PhmMinh Thun Khoa An ton thng tin

Pham Minh Thun Khoa ATTT 1

Ti liu tham kho
Pham Minh Thun Khoa ATTT 2
Ti liu tham kho
Pham Minh Thun Khoa ATTT 3
Ti liu tham kho
Pham Minh Thun Khoa ATTT 4
Ti liu tham kho
Gio trnh Buc tuong lua
Tm hiu v tuong lua Firewall
Building Internet Firewall 2
nd
Edition
Firewalls 24Seven 2
nd
Edition
Internet Firewalls and Network Security 2
nd
Edition
Firewall Fundamentals (Cisco Press)
Linux Firewalls 3
th
Edition
Best Damn Firewall Period
www.google.com
Pham Minh Thun Khoa ATTT 5
Mc tiu v yu cu mn hc
Mc tiu
Cung cp khi nim, nguyn l co ban v buc tuong lua.
Gip hoc vin nm vung cc cng ngh, m hnh kin trc,
xy dung cc chnh sch tuong lua tu d thit lp v bao tr
tuong lua.
Yu cu
Nm vung kin thuc mang my tnh dc bit l m hnh
OSI v TCP/IP.
Pham Minh Thun Khoa ATTT 6
Ni dung mn hc
Tng quan v bc tung lua
Cc cng ngh tung lua
Cc kin trc bao v cua tung lua
Xy dng chnh sch bao mt cho mt bc
tung lua
Bao tr tung lua
Cc san phm tung lua din hnh
Pham Minh Thun Khoa ATTT 7
Chuong 1
Tng quan v Bc tung lua
Pham Minh Thun Khoa ATTT 8
Cc cu hoi d}t ra:
Tuong lua l g?
Tai sao phai su dung tuong lua?
Pham Minh Thun Khoa ATTT 9
Tng quan v bc tung la
Khi nim tung la
1
Ljch s pht trin tung la
2
Chc nng tung la
3
Cc han ch ca tung la
4
Cc sn phm tung la
5
Pham Minh Thun Khoa ATTT 10
t vn d
H thng mang thng tin pht trin manh m (nht l
mang Internet) xut hin nhu cu dam bao an ton
thng tin
S luong vu tn cng trn mang ngy cng tng,
phuong php ngy cng tinh vi, gy tn hai lon.
Su dung mt trong cc bin php phng chng huu
hiu d l buc tuong lua
Pham Minh Thun Khoa ATTT 11
1. Khi nim tung la
Tuong lua (Firewall) l h thng ngn
cch mt s vng v bao v chng truoc
cc vng cn lai
Tuong lua l nhung thit bi hoc cc h
thng kim sot traffic giua cc mang
c muc d an ton khc nhau.
Tuong lua l mot co ch d ngn cch bao v mang tin cay (trusted
network) khoi cc mang khng tin cay (untrusted network).
=> Ch : Firewall khng gn lin vi vic bao v mng truc Internet
Tuong lua nhu mt Barrier, tram kim sot o cc dim ni giua cc
vng, lm nhim vu kim tra v quyt dinh traffic mang c duoc di
qua hay khng.
Tuong lua c th l thit bi phn cung hoc phn mm
Pham Minh Thun Khoa ATTT 12
2. L[ch s pht trin tung la
1980: Xut hin cng ngh tuong lua
1988: Tuong lua loc gi tin xut hin, Jeff Mogul
(DEC) cng b 1988
1980 1990: Xut hin th h tuong lua thu 2:
Circuit Level Firewall, Dave Presotto v Howard
Trickey (AT&T Bell lab) nghin cuu
1990 - 1991: Cng ung dung xut hin. Tuong lua
thuong mai du tin cua hng DEC (Digital
Equipment Corporations) pht hnh voi tn SEAL.
Pham Minh Thun Khoa ATTT 13
2. L[ch s pht trin tung la
1992: Bob Braden v Annette DeSchon (DH Nam
California) pht trin h thng luong lua loc gi tin
th h thu tu: Visas
1994: CheckPoint Software Technologies xy dung
thnh phn mm sn sng cho su dung: Firewall-1.
Pham Minh Thun Khoa ATTT 14
Cc th h tung la
Loc gi tin xut hin ln du tin vo nm 1988
Cng vng xut hin trong giai doan 1988 1990
Cng ung dung xut hin vo nhung nm 1990 -
1991
Thanh tra trang thi xut hin vo nm 1994
Pham Minh Thun Khoa ATTT 15
3. Chc nng tung la
Chuc nng chnh cua tuong lua l diu khin, kim
sot truy nhp:
Kim sot dich vu (service control)
Kim sot huong (direction control)
Kim sot nguoi dng (user control)
Kim sot hnh vi (behaviour control)
Pham Minh Thun Khoa ATTT 16
3. Chc nng tung la
Gip trin khai gim st cc su kin an ninh mang.
Cc h thng canh bo, IDS & IPS c th trin khai
trn h thng tuong lua
Gip trin khai mt vi chuc nng trn nn tuong lua:
NAT, thng k, logs ....
Su dung trong vic trin khai mang ring ao
Pham Minh Thun Khoa ATTT 17
4. Cc han ch ca tung la
Tuong lua khng th chng lai cc tn cng vng
qua tuong lua
Tuong lua khng th chng lai cc nguy co de doa tu
bn trong
Tuong lua khng th bao v mang khoi tt ca cc
cuc tn cng c hai
Pham Minh Thun Khoa ATTT 18
5. Cc sn phm tung la
Checkpoint (CheckPoint Software Technologies)
Hng du v cng ngh tuong lua, mang ring ao
86 quc gia, 1900 di tc.
Ni ting voi cng ngh Statefull Inspection
San phm: Firewall 1, UTM-1, ...
Pham Minh Thun Khoa ATTT 19
CheckPoint Software Technologies
Pham Minh Thun Khoa ATTT 20
5. Cc sn phm tung la
Cisco
PIX (Private Internet Exchange)
H diu hnh ring
Thut ton bao mt ASA (Adaptive Security Alogrithm)
Tch hop mang ring ao
Loc URL: WebSense v N2H2
Du phng li (High Availbility)
Pham Minh Thun Khoa ATTT 21
Cisco PIX
Pham Minh Thun Khoa ATTT 22
PIX Firewall
Pham Minh Thun Khoa ATTT 23
PIX Firewall
Pham Minh Thun Khoa ATTT 24
PIX Firewall
Pham Minh Thun Khoa ATTT 25
PIX Firewall
Pham Minh Thun Khoa ATTT 26
PIX Firewall
Pham Minh Thun Khoa ATTT 27
PIX Firewall
Pham Minh Thun Khoa ATTT 28
5. Cc sn phm tung la
NetScreen
Chip ASIC (Application Specific Integrated Circuit)
Tng tc d tuong lua, vuot tri v hiu nng
Su dung b vi xu l RICS, SDRAN chay h diu hnh
ScreenOS
Pham Minh Thun Khoa ATTT 29
NetScreen
Pham Minh Thun Khoa ATTT 30
5. Cc sn phm tung la
Microsoft ISA (Internet Security Acceleration)
Giai php phn mm ung dung cho cc h thng mang
doanh nghip
Tch hop Firewall, VPN, Web proxy, caching...
Pham Minh Thun Khoa ATTT 31
Microsoft ISA
Pham Minh Thun Khoa ATTT 32