Firewall Operations - Protecting a Critical System

http://www.cyberguard.com/news_room/news_newsletter_121203firewall.cfm

Firewall Operations - Protecting a Critical System

By Gideon T. Rasmussen - CISSP, CFSO, CFSA, SCSA

Security teams must ensure that firewalls are installed, configured and=20
maintained in accordance with mission requirements and the best=20
interests of the organization. There are many reasons why firewall=20
administration must be tightly controlled. Firewalls are inherently=20
complex. Employee turnover can result in a lack of continuity. Firewall=20
logs may be called as evidence in a court case. Many organizations must=20
also meet auditing requirements.

Before installing a firewall, its administrators should become=20
intimately familiar with its features and operations. While there is no=20
substitute for formal training, other resources include system manuals,=20
on-line documentation, manual pages, knowledge base entries and=20
technical support.

If an organization does not have experienced personnel, administrators=20
should engage a consultant to properly install and configure the system.=20
Ensure that administrators are available to participate in the=20
installation and obtain knowledge transfer. Test disaster recovery by=20
reinstalling the firewall software and restoring from backup.

Thoroughly document how each firewall should be installed in a formal=20
configuration standard. Installation must be in strict compliance with=20
system manuals to help ensure stability and compliance with support=20
agreements. A standard should also provide step-by-step instructions.=20
Consider the following topics:

Proxies: Use proxies to limit traffic to designated protocols. Proxies=20
can block file sharing programs such as Kazaa and iMesh. They can also=20
defeat hacking tools. Proxies give administrators granular control over=20
a protocol. For example, CyberGuard's FTP proxy can be configured to=20
permit download and deny upload. The HTTP proxy makes it possible to run=20
multiple Web sites on one system. You=92ll find more information about=20
CyberGuard=92s proxies here:=20
(http://www.cyberguard.com/news_room/news_newsletter_030619smartproxies.c=
fm).=20


Comments: Include comment entries in the packet filter rules file.=20
Firewall rules grow quickly. It is important to retain the purpose of=20
each rule. Adopt the following format as a standard: "rationale,=20
mm/dd/yy, ticket #, your name."

Grouping: Grouping is very powerful and should be used whenever=20
possible. Grouping reduces the complexity of firewall rules and=20
minimizes the potential for human error. If you have several systems=20
with the same service requirements, create hosts and services groups.=20
The utility of grouping becomes more apparent as the number of systems=20
increases.

Accounts: Create individual accounts for each administrator. Delete the=20
common administrative account. This configuration enhances accountability=
.

Roles: Use duty roles to grant specific accesses. For example, an=20
auditor should have read-only permissions. Support staff only requires=20
the ability to stop and start the system.

Configuration Tracking: Configuration tracking records changes made=20
during a login session. Its database enables administrators to compare=20
the differences between an older configuration file and the current=20
version. Configuration tracking can also record a user-supplied ticket=20
number.

DNAT: Enable Dynamic Network Address Translation (DNAT) on each external=20
interface. DNAT changes internal IP addresses to the external IP of the=20
firewall with a unique source port. The outside world sees the external=20
address. Upon return the firewall knows which IP to switch back to from=20
the originating source port.

Passwords: Enforce strong password elements. Configure passwords to=20
expire every three months. Password elements should include alpha,=20
numeric and special characters.

Auditing: By default, binary logging is enabled. More than 300 events=20
are logged. Configure activity logging to record security events and the=20
services enabled on the firewall.

Logs: Schedule an export of binary audit logs to an FTP server. Copy=20
system logs to a central syslog server. Configure log management to=20
prevent the system disk from filling up.

Alerts: Configure the firewall to send notification of suspicious=20
events. You can choose from a variety of notification methods including:=20
file, window, e-mail, SNMP trap, pager, syslog and shell command.

Before granting production status to a system, confirm that a scheduled=20
backup has successfully completed. Ensure the system is properly=20
configured by conducting a security vulnerability scan. Also remember to=20
monitor the firewall from a remote location.

Implement a formal change process and incorporate your firewalls into=20
the system development life cycle. In particular, ensure that firewall=20
rules are not left in place when a system is decommissioned. This can=20
represent a serious vulnerability if a system is repurposed or its IP=20
address reissued while firewall rules still provide access from the=20
outside.

Apply new versions and product support updates as they are issued. The=20
operating system=92s multi-level security and hardened kernel are the=20
foundation of the cyberGuard =93zero vulnerabilities=94 solution=20
http://www.cyberguard.com/ukadseries/vulnerabilities.cfm. CyberGuard=20
firewalls have achieved Common Criteria EAL4+ certification and maintain=20
that certification through participation in the Assurance Maintenance=20
program. That means that new versions and updates maintain their=20
original certification.

Create an operations guide to ensure continuity. At a minimum it should=20
detail how to stop and start the firewall and restore from backup.

Finally, include firewalls in disaster recovery planning. Store=20
installation media and firewall backups off-site. Confirm that the=20
recovery site has firewall hardware available.