Article: "Firewalless" networks. Is it possible to be safe?

Firewalless networks. Is it possible to be safe?
[email protected]

Introduction
In the early days of IT the centralized work model, represented by 
huge computers, offered the level of security necessary around the 
end of WWII. Even though it had very specific uses and lacked 
teleprocessing altogether, the strictness imposed by the centralized 
model would characterize the next two computer generations. Years 
later, these great "electronic brains", known as Mainframes, would 
be present in practically all great international corporations.

The commercial use of terminals was first seen 1962, when IBM and 
American Airlines unveiled SABRE, an airline ticket reservation 
system. The centralized model based in non-processed terminals =96 as 
seen in the SABRE solution =96 would dominate the market for the next 
twenty years.

The distributed model would take over the market only after the 
release of the first personal computers. In the following years, the 
corporate market would be flooded with office automation software 
like WordStar and VisiCalc. The ease of use was fundamental in the 
expansion of the distributed model; however, the antagonistic need 
to centralize and distribute information drove Information 
Technology to the evolution of the client-server model, which may be 
considered a hybrid of both paradigms.

Security was never the distributed model's strongest point, 
considering it was clearly driven by the corporate market, and not 
the military needs. Confidentiality, integrity and availability were 
not a concern in the local networks of the 1990's. With the later 
advent of the commercial Internet, the client-server model 
consolidated and the market came to understand TCP/IP and its great 
knack for integration. It was also about this time when the first 
commercial firewalls, as we know them, came into sight. 

Years later, there are three main classes of firewall:
Packet-Filter =96 The simplest type of firewall, able to evaluate 
network packets based on rules set by the admin, without concerning 
itself with applications or details such as session, content etc.
Circuit-level =96 Contrary to the last type, these firewalls can 
automatically analyze and judge traffic sessions established by 
particular applications and protocols. Commonly called Stateful 
Inspection Firewalls.
Application-level =96 Also known as Proxy Firewalls, theses devices 
control the connection between two networks within its application 
level, and therefore is capable of more strict control.

The increasing popularity of Circuit-level Firewalls reinforced, as 
a consequence, the use of security perimeters in the corporate 
market. Even if moderately employed in the segregation of networks, 
this concept offers a high level of protection, due to its ability 
to control every way in and out of a network. Currently, the most 
common security perimeter example is the DeMilitarized Zone, or DMZ, 
where all data traffic passes through a control mechanism =96 i.e. a 
firewall.

The Traditional Segmentation Model
The most popular model of network isolation divides the network in 
two security levels, with the use of a firewall device. Similarly to 
the model adopted for websites, it is suggested to divide a network 
in three levels of access:
External or Red 	=96 that which cannot be trusted;
DMZ or Orange 	=96 that which is trustworthy but is exposed to 
greater risk;
Internal or Green 	=96 that which can be trusted.

The internal environment is the location in which, at least 
theoretically, operational control can be exerted, and also a great 
degree of trustworthiness is presented. The external environment is 
characterized by the absence of control and thus, a minor level of 
trust. In this model, the connection point between the three 
environments is some kind of firewall.

Although vastly utilized in the connection of corporate environments 
with the Internet, this model has proved to be very expensive when 
applied in the protection of large corporate networks. While it is 
easy to determine what is "good" and "bad" in an internet 
connection, the distinction is a lot more blurred within a local 
network. In other words, when inside a controlled environment, the 
segregation apparatus must distinguish each and every access in an 
individual and flexible fashion. For instance, a user responsible 
for equipment operation must not have access to the CEO's personal 
computer.

On top of that, even though a regular internet exit point never 
includes more than two routers, the innards of a typical corporate 
network are usually tangled with routers, switches and routing 
protocols, a situation which demands a higher level of performance 
and capillarity form the systems. Even though it is theoretically 
possible to exert the necessary control over the environments, the 
maintenance of a segmented situation within the established 
parameters is extremely complex. The traditional model, based on the 
segmentation of the corporate network in three layers of access, is 
not practical and tremendously expensive.
A different security model
Based on previous experiences with Information Security and security 
environment operation, our team developed a model which is able to 
attend not only the needs of availability, confidentiality and 
integrity, the three pillars of security, but also the important 
financial necessities so present in the daily life of a corporation.

The resulting archetype is based on a modification of the thin-
computing concepts, where processing is dislocated from the personal 
computer to a terminal server which offers transparently an 
operational experience identical to that of a pc.

Although not very popular, this computational paradigm naturally 
presents many desired characteristics compatible with security 
principles and with the way that our team envisions corporate 
security. By centralizing application execution and data storage in 
the servers, it becomes economically viable to offer the resources 
that guarantee the security of information to all users in any 
company. The resources are:
Redundant data storage systems (RAID, SAN etc.);
Centralized personal data backup;
Application  and operational system updating;
Centralized security systems configuration.

In relation to the traditional model of network segmentation, the 
paradigm offered by this paper aggregates the concept of concentric 
security perimeters implemented in the application level through 
general use systems. This means using web, terminal and database 
servers as control devices.

This concept is quite close to the one presently used in proxy 
servers, where the connection between networks takes place in the 
session level1 instead of the network level.

The picture below illustrates the proposed model.

Figure 1 (not attached but available online at 
http://www.cfsec.com.br/artigos/ysp_0001.pdf)

The three layers are thus:

ATL =96 Access Terminal Layer:
The computers that provide the final users access to the remote 
workstations. Example: thin-clients, X-Terminals, browsers. Simple 
protection systems, like cryptography, private VLANs and access 
tokens would be used in this layer.

TSL =96 Terminal Server Layer:
The equipment that processes the workstation functions. Protection 
mechanisms include RAID, backups, OS security configuration 
policies, content control and anti-virus software.

Although the two components mentioned above are usually integrated 
in centralized computing solutions, such as Citrix Metaframe and 
Microsoft Terminal Server, there are several other options. Security-
wise, data may be accessed from numerous means, including the web 
browsers widely employed in internet banking systems. This paper 
chooses thin-clients because they are generic and complete 
alternatives.

ASL =96 Application Server Layer:
These are the servers for applications such as email, Intranet and 
databases. Assailants that manage to penetrate the outer levels will 
not succeed in bypassing technologies like secure configuration 
procedures, data cryptography and network based IDS.

Considering that the hierarchy of network servers greatly varies 
from company to company, this inner layer may be subdivided in to 
the Interface Sever Level and Core Network Layer. This architecture 
can restrict users to one or more specific application servers. For 
instance, a user with access to an intranet server =96 which is linked 
to a database sever =96 may not access the database itself.
Segmenting a local network
One interesting aspect of the architecture proposed in the paper is 
its great flexibility. Bearing in mind that each department inside a 
large corporation has its own information access necessities, 
different admission mechanisms may be configured to all. It is 
perfectly feasible for traditional segmentation models to co-exist 
with the one proposed in this paper, thus lessening the 
implementation impact of the new system.

Regardless of that, as an environment is made adequate to the 
principles of this paper, it is important to execute segmentation 
according to the application profile and each user's information 
access. The most conventional way to do this is through segmentation 
of departments, creating one or more terminal servers each.
A new Information Security paradigm
As a whole, the new model outperforms the traditional one as it 
aggregates network security to central management and high 
availability, both distinctive features of centralized computing. 
With the architecture proposed, security gives a step forward as it 
offers to the user redundancy characteristics previously only 
available for network servers like multi-processing, redundant power 
sources and disk arrays.

Not only the proposed structure is capable of segmenting data 
networks, but it assists in the supervision of often forsaken tasks, 
such as the backup of workstation stored data and the management of 
global security configurations.

By delegating the control and access responsibilities between 
several technologies, the environment suggested in this paper can 
minimize latency and performance problems usually present in 
application level segmentation solutions. More than that, this model 
differs from others as it treats security as a whole, instead of 
being restricted to simple access control. Nevertheless, we do not 
envision this model as a complete substitute to good old firewalls.