Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
355
sible (e.g. DDOS attack). Some reactions may be harmful from the point of view
of protected domain business.
In FCDS prototype there are implemented following open source reaction
elements:
• Firewall – iptabeles;
• DNS blackholing – Bind;
• Web Proxy – Squid.
They were chosen after requirements definition for developed system.
First of them iptables [14] is an application used to manage packet filtering.
It enables creating Linux firewalls (stateful firewall) or NAT (Network
Address Translation). System administrator defines chains including set of rules
e.g. ACCEPT, DROP, REJECT (Figure 6).
Figure 6. Definition of rules for iptables
Each rule in a chain contains the specification of which packets it matches.
Packets are processed by sequentially traversing the rules in chains. In FCDS iptables
is used for dropping IP packets when source/destination address is recognized
as intrusive.
Second implemented RE is also open source software for DNS blackholing
– Bind [15]. Bind publishes the Blacklist of IP addresses of zombie computers
or other machines being used to send spam, listing the addresses of ISPs who
willingly host spammers, or listing addresses which have sent spam to a honeypot
system. In FCDS system the blacklist is created basing on HSN sensor (system
Honey Spider Network [9] working as a sensor). In the case of FoS environment
DNS blackholing is destined for user computer protection against visiting infected
www portals. It requires proper user terminal configuration to enforce utilization
of appropriate DNS server.
As the Web Proxy as RE in developed system is used Squid [16]. Squid
is a proxy which offers a rich access control, authorization and logging environment
to develop web proxy and content serving applications. Squid is a highperformance
proxy caching server for web clients, supporting FTP, and HTTP