Firewall best practices

Q: Checkpoint firewall R62 & Nokia IP 560 Hardware based appliance best practices
We have Checkpoint firewall R62 & Nokia I 560 Hardware based appliance , we do audit of rules on quarterly basis but still i feel that lot of tuning to be done on Nokia IP 560 and Checkpoint .Can some one please help me in getting best practices for firewall.

A: Hi ...,
Best practices can be classified in 2 main areas:
1- Information Security
2- Operational

For information security, make sure that you follow a higher level information security framework with integrated risk management. Firewalls must be a part of the bigger picture, not standalone devices.
ISO 27001, NIST, COBIT or FFIEC can be a good start.
There are several guidelines by FFIEC if you are operating at financial services industry.
http://www.ffiec.gov/ffiecinfobase/html_pages/it_01.html

You can also check firewall specific guidelines from NIST
http://csrc.nist.gov/publications/nistpubs/800-41/sp800-41.pdf

Once you make sure that you address governance, risk and compliance (GRC) related concerns you can dive into operational issues such as reliability, high availability, performance, scalability, manageability.

We have been managing thousands of Check Point systems under Nokia platform. It is difficult to cover best practices in single post (from change management to patching, from backup policy to cluster optimization) There are several good recommendations in other posts as well; here is a quick view from my side.

1- Optimize rulebase (most used rules at the top, use logging intelligently, avoid duplicate objects, check unused objects rules, make sure that overlaps do no exist, use network object, decrease NAT usage etc)
2- Upgrade to R65 for Check Point. It is more stable and you will get all the new fixes faster.(when compared with R62)
3- IPSO 4.2 will bring you more features with SecureXL, QOS etc. but go over the release notes carefully. Make sure that SecureXL is enabled within the current deployment.
4- If you have performance issues and you are not planning to upgrade platform check the new ADP cards from Nokia.
5- Architecture-wise avoid running non-firewall features such as SmartCenter, AV, filtering on your Nokia unless you need them.
6- If you have site-to-site VPNs check the route based VPN feature with dynamic routing for better redundancy

I also recommend using 3rd party test services which include DDOS.

For automation, you can use firewall audit, change management tools such as Tufin, Algosec and Firemon (we work with Tufin). These tools will give you a lot of input on audit. On the security risk management side if you have budget, you can check SkyboxSecurity and RedSeal. They will be really helpful.

If you have any specific questions please let me know,

cheers,
- yinal

ThinClient Security

Q: Kindly elaborate your experience with ThinClient security from the likes of HP and Wyse.

Currently researching the following with regard to Thin Client Security :

1. Need of an AV in ThinClient and its manageability.If an AV is required which ones recommended and why(file size,footprint on the OS and detection capability)
2. How to enforce security policies in Embedded XP. Eg : Device control/lockdown of the system etc
3. Case study of ThinClient security - breaches that has happened in the past;best practices and recommendations etc etc
4.Possibility of a ThinClient turning on to be a zombie for a botnet and any other security considerations to keep in mind


A: Hi ........,
It is difficult have a generic answer for all thin clients since there are several OS flavors and several different deployment/use cases. HP offers clients with Windows CE, NeoLinux , Windows XP Embedded, Debian Linux 4.0 ,HP Thin Connect and Wyse offers clients with Wyse ThinOS ,Windows XP Embedded, Wyse Linux Windows CE etc) …You can choose to restrict user activity to minimum and reboot with a fresh image each time, or you may choose to customize your thin OS with some execution and allow limited apps in addition to RDP, ICA type terminal clients. So your risk profiles vary based on your decisions.

That being said here are my comments


Need of an AV in ThinClient and its manageability. If an AV is required which ones recommended and why(file size, footprint on the OS and detection capability)

If you are looking at XP embedded (XPe) as you stated down below you have some options. CA Anti-virus (formerly eTrust) is the first player with a small footprint.. Symantec offers full endpoint security with The Symantec Endpoint Protection for Windows XP Embedded. disk/cpu/memory requirements on Symantec client is 30Mb/1.3Ghz/128MB.. You can also use McAfee VirusScan Enterprise on XPe. I would crosscheck the licensing options on each of the option as well.. If you choose terminal connections and lock down the client only you may question the necessity as well.


How to enforce security policies in Embedded XP. Eg : Device control/lockdown of the system etc

Like in real XP, group policies and windows firewall. On Windows XP Embedded with SP2 you/your vendor can configure your run-time image for better security. Windows XP Embedded run-time image should include Group Policy Client Core Gptext.dll and Windows Firewall components.You can use MMC to update Group Policy on a deployed run-time image. You can also add Symantec endpoint security to the mix..

Case study of ThinClient security - breaches that has happened in the past;best practices and recommendations etc


Breaches seldom make it all the way to case studies for a good reason. In the past I have not personally witnessed a “thin client” related breach. But XP embedded is very close to XP and it is subject to similar attacks and even worse since it is not a closely monitored OS. There is a higher risk on thicker Linux and XPe distros if the end user is allowed to make any changes in the configuration. Best practice is to control all environment and disable user level access to OS settings completely. Remote exploits ( e.g. JavaScript, ActiveX vulnerabilities) will be sand-boxed if the user rights a restricted properly. I personally like terminal connection only or OS streaming models where every boot is a fresh start.


Possibility of a ThinClient turning on to be a zombie for a botnet and any other security considerations to keep in mind

It is technically possible if user has a right to modify anything and execute the changes. I would choose the thinnest model if the requirements do fit.

cheers,
- yinal

How to allow Internet access for research and protect servers at the same

Q: How do we allow Internet access for research and protect our servers at the same time? As a programmer analyst I use the Internet to do research for my work. We are looking for a way to still allow this but protect our servers where client info is held. We don't want to be constantly updating a trusted sites list with website addresses that our programmers use. Any suggestions would be greatly appreciated!

A: Hi ....,
As recommended in the previous posts, the first action is to follow a comprehensive security framework to make sure that all high level security concerns are addressed with appropriate security controls and information security governance is in place. (You can choose NIST, COBIT, ISO 27001 etc)

When the policies and procedures are addressed, on the architecture side I have several recommendations:
1- Segment your servers from research desktops. Servers have to be behind security controls like intrusion prevention, firewall, data leakage protection, database security, behavioral anomaly detection etc.
2- Secure your desktops and servers with client based firewalls, host based intrusion prevention systems, 802.1x, anti-virus, anti-malware, encryption, group policies, tripwire, application control, secure IM etc. Always secure your client data, use rights management tools, database security tools, encryption tools and audit tools on your servers where you keep client data, make sure that every security policy is enforced. Strong authentication is also recommended. Make sure that you control every output device like USB tokens, CD writers, backup tapes etc.
3- Filter your internet http/https access with anti-malware, anti-virus, instant message protection in addition to URL filtering, you can use a web based filtering service like ScanSafe or you can go with an in-house solution like BlueCoat, Websense, SecureComputing etc type of URL + AV + IM filters.. Deny outbound tunnels on external gateways. (which is a very common way for programmers to bypass filters…)
4- And for your programmers… Managing white-lists (trusted sites) is painful. Use a self-service management gateway for your URL filtering so that the users can request the sites that they want to access for limited time, and the approval process is automated. The way it works is to have a web portal where end users request for new trusted sites for research. Approval can be automatic or manual, unlimited or limited, user restricted or for all. You can integrate this portal with your internal user directory such as active directory or LDAP, so that portal can recognize each requestor without additional login

Let me know if you have any specific question about the any of the solution areas that I have briefly mentioned.
cheers,
- yinal

Type rest of the post here

Configuring VPN as leased line backup

Q:
Hi every body
Can you help me in configuring a VPN.
The setup is like this my customer has a point to point lease line as a primary link going to head office using Router 1841 , OSPF is running on this segment
, he has a ASA 5510 behind the the router , from ASA he has a ADSL modem directly connected
Now , what he wants to achieve is once the primary link (lease line) goes down , traffic start going out ffrom the ADSL link through a VPN tunnel.
Keep in mind on the Head Office he is running with Juniper Products.
Do you have any idea how it will be achieved.
I will really appreciate your quick response.



A:
Hi ...,
We deploy similar IPSEC VPNs over Internet links for high availability requirements. I call this MPLS Plan B... (In your case Leased Line Plan B :)

Here is my understanding of your setup:
Remote Office: Cisco ASA connected to Internet, Cisco 1841 connected to leased line
Headend: Juniper firewall connected to Internet, Some Cisco hardware connected to leased line
Internal Routing: OSPF


What you need is to extend dynamic routing (in your setup OSPF) to Cisco ASA and the Juniper appliances. Make sure that both ASA and the Juniper appliances participate in the OSPF. First build the IPSEC tunnel between the remote site ASA 5510 and the headend Juniper. Firewalls will route traffic to IPSEC tunnel interfaces as a by product of OSPF routing decision.

An important catch is the validation of the cost of Internet links for OSPF. Internet OSPF cost must be higher than the leased line cost, this will assure that leased line will stay as the primary link. Increase costs manually if that is not the case.

Inter-product IPSEC tunnels (in this case ASA to Juniper) can be tricky I do recommend a lab proof of concept before production cutover.

Another way of building Internet failover is to use GRE tunnels between internal Cisco hardware, so that you can bypass the Juniper headend firewall integration for routing (All you will need is a simple IPSEC VPN between ASA and the Juniper that allows GRE traffic between internal Cisco routers) . I prefer the first option.

cheers,
- yinal

End Point device security is becoming a major issue?

Q: Hi, End Point device security is becoming a major issue. Devices like IPODS, Mobile's etc. are a threat to Data Security in Organizations. Any of us are facing such challenges in their organizations?

A: Hi .....,
Here are 3 basic approaches:
1- Cut the cord – do not allow transfer of any data to mobile devices, this option assures security but it is not a mature solution on the user side. We all agree that mobile devices are business enablers
2- Control/Manage End Points – You need to manage all these end points as a part of your enterprise operation. Security on the endpoints is no more different than any other enterprise components but it is more difficult since the resources are much more limited (you cannot have 20 applications running on Nokia phones or you cannot manage iPods centrally. You can start with the following list – single client is preferred:
- Port Control (USB, CD, Floppy, Bluetooth, IR, Wi-Fi, Ethernet etc)
- Location awareness
- Encryption (file, disk, mail), key/cert management
- Firewall
- IPS
- Antivirus (http and SMTP)
- Antispam, Phishing, Malware control (http, SMTP, SMS)
- URL filtering
- Application control, and tripwire type change control
- Remote device management (in a secure manner :)
- Biometrics/TPM/SSO/802.1x support
- Easy to scale on multiplatform esp. on mobile
3- Control Data- Instead of focusing on the device level security, you may focus on data security. You can shift from the logical controls to data level security controls. If the data in the organization is classified by security requirements and protected accordingly, the devices will naturally comply with the higher plan. For the critical data I do recommend checking the enterprise rights management systems (a.k.a. DRM). Once your data is protected by enterprise rights management (ERM) or Information Rights Management (IRM) , it will be protected on the endpoint devices as well. Deploying ERM is the challenge. You may start googling with the following keywords; EMC (Authentica), Oracle (SealedMedia), IBM or Microsoft RMS or choose dedicated shops like InstaSecure Modevity or Liquid Machines. I hear a lot of activity around Liquid Machines.

Let me know if you have a specific question on the topics above,
cheers,
- yinal

How much can "fear" be used ethically in selling a computer & network security solution?

Hi ...,
I have worked on both buy and the sell sides of the enterprise security space for years.

Fear is not a wrong feeling, but lying is a wrong unethical, immoral act.

The ethics; encompassing right conduct during the information security sales cycle is not unique to information security; it is based on the same ground principles of business ethics.

A sales person should be telling the truth. FUD selling is as unethical as selling unreal hope or misusing trust. FUD is discussed more because buyer side falls into the lies easier.

Fear, is a lifesaver when it is sensed in the right time in the right amount.
Fear can be classified as an instinct instead of an emotion.

If a tire sales person tells me that my car may have a serious accident because I have old tires, and it is the truth, I may owe him my life, there is nothing wrong with the fear there.
But if the same tire sales person tells me that my car may have a serious accident because I have old tires, and whatever he tells me is an is actually an empty ungrounded sales pitch, fear is the tool of sales. It is wrong.


That is the ethics line between the evil and the good. On my personal life I only relay fear where I have fear, where I share the same concerns with the person I am talking with. Risks can only determined from facts, not hearsay or imaginary sources, so my personal fears can be far way from reality for the person I am communicating with. A disclaimer of the facts when discussing the fearful topics can be a good ethical start for the sales side.

I can give more real life examples if you need any,
Let me know if you have any questions,
Regards,
- yinal ozkan

Managed Security Services Providers and the BPO / ITO Providers

If you follow the managed security services providers (MSSP), you will notice a significant shift in the definition of outsourcing. Usually most of the MSSPs are aiming to manage the customer premises equipment with sophisticated remote management, and central log correlation tools. The manpower required to execute this operation is different from the BPO providers or even Managed Service Providers, just a handful Security Operation Centers (SOCs) and a 24x7 full escalation engineering shift is good enough to kick start an MSSP operation.

The difficulty in managing customer owned security devices derives from multiple sources, but if you exclude the technological challenges (like development, capacity, infrastructure, tools) the main roadblock for the newcomers is “Trust”

Giving up security, the keys to the kingdom is not easy, especially to an operation center that is connected via cross-oceanic fiber cable. All early players in the market played the “local” hand to gain the trust of the potential clients. In a post 9/11 world, relying on the 3rd party for all information security operation required different assurances. Large corporations chose different paths:

1- Choosing their trusted telecom company to provide managed security services instead of their core BPO partner
2- Choosing , monitor-only services from BPOs and limiting the scope to view and alert type of passive access instead of full security operation management
3- Trusting on a local specialized MSSP instead of a low-cost overseas shop

If we look at the MSSP market today, the decision tree above is very visible in the developed markets for managed services. Telecoms are eager to acquire any MSSP that can bring them the services recurring services revenue, and higher services margins. In the last 2-3 years, BT, Verizon, France Telecom NTT, KPN they all acquired some sort of managed security services providers to compete in the global market. The other global/local telecom chose to develop their own services. (e.g. AT&T, DT) Either way telecoms see MSSP market as their own managed CPE market.

On the second category, a lot of large outsourcing contracts came with security monitoring that pushed BPO providers to build impressive monitoring / log correlation operation centers. But large corporations usually kept the internal security team intact to manage the security infrastructure.

The last category of specialized MSSPs grew significantly with the demand. The interesting part is that none of the global players were from the outsourcing world Verisign, Symantec, Integralis, ISS, SecureWorks, Perimeter, RedSiren, Counterpane, NetSec, CyberTrust, Ubizen etc, none of the specialists belonged to a BPO provider. Most the specialized MSSP companies listed were acquired by the telecoms by the way.

So the question lies in “what will happen next?” Will the telecoms finally figure out the magic of delivering services, or will they prove yet another failure in investment. It is very difficult for a telecom company deliver a highly customized service, on the other hand cookie-cutter, managed router, managed MPLS type of boxed solutions do not play well in managed security services..

Of course there are alternatives like IBM acquiring ISS, Microsoft acquiring FrontBridge, Google acquiring Postini, and finally Dell acquiring SilverTech. But with the exception of IBM, in-the-cloud on-demand managed security services form a different category than the outsourcing complete operation, or the managed CPE.

I see a lot of leverage where large scale managed services shops (MSPs) to engage specialized MSSPs to build a hybrid best of both worlds model. At the end of the day it is very difficult to draw a demarcation line for managed security. If the desktops and the servers are a part of grand information security plan, an MSP should play well with the information security management provider; trusted MSSPs will also bring security credibility to MSPs. On the other hand MSSPs will be able to tap 500+ large MSP operation centers, and they will be able to deliver direct end-user security support for the first time. Segregation of duties will automatically be delivered in the meantime.

Time will show, which path will dominate the market.
On personal behalf,
- yinal ozkan

What are the business drivers that lead to Infrastructure Management Outsourcing?

Q: What are the business drivers that lead to Infrastructure Management Outsourcing? What are some of the most pressing needs/challenges that an organisation wants to overcome through IM outsourcing.
Clarification :Other than cost arbritrage, what are the primary business goals.

A: Hi …….,
I have been working on information security infrastructure management outsourcing area for a considerable time. As listed above, there are several business drivers that lead to these projects. Here is my classification:

1- Efficiency: If somebody else can manage your infrastructure in a more efficient way that your internal team, then you should consider a third party

2- Cost Cutting: Who does not like to spend less for the same deliverable? Even in the cases where the efficiency and risk levels are not better with the third party, decision is obvious when you can cut costs considerably.

3- Competitivenes: Time to market, beating your competitors, innovation capability, intraindustrial integration, financial capability, are good concepts and the good business drivers. If your infrastructure is managed by a third-party, and the third party makes you agile, it is time to outsource.

4- Risk: Risk always matters. Ignoring risk is not bliss. Covering the bases sometimes involves a professional third party. Lowering risk can be measured quickly and can be listed as business driver.

All these 4 drivers involve each other when thoroughly, but classification helps better identification.

If you have specific questions about any category related with examples, please let me know,

Regards,
- yinal ozkan