FIREWALL
A firewall is a network device that works on the 3rd and 4th OSI Layers, namely Network and Transmission layers, positioned between the local network and the internet in order to prevent attacks that may come from the internet, and configured with certain rule sets to protect systems and users from cyber attacks. It acts as a barrier against all possible threats. It controls all incoming and outgoing network traffic and allows it to pass through certain filters. It is frequently preferred in corporate network structures due to its ability to prevent threats with written rule sets. It decides whether the packets coming to it or passing over it will be forwarded to the places they need to reach depending on the routes written in the network. These decisions include information such as from which source, which port, and which application the packet to be transmitted will be delivered, as well as information such as which destination, which port, which application will be delivered, and apply to approval or block to the packet transit. Basically, the firewall structure includes capabilities such as IP filtering, port filtering, web filtering, content filtering, application filtering, and virus signature-based filtering.
The firewall rule set works with white list logic. Network access is allowed by creating a sort of whitelist of services, ports, and actions to be taken. All activities outside this list are blocked and access is restricted, thus providing a high level of protection.
Firewall systems are divided into hardware or software based in terms of their physical structure. Software-based Firewall applications are usually installed on operating systems on clients or servers. Hardware-based firewalls are systems that run on particular hardware. Today, this structure is developed and offered as a complex and modular service of the technology to be used. In addition, Firewall devices, which are physically located in many organizations, can also serve over the cloud today. In addition to this, it works in a way that can work with SDN architecture, where decisions and rules are made by the central controller, and end devices work with the same rule sets and transmit all log outputs obtained from traffic to the main controller, allowing management and control from a single point.
In terms of working structure, firewalls are divided into two Stateful and Stateless. Stateful means stateful, and Stateless means stateless.
- Stateful Firewall, which is stateful, always checks the network connection and adds the current traffic status and packet flow to the status table. State table entries are created for TCP streams or UDP datagrams that are allowed to communicate through the firewall according to the configured rulesets. This is because TCP is initially stateful.
Using the source and destination address, port number, and IP flags, TCP keeps track of active connections on the network until the current session ends. Depending on the usage period of the application used, if no packets are seen in traffic for a certain period of time, the session is terminated and the TCP connection is removed from the state table. Thus, it always follows the process of the last stop instantly and has live information. The monitoring of this instant information flow is associated with the 3-way-handshake used on TCP. The connection is established (SYN), at the point where the firewall checks the packets from both sides, the connection is received by the server and a connection is made (SYN+ACK). Finally, the firewall has information about the completion of the current state and sends a restart message (FIN+ACK) to the server to log off. All incoming packets after logout are rejected and dropped off the line.
Stateful firewalls are also capable of detecting fake messages or unauthorized access. It has strong memory usage to protect network connections and sessions thanks to the 3-way-handshake it performs. It can make future filtering decisions based on the results it receives and records instantly. For these reasons, the system must be updated to the stable version in order to keep it constantly up-to-date and to have up-to-date signatures.
- A stateless Firewall is also known as ACL (Access Control List) in its simplest form. It does not store any information about the connection statuses in the network in its memory, and it only takes action on the application of the rules between the statically entered source and the destination. This state, when a packet is sent by the sender when packets passing through a firewall are filtered, checks for a match with any of the ACL rules configured in the firewall, and then in the action taken forwards the packet from the source to the destination or rejects the transmission according to the configured rules. They work very fast even in heavy packet traffic because they have fewer inspection and interpretation capabilities. In addition, it is more cost-effective. However, it takes more time to prevent attacks and manage network traffic because it is necessary to statically add more rules and details.
Cyber attacks have also developed day by day and have allowed the use of different attack types and vulnerabilities on applications with the development of technology. Attackers trying to bypass firewalls can attack by placing malicious redirects or requests within seemingly safe resources and creating a vulnerability for traffic passing through the Firewall. For this reason, the Firewall structure has evolved to protect against attacks over time and has led to the emergence of more than one different type. Firewall types, which develop depending on the manufacturers, can provide modular services through a different product or additional license. These species are;
- Next-Generation Firewall: It provides antivirus protection along with the inspectability of encrypted packets within the network. However, the most important feature of this system is its ability to perform deep packet inspection (DPI). Thanks to deep packet inspection, it is skeptical of even requests from secure sources and in-depth analysis of packet header and raw data content. Thus, integrated security systems (DLP, IPS, IDS, Content Filtering, AV Control) are gathered under a single roof, providing more efficient protection.
- Network Address Translation (NAT) Firewall: It keeps the local IP addresses confidential by connecting different network addresses of local users to the network via a single IP address. At the same time, by using a virtual IP address, it can make NAT by directing local users to this address and using this address as a gateway.
- Stateful Multilayer Inspection Firewall: It has multiple layers and multiple inspection mechanisms. It has the ability to examine and compare data packets in both the network layer and the application layer. The primary goal is to make sure the source is secure as layer-by-layer filtering is applied.
- Domain Name Server (DNS) Firewall: DNS protocol is the heart of all internet services. All internet traffic, whether TCP, UDP, SSL, or unencrypted, uses DNS. DNS Firewall is a cloud-based firewall solution that provides effective protection based on the defined rule set by resolving DNS traffic. DNS queries and resolutions are logged and examined on the Firewall. In this way, malicious software is prevented from spreading through DNS services. In addition, all redirects defined as Destination IP 0.0.0.0 are forwarded to the DNS query before forwarding, allowing access if the access point is included in a secure category.
- Unified Threat Management (UTM) Firewall: UTM Firewall has IDS and IPS features. Flexible web filtering can be done for social media and unwanted application categories, specific to a certain time interval or user group, and potentially harmful threats can be blocked beforehand. It is often preferred in open-access areas such as shopping malls or restaurants.
PROXY
Proxy is used to direct user access at points where personal data is valuable and to prevent the capture of information required for cyber attacks at the last layer. It blocks data leaks, spoofs, ad scams, and threats with different negative consequences.
It is a network security tool that allows passing through another intermediary channel to the address desired to be accessed on the internet from within the local network. It prevents the visited addresses from being recorded by the address owner. It can also be ensured that users are directed to a secure page by preventing them from going to addresses with certain categories. For this reason, it is defined as a proxy or proxy server used in the application layer and providing end-user security.
It acts as a transparent communication channel between the user and the internet. Users first forward the requests to the Proxy, and the Proxy sends the incoming requests to the destination on the internet. Packet returns are also first forwarded to the proxy by the internet. The proxy that receives the packet delivers the data packet to the relevant user. Thus, using a proxy, blocked websites can be accessed, bandwidth is saved, confidential documentation is difficult to obtain, and faster and safer internet access is provided.
WEB APPLICATION FIREWALL – WAF
WAF is a network security tool that monitors, filters, and blocks incoming and outgoing data packets from applications or websites running on the web. It protects websites and applications running on WAF from attacks by creating a barrier between a website server and the user’s requests. It runs on the Application Layer, which is Layer 7 of the OSI layers. Thus, it performs detailed packet inspection on HTTP/HTTPS/SOAP/XML protocols and prevents malicious software from accessing the network. When the working structure is examined, it can be considered as a reverse proxy positioned on the application.
In order to prevent any threat that may occur in the services running on the web, the data traffic of these services is provided to pass over the WAF before the server access. Thus, many types of attacks can be prevented, including SQL injection attacks, XSS or XML attacks, JSON vulnerabilities, file upload attack methods, or DDoS attacks that cause interruptions by exceeding the band and storage capacities of web services, usually by using bot machines. WAF also scans networks for unusual HTTP requests and blocks potential threats. Thus, malicious software is detected in advance and the access of the relevant addresses to the server is prevented.
As the data traffic of the website or application increases, the interest in it and the possibility of cyber-attacks increase. Considering that websites have user data today, it has a very important place to protect users’ data, provide uninterrupted service to users, to save cost and time. It can provide hardware-based, software-based, or cloud-based services. It is possible to perform similar scanning, recognition and blocking with the IPS service in the application layer of NGFW devices, but it only provides protection against known attacks and vulnerabilities. WAF, on the other hand, can detect a previously unknown threat situation by inspecting the application’s software.
ANALYTICS
Factors such as malware, rapid developments in cyber threats, and the long time-consuming manual log analysis have increased the need for technologies that perform security analysis in order to take quick action. Thus, network analytics products as a service have emerged that provide the process of collecting information about the data flow in traffic by examining raw data in real-time, correlating this information, generating simultaneous alarms, and ultimately applying advanced techniques to produce an actionable security result. The specified operations can be performed with simple comments and observations with the network monitor application, as well as with applications such as Wireshark that collects a pcap data, which is formed by collecting all raw data, and performs uninterpreted analysis and examination. Today, many services include analytical analysis, machine learning, and data interpretation. Thus, it is possible to obtain information about the cause of any interruption in data traffic, any weakness, or a possible threat, and thus, it is possible to easily produce a solution. At this point, more than one analysis method can be used, for example, semantic relationship and forensic criminal investigation can be done in order to analyze the source and content of the web pages to be accessed. Analytical servers, on the other hand, collect and interpret all this information, making it easier to prevent attacks in the light of the reports it gives.
SECURE MAIL GATEWAY
It is a device that provides network security on e-mail by providing services such as real-time antispam and antivirus protection, advanced content filtering, and data loss prevention in incoming and outgoing e-mail traffic. Its management, use, and control are quite simple due to its working structure. There are two different components in the working structure, the control center, and the scanner. The traffic passes through the browser server and is checked by the browser component to detect redirects, links, spam, or e-mails with fake IDs that pose a risk or appear as a threat. Rules and specific filters to be applied to threats caught through the control center can be decided. In this way, e-mails identified as threats are not forwarded to the target users, the mail server loses its importance and the entire control mechanism is created on SMG. Thanks to machine learning, even if there is no threat element in the incoming mail structures, it can be risky, performs a second scan for the mail, examines the current known vulnerabilities and signatures and interprets the current situation for unknown vulnerabilities. Thanks to the LDAP integration, the user response in the incoming emails can be verified. Thanks to SMG, if the e-mail is not secure, it is blocked and not delivered to the recipient. All these processes are performed in the background without the need for any action from the receiver.
DATA LOSS PREVENTION – DLP
The DLP product or service is used to prevent data loss as a result of a threat or malware that may be encountered on the network. It provides visibility of risky business processes by minimizing the risk of information loss. It provides convenience to network administrators at many points such as restricting unauthorized access to data, storing and classifying data correctly, and determining access authorizations. Thus, unwanted data output from the systems used can be prevented or the usage status of the defined information and documents can be monitored. The criticality level of these documents can be determined by specifying certain keywords for DLP. As a result of the threats discovered or encountered by the system, it generates a report on stages such as incident, incident response, forensic analysis, and the latest status of the data. It works like a kind of unique fingerprint copying system in terms of its working structure. It detects, extracts, analyzes threats and takes backups so that data is not lost in the meantime. It can take the initiative to lose data of very low importance. The continuous increase in the backup file size triggers an increase in the load on the system and may cause potential problems. Thus, with the DLP service, both the network and the clients are technically under control.
SECURITY INFORMATION EVENT MANAGEMENT – SIEM
SIEM is security software that collects all daily event data generated by servers, network devices, and firewalls that are actively involved in the network. It works simultaneously within the network and enables the network management team to take a proactive role. It is used as a central system to monitor and analyze all events in the threat detection, risk prevention, and communication infrastructure, to make them meaningful after the detection of the identified problems and to show warnings based on analysis, and to report these records to the network administrator. This data is also known as Syslog.
In the event logs, all events, errors, information messages, and warnings belonging to the system or users working on the network are a breakdown and are recorded on a daily basis. For example, logs could include anything, including failed logins, malware activities, or a successful SNMP notification. It collects log records over the systems using certain protocols and provides access to end information by using agents on endpoints. Some SIEM products use interfaces called Collectors for log collection. Depending on the collector structure, its function may vary. In some cases, the Collector is only responsible for transferring the incoming raw log to the SIEM system, while in some cases it is necessary to parse, enrich, and parse, etc. the incoming log. After processing, it sends it to SIEM. Thus, the volume of transmitted and stored information is reduced and the efficiency of the content is increased.
Threats are difficult to isolate, but distinguishable from each other, as all movements are recorded regardless of the state of action. Thus, it becomes easier to take action regarding a detected abnormal situation and to prevent a possible threat, which makes it easier to take precautions before damaging the systems. In addition, it allows automation of the network structure by integrating with different technologies and services.
SIEM can use correlation engines by making associations on the logs it collects, as well as making an analysis based on pre-created rules. SIEM has no protective function for networks or systems. Filters, expressions, and syntax are standard in SIEM products. Thus, correlation rules are easy to write. It is possible to write different analyses, different queries or filters as long as the logic of the rules does not interfere with each other.
INDICATOR OF COMPROMISE – IOC
IoC is a service that works with the logic of filing on systems and is used to recognize and better analyze potential threats within the network. It is designed to detect attacks at an early stage and limit their damage. It can also be expressed as evidence of a security breach that indicates inconsistencies or unusual events in the network. The concrete evidence collected can reveal not only how an attack took place, but also what tools were used in the attack and information about the source of these attacks. For this reason, IoC is used to better examine and analyze the techniques and behavior of malware.
Apart from standard security services, it also excels on metadata that is difficult to detect, or samples of malware, code, or content that are incredibly complexly written. For this reason, when analyzing a potential threat, various IoC data are determined, brought together, and analyzed. Examples of attack types for this situation are DDoS attack, DNS attack, exploit attack, login attack, web application, and malicious attack, etc. it could be. Thus, a proactive approach to attack detection ensures that security events or threats are discovered as simultaneously as possible.
A suspicious event detected on the network in IoC analysis is recorded and analyzed after the packet flow. Inspection can be provided through a single source or a specific attack type. The traces left by the attacking source during the investigations are a clue for analysis. Thus, the IoC allows prioritization of data transmission from certain sources as it enables attack analysis and pre-recognition of the attack. In this case, the point that the network or security manager should focus on during the attack becomes clear. Unfortunately, however, the IoC is reactive in nature, so if it finds a clue about a threat, it’s sure to be compromised already.
VIRTUAL AIR GAP – VAG
In current technology, where cyber attacks or threats are inevitable, no security solution can guarantee absolute trust. It provides secure information exchange between networks with different security levels in order to perform critical transactions. Thus, institutions working with critical or confidential data prefer to create a separate network for their systems that will communicate with the global network over the internet and keep the critical data in a closed network so that it does not go out to the internet. Thus, an isolated local area is created and only important data is created within the institution and used in this area. At the same time, separating two traffic from each other relieves bandwidth and creates a usage area. The most common solution used to protect sensitive or classified information from leakage or manipulation is to physically create two separate networks and create a structure by disconnecting the networks from each other. However, there are cases where data needs to be transferred to or from the protected network for exceptions.
VAG, with its Turkish name Virtual Air Gap, is similar to a data diode in terms of its working structure. Just like a diode, which is an electronic component, it is a traffic passer that works unidirectionally and in certain situations. The specific protocol to be passed between the external network that provides access to the Internet and the isolated internal network that contains sensitive data allows the application or data to be passed in one direction only. It provides permeability just like a flat cable without any routing between the two specified networks. In terms of hardware features, it enforces physical unidirectionality and emulates protocol servers to handle two-way communication by virtually replicating databases. Since it is only physically capable of sending data in one direction, it creates a physical barrier or “air gap” between two points. Thus, while there is no outside-to-in connection, it allows data to flow out with almost no delay. Data Diodes can now also be configured to transfer multiple protocols and data types simultaneously, just like a virtual air gap, if desired.
VAG, on the other hand, allows two-way traffic to be created by selecting only the specified protocols in this one-way communication. For example, applications of the HTTPS protocol can access from the inside to the outside, while the SFTP protocol is passed from the outside to the inside so that only the sensor data can be accessed. Traffic that does not comply with any of the specified applications, rules, or protocols will not be passed between the two networks. The protocols and applications that create the traffic permeability on these products are limited. Since the product can pass two-way traffic, manufacturers aim to prevent hardware vulnerabilities by meeting the minimum requirement while producing the device. Since the working structure of the system is not basically software-based, there is no software-based security vulnerability and hardware-based security provides trust in communication. Communication is not carried out using IP addresses, communication between disks is encrypted, signed, and certified.
Thanks to the fiber optic communication that provides the physical connection on the VAG, the data transfer rate is kept at the highest possible level, and this is primarily preferred for real-time applications because it is both secure and fast.
Instead of using separate physical machines, virtual airspace uses a single physical machine to provide the same high level of security. Data traffic comes from the inside to the outside and the data is written to the internal server of the air gap. If the data coming to the internal server meets the specified application or protocol conditions, it is written to the external server disk by hashing with strong algorithms and using the relevant signatures. The hash key is opened and the data is read. Similarly, with VAG, the transfer can be made from the external server to the internal server, while in network diodes, this communication is only one-way.
