Improving Web Application Security: Threats and - CGISecurity

414 Part IV: Securing Your Network, Host, and ApplicationFiltersFiltering published ports on a firewall can be an effective and efficient method ofblocking malicious packets and payloads. Filters range from simple packet filters thatrestrict traffic at the network layer based on source and destination IP addresses andport numbers, to complex application filters that inspect application-specificpayloads. A defense in depth approach that uses layered filters is a very effective wayto block attacks. There are six common types of firewall filters:● Packet filtersThese can filter packets based on protocol, source or destination port number andsource or destination address, or computer name. IP packet filters are static, andcommunication through a specific port is either allowed or blocked. Blockedpackets are usually logged, and a secure packet filter denies by default.At the network layer, the payload is unknown and might be dangerous. Moreintelligent types of filtering must be configured to inspect the payload and makedecisions based on access control rules.● Circuit-level filtersThese inspect sessions rather than payload data. An inbound or outbound clientmakes a request directly against the firewall/gateway, and in turn the gatewayinitiates a connection to the server and acts as a broker between the twoconnections. With knowledge of application connection rules, circuit level filtersensure valid interactions. They do not inspect the actual payload, but they docount frames to ensure packet integrity and prevent session hijacking andreplaying.● Application filtersSmart application filters can analyze a data stream for an application and provideapplication-specific processing, including inspecting, screening or blocking,redirecting, and even modifying the data as it passes through the firewall.Application filters protect against attacks such as the following:● Unsafe SMTP commands● Attacks against internal DNS servers.● HTTP-based attacks (for example, Code Red and Nimda, which useapplication-specific knowledge)For example, an application filter can block an HTTP DELETE, but allow an HTTPGET. The capabilities of content screening, including virus detection, lexicalanalysis, and site categorization, make application filters very effective in Webscenarios both as security measures and in enforcement of business rules.