Firewalls & Intrusion Detection: Rules, IDS/IPS, Honeypots & Logs

TAKEAWAYS:

• Firewalls filter traffic using rules (ACL, stateful inspection) and can be network-based (hardware) or host-based (software).
• Intrusion Detection Systems (IDS) monitor signatures (known attacks) or anomalies (unusual behavior), while IPS actively blocks threats.
• Honeypots decoy systems lure attackers to study their tactics, while SIEM tools correlate logs to detect breaches.
• False positives/negatives are critical trade-offs in IDS/IPS design, affecting performance and security.
• Log analysis (syslog, SIEM) helps reconstruct attacks and enforce compliance (e.g., GDPR, Nepali cyber laws).
• Real-world use: Banks (e.g., NMB) use firewalls to block SQL injection; Pathao’s servers rely on IDS to detect fraudulent ride requests.

1. Firewalls: The First Line of Defense

Firewalls act as gatekeepers between trusted internal networks and untrusted external ones (e.g., the internet). They enforce access control policies by inspecting and filtering traffic based on predefined rules.

1.1 Types of Firewalls

Firewalls are classified based on their inspection method and placement in the network. Below is a comparison table:

1.2 How Firewalls Work: Rule Processing

Firewalls use Access Control Lists (ACL) to decide whether to allow or deny traffic. Rules are processed in order, and the first match determines the action.

Example: ACL Rule Processing

Assume the following rules for a small office network (IP range: 192.168.1.0/24):

Worked Example: Traffic Flow

1. Packet A: From 192.168.1.5 (internal) to 10.0.0.1 (external) on TCP 80.
   • Rule 1 matches → Allowed.
2. Packet B: From 192.168.0.100 (external) to 192.168.1.10 (internal) on TCP 22.
   • Rule 2 matches → Denied (blocked SSH).
3. Packet C: From 192.168.1.20 (internal) to 192.168.1.10 (internal) on TCP 443.
   • Rule 1 matches → Allowed (internal traffic).

Mermaid Diagram: Firewall Rule Processing

flowchart TD
    A["Packet Arrives"] --> B["Check Rule 1: Allow Internal"]
    B -->|"Match"| C["ALLOW"]
    B -->|"No Match"| D["Check Rule 2: Deny SSH to Server"]
    D -->|"Match"| E["DENY"]
    D -->|"No Match"| F["Check Rule 3: Allow HTTP"]
    F -->|"Match"| G["ALLOW"]
    F -->|"No Match"| H["Check Rule 4: DENY ALL"]
    H --> I["DENY"]

1.3 Firewall Placement in Networks

Firewalls are deployed at strategic points to maximize security:

Key Placements:

1. Perimeter Firewall: Between the internet and the internal network (e.g., Firewall 1 above).
2. DMZ Firewall: Protects public servers (e.g., web, mail) from internal networks.
3. Internal Firewall: Segments sensitive data (e.g., databases) from less secure zones.

Real-World Example: Daraz’s Firewall Strategy

• Perimeter Firewall: Blocks DDoS attacks targeting Daraz’s checkout servers.
• DMZ: Hosts public APIs (e.g., product catalog) but restricts access to internal inventory systems.
• Internal Segmentation: Separates payment processing (PCI-DSS compliant) from customer support.

1.4 Firewall Limitations

2. Intrusion Detection and Prevention Systems (IDS/IPS)

While firewalls prevent unauthorized access, IDS/IPS detect and respond to active attacks.

2.1 Intrusion Detection Systems (IDS)

IDS monitors network/host activity for suspicious patterns and alerts admins. It does not block traffic.

Types of IDS

Worked Example: Signature-Based IDS

• Attack: A SQL injection attempt on a web server:

  http://example.com/login.php?id=1' OR '1'='1
  

• Signature Rule (Snort):

  alert tcp any any -> 192.168.1.10 80 (msg:"SQL Injection Attempt"; content:"' OR '"; nocase;)
  

  • Action: IDS logs the alert but does not block the traffic (that’s IPS’s job).

Mermaid Diagram: IDS vs. IPS Response

sequenceDiagram
    participant Attacker as Attacker
    participant IDS as IDS (Detects)
    participant IPS as IPS (Blocks)
    participant Firewall as Firewall

    Attacker->>IDS: Malicious Packet (SQLi)
    IDS->>Admin: Alert (Signature Match)
    Admin->>IPS: Configure Rule to Block
    IPS->>Firewall: Drop Traffic Matching Pattern
    Firewall->>Attacker: Packet Dropped

2.2 Intrusion Prevention Systems (IPS)

Unlike IDS, IPS actively blocks malicious traffic in real-time. It is inline with the network traffic.

Real-World Example: Ncell’s IPS Against Fraud

• Threat: SIM-box fraud (unauthorized international calls).
• Solution: IPS detects anomalous call patterns (e.g., sudden spike in calls to a single country) and blocks the suspicious SIM before calls are routed.

2.3 Honeypots: Decoy Systems to Trap Attackers

A honeypot is a fake system designed to attract attackers, allowing security teams to:

• Study attacker tactics (e.g., malware behavior).
• Distract attackers from real systems.
• Collect intelligence on new threats.

Types of Honeypots

Worked Example: Honeypot in a Bank (NMB)

• Setup: A fake ATM server exposed to the internet.
• Attack: An attacker tries to exploit a known SQLi vulnerability in the ATM interface.
• Outcome:
  • The bank’s SIEM detects the attack from the honeypot.
  • Security team updates real ATM systems with the patch.
  • Attacker’s IP is blacklisted before they reach real systems.

3. Log Analysis and SIEM

Firewalls and IDS/IPS generate logs, but raw logs are useless without analysis. SIEM (Security Information and Event Management) tools correlate logs to detect advanced threats.

3.1 Key Log Sources

Mermaid Diagram: SIEM Log Correlation

3.2 SIEM Tools in Action

Example: Detecting a Data Exfiltration Attack

1. Step 1: IDS detects unusual outbound traffic from a database server to a cloud storage bucket.
2. Step 2: SIEM correlates this with:
   • Firewall logs: Multiple new outbound connections to an unknown IP.
   • Database logs: A user (admin) ran SELECT * FROM customers (unusual at 3 AM).
3. Step 3: SIEM triggers an alert and blocks the IP via the firewall.

Real-World Example: NEPSE’s SIEM for Market Manipulation

• Threat: Insider trading via unauthorized API access.
• Solution: SIEM monitors:
  • Failed login attempts (brute force).
  • Unusual data downloads (e.g., bulk stock price history).
• Action: Automatically locks the account and notifies compliance officers.

4. False Positives and False Negatives

A major challenge in IDS/IPS is balancing security and usability.

Example: False Positive in a University (TU)

• Scenario: A student downloads a legitimate security tool (e.g., Wireshark).
• Problem: IDS flags it as malware (based on file hash).
• Solution: Whitelist known-good tools in the IDS rules.

Example: False Negative in a Bank (GlobalPay)

• Scenario: A zero-day exploit in a payment gateway.
• Problem: Signature-based IDS misses it (no known signature).
• Solution: Deploy anomaly-based detection (e.g., sudden spike in transaction volume).

5. Exam Tip: How to Score Full Marks

What Examiners Look For

1. Definitions: Clearly distinguish between IDS vs. IPS, firewall types, and honeypot categories.
2. Diagrams: Draw network topologies (e.g., DMZ placement) and rule processing flows.
3. Real-World Applications: Link concepts to Nepali companies (e.g., Ncell’s IPS, Daraz’s firewall).
4. Worked Examples: Show step-by-step rule matching or log analysis.
5. Trade-offs: Discuss false positives/negatives and performance vs. security.

Common Mistakes to Avoid

• Confusing IDS and IPS: Remember, IDS detects, IPS prevents.
• Ignoring Rule Order: Firewall rules are top-down; the first match wins.
• Overlooking Honeypots: They are not firewalls but decoy systems.
• Not Drawing Diagrams: Always include network layouts or Mermaid sequences for protocol flows.

Sample Exam Questions & How to Answer

Q1: "Explain how a stateful firewall differs from a packet-filtering firewall with an example." Answer Structure:

1. Definition: Packet filtering = header-only; stateful = tracks connections.
2. Example: Show a TCP handshake where packet filtering allows SYN but drops ACK (if no rule), while stateful allows both.
3. Diagram: Use a Mermaid sequence for the handshake.

Q2: "Describe how a SIEM tool would detect a data exfiltration attack in a corporate network." Answer Structure:

1. Log Sources: Firewall (unusual outbound), IDS (anomalous traffic), database (bulk queries).
2. Correlation: SIEM matches time, IP, and user across logs.
3. Response: Alert admin + block IP via firewall.