System Requirements

Windows 2000 SP3+ (Pro, Server, Advanced Server, Datacenter)

Windows XP Home, Pro

Windows 2003 Server, Advanced Server, Web Edition


Functionality Summary

Tiny Personal Firewall 5.0 combines several layers of endpoint security into one compact product. These layers are:

  • Network Protection (stateful packet inspection bi-directional network firewall)
  • Network Intrusion Detection (packets and streams scanning)
  • Network Intrusion Prevention (real time interception of the network traffic based on the contents of the packets and streams)
  • Windows Security - the complete set of guards protecting:
    • File access
    • Registry access
    • Process spawning control
    • COM objects control
    • Devices access control
    • Services control


Rules in General

All security rules except of Intrusion Detection and Prevention follow this basic concept:

  • Define the Object (protocol & port, file, folder, registry, device, COM etc.)
  • Define additional parameters if any (Remote IP in case of network security)
  • Define what Application should have the access to defined object
  • Define the Access Type to defined object (where you need to – network has only one access type – communicate – while files access four – read, write, create, delete)
  • Define Access Result – allow, prevent, ask-user
  • Define Audit Level – ignore, monitor, alert
  • Define other parameters if present (time, conditions etc.)

Assign the rule to user (select the user) or to the system (applications run under system account)

In This Section

Assignment of the Rule

Assignment Notes


Assignment of the Rule

Application running under User vs. System accounts

You can specify whether the rule will be applied to application running under user account or under the system account.

In order to fully understand the benefits of the assignment it is good to know that one of the features that came with NT (followed to Win2000 and XP) architecture was the ability to run application under various accounts defined on the computer.

User Account Processes

Usually these are the applications which were installed to be run by users interactively. MS Word application run by user John is a different process from the very same MS Word executable run by user Mary. TPF5 can assign different privileges to MS Word for Mary and John and apply these at the same time.

System Account Processes

Usually these are the applications which were installed to be run as a service. Even though the service may run under user account most of the services are designed to run under system account. File sharing and other key services are run under system account as an example. It is very important to keep in mind that most of the time it is not possible to distinguish which user's physical activity invoked behavior of which system service. Therefore you should be planning the rules for system services as the rules common to all users logged on the particular computer.

You can use wild cards wherever permitted and offered and create easily zones restricted for all but certain applications running under certain user accounts only and only at selected time.

See Also

Rules in General

Assignment Notes


Assignment Notes

When you select "All Users" in the assignment and check "Use rule only for system processes, when selected users are logged in (system rule)" it does mean that this rule will apply to any system process when there is any user logged on, as well to system process when there is no user logged on at all. You can think of it that TPF5 assumes (when there is no real user logged in) there is always at least "default" user, so the rules will still apply even then.

See Also

Rules in General

Assignment of the Rule


Common vs. User configuration

TPF 5.0 combines two levels of configuration:

  • Administrator defined (Common Rules)
  • User defined (User Rules)

These two layers of configuration run accross all components of TPF5 including Application Repository, Network Security and Windows Security. IDS and IPS have the configuration common for all users of the computer.

Administrator can create common rules which would apply to all users on the computer. These rules could either support users or restrict users. High Priority Common Rules always overrules user defined rules. Low Priority Common Rules may be overruled by User defined rules. Users do not have access to Administrator defined rules.

Using this philosophy the administrator has the flexibility to provide more flexibility to users with higher level of trust and restrict users with lower level of trust.

Users always create their rules with medium priority. This allows administrator to either give user good base for his decision (set some ask user rule for access to certain files or program network communication) or prevent user from accessing whichever resources the administrator deemed important.

In This Section

Common vs. User Configuration Notes


Common vs. User Configuration Notes

Remember! User cannot change Administrator defined rules!

When operating the firewall users may be presented with the Ask User dialogs which might create the rules interactively. If the user is privileged (he has administrative rights) he could choose to enroll the new rule and application into the Common Rules or Repository. This would result that these rules and application would apply to all users on the computer.

See Also

Common vs. User configuration


Application Repository

The general idea behind the application repository is that only applications which exist in the Application Repository may be assigned with rules. All other applications which do not exist in the Application Repository are treated as "unknown' applications and only general rules effective for 'All' applications may be applied to them.

Once the application is enrolled in the application repository it can be used in the rules. It is recommended to group applications into the application groups in order to assign them with the group policies thus simplify the configuration.

When unknown application starts it is being recognized as unknown application and the user is presented with the dialog (this must be enabled in the configuration (Files and Folders -> Options). At this point the user can decide whether he wants to enroll the application and whether he wants to put the application into some of the Application Groups.

Grouping the application is generally recommended. The user could avoid many additional dialogs asking whether to permit specific access for the particular application.

Default Policy

By default TPF5 comes with one predefined group called TRUSTED. This name of the group is used in rules to set quite liberal access to the network and computer resources. Most users will do with the default group. If you have the need to group the applications more granularly you might enjoy following guidelines.

Effective Group Policies

In general the user could do with fairly simple group policy. All trusted applications could be put into Trusted group and the Trusted group could get unlimited access to computer resources either by general rules or by applying the Exceptions on such group.

More advanced users could create more sophisticated group policies thus protecting themselves against to more sophisticated attacks.

One view to look at the possible grouping of application is to create one application group for network communication, one for file access, one for application spawning etc. Then, since one application can be the member of multiple groups, it is possible to select one set of applications as trusted for network access, another set of applications trusted to access system files, another set of applications trusted to access important documents, another group being allowed to start other processes etc.

Example:

Kazaa may be member of:
- unrestricted communication group (it is P2P, it's got to communicate on random local ports and all ip addresses)
- very restricted file access group (you don't want Kazaa to send you stuff right? So you will allow Kazaa to touch music files only plus whatever system it needs).

Now - when you say - OK, I trust Kazaa, I move it do different group with less restricted file access you don't want to deal with its network configuration, right?

You can imagine that "application group" would be rather called "resource group". Then you assign applications to groups 'access to Docs and Settings', 'run as a server on ports less then 1000', 'access to Run keys' etc. It would be up to the complexity of your environment to create higher or lower number of groups.


Network Firewall

TPF5's network firewall is a combination of stateful filtering on NDIS and TDI layers so that firewall could tie specific network activity to specific applications.

The all new TPF5's technology allows to create the rules for specific applications running under specific accounts and apply them simultaneously on the Windows 2000, Windows 2000 Server, Windows XP Home and Pro and Windows 2003 Server computers.

TPF5's firewall allows to differentiate between the network traffic coming through specific network interfaces and apply different rules based on which interface is used.

TPF5 can make the computer completely stealthed and invisible from the Internet.

In This Section

Network Security Rules Notes


Network Security Rules Notes

Sorting Network Security Rules

TPF5 sorts the rules within the Low Priority, User or High Priority categories on its own. This bring the great benefit of focusing on the configuration itself instead of watching the rules and their order.

TPF5 sorts the rule pretty much like Excel would sort the table - it sorts all rules by Column A, then B, then C etc. In TPF5 these columns and their order are:

  1. Application - Any(*) has the lowest priority
  2. Object (protocol definition) - Any has the lowest priority
  3. IP address - in this order - Single, Subnet, Any
  4. Access - in this order - Ask User, Alow, Deny
  5. Time - Any has the lowest priority
  6. Security Zone - in this order - Safe, Dangerous, Any
  7. Users - All(*) has the lowest priority

Security Zones

TPF5 incorporates security zones Safe Zone and Dangerous Zone. The network interfaces may be assigned to these zones. The zones may be assigned to the particular rules. Then the rule would apply only in case that the network communication would be going through the network interface when assigned to such zone.

As an example you can protect your file sharing ports (UDP 137-138, TCP 139) and apply this protection only for dangerous zone. When you are at your home or corporate LAN you move your network interface into Safe Zone and you will be able to share your files. When you run your laptop at the airport wireless LAN you simply move the interface to Dangerous Zone.

To stealth system ports 135-139, 445 etc.

135, 139, 445 etc, are vital for Microsoft Networking eg. File Sharing, Computer Browsing etc. The activity on such ports is performed by Windows System processes. Therefore all rule that would close theseports must be assigned to an application running under System account in the assignment.

To stealth these ports you need to check:

  1. In which zone you have interface you want to block.
  2. If there is a rule for this zone and ports you want to shut.
    • if there is a rule, you might want to check there is Prevent and Monitor (for Access Result and Audit Level)
    • if there is not such rule, you can create one (or more) using predefined "transport objects"

If you create a new rule make sure that you have specified "system assignment" in rule assignment (indicated by '$').

Also make sure, that for anything different than "allow" set audit level to "Monitor" so, you can later check in Amon or Log that something was prevented.

Hint: You may want to stealth these ports when you are outside and leave them opened when you are at your LAN. Use Security Zones to achieve this. When on LAN move your active network interface to Safe Zone (which would have the sharing allowed). When outside of LAN move your active network interface to dangerous zone.

ICMP Protocol

ICMP is a specific protocol. In order to create the rule for ICMP protocol predefine or 'Direct Specify' the firewall object, choose ICMP protocol and select from variety of ICMP commands.

DO NOT FORGET TO ASSIGN THIS RULE TO SYSTEM APPLICATIONS! ICMP protocol is handled by Windows system processes.

You can configure ICMP only for all apps (*) and as a system rule.

Internet Sharing and Stealth Mode

In Options dialog 'Prevent Closed Port Access' has three choices:

Don't Hide Closed Ports - leave all unused live ports visible from the Internet

Filter Incoming Requests - all ports unoccupied by a live application will be stealthed and packets dropped before they would reach them. This is complete stealth mode resulting that ICS would not work.

Filter Outgoing Responses (ICS setting) - this option will result stealthing of all ports not used by ICS.

Closed Port

Closed Port Access means that there is an attacker coming from the Internet trying to establish/probe the connection on a port which is not used by specific application. TPF5 calls such port as 'Closed Port'. Existence of ports may reveal the attacker information that the computer exists at given location and is potential target.

See Also

Network Firewall


IDS and IPS

IPS (Intrusion Prevention System) and IDS (Intrusion Detection System) are vital for advanced grade information about potential network threats and attacks.

Both IDS and IPS work in conjunction with Network Security engine. IDS passively monitors the incoming connections while IPS intercepts these connections in a real time.

Both IDS and IPS engines analyzes single packets as well as the streams.

Because IPS scans the network traffic in a real time it is recommended to build the number of rules there with caution.

In This Section

IPS and IDS Notes


IPS and IDS Notes

IPS (Intrusion Prevention System) and IDS (Intrusion Detection System) are vital for advanced grade information about potential network threats and attacks.

Both IDS and IPS work in conjunction with Network Security engine. IDS passively monitors the incoming connections while IPS intercepts these connections in a real time.

Both IDS and IPS engines analyzes single packets as well as the streams.

Because IPS scans the network traffic in a real time it is recommended to build the number of rules there with caution.

You can move rules between IDS and IPS by right-clicking the rule and selecting the appropriate choice.

See Also

IDS and IPS


Windows Security Engine Summary

TPF5's unique Windows Security technology significantly improves the security of the desktop (or server) by eliminating the unknown threat - malicious code, dangerous trojans that hackers or perhaps undisciplined employees could implant onto your system otherwise. Our Windows Security technology intercepts the system calls and (driven by rules) allows to set up secured and relaxed areas inside of the host's environment. It also allows to manage the activity of the applications installed on the computer. Furthermore, in the managed environment, TPF5's Windows Security technology allows to manage the access of computer users to files and folders and their ability to run the applications.

The Windows Security engine protects the computer resources against unwanted and suspicious accesses and changes using following guards:

File Access Guard

By accessing the file system, a hostile process could gains access to all your data and files. TPF can restrict access of various applications running under different user accounts to the file system. Imagine a non-privileged user running his instance of MS Word with limited access while administrator user on the same computer running the same MS Word at the same time would have unrestricted access to it.

Registry Guard

The windows operating system saves the system and application configurations within the registry database. If a hostile process changes settings within the registry database, it might leave applications or your entire system unusable or create a security hole at least. By changing the registry database, a hostile application can also gain unwanted access to resources on your computer.

Process Spawning Guard

With Process Spawning Guard you could define whether particular process could be started by some other process or by the user only. You could also define whether the new application woudl run in the security context of the parent application or its own. This can prevent misuse of trusted applications by a hostile code.

Services Control Guard

TPF monitors all access to system services issued from restricted applications. By changing the settings of particular services (stopping or accessing certain services), a hostile process can make your computer unusable or gain unwanted access to resources and data.

Device Access Guard

Manages which system devices could be accessed by specified or unspecified processes. Imagine offering access to floppy drive only to certain applications for backup purposes.

OLE/COM Guard

Certain functional interfaces of the system or applications installed on the computer are intended for the internal use only or for special applications use only. There is no reason for these resources to be used by the third applications under normal circumstances. OLE/COM guard protects these vital resources and experienced administrators have very detailed opportunity to configure it.

In This Section

File Security

Registry

VBA

OLE/COM Protection

Spawning

Services Control

Exceptions


File Security

The File Access protection is probably the most visible and most simple to explain part of our Windows Security engine. Without the file access protection you can buckle up your files seat belts because one day your files are going to say "bye bye".

Imagine Microsoft Word or Excel. These application have typically high level of trust or - in another words - nobody is really concerned about their security. Now imagine all APIs which these application have and their macro capabilities. Did you know that Microsoft Word could be told to delete some of your data?

Hide Them!
Or imagine Windows Explorer. The Explorer is really your window through which you see your computer and your files. This also means that the Explorer has the rights to access all your data and can delete them! With TPF5 you can easily 'hide' particular data or the entire hard drive for unprivileged user so that when he would log on he would not be able to see them! Still - should you desire so - he would be able to use them using specific application (such as book keeping, accounting, statistics etc.)

Windows Security File Guard can eliminate these threats and can easily become your partner in the managing the file access rights on your computer.

In the managed environment the file access rights may be modified based on who is logged on the computer or where is the computer located.

Technically Speaking
File Access Guard intercepts the access of the processes to the file system. It recognizes particular type of access (Read, Write, Create, Delete) for each process/application running under specific user account. One application may have different access rights if running under User1 from the same application running under User2 - SIMULTANEOUSLY!

See Also

Windows Security Engine Summary

Registry

VBA

OLE/COM Protection

Spawning

Services Control

Exceptions


Registry

Microsoft Windows and most of Windows applications store their settings and configuration in Registry. Obviously, altering some portions of the registry could affect stability of the system and the applications. Certain Trojans use registry to bypass virus scan engines making the virus protection ineffective. In addition overwriting some registry settings may cause serious security vulnerability.

What are vital types of keys on your PC?

Run Keys

Protection to overwrite Run Keys is very effective weapon against to most aggressive viruses. Run Keys are special Registry keys. In Windows 98/ME they may be misused (by viruses and Trojans) to auto start any application on or even before user's logon. In Windows NT/2000/XP aggressive virus may cause that the executable would be granted with unlimited access rights to your computer on next Administrator logon. The consequences of this may be disastrous.

Windows Settings Key

The Windows Settings Key protection eliminates the possible attack to capture user name and password during logon as well as the protection of some other important system settings.

Extension Association Keys

If allowed the virus or Trojan could create the association where each time you would execute .exe, .txt, .doc or any other extension based file the virus or Trojan would execute.

Services Key

Driver or Service have unlimited access to your computer. If virus or Trojan would be allowed to add a subkey into Services Key then it could install new service or driver and severely harm the data or compromise the computer security. It is recommended to have this protection always on.

See Also

Windows Security Engine Summary

File Security

VBA

OLE/COM Protection

Spawning

Services Control

Exceptions


VBA

MS Office documents (e.g. *.doc, *.xls) may contain some VBA macros which are often misused by various viruses and trojans. Without VBA Macro guard these macros could replace or delete the important files just by running *.doc attachment .

VBA Macro guard allows to following restrictions on VBA macros:

  • Do not run - Running of VBA macro will be prevented
  • Use Custom VBA Settings - VBA macro would be allowed to run with the security settings set for the custom application 'VBA Macro'. The rule set for such application would be applied for every macro process.
  • Inherit from Parent - VBA Macro would be allowed to run in the security context of the parent application (e.g. MS Word - whichever access would MS Word has the macro would have it too).

One of the more important features of VBA macro guard is the capability to run apply various restrictions based on the macro itself.

See Also

Windows Security Engine Summary

File Security

Registry

OLE/COM Protection

Spawning

Services Control

Exceptions


OLE/COM Protection

OLE (object linking and embedding) was originally developed for cooperation between the applications. Later it has been extended to a complete system - COM. The Component Object Model (COM) is a technology that combines the benefits of object-oriented programming with binary reuse, language independence, version-ability, self-registration, and ease of licensing.

Since the COM technology covers such topics as ActiveX, inter process communications and distributed COM, it could also be very dangerous if misused. OLE/COM guard can control the use of COM by a particular application with the following access rights:

  • COM Initialization
  • Create in-process servers
  • Create local servers
  • Create remote servers

See Also

Windows Security Engine Summary

File Security

Registry

VBA

Spawning

Services Control

Exceptions


Spawning

Process Spawning controll is another user attractive feature of our Windows Security engine. You can see the ability to controll which process can spawn which from two angles:

1. Protection

Malicious Trojan or virus may misuse known and trusted applications to damage the data or make the computer vulnerable to the attack. As an example through the command line instruction a Trojan may instruct command interpreter (cmd.exe) to delete certain or all files. From the other point of view when you set up process spawning rules you must keep in mind that some applications require spawning (engage other processes to run) in order to run.

2. Management

Process Spawning Guard not only protects your Windows applications against ot misuse - it can also manage their use effectively. Say in managed environment when more people work on the same computer (switch users) some users enjoy greater level of trust then the others. In managed environments certain users will be allowed to send email from MS Word application while the other won't.

See Also

Windows Security Engine Summary

File Security

Registry

VBA

OLE/COM Protection

Services Control

Exceptions


Services Control

Services settings determine the protection of the computer against to hostile programs that can register themselves as a system service or stop or delete other services. The service registration was one of the features of well known worm Klez which hit the computers worldwide in 2002 and caused millions of dollars of damages.

There are several levels of Services protection available.

Prevent Service Installation/Removal

The Service Installation/Removal Prevention protects the computer from viruses and Trojans that would take over the system by registering as a system service.

Prevent Service Stop/Control

Standard applications should not have the need to stop or control a service. Stopping or controlling of system services could have undesirable influence on running Microsoft Windows and may significantly affect the system security. Unless there is a specific reason this setting should always be on. This setting still allows Service Start and Query actions since these are not major security threat and certain applications could require to start other services during their activity.

Prevent Start/Query Service

Imagine worm which would detect that you have Internet Information Server (Windows2000 built-in web server) disabled on your computer. It could start it up without your knowledge and expose all data for free download! You can say - "I do have a firewall, right?". Yes you do but answer frankly - would you refuse IIS from communicating when it is known and trusted application?

See Also

Windows Security Engine Summary

File Security

Registry

VBA

OLE/COM Protection

Spawning

Exceptions


Exceptions

Even though Exceptions is not a feature it is very important component of TPF5's functionality.

Exceptions allows to enable and disable various security guards for particular applications or groups of applications. The main use of Exceptions is when you find out that the application would be incompatible otherwise.

Also if you would find out that the application would be 'using' particular guard too extensively without any security impact - then you might want to disable the particular guard for such application.

See Also

Windows Security Engine Summary

File Security

Registry

VBA

OLE/COM Protection

Spawning

Services Control


Backing Up The Configuration

In order to backup the configuration you must backup ..\Program Files\Tiny Personal Firewall\Policy Table.

Please note that User rules can't be moved since these rules are tied to identities on the particular computer. You can still back them up for use on the same computer.

How to fully move TPF5 configuration to a new computer (including user configuration):

  1. Backup Policy Table and move it to other computer
  2. On the new machine log at least once under each user account.
  3. Identify which directory in ...\Policy Table\<module_ID>\Usr belongs to which user on old and new computer
  4. Manually copy the content of XML files from one configuration to another

Reporting

TPF5 includes simple reporting tool available through tab Logs in the Admin Tool.

Please note that TPF5 stores the events in the logs of the fixed size. The Log viewer analyzes and displays data from each day and from each file.