Front cover - IBM Redbooks

and applications are not compatible with certain firewall functions; for example,
using IPSec across a NAT firewall is highly dependent on the IPSec protocol
being used and the NAT device. We realize that in most organizations, the
decision to deploy an application is driven by the business departments, not the
IT department. There needs to be IT security involvement in the planning stages
of new applications to identify potential application dependencies that may have
compatibility issues if the application access takes place across various firewall
defense technologies. It is the responsibility of the IT security administrators to
minimize potential security exposures and limit overall risk to business
application owners and the organization.
Before we get into some detailed firewall specifications, we first provide a list of
general firewall configuration specifications that we recommend. We hope you
will incorporate the specifications in the following list into your organization’s
security policy. Note that each recommendation can easily be converted to a
policy statement by simply changing the word “should” to “will”:
– When utilizing multiple firewalls, a naming scheme should be in place to
avoid conflicts with host names.
– Firewalls acting on Internet zone traffic should have vulnerability scanning
and penetration-testing services performed on a frequent, regular basis.
– Intranet zone firewalls may have firewall interfaces enabled with approved
monitoring protocols for use by IT firewall management teams.
– Logging and security violations should be handled according to the
security policy’s Security Incident Management processes and
procedures.
– Anti-spoofing filters should be enabled.
– Firewalls should be configured with “deny all” as the default rule set.
Now that we have described the recommended firewall configuration policies, we
will begin describing a “best practices” set of firewall functionality that is broken
down into mandatory functions, and recommended functions:
Mandatory firewall functions
► IP filtering capabilities to port, host, and network specifications
► Network Address Translation (NAT)
► Logging and alert notification services
► Support Virtual Private Network (VPN) tunneling services
– SSH tunneling services (as preferred support for administration and
maintenance activity)
– High-availability support for load-balancing and fail-over configurations
Chapter 4. Security components and layers 143