Firewalls, Worms, Trojans and Viruses

Overview

Recall questions on firewalls, packet filtering, proxy servers and stateful inspection, how viruses, worms and trojans differ, and how code quality, monitoring and protection address them.

What you need to know

Answer each one before you reveal it.

Questions from this subtopic

Each one with the model answer underneath.

1. 1

   What is a firewall, in general terms?

   Model answer

   A firewall is hardware, software, or a combination of the two, placed between a private network and the outside network. It examines the traffic passing in each direction and allows through only what the rules permit, blocking everything else, so as to protect the private network from unwanted or malicious traffic.

2. 2

   Explain how packet filtering works in a firewall.

   Model answer

   Packet filtering examines each packet on its own and decides whether to let it through by comparing the information in its header against a list of rules. The header fields checked are typically the source IP address, the destination IP address, the port number and the protocol. A rule might permit traffic to the port used by web servers but block everything arriving on other ports, or block all packets from a particular range of addresses. Packets that match a permitting rule are forwarded; those that do not are dropped. Each packet is judged in isolation, with no memory of what has gone before, which makes it fast and simple but means it cannot tell a genuine reply from an unsolicited packet that has been made to look like one, and it never inspects the contents of the packet.

3. 3

   Explain how a proxy server works as part of a firewall.

   Model answer

   A proxy server sits between the internal network and the Internet and makes requests on the users' behalf. An internal machine sends its request to the proxy; the proxy makes its own request to the outside server, receives the response, examines it, and only then passes it on. Because the outside server only ever deals with the proxy, the internal machines' addresses are hidden from it. Because the proxy sees the whole content of the request and the response, it can filter out prohibited sites or content types and log what has been requested, which simple header filtering cannot do. It can also cache frequently requested pages and serve them directly, reducing traffic and improving speed.

4. 4

   Explain how stateful inspection works in a firewall.

   Model answer

   Stateful inspection keeps a record of the connections currently in progress and judges each packet in the context of the connection it belongs to, rather than in isolation. When an internal machine opens a connection to an outside server, the firewall notes the details of that connection in its state table. Packets arriving from outside are then checked against that table: a packet that is a legitimate part of an established, internally initiated connection is allowed, while a packet that claims to be a reply but matches no recorded connection is dropped. It can also check that the sequence of packets makes sense for the protocol in use. This catches attacks that simple packet filtering lets through, at the cost of more processing and memory.

5. 5

   Compare packet filtering with stateful inspection.

   Model answer

   Both examine packets, but packet filtering treats every packet as unrelated to every other and judges it purely on its header against fixed rules, whereas stateful inspection remembers the connections in progress and judges each packet by whether it fits one. Packet filtering is faster and needs little memory, but an attacker can forge a packet that looks like a reply and it will be accepted. Stateful inspection blocks such a packet because no matching connection exists, but it must hold a table of active connections and do more work per packet.

6. 6

   What is a virus, and what does it exploit?

   Model answer

   A virus is malicious code that attaches itself to a host file or program and replicates by inserting copies of itself into other files. It cannot spread on its own: it requires the user to run the infected program or open the infected file, and it then spreads when infected files are shared. It exploits the fact that users routinely run programs and open attachments without checking their origin, the fact that a running program has the same permissions as the user who ran it, and the automatic execution of embedded code such as macros in documents.

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.