Context Aware Firewall Policies Ravi Sahita Priya Rajagopal

Context Aware Firewall Policies Ravi Sahita Priya Rajagopal, Pankaj Parmar Intel Corp. June 8 th 2004 IEEE Policy (Security) ®

Overview Background Motivation Policy goals (example) Intrusion detection->Host<-firewalling Management SAFire Milestone conclusions 2 Communications Technology Lab

Background Why firewall? Defense in depth against software flaws (software complexity increasing) Control over services accessed/exposed Control over information flow across boundaries (platform or network) Needed: Increased proactive response instead of reactive 3 Communications Technology Lab

Policy goals (example) Track flow only if the session is initiated by client By default, restrict all traffic other than allowed services control traffic Create transient filters for the negotiated data flows On the negotiated port, restrict access to specific allowed commands/capabilities for that service When transferring data, block/flag suspicious content (so that it is checked) before it reaches apps All traffic that causes invalid protocol state transitions must be blocked proactively 4 Communications Technology Lab

Advantages of host based FWs Visibility into internal traffic – Can protect against internal attacks Smaller number of flows, More state per flow – Decreased load on aggregation points Enable finer access control in a mobile environment – Carry your security Can use end-to-end protocol properties Allow true end-to-end encryption of traffic which would otherwise be proxied by the network devices 5 Communications Technology Lab

IDS -> Host <- FW 6 Communications Technology Lab

Complex management Infrastructure firewalls are needed Host FWs=>number explosion, but valuable Make security policies easier to map without sacrificing functionality Make components tend towards autonomous behavior Make it easier to correlate events across hosts and infrastructure 7 Communications Technology Lab

Why SAFire? What are the sub-elements of such packet analysis Allow building finer grain network access control policies Rich enough to keep up with new network services/changes Local remediation Abstraction of FW / IDS rules for a host 8 Communications Technology Lab

Capabilities identified Application layer rules Pattern manipulation Outsourcing policy decisions Reuse of definitions Dynamic rule management 9 |-----HOST CONTEXT----| Packet data extraction and filtering Flow state table management Communications Technology Lab

Sequence of steps Express application protocol in a DFA Map protocol states to the Generic PSM Extract transition rules from the normalized PSM naming <src, event, dst, action> Map to SAFire primitives (using tools) 10 Communications Technology Lab

Generic Protocol States Mapped to protocol specifics 11 Communications Technology Lab

Rule processing 12 Communications Technology Lab

Implementation 13 Communications Technology Lab

Conclusions United model can comprehend HIPS+FWs Language extensibility = parallel progress Model allows security policy verification across implementations Minimal tradeoff is processing overhead for mapping and translation Context information on the host can be leveraged for finer access control Initial prototype shows minimal delay from user POV Communications Technology 14 Lab

Thank you! Questions/Comments to ravi. sahita@intel. com 15 Communications Technology Lab