Firewalls, proxies and encryption

Overview

Recall questions on firewalls, packet filtering and stateful inspection, proxy servers, what encryption achieves, symmetric and asymmetric keys, certificates in HTTPS, what each measure does not protect against, and default-deny rules.

What you need to know

Answer each one before you reveal it.

Questions from this subtopic

Each one with the model answer underneath.

1. 1

   What is a firewall and how does packet filtering work?

   Model answer

   A firewall is hardware, software, or both, placed between a network (or a single machine) and the outside, which inspects traffic passing through and permits or blocks it according to a set of rules. In packet filtering, the firewall examines each packet's header and compares it against the rule set: the source IP address, the destination IP address, the protocol and the port number. If a rule permits that combination the packet is forwarded; if a rule blocks it, or if no rule permits it, the packet is dropped. Blocking by port is how an administrator closes off services that should not be reachable from outside, leaving only those genuinely needed open.

2. 2

   What is stateful inspection, and why is it better than filtering each packet in isolation?

   Model answer

   Stateful inspection means the firewall keeps a record of the connections currently open through it, and judges each packet in the context of that record rather than on its header alone. It can therefore tell the difference between an incoming packet that is a legitimate reply to a request one of its own machines made, and an unsolicited incoming packet from the same address and port that is nobody's reply. Simple packet filtering cannot make that distinction: to allow replies at all it must leave a range of incoming traffic permitted, which an attacker can exploit by forging packets that look like replies. Stateful inspection also spots packets that do not make sense at their point in a connection's sequence.

3. 3

   A firewall is installed. What does it still not protect against?

   Model answer

   Anything carried inside traffic the rules permit: malware in an email attachment or in a file downloaded over an allowed web connection passes straight through, because the firewall permitted the connection. Anything a user invites in - phishing, a trojan the user chooses to install. Insider misuse, because the firewall sits at the boundary and does not police what an authorised user already inside does. Traffic that bypasses it entirely, such as a device joining by an unauthorised wireless access point, or data leaving on a USB stick. Stolen credentials used to log in legitimately, which look like a permitted connection. Attacks against a service that must be open, such as an attack on the web server through port 443. Encrypted traffic whose payload it cannot inspect. And a denial of service flood, which can saturate the connection before the firewall even makes its decision.

4. 4

   What is a proxy server, and describe the path a web request takes through one.

   Model answer

   A proxy server is an intermediary that makes requests on behalf of clients. Instead of connecting to the web server directly, the client sends its request to the proxy. The proxy examines the request against its rules, and if it is allowed either serves it from its own cache or makes the request to the web server itself, using its own IP address as the source. The response comes back to the proxy, which may store a copy in its cache and log the transaction, and then passes it to the client. From the web server's point of view the request came from the proxy, not from the client.

5. 5

   What does a proxy server give you?

   Model answer

   Caching: frequently requested pages and files are held locally and served without fetching them again, which reduces the bandwidth used on the external connection and makes responses faster for users. Content filtering: requests for blocked categories or specific sites are refused, which is how schools and workplaces restrict browsing. Logging and monitoring: all requests pass through one point so usage can be recorded and audited. Anonymity for the client: the external server sees the proxy's address, not the individual user's, which hides the internal network structure. Protection of a server: a proxy placed in front of a web server receives the requests instead of the server itself, so the real server is not directly exposed, and requests can be distributed across several servers to balance the load.

6. 6

   What does a proxy not protect against?

   Model answer

   It does not encrypt anything by itself, so traffic beyond the proxy is only as protected as the underlying protocol makes it. It does not stop malware inside content it has been configured to allow. It cannot filter what it cannot see, so encrypted traffic passes through opaque unless it is configured to intercept and decrypt it, which is intrusive and itself a security risk. It does not stop a user reaching a blocked site by another route, such as a mobile connection or a device outside the network. It does nothing about insiders, phishing or stolen credentials. And it is a concentration of risk in itself: everything passes through it, so the operator can see all of it, a compromised proxy exposes everyone, and if it fails nobody can browse.

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.