firewall query engine and firewall comparison engine mohamed gouda alex x. liu computer science...
TRANSCRIPT
Firewall Query Engine andFirewall Query Engine andFirewall Comparison EngineFirewall Comparison Engine
Mohamed GoudaMohamed Gouda
Alex X. LiuAlex X. Liu
Computer Science DepartmentComputer Science Department
The University of Texas at AustinThe University of Texas at Austin
Problem
Interplay of firewall rules in large enterprises is extremely complex.• Rules for an enterprise can number in the thousands.• Rules written by diff. people at diff. times for diff. reasons.• Enterprise may have hundreds of interconnected
firewalls.
As a result of this complexity:• Unearthing security holes and troubleshooting errors can
be difficult or impossible.• Changes in one rule can cause cascade failures and
severely impact the network.• Large enterprises have extensive, time-consuming
procedures required to implement any changes in rule sets.
Solution 1: Firewall Query Engine
Answer queries regarding firewall behavior Simulates how a rule set will operate Allows rapid and accurate troubleshooting Queries can be auto-generated using
vulnerability databases
Firewall Query Engine
Vulnerability database
Firewall rule set
Business requirements
all malicious traffic passed
all legitimate traffic blocked
Solution 2: Firewall Comparison Engine
Input into engine is 2 different rule sets • Rule set before changes• Rule set after the changes
Output is delta file that shows different results (i.e., impacts and risks of the changes)
Speed up process of change management, version control
Avoid the unintended impacts and risks of changes
FirewallComparison
Engine
Rule set before changes
Rule set after changesComplete list of impacts/risks
Technology overview
Patent applications have been filed on engines.
Algorithms are mathematically proven to provide complete and accurate results.
Both engines will be implemented with a software tool that is compatible with data structures used in the major firewalls (Cisco, Checkpoint, Juniper).
Benefits
Improves and verifies security and effectiveness of enterprise firewalls
Able to efficiently troubleshoot problems
Able to streamline approval and increase certainty when implementing changes in firewall rules
Features
Accurate simulation of operation of rule set Accurate comparison of different rule sets These engines can be used to solve many
other firewall management problems:• Troubleshooting over hundreds of
interconnected firewalls: “Which part of the network can be attacked by slammer worms?” “Who blocked communication between server A and B?”
• Continuous monitoring of firewalls• Security risk assessment: “How secure is my
network?”
Performance of Firewall Query Engine
Performance of Firewall Comparison Engine
Technology differentiation
Engines are first in literature Applies formal methods to known network
security problems
Availability
Prototype software has been developed and tested on over 3,000 rules (in simulation).
Commercial implementation will require user interface and data integration with existing firewall products.
Solution 3: Firewall Generation Engine
Firewall Generation Engine• Automatically generates rules that are error-
free and compact
• Uses decision tree data structure for inputs
• User input only requires answering yes/no questions
• Vastly simplifies updating rule set
Solution 4: Firewall Cleaning Engine
Firewall Cleaning Engine• Eliminates redundant rules• Can improve network latency
FirewallCleaningEngine
Rule setEquivalent rule setwith no redundant rules
Case study
To validate the effectiveness of our design methods:• Took a real-life firewall (of 87 rules) and
redesigned it using the structured firewall design method
• Compared the two firewalls, and found 84 discrepancies
• Discussed these discrepancies with the firewall administrator
• He confirmed: In 82 discrepancies, his decisions were wrong.
Case study (continued)
Out of the 82 discrepancies in his version:• 72 were caused by incorrect ordering of
rules.
• 10 were caused by missing rules.
The two discrepancies where our decisions are wrong were caused by wrong assumption of the requirements.