Firewall Policies and VPN Configurations

Syngress, Dale Liu, Stephanie Miller, Mark Lucas, Abhishek Singh, Jennifer Davis

• Publisher: Syngress
• Year: 2006
• Print ISBN: 9781597490887
• eBook ISBN: 9780080506517
• Topic: Ciencia de la computación
• Subtopic: Ciencias computacionales general

A firewall is as good as its policies and the security of its VPN connections. The latest generation of firewalls offers a dizzying array of powerful options; they key to success is to write concise policies that provide the appropriate level of access while maximizing security. This book covers the leading firewall products: Cisco PIX, Check Point NGX, Microsoft ISA Server, Juniper's NetScreen Firewall, and SonicWall. It describes in plain English what features can be controlled by a policy, and walks the reader through the steps for writing the policy to fit the objective. Because of their vulnerability and their complexity, VPN policies are covered in more depth with numerous tips for troubleshooting remote connections.· The only book that focuses on creating policies that apply to multiple products.· Included is a bonus chapter on using Ethereal, the most popular protocol analyzer, to monitor and analyze network traffic.· Shows what features can be controlled by a policy, and walks you through the steps for writing the policy to fit the objective at hand

Part I

Security Policy

Chapter 1

Network Security Policy

Topics in this chapter:

■ Defining Your Organization

■ Trusted Networks

■ Untrusted Networks

☑ Summary

☑ Solutions Fast Track

☑ Frequently Asked Questions

Introduction

Deploying a network security policy is a significant and serious undertaking. Making good decisions in this matter will save a great deal of money and prevent many future security issues on your network, while making incorrect or hasty decisions will lay the foundation for an insecure network infrastructure. Creating a network security policy will affect your organization in a number of ways, including (but not limited to):

■ Financial A new network security policy may require you to purchase new equipment and software, such as firewalls, IPS (intrusion protection/prevention system), anti-virus software, new routers, and more. You’ll likely also incur additional salary costs for security personnel trained to manage the new hardware and software.

■ Network availability You may have to install new hardware and software on your network to comply with a new network security policy, which may impact your overall network availability as you install and configure this infrastructure. Therefore, the process needs to be well planned to reduce risks, costs, and downtime for your clients and internal users.

■ Usability In almost every case, the security of a computer system is inversely related to its usability. As a result of your network security policy, you may reach a state where the usability of the network is drastically reduced. Your network security policy needs to balance security against usability, so that your security policy does not become so rigid that your users cannot perform their job functions.

■ Legal Depending on your country and the activity of your business, you may be required to comply with legislative measures such as HIPPAA or Graham-Leach-Bliley. You need to consider these regulations when designing your network security policy.

Before you can begin to implement a new network security policy, you need to perform extensive planning and preparation before writing documents and configuring new hardware or software. It is important to know your network, to understand the reasons for every network device, to know the vulnerabilities of every technology in use, the strength of each device, and the way devices are connected to each other.

It’s also crucial to understand how your network is going to be used, to know the requirements of your business, how many and what kind of users will have access to the network. You should also understand why the network was installed (or is going to be installed) and whether you have sufficiently trained staff and budget to manage the network. In any case, every network has its own requirements and objectives. Every network is different, and not many countermeasures applied in one network to reduce the risks to it will be directly applicable to another network.

It is easy to find the differences between a campus network in a large university and the network of a small office, the network of a big enterprise or that of a small home network. They are all networks, and they will perform the same basic operations; however, the security requirements may vary greatly.

As with most matters relating to Information Technology, the budget available to you to enforce network security is a real issue when designing and implementing your policies and procedures. Your requirements need to be sufficiently affordable for your company or client. Sometimes, it is better to generate a procedure that every user will need to know and follow, rather than try to implement a complex and expensive technical control.

Many organizations now realize the need to have an articulated information security policy, to be more effective in their preventative, detective, and responsive security measures. Moreover, because of government regulations, organizations in certain vertical industries are required to have formally documented information security policies.

In addition, an information security policy is also extremely beneficial to the security manager because it provides, at an executive level, a mandated framework for ensuring the confidentiality, integrity, and availability of an organization’s information assets. What this means is that the security manager has some weight in his or her corner for budget requests when he or she has an approved information security policy.

Finally, for the security administrator, having a written and approved policy can ensure that you are able to deploy different technologies in a way that minimizes disruption to business. Think of the written policy as a recipe to ensure you configure everything correctly. Moreover, a policy is the best way to ensure you will keep your job, should something happen.

Note

Whatever type of network you are deploying, you need to keep your feet on the ground; a company’s network needs to allow the company to produce more earnings than costs. In other words, you shouldn’t spend more money protecting an asset than the asset is actually worth.

When tackling this issue, it’s also critical to keep in mind the differences between a security policy and a security procedure. Your network security policy needs to be a high-level and fairly stable document that can withstand a certain amount of change to the operating systems your clients and servers are running, so you are not issuing changes to the policy every time Microsoft releases a new service pack. You can implement network security procedures to support the security policy; these procedures will discuss specific operational or procedural details that will allow you to comply with the high-level security policy. “All Internet-connected computers must be secured against malicious intrusion” is an example of an edict you might find in a network security policy, whereas “all Windows XP computers must have Service Pack 2 installed and the Windows Firewall enabled” is an example of a specific procedure you might put in place.

Defining Your Organization

You just received the task to define a network security policy for your network. As mentioned in the introduction of this chapter, you need to think about several topics before defining your new network security policy.

A good way to start is to think about your organization. How well do you know your organization’s business processes, both as an individual company and the needs and requirements of its industry as a whole? Sometimes, when an information security engineer or a consultant is asked to design a network security policy, he or she realizes that it is imperative to develop a better understanding of the organization before beginning.

To be able to design a useful network security policy, you need to know what the network is designed for. You need to design and deploy a network security policy that secures a company’s resources, while still allowing people to do their jobs. Therefore, think about the department, the business, what the company produces or sells, whether the business is seasonal or cyclical, or if its activity remains roughly the same year round. Does the company have any business with foreign customers, vendors, or business partners? Are any governments involved in the operations of the business, and does the business require any kind of government s...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright page
• Acknowledgments
• Technical Editor
• Contributing Authors
• Part I: Security Policy
• Part II: Firewall Concepts
• Part III: VPN Concepts
• Part IV: Implementing Firewalls and VPNs (Case Studies)
• Index