There seems to be a lot of interest in procedures to allow various
protocols to tunnel through a firewall. This leads me to wonder what
sort of control is being exercised over these protocols, and what sort
of security policy is being enforced by the firewall.
If the purpose of your firewall is to protect company secrets, then it
seems to me that allowing any of the common file transfer protocols
(ftp, gopher, mosaic, etc. etc.) through the firewall is a potential
breach of your security policy. If anybody with access to your
internal network can bring in any program that they want, then you have
no control over your internal files. Assume I, as an industrial spy,
want to steal, say, netlist information. I build a trivial but somewhat
interesting application, which also happens to search all accessible
directries for files that have netlist extensions, and mails what it
finds back to me. I place this program on some net server. Then I post
to a hardware engineer oriented bulletin board, saying what a nifty
program I found, and where to get it. I bet that within a week, I would
have a very interesting collection of files mailed to me, all without
ever attempting to breach any security systems. Sure, the results are
random, but people are willing to search dumpsters for information, and
this method should produce better results with less effort. So your
firewall has completely failed to prevent your proprietary information
from escaping, but since no attack was noticed, you feel secure. Note
that this does not assume that you have "bad" employees, just curious
ones.
Given that you would be lynched if you cut off access to the internet,
what can one do to at least detect this sort of attack? Maybe wrappers
for applications that can transmit information, which would refuse to
be invoked by untrusted programs? Auto-scanning of outbound
mail/ftp/etc. for suspicious patterns? Has anyone tried restricting
connections to only "trusted" outside servers? Any other suggestions?
Paul
Follow-Ups:
|
|
