Pardon the omnibus response, but it's been quite busy the last seven days
here in Glorious Dexter, Heart of the Internet. So onward:
Mark Ludwig (Mark-Ludwig @
uai .
com) complains that my analogy that
"connecting to the information highway without a firewall and a
security policy is like removing all the doors from your building" is
an exaggeration. Then he says that the internal doors and corridors
are secured by the vendors supplying the systems. Exactly -- we know
the systems are suspect, so if you aren't *as a matter of policy*
taking the extra steps to secure those systems, you have no secure
internal doors. If you don't have a firewall, you have no secure
external door. I stand by the analogy.
Mark Moraes <Mark-Moraes @
deshaw .
com> wrote:
MarkM> In general, cost is a concern for most people once the
MarkM> functionality/reliability requirements are met . . .
He goes on to compare a $2,500 filtering router to a $25,000 firewall
and points out that if a client is willing to accept the limitations
of the former, they'll always chose it over the latter. Absolutely,
it's the only rational decision. However, there are two related
problems. First, until fairly recently most sites have simply not
considered security as one of the requirements [[and I might cynically
add that even if they did, in far too many vendors cases the security
of their systems was so close to zero there *were* no good choices.]]
Second, there is a real tendency to make an uninformed decision. "Oh,
we can live without <fill in the blank>." Then when there is pressure
to do <fill in the blank>, they open holes in the filter and are right
back where they started from, ie, zero.
Going on on this topic... There is an understandable tendency in any
corporation to not regard security as a departmental issue. If
department A is well-supported and puts effort into security while
department B just uses whatever is shipped from the vendor, department
B will run at a lower cost than department A. This is especially so
when evaluating the vendor-shipped security of a given system. First and
foremost in any hardware selection is if it runs the software you need.
That choice often narrows the field to one, count it, one contender.
Suddenly it's not a price/security choice any more. If the corporation
needs that software, the decision is made. Then you make an after-the-
fact decision about how to live with it. In such cases, a firewall is
almost always cheaper than making the vendor systems secure and keeping
them so.
Follow-Ups:
|
|
