. These internal threats can include authorized users attempting to exceed their permissions, or unauthorized users trying to go where they should not be. Therefore, an insider is more dangerous than an outsider, because he or she has a level of access to facilities and systems that the outsider does not. Many organizations lack the internal preventive controls and other countermeasures to adequately defend against this threat. Wide open networks and servers sitting in unsecured areas provide easy access to the internal hacker.

The greatest threat, however, arises when an insider colludes with a structured outside attacker. With few resources exposed to the outside world, it is easier for the bad guys to enlist internal people to do their dirty work. The outsider’s skills combined with the insider’s access could result in substantial damage or loss to the organization.

Attacks

Attacks can be divided into three main categories:

Reconnaissance Attacks Hackers attempt to dis...

Table of contents

• Cover
• Title Page
• Copyright
• Technical Editor and Contributing Author
• Contributors
• Table of Contents
• Chapter 1: Defining a Firewall
• Chapter 2: Setup
• Chapter 3: Realms, Roles, and Resources
• Chapter 4: Authentication Servers
• Chapter 5: Secure Application Manager
• Chapter 6: Terminal Services and Citrix
• Chapter 7: Network Connect
• Chapter 8: Endpoint Security
• Chapter 9: Web/File/Telnet/SSH
• Chapter 10: Maintenance Section
• Chapter 11: System Section
• Chapter 12: Sign-in Policies
• Chapter 13: Logging
• Chapter 14: Enterprise Features
• Index