CST 311 Week 8 Journal Entry

Operational Security and Overall Class Reflection

This week, we learned about operational security. Two types of operational security methods were discussed: firewalls and intrusion detection systems. Firewalls help filter out packets passing from the Internet to an internal network. They are designed to prevent denial of service attacks and illegal modifications of internal data and only allow authorized access to a network. This can help keep the untrusted packets out of an internal network and let the trusted packets in. 

There are three types of firewalls. First, there is a firewall with stateless packet filtering. This firewall decides which packet to forward or drop based on information such as IP address, TCP/UDP port numbers, ICMP message types, and TCP SYN and ACK bits. The firewall can be set so that packets with given information can be evaluated based on rules, such as ACK =0, and can be blocked from entering the internal network. 

Second, there is a firewall with stateful packet filtering. In this firewall, the status of every TCP connection is tracked, and packets are dropped or forwarded based on certain information. It monitors information, such as the ACK, SYN, or FIN bit, and checks the TCP connection. Based on the information and TCP connection, packets are forwarded to the internal network or dropped as they could be a potential threat to the internal network. It also timeouts inactive connections at the firewall so that packets are no longer admitted. The restrictions of what is allowed or denied into an internal network are kept in an Access Control List (ACL). The ACL keeps a pair of actions and conditions for each incoming packet and determines which are allowed and which are denied. Both stateless and stateful packets filter the ACL. 

Lastly, we have application gateways. Application gateways are also known as proxy firewalls and filter packets on application data, such as fields such as IP, TCP, and UDP, which are data specific to the application layer. An example where application gateways are applied is with telnets. When applied to telnet, this application gateway requires all telnet users to telnet through it, is for authorized users only, and has a router that filters telnet connections not from the original gateway. This prevents unauthorized users from entering the internal network.

The second type of operational security is intrusion detection systems. These systems operate on TCP and IP headers to filter packets. They check the content of each packet against information such as a check string or known viruses. If multiple packets are being sent, ports and network mapping are checked, as is the potential for a denial-of-service attack. This system can be implemented at different locations, such as the connection between the firewall and an external server or between a firewall and an internal network. 

Overall, this was a great way to end the class. I enjoyed the deep dive into computer networks and the mathematics behind them. I have an interest in cybersecurity, so it was interesting to learn about computer networks' function at each layer and what can be done to increase security within those networks.