Trap door; firewalls and ACL

Trap door

A trap door (back door) is a secret entry point deliberately built into a program, bypassing normal authentication, e.g. a hidden username or password, or a special key sequence which gives access. Programmers add it for debugging or maintenance, but if forgotten or misused it is a serious security hole. Example: a login program that accepts the name "zzzz" with any password. It is difficult to detect, so the defence is code review and careful control of development.

Firewall

A firewall is a system (hardware, software or both) placed between a trusted internal network and an untrusted external network (Internet). It checks all traffic and permits or blocks it according to rules. It protects against external attacks, but not those that bypass it (insider attacks, laptops brought inside).

 Internet ---> [ Firewall ] ---> Internal LAN
                  rules

Types:

• Packet-filter firewall: examines headers (source/destination IP, port, protocol) and allows or drops packets.
• Stateful inspection firewall: keeps track of connections.
• Application-level gateway (proxy): examines the content for specific applications (e.g. HTTP, FTP).

Typical rule: allow TCP port 80 to the web server, deny everything else.

Access control list (ACL)

An ACL is a list attached to an object (file, directory, router interface) specifying which users or groups can perform which operations.

In routers, an ACL is also used for packet filtering: an ordered list of permit/deny rules checked from top to bottom. When a request arrives, the OS or router checks the ACL, and permits it only if a matching entry gives that right. ACLs are easy for finding who may access an object, and for revoking access, but a long list slows down checking.

Together, firewalls protect the network boundary, ACLs protect the individual resources inside, and trap doors are what must be guarded against in the software.