Cybersecurity Report: Firewall Implementation, Risks, and Policies

This report provides a detailed analysis of cybersecurity, focusing on the role of firewalls in protecting networks and systems. It begins by defining firewalls and explaining how they implement security measures to prevent unauthorized access. The report then delves into the risks and vulnerabilities associated with firewalls, including insider attacks and misconfigurations, while also exploring techniques attackers use to bypass firewall security, such as hacking and malware. Furthermore, it examines various countermeasures to mitigate these risks, emphasizing the importance of intrusion prevention systems and deep packet inspection. The report also highlights the key features of an effective information security policy to minimize firewall risks and concludes by emphasizing the importance of firewalls as part of a comprehensive cybersecurity strategy. Different types of firewalls are also discussed, including packet-filtered, next-generation, proxy, and network address translation firewalls.

Cyber Security

ABSTRACT
Cyber Security is one of the most severe and menacing issue which is associated with
unethical and inappropriate access, as well as usage of one’s data that is stored within the
Firewall computing software. Moreover, this act and threat usually arises for personal gains or
even for vendettas. Hence, the paper below discusses the Firewall security and is divided into
separate tasks to help in getting a better insight within the report.
The first task of the report would be addressing how Firewall computing implements cyber
security, for which the dynamics of Firewall computing are explored and the requirements of this
task is fulfilled. Furthermore, the second tasks is related to the vulnerabilities and risks
associated in Firewall computing. Within this, certain risks and vulnerabilities associated with
firewalls are discussed. In addition to this, the third task the techniques that are used by attackers
to overcome Firewall computing technologies are discussed, which explores methods like
hacking, malware and so forth. Moreover, this task also takes into account several
countermeasures to provide better security to Firewall computing systems, which explores a
better and more effective functioning of firewalls. The last task of this paper highlights the key
features of policy that would mitigate risks in Firewall computing, for which Information
Security Policy has been discussed in detail.

Table of Contents
ABSTRACT.....................................................................................................................................2
INTRODUCTION...........................................................................................................................4
TASK 1............................................................................................................................................5
IMPLEMENTATION OF SECURITY BY FIREWALLS.............................................................5
What is firewalls and How firewalls implement cyber security?................................................5
RISKS AND VULNERABILITIES OF FIREWALLS...................................................................8
Risks in firewalls.........................................................................................................................8
Vulnerabilities in firewalls.........................................................................................................10
TECHNIQUES AND COUNTERMEASURES...........................................................................11
Techniques used by attackers to overcome firewall security....................................................11
Countermeasures to the risks.....................................................................................................13
Effectiveness of Both Systems..................................................................................................14
INFORMATION SECURITY POLICY.......................................................................................15
Outlining the key features of a policy that would mitigate or prevent risks to firewalls...........15
CONCLUSION..............................................................................................................................19
REFERENCES..............................................................................................................................20

INTRODUCTION
Cyber security is a very important and Critical area for business is and an organisation
flourishing in the market as cybercrime is regularly increasing and aggressively growing. As
known that technology is a blessing and a curse both for the users because it is basically day to
day part of every individual’s lives but several malicious elements make negative and harmful
use of technology for their personal growth which hinders and harms several businesses and
people(Bada, Sasse and Nurse, 2019). Cyber security refers to the body of technologies
processes and practices designed and created for protecting the networks systems programs
devices and the data from hackers and unauthorised attackers. Cyber security is also defined as
information technology security. Cyber security is very important as the data stored with
government military financial corporate and medical organisations and their computer systems
and other devices is very critical and harmful. The report it is based on a Cybersecurity tool
known as firewalls which is a technology developed and designed for keeping the attackers out
of the systems of the users and provide in security to the data available with the organisations.
The report covers and focuses on several different areas related to Cybersecurity and firewalls. In
the very beginning the focus is on understanding the tool of firewalls which is a software and
hardware developed for protecting the networks from any malicious attacker. Several types of
firewalls which are flourishing in the market are defined and described along with the
implementation of firewalls on cyber security. Moreover, the risks and vulnerabilities associated
with firewalls and its programs are also analysed along with highlighting on different steps to
reduce their impact and mitigate the risk (Sun, Hahn and Liu, 2018). Furthermore Different
techniques which are used by attackers and hackers to overcome the firewall security are
identified and explained. Along with it different countermeasures to these risks and techniques
which can be used by attackers for breaching the firewall security also highlighted along with the
effectiveness of both the attacking techniques and to the countermeasures. At the end several key
features of the policies that would mitigate or prevent the risk two firewalls are described and
mentioned in the report.

TASK 1
IMPLEMENTATION OF SECURITY BY FIREWALLS
What is firewalls and How firewalls implement cyber security?
Firewalls is a system designed preventing and protecting any unauthorised access from a
private network. Firewalls can be implemented in any of the three ways that is hardware and
software also in a combination of both. Firewalls is a software or hardware that prevents any
unethical or unauthorized internet user or attacker from accessing any private networks
connected with internet and more especially keeps safe the intranet networks. There are several
messages which enters and leaves the intranet of a company which is a local Network used by 8
to be connected with all the people associated with the organisation (Xin and et. al., 2018). The
different messages and data which is entering and exiting the internet of the company must pass
through the firewall which take care and examine each single packet of information and
messages. The firewalls block those packets of information or data passes through the intranet,
those who do not meet the specified security criteria by the company. A firewall is considered to
be one of the finest and first line of defence sir in protecting private information messages and
data of companies but it cannot be considered the only such line of protecting data. The firewalls
are generally developed and designed for protecting the network traffic and connection and
therefore do not attempt or make efforts to authenticate individual users while determining who
can access a particular computer for a particular network.
Implementation of firewalls cyber security:
Firewalls carefully analyses all the incoming traffic on a system or on a network based on
pre-established rules filters and security information. The analysis and evaluation of incoming
traffic enables the firewalls to identify the source of the traffic and determine it into a secured or
unsecured source in order to prevent any breaches in the system by unauthorised parties and
attackers(Mosca, 2018). Firewalls work as a guard of traffic at computer system and network at
the entry point of it which are called as ports. These ports are the entry points of a network is the
place where information is exchanged with external devices for example, “source address
172.18.1.1 is allowed to reach the destination 172.18.2.1 over port 22”. The IP addresses of a
computer system and software is considered as a house and the port numbers are considered as
the rooms within the house. In these houses only trusted people that is trusted source addresses

are allowed to enter the house and that is the destination address. Months the trusted source
address is entered in the destination then it’s for the filtered so that the source address is only
allowed to access certain information from certain destination ports depending on the
authenticity and security measures of the port. The owner of the boats are allowed to access all
the sources of different ports while the other parties who are associated with the network and
company are allowed in certain specific sports according to their security measures and traffic
filters (Liu, and et. al., 2018).
As known and discussed that firewalls can be implemented in three manners that is either as a
software or as a hardware and the third option is one of the best option to have both that is to
have a combination of software and hardware firewalls. A software firewall is a program which
is installed on the computer systems and networks of company which regulates all the traffic
through specific port number and applications. On the other hand the hardware firewalls which is
a physical firewall is a piece of equipment that is installed between the networks and gateway of
the company. There are several different types of fire was available in the marketplace which can
be implemented and installed by organisations in their computer Network and systems for
keeping the unauthorised attackers out of their systems allowing company to secure and protect
their personal information and all authenticated data. Several different types of firewalls are as
follows and mentioned below in the next section of the report.
Types of firewalls:
 Packet-filtered firewalls: the packet filter firewalls are the most common type of
firewall which are basically developed for examining the packets and messages entering
the port and prohibit them from passing through if did not matches any established
security rule set. The packet filtering firewall checks the source of the packet and the
prescribed destination with the help of IP addresses (Gratian and et. al., 2018). Once the
packet matches the security rule sets then the packet filter firewalls allows the package to
travel and enter the network as it is trusted to enter otherwise the firewall denies the entry
of packet. Packet-filtered firewalls are basically divided into two categories which are
statefuland stateless. The statefulfirewall remembers all the information about previously
passed packets and considered much more secured and protected. On the other hand the
state less firewalls are entirely opposite and examine the packets independently of one
another and lack the context making them easy targets for the hackers and unauthorised

attackers. The packet filtering firewall are effective as the ultimate Lee provide very basic
protection and can be very limited.
 Next generation firewalls (NGFW)-the next generation firewalls are the results of
updated technology and revolutionary changes taking place in the technical world. The
next generation firewall is basically a combination of traditional firewall technology with
additional functionality according to the updated technologies such as encrypted traffic
inspection intrusion prevention system, antiviruses and many more. the next generation
firewalls are most notably includes deep packet inspection in comparison with other basic
firewalls only look at packet headers. The deep packet inspection examine the data within
the packet itself and assist uses to more effectively identify and categorise the packet so
that it can stop a malicious data to enter the network of the company(Shoemaker, Kohnke
and Sigler, 2018).
 Proxy firewalls- The proxy firewalls certainly filter the network traffic at very beginning
and at the application level. The proxy firewalls act an intermediary between two ends of
the system. The clients or the users or the companies using the proxy firewalls send a
request to the firewall there it is then evaluated and analysed against a set of rules and
then permitted if the packet matches the security traffic blocked by the firewall. The
proxy firewall mostly monitor the traffic for layer 7 that is make deep packet inspection
protocols such as HTTP and FTP make use of both deep packet inspection and state full
to detect malicious traffic and to stop the entry of unprotected and unsecured network in
the systems of users.
 Network address translation firewall (NAT)- The network address translation firewall
allows multiple devices with a sole and an independent network addresses to connect
with the internet using a simple and a single IP address and keeping all the other
individual IP addresses hidden (Hareide and et. al., 2018). This firewall protects all the IP
addresses as the attacker scanning a network for IP addresses cannot capture a specific
detail and which provides a more and higher level of security against any malicious
attacker or hacker to the system. The network address translation firewall are kind of
similar to proxy firewalls but in that act as an intermediary between a group of computers
and outside traffic on the other hand this network address translation firewall allows
multiple devices to connect with the internet within a single IP address.

RISKS AND VULNERABILITIES OF FIREWALLS
Risks in firewalls
Firewalls are a fundamental piece of any organization's cybersecurity engineering. In any
case, firewalls alone ought to never be considered as the whole and sole answer for the
organization's cybersecurity needs. Indeed, they are helpful however there are a couple of issues
with firewalls that can make it a poorly conceived notion to just depend on this one security
apparatus to ensure the business. Here are some issues or risk associated with firewalls
mentioned below:
 Insider Attacks: The perimeter of firewalls is developed for keeping up with the attack
that originate from the outside of the system and network. But the system do not protect
the network is the attack takes means from the inside. Typically the perimeter of firewall
feels and becomes useless when the attackers have already accessed to the system.
Therefore it is considered as the risk of firewall because it is specifically created for
keeping the system safe from the outside and not from the inside (Sabar, Yi and Song,
2018). Still even the attackers originate and reaches the system from the inside of the
networks firewall can still be e off some use and do some good but for that the business
has to have an internal firewalls on the top of their perimeter firewalls. This internal
firewalls helps in dividing the individual assets on the network which increases the
efforts of attackers for moving from one system to another enable in increasing the
breakout time of attackers.
 Missed security patches: if the network firewall software is not managed properly the
issue of security patches arises and it is considered as a risk associated with firewalls
software. Every software program has some vulnerabilities which enhances the power of
attackers and enable them to exploit the system (Khalili, Naghizadeh and Liu, 2018).
When the vendors of firewall software discover these vulnerabilities associated with the
software they usually take measures and create a patch for fixing the problem as soon and
fast as possible. But the existence of a mere patch do not means that it automatically the
applied to the firewall program until then the vulnerability is still there and the attackers
can exploit it. The companies using the firewall software have a solution for this problem
and that is to create and stick to a very appropriate and strict patch management schedule

under which they should check for all and any security updates for the system and make
sure that the supply of those updates are made as soon as possible.
 Configuration mistake:even if a firewall software is placed on the network and all the
vulnerability patches are applied and updated by the organisation on the network there is
still a chance of creation of problem if the configuration settings of firewall software
generate any conflicts. This risk of firewall software can lead two laws of performance on
the net worth of the company and the firewall software out rightly fails to provide
protection to the system and networks. For instance, dynamic routing is a setting in a
firewall software that was long ago deemed as a bad idea because it resulted in a loss of
control on the system that reduces security and protection(Levi, Allouche and
Kontorovich, 2018). But some of the companies ignore it and leave it on which created
vulnerability for then in their firewall protection and caused a configuration mistake
attackers to enter and misuse their systems. Having a poorly configured firewall software
system is basically inviting the attackers and giving them the keys for entering into the
network by making things easier for them and spending time money and lot of efforts on
the security measures.
 A lack of deep packet inspection:A deep packet inspection also known as layer 7
inspection is a very rigorous and strict inspection mode used by next-generation firewalls
to examine and inspect the contents of information for a data packet before approving or
denying that packet passage to or from a system. Every organisation and big user of
firewall software is suggested to undertake the packet inspection in order to be protected
and says against any unethical breach or entrance of third party in their networks. The
organisation or users using in less advanced firewall me simply check the data packets
their point of origin and destination before approving or a request which can be easily
spoofed off by attacker and enable them to track the networks off firewall in a easy way
without making any rigorous efforts. Therefore it is always suggested to organisation and
firewalls users in order to fix this problem is to make use of firewalls software that can
perform deep packet inspection which is rigorous in nature for checking all the data and
information packets for known malware so that the unnecessary package can be rejected
and more importantly the unethical breaches can be ignored with keeping the system and
network safe from any attackers (Porcedda, 2018).

 DDoS attack: The DDoS stands for Distributed Denial of Service and it is one of the
most commonly and frequently used attack strategy by the breachers for entering into the
software and stealing the data. This is the most common and frequently used strategy
because it is highly effective and potential in nature along with it the cost associated with
it in order to execute it is very low. The strategy works appropriately with the goal of
overwhelming the defenders resources and create a shutdown inability to deliver the
services. This is one category of attack which is a protocol attack designed to drain
firewall and load a balancer resource and information to keep them song processing
traffic. Firewalls software can mitigate some types of distributed denial of service attacks
but it is risky because they can still be overloaded by protocol attacks which empowers
the attacker and enable them to breach the network. The strongest part of distributed
denial of service attacks is they are not easy to fix and till date there is no appropriate
solutions for this kind of attack (Kure, Islam and Razzaque, 2018). This is because there
are several attack strategies that can leverage numerous weaknesses and flaws in the
organisations network structures.
Alone, firewalls cannot protect the system from the entry of the dangers and attacks that are
out there considered as drawbacks of enhancement of technology. They can fill in as a basic
piece of a bigger cybersecurity procedure to defend the business and the systems.
Vulnerabilities in firewalls.
 Passwords are set to the default which makes each security issue conceivable, including
responsibility and accountability issues when network issues are occurring.
 Anybody on the Internet can get to Microsoft SQL Server databases facilitated from the
inside which can lead them to inner database, particularly when SQL Server has the
default credentials or very weak passwords.
 Firewall OS programming is obsolete and no longer supported this can encourage
realized events including remote code execution and forswearing of administration
assaults, and probably will not be great in eyes of others if a breach happens and it's made
realized that the framework was obsolete (Lee, 2018).
 Anybody on the Internet can get to the firewall by means of decoded HTTP associations,
as these can be abused or mistreated by an outsider or a third party who is on a similar
system, for example, an open/decoded wireless system.

 Anti-spoofing controls are not empowered on the outside interface which can encourage
denial of administration and related assaults.
 Rules exist without logging which can be particularly dangerous for basic frameworks
and administrations.
 Any protocol and service can interface between inside system networks which can
prompt inner breaks and consistence breach or violation, particularly as it identifies with
PCI DSS cardholder information environments.
 Anybody on the inside system can get to the firewall by means of unencrypted telnet
connections. These associations can be abused and misused by an internal party (or
malware) if ARP harming is enabled by means of an instrument, for example, the free
password recovery program Cain and Abel.
 Any sort of TCP or UDP service can leave the system which can empower the spreading
of malware and spam and lead to worthy use and related arrangement infringement and
breaches (Leszczyna, 2018).
 Rules exist with no documentation can make security the board issues, particularly when
firewall administrators leave the association suddenly.
Certainly, in businesses firewalls can help prevent the results when these vulnerabilities are
abused, for example denial of administration attacks realized by malware diseases and missing
patches, high transfer speed utilization identified with SQL infusion database dumps.
TECHNIQUES AND COUNTERMEASURES
Techniques used by attackers to overcome firewall security
In the era of computer firewall protection, firewall security execute actions for blocking
spread of attacks on computers. Firewall security helps in protecting networks through filtering
traffic addition to blocking outsiders from having any type of unauthorised access for private
information in individual computer. It safeguards computers and data in distinct level that makes
an individual feel safe and secure for their data in systems. Firewall security also ensures that the
information available with an individual or an organisation within their firewall storage remains
essentially secured in a way which protects the privacy and confidential information about
individuals and their personal, along with professional lives.

However, there are various attackers who use different techniques in order to bypass or
overcome this security system and steal the data in an unauthorised and illegal manner.
Therefore, it becomes necessary to highlight and determine several methods and techniques
which are usually used by the same in order to ensure security against such threats. Therefore,
some of these technologies are explored below:
 Intrusion prevention technology: It is one of technique that attackers users for the
purpose of overcoming firewall security. It helps attackers to destruct malicious traffic
with huge number of CTU™ that develops unique aspects and removed burden related to
device management. With the technique, attackers first remove excess of traffic on
networks and then corrupt the information via coding and other mediums. Hence, then it
leads the attacker easily towards the data uploaded within the Firewall computing of an
individual. Furthermore, despite of just stealing data, they could also plant false
evidences against these individuals in a threatening manner which is a serious violation
of a person’s privacy (Liu and et. al., 2018).
 Crashing network: Attackers uses the technique in which they shut down the network
that a person is using and transmit the data in their own system. This is all related with
certain clang that are placed in network and with this, entire data is transmitted in their
personal system against firewall security. These are the attacks when the person
authorised for the access of data could not do the same due to blockages of complex
coding planted by attackers. These enhances the encryption level within the firewall
software which restricts the user from accessing and even viewing the data, with possible
chances of corruption of the information available within the storage units.
 Connect- Back approach: Incoming connections are safeguarded by firewall. For
overcoming from firewall security, attackers or hackers uses the technique of Connect-
back Approach because these are oftenly blocked by firewall. With this technique,
attackers direct email to particular targets in the network with aim to trick an user
towards accessing email that provides them entry. It is also linked with acquisition of
various login credentials which are then used by the attackers to appropriately and
effectively access the information on the server from anywhere in the world.
Alternatively, they attacks IP addresses that are found on servers of firewall for updating
their systems with information of target population. However, this attack is mostly seen