Uma abordagem para sistema de firewall distribuído auto-adaptativo

Abstract

The border firewall play a fundamental role for corporate network security, acting as the first defense barrier delimiting a secure perimeter. However, the culture of Bring Your Own Device weakens the notion of secure domain, contributing to the creation of attack vectors inside the secure perimeter. Distributed firewall systems emerged with the proposal of protecting individual hosts against attacks originating from inside the network. In such systems, firewall rules are created centrally, then distributed and enforced on all servers that compose the firewall, restricting which services should be available. Meanwhile, software vulnerabilities can make network services vulnerable to attacks, since firewalls usually do not scan application protocols. In this sense, from the discovery of a vulnerability until the publication and application of patches there is an exposure window that must be reduced. Given this scenario, the present work presents a proposal of a self-adaptive distributed firewall system. This proposal is based on monitoring hosts and using a vulnerability assessment system to detect vulnerable services, integrated with components capable of deciding and applying firewall rules on affected hosts. In this way, our approach is able to respond to vulnerabilities discovered in these hosts, helping to mitigate the risk of exploiting the vulnerability. Our system was evaluated in the context of a case study that simulates a corporate network environment, where the results achieved demonstrate its viability.