Advanced Firewall Configuration for Today’s Internet

INSTRUCTOR: Fred Avolio, Avolio Consulting, Inc.

AUDIENCE: Network, system, and firewall administrators

LEVEL: Technical

ASSUMPTIONS: Administrator-level knowledge of TCP/IP networks, network security principles, and firewall best practices.

Welcome to the new millenium. It is not 1993 anymore. This is not your father’s Internet. Why are our firewalls configured as if it is? Networks have gotten more complicated, rather than less. Users demand access to more and varied network services. Servers and services are more “feature-ful” and … well, you know what that means.

In this course, you will learn how to use firewalls more effectively to meet the challenges of securing your networks while still providing for the business requirements (or mission needs). You may also learn how to help see through wants and desires disguised as requirements. (You will also learn ways to try to help upper management see security expenditures as a cost of doing business rather than as an expense, but the instructor doesn’t guarantee they’ll get it.)

Topics:

• Security assumptions — 5 minutes on everything you should already know.
• Marketing Hype — Lies, Damn lies, and Claims
• Dangers and Speedbumps — FW vulnerabilities
• Firewall Configuration for today — Managing security and the need for speed.
• Internal Firewalls — not firewall internals, but sprinkling firewalls throughout our organization in ways that work
• Firewalls and VPNs — Good Practice in Placement
• Rules for interconnecting networks with firewalls.
• Wireless: controlling user’s urges
• Risk reality check — how to measure real risks
• Testing firewalls with vulnerability assessment tools
• Firewalls are not Enough — synergistic security controls
• 2 Top 10 Lists (the good and bad)

Students should come prepared to share experiences, discuss alternatives, and ask questions.

Students will leave with recommendations for tightening up your defenses, raising your network security assurance level, and suggestions for policy enhancements.

This will NOT cover:

• IP basics
• Firewall basics
• VPN or IPsec in any detail
• Configuration of particular firewalls
• How to do the impossible (e.g., how to make it cheap, fast, and easy)