A large number of companies are connecting their networks to the Internet, looking for better integration with their clients and other commercial partners, all in the context of a growing global economy. Statistics show that this process is irreversible - the Internet continues to profoundly impact commercial and business applications. A presence on the Internet (and using it correctly) can give a company a very important competitive advantage.

However, when they begin to offer Internet access to their employees, the majority of companies face two potential problems. First is the risk that a direct connection to the Internet can represent to the security of the company’s information. If the company has access to the Internet, the Internet also has access to the company, unless the necessary precautions are taken.

Second is the problem of employee productivity. Since the Internet represents a seemingly endless information archive with many different subjects, it is easy to imagine that some of its services (WWW, IRC-Chat, FTP, Newsgroups, etc.) might be used by the employees for purposes incompatible with the company’s objective and mission.

2. Traditional Firewalls

"Firewalls" were developed to resolve the problems of internal network security and access control to Internet services. Firewalls are aptly named, for they resemble the structures that prevent fire from spreading from one environment to another. Generally, firewalls are server-based applications that monitor and control the traffic between two networks.

Traditional gateway firewall products were specifically developed to protect networks from external intrusions over the public Internet. The main goal of these products is to control access to your private network by external sources. Since their introduction, traditional firewalls have been widely viewed as the "Holy Grail" for network security.

Today, that view is changing. Users are beginning to realize that firewalls are only part of the total security solution, not the entire solution itself.

According to recent security surveys by the Computer Security Institute/FBI and Ernst & Young (1997), nearly 50% of all network intrusions come from INSIDE. Protecting the "front door" of an organization with a traditional firewall does not secure a network from internally based attacks – dial-up access, Trojan Horse type programs, or disgruntled employees. Traditional firewalls act like a security guard at the main entrance; they control only the main door protecting the network – leaving backdoors, windows and emergency doors and other entrance points unguarded and open. These are "points of least resistance" within a network that make easy targets for hackers and other intruders.

In addition, the firewall market is rapidly becoming commoditized. It is dominated by 4 major players, and further consolidation is ongoing (Source: Frost & Sullivan research report, "US Network Security Markets" 1997). Given the size of the traditional firewall installed base – 344,000 units deployed – and the maturity of the existing firewall market (Frost & Sullivan, "US Network Security Markets"), this represents a significant new opportunity. The supply channel also is ready for the next security solution to sell to existing firewall customers.

If we examine the recognized elements of security and the functionality of traditional firewalls, we see that firewalls don’t provide a complete solution to any of the security elements, as shown in the following table:

Based on the problems outlined above, the concept was developed whereby a "machine" will function as a server for some services and a client of other services and all microcomputers will be a client and server at the same time. Using the recognized military concept of security that says that the strength of security is measured by the weakest ring, it makes sense to protect the vulnerable inner portion of the network. Since networks are made of servers and stations, this means protecting stations as well as servers. This is the Distributed Firewall Architecture (DFA), designed to place security as close as possible to all objects requiring protection.

Another part of the DFA is that security solutions must be tied to the operating system(s). The closer the placement of the security solution to the kernel of the operating system, the stronger the security. Beyond that, attachment to the operating system provides that the security is transparent and simple for the end user and the environment. DFA allows legacy systems to continue to work the way they always have. This approach also is good for administrators because it allows them to implement Intranet security without having to make modifications to the environment and/or to end-user applications.

One of the strongest concepts of DFA is that users are separate from IP addresses. This provides the granularity needed to implement more sophisticated security measures. The technology is user-based, not IP address-based. Regardless of the IP address assigned to a user at any given time, he or she will be the same person, and needs to be authenticated as a person, not as an IP address.

The protection in the DFA model is based on the Seven Security Elements: Authentication, Access Control, Privacy, Integrity, Non-Repudiation, Auditing, and Enterprise Management. The DFA was created to accept the standards of and use each of the seven security elements. These seven elements combined in an integrated product will solve security problems in the future. Today, some products are available that solve one, two, or sometimes three of these elements, but no single product covers all seven elements. And most of these products don’t support all the main operating system platforms.

• Authentication

• Operating System(s) Authentication
• Tokens and SmartCards
• Digital Certificates – X509
• RADIUS
• Biometric Technology

• Access Control

• Single Sign On

• Privacy

• IPSEC
• ISAKAMP, SKIP,
• RSA, Diffie-Helman, Elliptic Curve
• IDEA, DES, 3DES, RC4, RC2

• Integrity

• MD5, SHA

• Non-Repudiation

• SET

• Auditing

• Enterprise Management

• SNMP, LDAP

5. He@tSeeker Pro™

Protecting against internal threats requires a radical new approach to firewall security. That’s why Fortress Technologies created NetFortress He@tSeeker Pro – an Intranet firewall that can be distributed and centrally managed to bring the implementation of security policy down to the individual desktop.

He@tSeeker Pro™ is a security, administration, and auditing software product, based on the Distributed Firewall Architecture (DFA). The main goal in the design of He@tSeeker Pro™ is the extension of network security from the point where the security of traditional firewalls ends.

Installed on a company’s workstations and servers to complement the security offered by traditional firewalls, He@tSeeker Pro™ allows access to Internet resources to be secure and productive, according to well-defined standards.

He@tSeeker Pro™ can be customized for a variety of projects and applications, such as user authentication, cryptography, ATM machines as an electronic commerce solution on the Internet, Extranets, home banking, election projects, electronic kiosk, among others.

He@tSeeker Pro™ monitors other applications that request services from the Windows Socket API (WINSOCK), intercepting these service requests and enabling or disabling access to the requested service’s program. Any program that has access to TCP/IP services based on WINSOCK can be monitored by He@tSeeker Pro™.

He@tSeeker Pro™ analyzes each data packet from a monitored application's request by the system-installed WINSOCK. In this way, it can determine if a logged user's requested package is compliant with the company's security policy. If this access request is not in compliance, the user will receive a standard message from the application being used, informing the user that the service was denied or the requested resource (Service or Host) is unavailable. He@tSeeker Pro™ also can be configured to display its own message notifying the user of any service denials.

To provide the needed security granularity, the He@tSeeker Pro™ uses two "fences." The first is at the IP level: this fence protects against attacks at the network layer. The second is at the TCP layer. Using both, He@tSeeker Pro™ provides the granularity needed to control the applications.

Whether resource usage is permitted or not, the He@tSeeker Pro™ system can register access trial in the station log file, saving the user’s name, date, time and the workstation used. This file can be exported to the server, allowing the auditor or super user to conduct professional network usage auditing, including all workstations.

To gain a better understanding of He@tSeeker Pro™, the following briefly describes the WINSOCK.DLL, what it does and how it works.

In order for a client application, such as a browser, an FTP client, a Chat-IRC or any other client program, to access services of a server application using TCP/IP as physical transportation, it is necessary to establish a connection between the applications.

The API WINSOCK is a routine library that allows the client application to establish these connections, and access different services such as name resolution, IP address treatment, etc. It is an API (Application Program Interface) that allows the client application developed for the Windows (Windows 3.x, Windows 95 or Windows NT) environment to use TCP/IP services to communicate with server applications.

WINSOCK defines a standard followed by programmers who develop applications for the Windows environment. The WINSOCK is a DLL (Dynamic Link Library), executable code loaded and unloaded by Windows applications dynamically as necessary.

WINSOCK is based on the SOCKS library, created in Berkeley for the UNIX environment.

As an example, a Windows application (Windows 3.1, a Windows 95 or Windows NT) wants to use TCP/IP services to access Internet services (through a modem, with dial up access) or a corporate intranet (through the network cables, using the Ethernet protocol).

In any case, the application uses WINSOCK.DLL functions, located "between" the application and the workstation TCP/IP stack, to open a connection (socket) with the desired service and to transmit and receive data using TCP/IP.

For example, in the browsers Netscape Navigator and Microsoft Explorer, the CuteFTP (FTP client) and Mirc (IRC-Chat client) are Windows applications that use the WINSOCK API to access TCP/IP services.

He@tSeeker Pro™ guarantees total access protection to Internet / Intranet services by staying between the application and WINSOCK.DLL.

In a 32-bit environment such as Windows NT, He@tSeeker Pro™ uses WSOCK32.DLL to protect 32-bit applications. WSOCK32.DLL has the same functionality of the WINSOCK.DLL.

When the application tries to connect to a server to obtain any service through WINSOCK API calls, He@tSeeker Pro™ intercepts the request and checks it against the access rules defined by the administrator, and allows or blocks the access accordingly. The application is not able to access WINSOCK.DLL without being monitored and registered by the He@tSeeker Pro™ log.

He@tSeeker Pro™ is a Windows application, with 16-bit (Windows 3.1 or Windows 3.11) and 32-bit (Windows 95 and Windows NT) versions. In all cases, He@tSeeker Pro™ requires that a Winsock 1.1 API compliant networking package is installed. He@tSeeker Pro™ is compatible with the standard definition of WINSOCK 1.0 and with Proxies of HTTP and FTP.

Minimum hardware requirements

The minimum hardware requirements to install He@tSeeker Pro™ are basically the same as those for the operating system in use. The table shows the hardware requirements recommended to install He@tSeeker Pro™ for better performance.

He@tSeeker Pro™ Main Sub-Systems

CFINET – Access Control Sub-System for 16-bit

CFINET32 – Access Control Sub-System for 32-bit

CFIWS32 – Access Control Sub-System for 32-bit

CFIHK32 – Access Control Sub-System for 32-bit

CFIHKMS – Access Control Sub-System for 32-bit

CFIITF*.DLL – Authentication and Users and Groups Network Database Access

CFIADMIN – Enterprise Security System Manager

CFIAUDIT – Auditing Sub-System

CFICRT32.DLL – Cryptography Sub-System

To correctly install and activate He@tSeeker Pro™, some changes are made in the Windows environment during the installation process. The changes are based on the options chosen during installation and are dependent on the operating system where He@tSeeker Pro™ is being installed.

Windows NT

• The PATH is changed, and the He@tSeeker Pro™ installation path is added at the end of the PATH.
• In the Application Menu the He@tSeeker Pro™ folder is included.
• In the Registry several variables are added and changed.
• He@tSeeker Pro™ is installed as a service, so it is activated before all the users are logged into the system.

Windows 95

• In the Application Menu the He@tSeeker Pro™ folder is included.
• In the Registry several variables are added and changed.
• He@tSeeker Pro™ is installed as a service, so it is activated before all the users are logged into the system.

Windows 3.x

• In the Application Menu the He@tSeeker Pro™ folder is included.
• In the file WIN.INI, session Windows, variable LOAD, the path to the execution of He@tSeeker Pro™ is added.

None of the other components of Windows Systems is changed by He@tSeeker Pro™ and only the directory indicated in the installation is used by He@tSeeker Pro™.

The deinstallation process restores the environment the way it was before installation.

5. Every time you execute the administration program, it checks to see if the Network Users Database has been changed. If so, it shows the administrator a message and allows him to resynchronize the He@tSeeker Pro™ database with the Network, deleting users and groups removed; inserting new users and groups on the Network; and reorganizing users that have been moved from one group to another on the Network. Everything is done automatically.

1. Two types of security philosophy can be defined:

6. Blocks Ports that are subject to attack:

-- FTP

-- Telnet

-- Netbios Name

-- Netbios Session

-- Netbios Datagram

-- TCP/IP service port blocking at the network layer

7.2.7 ICMP Attacks: Some or all ICMP packets can be disabled, eliminating the possibility that the workstation can be attacked by Ping of Death and other ICMP-related attacks (for Windows 95 clients only). He@tSeeker Pro™ stops ICMP attacks like Ping-O-Death, Supersonic Ping, Ping Flooding, Route deterring, SYN flooding, and DNS denial of service attacks.

7. Also blocks Win 95 Dial Up Networking (DUN) connections and ICMP through PPP.

9. Services
1. A name, which usually represents the used protocol (FTP, TELNET, HTTP, etc.), and a number that identifies the port on which the service can be accessed on the server (21 for FTP, 23 for TELNET, 80 for HTTP, etc. identify each service). He@tSeeker Pro™ allows you to control whatever service you want from number 1 through 65365.
2. Deny Access: He@tSeeker Pro™ controls outgoing and incoming traffic on the workstation separately for each service, through its bi-directional control. If the Outgoing check box is marked, the outgoing traffic is protected. If the Incoming check box is marked, the incoming traffic is protected. In workstations that are only clients (do not run services), you can block only the outgoing traffic, marking the Outgoing check box, for a specific service. In computers that run services (e.g. a Windows NT Host Server running the IIS Web Server), access to the service can be blocked through the Incoming check box. The service will be inaccessible for all the other workstations.
10. Hosts
1. He@tSeeker Pro™ allows you to control whatever host you want. You can control by name or IP address.
1. Name: Identifies the host on the Internet, according to the DNS (Domain Name Server), for example, www.ion.fortresstech.com. The name field allows the use of wild card masks (* and ?) to represent hosts that are part of the same domain. For example, to register and configure access to all hosts that are part of the ".gov." domain (hosts linked to the government), just register a host with the "*.gov.*" name. The domain name is always converted internally from the WINSOCK functions to an IP address. That is why host identification can be done through file name or IP address.
2. IP Address: In this field you can enter the host IP address; for example, 200.240.30.49. This number does not need to be supplied if you already have the host name. The other way to represent a host is through the wild card mask ( * ) in an address range with the same content. Entire subnet ranges can be defined using wildcard masking so that entire A, B or C classes can be defined as a host.
3. Host verification: this function allows you to find a host through its name or IP address and returns its real identification, indicated by its own host. When the host is found, He@tSeeker Pro™ presents a name suggestion, which you might use as a host name to obtain best results. For example, to the www.ion.fortresstech.com host, He@tSeeker Pro™ resolved the IP 207.120.127.90 and the name ion.fortresstech.com, and suggested the ion.fortresstech.com name for its protection.
2. Control Access of Directories and Files: He@tSeeker Pro™ allows you to specify a path to a specific directory or file. For example, you can block or allow access to a specific directory or to a specific HTML page in a WWW server protecting the Access to an Intranet Directory.
3. Deny Access: He@tSeeker Pro™ controls outbound and inbound traffic on the workstation separately, for each host, through its bi-directional control. If the Outgoing check box is marked, the outgoing traffic is protected. If the Incoming check box is marked, the incoming traffic is protected.

2. Auditing

4. Registers the beginning and the end of access of the Hosts in the log file, indicating the accessed Hosts or IP address.

5. Sends E-Mail to Admin on violation. This option allows you to configure the IP address of the Mail Server, which should be used from He@tSeeker Pro™ to send security denial of service alerts to the Administrator using e-mail. Use the Manage Administrator Mail List to select the users with administrator status who will receive security denial of service mail alerts.
6. Monitoring and consolidating Internet / Intranet usage. The Auditing tool allows network access and Internet / Intranet usage analysis through spreadsheets, graphs or data. This data can be exported for analysis by other software.
7. Collection of information through the system log. This guarantees data security, as it is not available to regular users. The auditing sub-system of the He@tSeeker Pro™ is available only to Super Users.
8. He@tSeeker Pro™ has a variety of reports and statistics graphs of the TCP/IP service usage, with executive information, such as: Most frequently accessed hosts, most frequent user or most used workstation, etc. The auditing graphs can be configured by workstation, user, time and general.
9. The log file is in a proprietary format for the purpose of security and performance. Nevertheless, it allows you to export the log to some standard formats to use with others tools like ASCII, DBF, DIF e HTML.
10. Spreadsheet fields (see Section 5.3)
11. The information presented on the spreadsheet is refreshed every 15 seconds, or whenever the user presses the left mouse button.
12. The auditing module allows you to apply restrictions to the log being inspected, so you see a partial view. For this reason, auditing supplies the Configure Restrictions option, which affects the entire log file. You can create the restriction you want by selecting the setup fields, shown from left to right, and applying an AND or an OR operator after each condition, by selecting the corresponding button.
13. Three versions of the log file: Spreadsheet, Graphs and Statistics
14. He@tSeeker Pro™ makes several activity evaluations available in graph format, which can be presented in many ways. The Graph options are 2D-Bar, 2D-Column, 2D-Total, 3D-Bar, 3D-Column and 3D-Pie.
15. Graphs and statistics can be viewed by frequency and time.
16. The Administrator is able to generate several kinds of statistics and graphs, like:

. % of use of the equipment by host;

. % of use of equipment by service (HTTP, FTP, Chat, E-mail, etc.);

. % of use of services per user;

. % of use of services per station;

. % of use of hosts per user;

. % of use of hosts per stations;

. e-mails sent;

. e-mails received;

. Number of Access to hosts and services.

17. He@tSeeker Pro™ is able to export the log to five different Log Formats: HTML, ASCII, DIF, DBF and his private format.
18. He@tSeeker Pro™ allows you to merge different workstation logs, generating a consolidated log file that shows all of the registered activity by date and time. When you work with consolidated log files you can see a more general picture of network usage, with more global statistics and graphs.

3. Ease of Use and Transparency

2. Allows you to install from a Single Point
3. Silent Client Installation
4. Automatic Client Upgrade
5. Show denial of service message, this option will show a "violation notification" message to the user when attempting to access a site or service that is blocked. If this check box is unmarked, the user will receive an error message from the application being used (for example, Netscape) if he or she tries to access something not permitted.

2. Three objects to be managed ( Users, Groups of Users and Hosts )

4. GUI Interface
5. Synchronizes the users and groups’ information displayed by He@tSeeker Pro™, along with the user's authentication method being used. He@tSeeker Pro™ reads and displays the users and groups database immediately after it is loaded. For example, if a user is excluded from the users database operating system after He@tSeeker Pro™ is loaded, the administrator can use the Synchronize command to delete the relationship of this user to the hosts and services.
6. Enable/Disable He@tSeeker Pro™. This is a useful tool to determine if the software is enabled or disabled. This option is useful for network tests, when the absence of He@tSeeker Pro™ can be simulated without the need to uninstall the product.
7. Uses DNS. This resource allows He@tSeeker Pro™ to control, not the Domain Name Server (DNS), to resolve names. This resource is enabled by default, and should be disabled only if the workstation uses a Proxy Server to access the Internet and does not have a DNS Server configured.
8. Host verification. This function allows you to find a host through its name or IP address and returns its real identification, indicated by its own host. When the host is found, He@tSeeker Pro™ presents a name suggestion, which you might use as a host name to obtain best results. For example, to the www.xyz.everysite.com host, He@tSeeker Pro™ resolved the IP 207.120.127.90 and the name xyz.everysite.com, and suggested the xyz.everysite.com name for its protection.

2.9.98

He@tSeeker is a trademark of Fortress Technologies, Inc.
© 1998 Fortress Technologies Inc. All rights reserved.

©1998 NetVersant Technologies. All rights reserved.
For further information, please call
(800) 274-6065 or e-mail NetVersant.