How important is NAT as a security layer?

Question

I've signed on to help a department move buildings and upgrade their dated infrastructure. This department has about 40 employees, 25 desktops, an old Novell server, and a handful of laboratory processing machines with attached systems. At the old location, this department had two networks - a LAN with no outside access whatsoever on an entirely separate switch, and a few machines with outside access.

We are trying to modernize this setup a bit as pretty much every user needs to access email and the time tracking system.

The parent organization (~10k employees) has a large IT department that is in charge of the connection and phone system at the new offsite location. The IT dept. had uverse dropped in and setup a VPN to their central network. Each desktop needs to be registered in the IT dept's system/website to get a (static) IP Address. Each IP Address given is outside accessible on any port that has a service listening on the client machine.

The server has confidential (HIPPA) data on it, the desktops have mapped network drives to access (some) of this data. There is also a client/server LIS in place.

My question is this: Is it worth making a stink that all of these machines are outside accessible?

Should we:

• Request NAT to abstract the outside from the inside, as well as a firewall that blocks all traffic not explicitly defined as allowed? If so, what argument's can I make for NAT/firewall that outweigh the benefits of them having each machine registered in their system? I would be relaying all IT related requests from the end users to the IT department in either case - so it doesn't seem very necessary to have them tied down to specific addresses in their system. Most importantly, it sounds like a nightmare to manage separate firewalls on every desktop (varying platforms/generations) and on the server.
• Request the IT dept. block all incoming traffic to each wan accessible IP on whatever existing firewalls they have in place
• Keep the departments LAN completely isolated from the internet. Users must share dedicated machines for accessing email, internet, and time tracking system.

Thanks in advance for any comments or advice on this.

Answer 1

NAT and firewalling are completely orthogonal concepts that have nothing to do with each other. Because some NAT implementations accidentally provide some firewalling, there is a persistent myth that NAT provides security. It provides no security whatsoever. None. Zero.

For example, a perfectly reasonable NAT implementation might, if it only had one client, forward all inbound TCP and UDP packets to that one client. The net effect would be precisely the same as if the client had the outside address of the NAT device.

Don't think that because most NAT devices have some firewalling built in by design or do some by accident that this means NAT itself provides any security. It is the firewalling that provides the security, not the NAT. The purpose of NAT is to make things work.

You must not assume a machine is not outside accessible just because it's behind a NAT device. It's not outside accessible if some device is specifically configured not to permit it to be accessed from the outside, whether that device does NAT or not.

Every machine having an outside address but with a stateful firewall that's properly configured, managed, and monitored is vastly superior to a cheap SoHo NAT box.

Many actual SoHo NAT boxes forward traffic to inside hosts despite no inside host having ever sent traffic to the source of the forwarded traffic. Permissive NAT does really exist.

Answer 2

Having just spent 7 years at a University with a /16 netblock and put everything on that netblock that wasn't specifically prohibited to be on such (PCI-DSS used to require this, until they fixed it), I have some experience with networks of this nature.

NAT is not required. All NAT does is make it a bit harder to reconnoiter a network, and forces an entity into a more-secure-by-default posture. That said, it is perfectly possible to build a secure network on public IP addresses. There were a couple of subnets that we had that were technically routeable, but nothing outside the perimeter firewall could get there.

Now for your other points:

Request the IT dept. block all incoming traffic to each wan accessible IP on whatever existing firewalls they have in place

This should be done by default. In my old University, the Student Computer Lab stations had no need to be addressable from the Internet and they weren't. The same went for the subnets that held the Student Health Center data. If a machine needed to be externally visible for some reason, there was an electronic document that had to be passed around and signed before it could be granted; even for servers in the centralized IT stack.

Keep the departments LAN completely isolated from the internet. Users must share dedicated machines for accessing email, internet, and time tracking system.

You don't have to go this far. The reason to go this far is if your fear of malware-related information-exposure is higher than the need for connectivity to network-based resources. Things are increasingly cloud/network based these days, so such air-gapped networks are getting harder and harder to maintain. If you truly do need to go to this extent, you may want to look into some of the Application Virtualization options out there, as that can limit the exposure of breaches should they occur.

Answer 3

As others have pointed out, NAT is not a security feature. However, it does offer some level of security as a byproduct: a side-effect of NAT is that none of the inner machine is accessible "from the outside". The same effect can be achieved by a firewall which blocks all incoming connections. This is not fine-grained, but rather effective in practice, and if NAT did not come with that "automatic" protection, a lot more existing networks would be attacked and zombified into spam relays (that's the scary point about IPv6, by the way: IPv6, when [if] widely deployed, will have a tendency of nullifying the protection effect of NAT, and one can expect an average increase of attack success).

Now having a well-configured firewall assumes that whoever configures the firewall does his job correctly, and, unfortunately, that's not a given (I do not want to presume on the abilities of your specific IT department, but the average quality of the work of IT departments around the World, especially in large organization, is less than thrilling). The alternative being to ensure that every single machine which is publicly accessible should resist all kinds of attacks related to incoming connections: close all unneeded services, make sure that the services which remain open are properly up-to-date and well configured. Fancy applying security updates on every single workstation ? And on the firmware of network-able printers ?

My advice would be to install your own filter box, through which all communications between your network and the outside world will go. That box should then filter out incoming connections; NAT and/or firewall, that's your call. NAT may be easier, especially if the IT department is "uncooperative".

Answer 4

Regarding masquerading (as opposed to static NAT):

Cisco

• '...it is not possible to "reverse map" incoming connections for other ports unless another table is configured'

• '....NATs can be placed into a role as a component of a site's security architecture, providing protection from attacks launched from the outside toward the inside network.'

Sans

• '...an excellent first layer of defense...can still be hacked. But now the hacker must compromise one of your internal systems to use as a bridgehead on your local network'
  (Daniel Crider, SANS Institute, InfoSec Reading Room, 2001-11-22, A 6-Layer Defense for an I.T. Professional’s Home Network, page 5)

IBM

• 'protects your personal computers from communication that is initiated outside your network because for range NAT to start, traffic must be initiated internally'

No, it's not a subsitute for a firewall, nor for other parts of your security solution. It does enhance the integrity of your systems.

Answer 5

NAT is not important as a security layer and shouldn't be thought of as providing any security (even when it inadvertently makes it more secure).

I don't know HIPPA compliance, but PCI compliance requires very specific setups for computers having access to credit card information. You should design around first meeting the HIPPA requirements and then design additional security measures. The joke of PCI compliance being that compliance reduces the risk of fines, but not necessarily reducing the risk of security exploits.

HIPPA rules might inform you of how you have to treat the computers that have access to HIPPA data.

Answer 6

Even though I know a bit about NATs and port forwardings I disagree most of what David Schwartz wrote. It might be because he was a bit unpolite Read the second paragraph of my answer.

NAT is not the answer to everything. It just makes it difficult for external parties to connect to your services. Most NAT implementations do conversion port-by-port basis and if the host in incoming packet is not recognized there will be no NAT rules to follow, therefore denied connection. This still leaves some holes with the server client just connected to connecting back.

More important is to secure yourself from inside connections as well as outside connections. NAT provides false security in this way. You only need one bug from an USB stick and there could be connection forwarding letting everyone in.

Regardless of your IP space you should limit connections to those allowed. Workstations usually should be not allowed to connect to SQL service. I personally do not like stateful firewalls but each to his own. I'm more the router type kind of guy drop all packets.

Answer 7

NAT is a Firewall. And It's not an opinion. It's a fact. Looking into the definition of Firewall:

A firewall is "a system or combination of systems that enforces a boundary between two or more networks."

National Computer Security Association's standard Firewall Functional Summary template

A NAT creates exactly that sort of boundary.

What other firewalls maybe provide is the ability to block outbound connections, not just incoming connections. Nice feature, but not the main one.

Talking about features, a DMZ is a hole between networks. Normally it provides a way to expose an internal service to the Internet. While not technically part of the NAT definition, it's a feature of all modern NATs

NAT is firewall and in some situations, the best one. Stateful inspection firewalls, which don't do NAT, do mostly "fail-open". I worked for a "Next generation firewall" company as developer. To do the protocol/application detection inline, some packets had to pass through until it get detected. There were no way to buffer it, without introduce delay. Almost all DPI solutions work like that.

NAT, on the other hand, fails closed. Common mistakes shutdown access to the Internet rather than open up access from the Internet.

Answer 8

Every response on this thread regarding NAT neglects an important aspect of NAT. The implementation of NAT creates an internal, private, non-routable address range. The term "non-routable" is significant. Hackers love to exfiltrate an organization's network data streams, and operating with your local internal network traffic on a public address range means the whole notion of defense-in-depth is significantly diminished. Why would anyone want to create conditions that allow your local traffic to be routable to the global Internet? To make things as easy, a malicious attacker could hack the device and add routes - but why would you give such an individual one less hurdle to backhaul your internal network data streams?

Put another way, should litigation arise from a HIPAA breach, what lunatic could take any courtroom stand and swear under oath that giving a hacker a direct flight to your sensitive information was a sensible decision? Would home wireless router manufacturers discontinue NAT as a customary default because their legal tells them, "Sure - Roll the dice... We should burn down our legal budget for the decade defending a case where we put personal residential systems in countless households in a state that (basically) leaves their collective pants were down around their ankles!"

I suspect there are too many who simply care to excuse implementation because they cannot or will not take the time to configure proper static or dynamic NAT or PAT as a best practice. PLEASE avoid needless ridicule and jail time by ignoring federal standards. If you accept any federal medical insurance, the NIST minimums are required. Debate elegant exceptions for a given tech outlier all you want, but let's not give anyone the impression it is a good idea to make an environment more vulnerable. Hypotheticals aside, doing the right things does take more time and effort... but there are cases where the right thing is the best choice.

Answer 9

With regard to your question "should I make a stink?" I would suggest that a risk assessment (issue, probability, impact, mitigation) be documented and presented to stakeholders. If you make a lone decision without communicating it and there is a significant breach, it could bode poorly for you.