TCP/IP Applications

To properly configure security mechanisms and best protect network resources, you must understand your network's specific TCP/IP applications. Normally, the security mechanisms you implement will be in the form of a firewall, either a screening router or proxy server.

Understanding the architecture of each application that will be routed through a firewall is necessary to proper firewall configuration. Common TCP/IP applications are described in the table below.

Telnet should only be used when you can verify the security of the entire network connecting the client and server, not over the Internet. If you wish to deny incoming Telnet connections, you should filter all Telnet traffic at the firewalls.

A typical email message contains a header indicating where the message initiated, who the recipient is, and the time and date. An email message can include any type of attachment, including viruses and trojans ^[1].
The best defense against malicious attachments is to purchase an SMTP^[2] server that scans all messages, or to use a proxy server that scans all incoming and outgoing messages. Another preventive measure is user education. Educating email users on how viruses and trojans are sent through SMTP will help reduce the number of viruses or trojans on the network. To learn more about hacker attempts to exploit FTP in the paragraph below.

FTP is used to send, edit and receive files over a TCP/IP connection and consists of a server and a client. Almost every TCP/IP host has a built-in FTP client, and most servers have an FTP server program.
FTP uses two ports for communication. The control connection port, TCP port 21, remains open during the entire FTP session, and it is used to send control messages and client commands between the client and server. A data connection is established using an ephemeral port and is created each time a file is transferred between the client and server, sometimes several times during the entire FTP session. Difficult to exploit directly, hackers are able to exploit FTP servers indirectly.

FTP servers may not require authentication from the client; when authentication is required, all user names and passwords are sent in plain text. A common exploit is to find an FTP server that accepts anonymous connections and has write access. Hackers can then upload erroneous information to fill up the entire hard disk space. This action is done in hopes that the FTP server is installed on the hard disk that contains the operating system. If the hard disk or log files are filled with false information from the hacker, the overload could cause the system to crash. The hacker then attempts to break into the operating system or other services without being detected by the log files.

Only allow anonymous connections to your FTP server so that you do not compromise any user accounts on the FTP server. Because FTP sends all user names and the corresponding passwords in plain text, your user accounts will not be compromised by using FTP.
SNMP is a viable network management solution within a company's private network, but you may want to consider filtering all SNMP traffic at the firewall.

[1]Trojan (trojan horse): A file or program that purports to operate in a legitimate way, but which also has an alternative, secret operation, such as emailing sensitive company information to a hacker. A trojan horse is a specific program that destroys information on a hard drive.

[2]Simple Mail Transfer Protocol (SMTP): The Internet standard protocol to transfer electronic mail messages from one computer to another. It specifies how two mail systems interact, as well as the format of control messages they exchange to transfer mail.