Offline firewall analysis

International Journal of Information Security

Volumn 5, Issue 3, 2006, Pages 125-144

  Mayer, Alain ^a   Wool, Avishai ^b   Ziskind, Elisha ^c  

^a CenterRun Inc   (United States)

^b TEL AVIV UNIVERSITY   (Israel)

^c Princeton University   (United States)

Author keywords

Internet protocol (IP); Network security; Packet filtering; Security anagment

Indexed keywords

EID: 33745155731     PISSN: 16155262     EISSN: 16155270     Source Type: Journal    
DOI: 10.1007/s10207-005-0074-z     Document Type: Article

References (38)

1. Algorithmic Security's Firewall Analyzer (2004) http://www.algosec.com/ Products/
2. Bartal, Y., Mayer, A., Nissim, K., Wool, A.: Firmato: A novel firewall management toolkit. ACM Trans. Comput. Syst. 22 (4), 381-420 (2004)
3. Bellovin, S.M.: Security problems in the TCP/IP protocol suite. Comput. Commun. Rev. 19 (2), 32-48 (1989)
4. Bellovin, S.M.: Distributed firewalls. login: The Magazine of USENIX & SAGE, pp. 39-47 (1999)
5. Chapman, D.W., Fox, A.: Cisco Secure PIX Firewalls. Cisco Press, Indiana (2001)
6. Cheswick, W.R., Bellovin, S.M., Rubin, A.: Firewalls and Internet Security: Repelling the Wily Hacker, 2nd edn. Addison-Wesley, Reading, MA (2003)
7. Dalheimer, M.K.: Programming With Qt. O'Reilly & Associates, Inc., California (1999)
8. De Berg, M., van Kreveld, M., Overmars, M.: Computational Geometry: Algorithms and Applications, 2nd edn. Springer, Berlin Heidelberg New York (2000)
9. Eronen, P., Zitting, J.: An expert system for analyzing firewall rules. In: Proceedings of the 6th Nordic Workshop on Secure IT Systems (NordSec 2001), pp. 100-107. Copenhagen, Denmark (November 2001); Technical Report IMM-TR-2001-14, Technical University of Denmark
10. Farmer, D., Venema, W.: Improving the security of your site by breaking into it. (1993) http://www.fish.com/security/admin-guide-to-cracking.html
11. Freiss, M.: Protecting Networks with SATAN. O'Reilly & Associates, Inc., California (1998)
12. Fulmer, C.: Firewall product overview. (2002) http://www.thegild.com/ firewall/
13. Fyodor: NMAP - the network mapper. (2000) http://www.insecure.org/nmap/
14. Gansner, E.R., Koutsofios, E., North, S.C., Vo, K.-P.: A technique for drawing directed graphs. IEEE Trans. Softw. Eng. 19 (3), 214-230 (1993)
15. Goldsmith, D., Schiffman, M.: Firewalking: A traceroute-like analysis of ip packet responses to determine gateway access control lists. White paper, Cambridge Technology Partners (1998), http://www.packetfactory.net/firewalk/
16. Graphviz - open source graph drawing software (2001) version 1.7, http://www.research.att.com/sw/tools/graphviz/
17. Guttman, J.D.: Filtering postures: Local enforcement for global policies. In: Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA. IEEE, Piscataway, NJ (1997)
18. Guttman, J.D.: Security goals: Packet trajectories and strand spaces. In: Foundations of Security Analysis and Design (FOSAD). Lecture Notes in Computer Science, vol. 2171. Springer, Berlin Heidelberg New York (2001)
19. Hazelhurst, S., Attar, A., Sinnappan, R.: Algorithms for improving the dependability of firewall and filter rule lists. In: Workshop on Dependability of IP Applications, Platforms and Networks, pp. 576-585. IEEE Computer Society Press, Los Alamitos, CA, (2000). Published in Proceedings of International Conference on Dependable Systems and Networks
20. Held, G., Hundley, K.: Cisco Access Lists. McGraw-Hill, New York (1999)
21. Huitema, C.: Routing in the Internet. Prentice-Hall, Englewood Cliffs, NJ (1995)
22. ICSA Labs Certified firewall products. (2003) http://www.icsalabs.com/ html/communities/firewalls/certification/rxvendors/index.shtml
23. Internet Security Systems Internet Scanner (2000) http://documents.iss.net/literature/InternetScanner/is_prs.pdf
24. Internet Security Systems BlackICE Defender (2003) http://blackice.iss.net/
25. Lucent VPN firewall brick (2002) http://www.lucent.com/security
26. Mayer, A., Wool, A., Ziskind, E.: Fang: A firewall analysis engine. In: Proceedings of IEEE Symposium on Security and Privacy, pp. 177-187. Oakland, CA. IEEE, Piscataway, NJ (2000)
27. Qt: Online reference documentation, version 2.0.1. (1999) Troll Tech http://www.troll.no/qt/
28. Ranum, M.: On the topic of firewall testing (1995) http://www.ranum.com/ pubs/fwtest/
29. Rubin, A., Geer, D., Ranum, M.: Web Security Sourcebook. Wiley Computer Publishing, New York (1997)
30. Russell, R.: (2000) Linux IPCHAINS-HOWTO, v1.0.8, http://www.tldp.org/ HOWTO/IPCHAINS-HOWTO.html
31. Stevens, W.R.: TCP/IP Illustrated, Volume 1: The Protocols. Addison-Wesley, Reading, MA (1994)
32. Welch-Abernathy, D.D.: Essential Checkpoint Firewall-1: An Installation, Configuration, and Troubleshooting Guide. Addison-Wesley, Reading, MA (2002)
33. Wool, A.: Architecting the Lumeta firewall analyzer. In: Proceedings of 10th USENIX Security Symposium, pp. 85-97. Washington, DC (2001). USENIX
34. Wool, A.: A quantitative study of firewall configuration errors. IEEE Computer 37 (6), 62-67 (2004)
35. Wool, A.: The use and usability of direction-based filtering in firewalls. Comput. Security 23 (6), 459-468 (2004)
36. Xu, W., O'Neal, S., Schoonover, J., Moser, S., Lamar, F., Grasboeck, G.: (2000) fwrules50, Available from http://www.phoneboy.com/fw1/
37. ZoneAlarm (2003) 3.7.143. Zone Labs, http://www.zonelabs.om/
38. Zwicky, E.D., Cooper, S., Chapman, D.B.: Building Internet Firewalls, 2nd edn. O'Reilly & Associates, Inc., California (2000)