Designing Firewalls: A Survey

Network Security: Current Status and Future Directions

Volumn , Issue , 2006, Pages 33-49

  Keromytis, Angelos D ^a   Prevelakis, Vassilis ^b  

^a Fu Foundation School of Engineering and Applied Science   (United States)

^b Drexel University   (United States)

Author keywords

Designing firewalls DMZ (demilitarized zone) and external (untrusted) networks; Firewall classification; Firewall deployment management

Indexed keywords

EID: 84889389351     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1002/9780470099742.ch3     Document Type: Chapter

References (21)

1. W. R. Cheswick and S. M. Bellovin, Firewalls and Internet Security: Repelling the Wily Hacker, Addison-Wesley, Reading, MA, 1994.
2. M. Dahlin, Serverless Network File Systems, PhD thesis, University of California, Berkeley, Dec. 1995.
3. Rattle, Using process infection to bypass windows software firewalls. Phrack, 13(62), July 2004.
4. S. M. Bellovin, Distributed firewalls, login: magazine, special issue on security, Nov. 1999, pp. 37-39.
5. M. Blaze, J. Feigenbaum, J. Ioannidis, and A. Keromytis, The role of trust management in distributed systems security, in Secure Internet Programming, LNCS 1603, Springer-Verlag, New York, 1999, pp. 185-210.
6. T. A. Limoncelli, Tricks you can do if your firewall is a bridge, in Proceedings of the first USENIX Conference on Network Administration, Santa Clara, CA, Apr. 1999.
7. V. Prevelakis and A. D. Keromytis, Drop-in security for distributed and portable computing elements. Internet Research: Electronic Networking, Applications and Policy, 13(2), 2003, pp. 107-115.
8. CERT, Advisory CA-2003-04: MS-SQL server worm, http://www.cert.org/advisories/CA-2003-04.html, Jan. 2003.
9. CERT, Advisory CA-2001-19: "Code red" worm exploiting buffer overflow in IIS Indexing Service DLL, http://www.cert.org/advisories/CA-2001-19.html, July 2001.
10. Y. Bartal, A. Mayer, K. Nissim, and A. Wool, Firmato: A novel firewall management toolkit, in Proceedings of the 1999 IEEE Symposium on Security and Privacy, May 1999, pp. 17-31.
11. J. Epstein, Architecture and concepts of the ARGuE guard, In Proceedings of the Fifteenth Annual Computer Security Applications Conference (ACSAC), Scotsdale, Dec. 1999.
12. M. Greenwald, S. K. Singhal, J. R. Stone, and D. R. Cheriton, Designing an academic firewall. Policy, practice and experience with SURF, in Proceedings of Network and Distributed System Security Symposium (NDSS), Feb. 1996, San Diego, pp. 79-91.
13. J. D. Guttman, Filtering postures: Local enforcement for global policies, in Proceedings of the IEEE Security and Privacy Conference, May 1997, Oatland, CA, pp. 120-129.
14. S. Ioannidis, A. D. Keromytis, S. M. Bellovin, and J. M. Smith, Implementing a distributed firewall, in Proceedings of Computer and Communications Security (CCS) 2000, Nov. 2000, Athens, pp. 190-199.
15. W. LeFebvre, Restricting network access to system daemons under SunOS, in Proceedings of the Third USENIX UNIX Security Symposium, 1992, Baltimore, pp. 93-103.
16. B. McKenney, D. Woycke, and W. Lazear, A network of firewalls: An implementation example, in Proceedings of the Eleventh Anual Computer Security Applications Conference (ACSAC), Dec. 1995, New Orleans, pp. 3-13.
17. J. Mogul, R. Rashid, and M. Accetta, The packet filter: An efficient mechanism for user-level network code, in Proceedings of the Eleventh ACM Symposium on Operating Systems Principles, Nov. 1987, Austin, TX, pp. 39-51.
18. J. C. Mogul, Simple and flexible datagram access controls for UNIX-based gateways, in Proceedings of the USENIX Summer 1989 Conference, 1989, Baltimore, pp. 203-221.
19. A. Molitor, An architecture for advanced packet filtering, in Proceedings of the Fifth USENIX UNIX Security Symposium, pp. 117-126, Salt Lake City UT, June 1995.
20. D. Nessett and P. Humenn, The multilayer firewall, in Proceedings of Network and Distributed System Security Symposium (NDSS), Mar. 1998, San Diego, pp. 13-27.
21. W. Venema, TCP WRAPPER: Network monitoring, access control and booby traps, in Proceedings of the Third USENIX UNIX Security Symposium, 1992, Baltimore, pp. 85-92.