The misconception a network is secure because a perimeter firewall is in place is quickly disturbed when management see how easily external intruders can get onto their company systems - a demonstration frequently takes less than 1 minute!
Management is thankful for the awareness they extract from the points below:
 |
Scan network to find open ports at a perimeter firewall (less than 30 seconds) |
 |
Access login prompt of primary business server (less than 10 seconds) |
 |
Hackers estimated time to breach system (milliseconds to weeks - only a question of time) |
Think of a firewall as the front wall to your office. However, instead of just one door (i.e. they are called firewall ports), it contains a number of doors that can be opened for access to an array of different rooms (i.e. each room representing email, files or applications).
The main purpose of a firewall is to prevent unauthorized access between networks. Generally this means protecting an organization's inner network from the Internet.
There's a lot of technical jargon surrounding today’s firewall which makes life even harder for the average business person to understand the function and risks involved - but we can help explain.
Imagine someone driving past your office to check which doors are open - that's called port scanning. Hackers can scan your perimeter firewall to check which ports (doors) are open. Many companies think they can eliminate this risk by implementing port scan prevention services in their perimeter firewall - this is a "smoke and mirror" response back to the hacker to suggest the doors (i.e. ports) are shut. Hackers can ignore this defensive measure and still walk right through the door which they know is still open.
If your organization needs to provide online access to network services (e.g. emails, applications, files, business reports) for remote users over the Internet, it must have ports open in the perimeter firewall. In other words, you must open doors in your office if you want to allow your staff, customers and suppliers to come in off the street (i.e. a volatile network like the Internet) to communicate, collaborate and exchange information.
Port scanning is just the start of the hacking process. There's a variety of weaknesses associated with most small to medium enterprise (SME) firewalls which cause a number of problems including:
| Problem #1: Extreme Difficulty to Authenticate |
| |
Many firewalls are stateless devices without authentication services.
In other words, it’s like security guards standing at each of your doors without a guest list. The guards cannot distinguish staff, customers, suppliers or hackers. |
 |
|
|
|
|
|
| Problem #2: Inadequate Inspection |
| |
'Stateful Packet Inspection' is like having a security guard manning one of your office doors and only allowing delivery personnel to enter - everyone else is rejected.
Technically speaking, 'Stateful Packet Inspection' strives to allow specific packets matching a known connection state to enter the network through a given port (door) in the firewall. It also proves useful as a means to try and disguise open ports throughout the port scanning process.
The problem is 'Stateful Packet Inspection' has great difficulty handling encrypted payloads. In other words, imagine a disguised delivery person entering your building with a sealed bag which could not be opened for inspection at the door.
Instead of rejecting the delivery person or at least asking them to leave their bag outside, your security guard thinks the bag looks okay and lets them enter through your door. No one knows, other than the delivery person, whether the bag is full of goodies or nasties. |
| |
|
|
|
| |
Easier to inspect a bag (i.e. packet payload)
that's freely accessible (i.e. unencrypted) |
|
Very difficult to inspect a bag (i.e. packet
payload) that is locked (i.e. encrypted) |
| Problem #3: Direct Exposure of Business Systems |
| |
Current common problem - "Step right through the firewall door and straight into the inner heart of your business".
One of the most concerning issues is the frequent practice where ports (doors) are opened in the perimeter firewall and directly link to primary business computers residing on your trusted network - otherwise known as port mapping / forwarding.
The process is like having doors permanently opened to the public at the front of your premises and leading directly into your confidential files storage area and private office space.
Mapping (linking) ports directly to your business systems is an extremely risky process and is based at best on the innocent misconception your software is 100% secure. When combining problems 1 and 2 outlined previously with ports linked directly to your primary business computers, a hacker is able to enjoy 24/7 access to you business's most important systems and/or confidential information - with no resistance from the firewall.
It's a brave move assuming software is 100% secure - Corporate market sales of internet security software (e.g. antivirus, spyware) and continual software updates illustrates discovery of software vulnerability is a never ending process. |
Let’s put all these major problems together and look at what we have?
i. |
A hacker can drive past your office and notice you have a door permanently opened to your board room |
ii. |
Even if you try and disguise open ports, the hacker knows you have doors open the minute you provide services over the web |
iii. |
They disguise themselves as a delivery person and approach the door carrying a sealed bag where they are greeted by a security guard. The security guard has no guest list and cannot inspect the bag but still lets the delivery person directly enter your boardroom |
iv. |
The delivery person enters your boardroom, opens their bag and pulls out a small and nimble tool to quickly pick the locks to your filing cabinets |
v. |
Once inside, the delivery person (hacker) can go to town with an array of ever increasing tools or known software vulnerabilities to violate your systems, information and/or network |
iv. |
Going undetected, the delivery person (hacker) proceeds to take small yet vital pieces of information |
v. |
The hacker walks away undetected |
|
