2KKUU7ita

Chapter 8: Network Infrastructure
Countermeasures against firewall rulebase vulnerabilities
The following countermeasures can prevent a hacker from testing your firewall:
✓ Perform a firewall rulebase audit. I’m always saying that you cannot
secure what you don’t acknowledge. There’s no better example of this
than your firewall rulebases. No matter how seemingly simplistic your
rulebase is, it never hurts to verify your work using an automated tool.
✓ Limit traffic to what’s needed.
Set rules on your firewall (and router, if needed) that passes only traffic
that absolutely must pass. For example, have rules in place that allow
HTTP inbound traffic to an internal web server, SMTP inbound traffic to
an e-mail server, and HTTP outbound traffic for external web access.
This is the best defense against someone poking at your firewall.
✓ Block ICMP to help prevent an external attacker from poking and
prodding your network to see which hosts are alive.
✓ Enable stateful packet inspection on the firewall to block unsolicited
requests.
Analyzing network data
A network analyzer is a tool that allows you to look into a network and analyze
data going across the wire for network optimization, security, and/or
troubleshooting purposes. Like a microscope for a lab scientist, a network
analyzer is a must-have tool for any security professional.
Network analyzers are often generically referred to as sniffers, though
that’s actually the name and trademark of a specific product from Network
Associates’ original Sniffer network analysis tool.
A network analyzer is handy for sniffing packets on the wire. A network analyzer
is simply software running on a computer with a network card. It works
by placing the network card in promiscuous mode, which enables the card to
see all the traffic on the network, even traffic not destined for the network
analyzer’s host. The network analyzer performs the following functions:
✓ Captures all network traffic
✓ Interprets or decodes what is found into a human-readable format
✓ Displays the content in chronological order (or however you choose to
see it)
139