Principles of Information Security: Firewalls, IDS/IPS, and Network Segmentation

Firewalls, IDS/IPS, and Network Segmentation

Firewalls, IDS/IPS, and Network Segmentation – Exam-Ready Study Guide

What This Is

Firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), and network segmentation are the first line of defense in network security. They control traffic flow, detect malicious activity, and limit lateral movement during breaches. A real-world example: The 2017 Equifax breach (147M records exposed) occurred because an unpatched web application firewall (WAF) allowed attackers to exploit a known vulnerability (CVE-2017-5638). Without proper segmentation, attackers moved freely across Equifax’s network, exfiltrating sensitive data. These controls are critical for defense-in-depth, compliance (PCI DSS, NIST SP 800-53), and preventing ransomware spread.

Key Terms & Concepts

• Firewall: A network security device (hardware/software) that monitors and filters inbound/outbound traffic based on predefined rules (e.g., Cisco ASA, pfSense, Windows Firewall). Operates at Layers 3 (Network) and 4 (Transport) (OSI model).
• Stateful Firewall: Tracks active connections (e.g., TCP handshake) and allows return traffic automatically (e.g., "allow established/related").
• Stateless Firewall: Filters packets based on static rules (e.g., "block all ICMP") without tracking sessions.
• Next-Gen Firewall (NGFW): Combines traditional firewall features with deep packet inspection (DPI), application awareness (e.g., block Facebook), and intrusion prevention (IPS) (e.g., Palo Alto, FortiGate).

• Web Application Firewall (WAF): Protects web apps (Layer 7) from attacks like SQLi, XSS, and CSRF (e.g., ModSecurity, Cloudflare WAF). Required for PCI DSS compliance.

• IDS (Intrusion Detection System): Monitors network traffic for suspicious activity and alerts security teams (e.g., Snort, Suricata, Zeek). Passive—does not block attacks.

• Signature-Based IDS: Matches traffic against known attack patterns (e.g., "alert tcp any any -> any 80 (content:'/etc/passwd';)").
• Anomaly-Based IDS: Uses baselines (e.g., "normal traffic = 100 Mbps") to detect deviations (e.g., sudden 1 Gbps spike = DDoS).
• NIDS (Network IDS): Deployed at network choke points (e.g., near the firewall).

• HIDS (Host IDS): Installed on endpoints (e.g., OSSEC, Tripwire) to monitor file integrity and logs.

• IPS (Intrusion Prevention System): Like IDS but actively blocks malicious traffic (e.g., drops packets, resets connections). Inline—traffic must pass through it.

• False Positive: Legitimate traffic flagged as malicious (e.g., a security scan blocked as an attack).

• False Negative: Malicious traffic missed (e.g., a zero-day exploit bypasses IPS).

• Network Segmentation: Dividing a network into isolated subnets to limit lateral movement (e.g., separating HR, Finance, and IoT devices).

• VLAN (Virtual LAN): Logical segmentation at Layer 2 (e.g., VLAN 10 for HR, VLAN 20 for Finance).
• Microsegmentation: Fine-grained segmentation (e.g., isolating each server in a data center using software-defined networking (SDN) like VMware NSX).
• DMZ (Demilitarized Zone): A semi-trusted network segment for public-facing services (e.g., web servers, email gateways) to isolate them from the internal network.

• Zero Trust: "Never trust, always verify"—assumes breach and enforces least privilege (e.g., Google’s BeyondCorp).

• ACL (Access Control List): A set of rules defining permitted/denied traffic (e.g., "allow TCP 443 from 10.0.0.0/24 to 192.168.1.100").

• Implicit Deny: Traffic not explicitly allowed is blocked by default (critical for security!).

• NAT (Network Address Translation): Translates private IPs (e.g., 192.168.1.1) to public IPs (e.g., 203.0.113.5) to hide internal network structure.

• SNAT (Source NAT): Used for outbound traffic (e.g., internal users accessing the internet).

• DNAT (Destination NAT): Used for inbound traffic (e.g., port forwarding to a web server).

• VPN (Virtual Private Network): Encrypts traffic between remote users and the corporate network (e.g., OpenVPN, IPSec, WireGuard).

• Split Tunneling: Allows users to access the internet directly (not through VPN), reducing bandwidth but increasing risk.

• Proxy Server: Acts as an intermediary for requests (e.g., filtering web content, caching, anonymizing traffic). Forward Proxy (client-side) vs. Reverse Proxy (server-side, e.g., Nginx, Cloudflare).

• Transparent Proxy: Users unaware of its presence (e.g., corporate content filtering).

• Non-Transparent Proxy: Requires manual configuration (e.g., browser settings).

• SIEM (Security Information and Event Management): Aggregates logs from firewalls, IDS/IPS, and endpoints to detect threats (e.g., Splunk, IBM QRadar, ELK Stack).

• Correlation Rules: "If firewall blocks 10 failed SSH attempts + IDS alerts on brute force = trigger high-severity alert."

Step-by-Step / Process Flow

1. Deploying a Firewall (NGFW Example)

Goal: Secure a corporate network with internet access, a DMZ, and internal segments.
1. Define Security Zones:
- Untrusted (Internet) → DMZ (Web/Email Servers) → Trusted (Internal Network).
- Use VLANs (e.g., VLAN 100 for DMZ, VLAN 200 for internal).
2. Write Firewall Rules (Least Privilege):
- DMZ Rules:
- Allow TCP 80/443 from Internet → DMZ Web Server.
- Allow TCP 25 (SMTP) from DMZ Email Server → Internet.
- Deny all other inbound traffic to DMZ.
- Internal Rules:
- Allow TCP 3389 (RDP) from IT VLAN → Server VLAN (with MFA).
- Allow TCP 443 from Internal → Internet (for updates).
- Block all inbound traffic from DMZ to Internal.
3. Enable Logging & Alerts:
- Log denied connections (e.g., "Blocked TCP 22 from 1.2.3.4").
- Set alerts for port scans (e.g., 10+ connection attempts in 1 minute).
4. Test Rules:
- Use nmap to scan from an external IP: nmap -Pn -p 1-1000 <firewall-IP>.
- Verify only allowed ports (e.g., 80/443) respond.
5. Enable IPS (Inline Mode):
- Deploy Snort/Suricata or NGFW IPS (e.g., Palo Alto Threat Prevention).
- Test with Metasploit: msfconsole > use exploit/multi/http/apache_mod_cgi_bash_env_exec.

2. Configuring IDS/IPS (Snort Example)

1. Install Snort (or Suricata) on a Linux server with two NICs (one for monitoring, one for management).
2. Download Rules:
3. Free rules: Snort Community Rules.
4. Paid rules: Emerging Threats (ET) or Talos.
5. Configure snort.conf:
6. Set HOME_NET (e.g., 192.168.1.0/24).
7. Set EXTERNAL_NET (e.g., !$HOME_NET).
8. Enable preprocessors (e.g., frag3, stream5 for TCP reassembly).
9. Test Rules:
10. Run in IDS mode: snort -A console -q -c /etc/snort/snort.conf -i eth0.
11. Trigger an alert: curl http://testmyids.com (should generate an "ET POLICY Suspicious User-Agent").
12. Deploy IPS (Inline Mode):
13. Use AF_PACKET or NFQUEUE to block traffic.
14. Example rule to block SQLi: drop tcp any any -> $HOME_NET 80 (msg:"SQL Injection Attempt"; content:"' OR 1=1"; sid:1000001; rev:1;)

3. Implementing Network Segmentation

1. Map the Network:
2. Identify critical assets (e.g., databases, domain controllers).
3. Group by function (e.g., HR, Finance, IoT, Guest Wi-Fi).
4. Design Segments:
5. VLANs: Assign subnets (e.g., HR = 10.1.1.0/24, Finance = 10.1.2.0/24).
6. Firewall Rules: Enforce deny-by-default between segments.
   • Example: Block SMB (TCP 445) between HR and Finance.
7. Deploy Microsegmentation (Advanced):
8. Use VMware NSX or Cisco ACI to isolate individual VMs/containers.
9. Example: Only allow MySQL (TCP 3306) from App Server → Database Server.
10. Monitor & Enforce:
11. Use SIEM to detect unauthorized lateral movement (e.g., HR user accessing Finance servers).
12. Enable 802.1X for port-based authentication (prevents rogue devices).

Common Mistakes

Certification Exam Tips

CISSP (Management Perspective)

• Focus on concepts, not configs: Know the difference between stateful vs. stateless firewalls, but don’t memorize CLI commands.
• Risk management: Expect questions like:
• "Which firewall rule change reduces risk the most?" → Removing "allow any any" rules.
• "What’s the primary benefit of network segmentation?" → Limiting lateral movement.
• Compliance: Know which standards require firewalls (e.g., PCI DSS Requirement 1, NIST SP 800-41).

Security+ (Technical Perspective)

• Port numbers: Memorize common ports (e.g., TCP 22 = SSH, TCP 3389 = RDP).
• IDS vs. IPS: Know that IDS is passive (alerts only), while IPS is active (blocks).
• Tricky question: "Which device operates at Layer 7?" → WAF or NGFW (with DPI).

CEH (Attacker Perspective)

• Bypassing firewalls: Know techniques like:
• Port knocking (sequential port access to trigger a rule).
• DNS tunneling (exfiltrating data over DNS queries).
• Fragmentation attacks (splitting malicious payloads to evade IDS).
• Evasion: "How would you bypass a signature-based IDS?" → Polymorphic malware, encryption, or slow scans.

Quick Check Questions

1. A security analyst notices repeated failed SSH login attempts from an external IP. Which of the following is the BEST immediate action?

A) Block the IP at the firewall.
B) Disable SSH on the server.
C) Enable rate-limiting on the SSH port.
D) Deploy an IPS in inline mode to block the attacks.

✅ Correct Answer: A
Explanation: Blocking the IP at the firewall is the fastest and most effective way to stop the attack. Disabling SSH (B) is too disruptive, rate-limiting (C) may not stop the attack, and deploying an IPS (D) is a longer-term solution.

2. An organization wants to isolate its IoT devices from the corporate network. Which of the following provides the STRONGEST segmentation?

A) Placing IoT devices on a separate VLAN.
B) Using a stateful firewall to block all traffic to/from IoT devices.
C) Deploying a DMZ for IoT devices.
D) Implementing microsegmentation with host-based firewalls.

✅ Correct Answer: D
Explanation: Microsegmentation (e.g., VMware NSX, host-based firewalls) provides per-device isolation, which is stronger than VLANs (A) or DMZs (C). A stateful firewall (B) alone doesn’t segment within the network.

3. During a penetration test, an attacker exploits a web app vulnerability to gain a shell on a server in the DMZ. What is the MOST likely next step for the attacker to move laterally?

A) Exploit a misconfigured firewall rule allowing DMZ → Internal traffic.
B) Use ARP spoofing to intercept traffic between the DMZ and internal network.
C) Brute-force the domain controller from the DMZ server.
D) Deploy a reverse proxy to pivot into the internal network.

✅ Correct Answer: A
Explanation: The most common lateral movement path is exploiting misconfigured firewall rules (e.g., "allow DMZ → Internal on TCP 3389"). ARP spoofing (B) is Layer 2 and less likely in a segmented network. Brute-forcing (C) is noisy, and reverse proxies (D) are not typical for lateral movement.

Last-Minute Cram Sheet

1. Firewall Types:
2. Stateless: Filters packets individually (no session tracking).
3. Stateful: Tracks connections (e.g., allows return traffic).
4. NGFW: Layer 7 inspection, IPS, application control.

5. WAF: Protects web apps (Layer 7), blocks SQLi/XSS.

6. IDS vs. IPS:

7. IDS: Passive, alerts only (e.g., Snort in alert mode).

8. IPS: Active, blocks traffic (e.g., Snort in inline mode).

9. Network Segmentation:

10. VLAN: Layer 2 segmentation (can be bypassed).
11. Firewall Rules: Layer 3 segmentation (required for security).

12. Microsegmentation: Per-device isolation (e.g., VMware NSX).

13. Key Ports:

14. TCP 22: SSH
15. TCP 25: SMTP
16. TCP 80/443: HTTP/HTTPS
17. TCP 3389: RDP

18. UDP 53: DNS

19. NAT Types:

20. SNAT: Source NAT (outbound traffic).

21. DNAT: Destination NAT (port forwarding).

22. Zero Trust Principle: "Never trust, always verify" – least privilege, microsegmentation, MFA.

23. ⚠️ Common Exam Trap: "Firewalls operate at Layer 3 only" → False! NGFWs/WAFs operate at Layer 7.

24. Implicit Deny: The last firewall rule should always be "deny any any".

25. False Positives vs. False Negatives:

26. False Positive: Legitimate traffic blocked.

27. False Negative: Malicious traffic allowed.

28. PCI DSS Requirement 1: Install and maintain a firewall to protect cardholder data.