On Thu, 8 Aug 1996, Steve Kotsopoulos wrote:
> jminie @
earthlink .
net wrote:
> >We're aware of how insecure UNIX is natively. The point here is that a
> >firewall should be as close to 100% secure as possible out-of-the-box,
> >removing the possibility that human intervention (or human NON-intervention,
> >for that matter) doesn't create or allow ANY holes for ANY length of time.
> >
> >A couple of UNIX-based firewall vendors DO address the issue of the
> >non-secure kernel. If kernel insecurity is addressed at the vendor level,
> >(i.e. - the guys making the money) the argument about customer-level
> >'professional' versus 'scanner' firewall users should be non-existent. I
> >truly believe in the concept that, without a hardened kernel there is no way
> >to guarantee a truly secure firewall.
>
> I agree. Here are my new definitions, which may be of use to others:
>
> A 'firewall' is a system that if configured correctly by professionals
> (who have read all the manuals from cover to cover), and notwithstanding
> hardware or software bugs or problems, protects your network.
And I'd like to modify your definations:
A "firewall" is an access control device. It can be used to protect your
network, a small group of hosts w/in your network or even a single host.
A good firewall is determined not only by its architecture, but also by it's
ability to protect both itself and the trusted host(s) located "behind" it.
>
> A 'good firewall' is a system that protects your network.
> It must have defense in depth, so that in the event of a failure (such
> as after the discovery of new bugs), other mechanisms will protect you.
This is but one paradigm. A perimeter defense is the other and is the
preferred defense paradigm among network security consultants. Generally,
spreading out your defense (especially in large networks) can be a nightmare
for system administrators. However, if you like the defense in depth
paradigm and if you have anything worthwhile on you trusted network be
prepared for uninvited guests.
> It must have a fail-safe design, for protection in the event of
> hardware/software problems or administrative errors. Instead of letting
> attackers in when there is a failure, fail-safe systems deny access to
> both attackers and legitimate users. Failure to read the manual may result
> in you not being able to turn a service on, instead of the service being
> wide open without protection, and possibly making your internal network
> vulnerable.
>
> If I wanted to protect my network, I would buy a 'good firewall'.
I would buy a "good firewall" but I think I'd differ from your definition.
>
> Since so many people wanted to talk about the necessity of completely
> reading the manuals, I searched the FireWall-1 web site to see what
> they had to say about it. The closest I could find was the "Ease of Use"
> paragraph at http://www.checkpoint.com/brochure/page10.html
> It starts with "FireWall-1 was designed to be easily installed,
> configured and managed.", then talks about the easy to use GUI,
> and the integrity checking that reduces the chance of operator error.
> I couldn't find any mention of a manual.
I don't want to get into vendor product endorsement or advertising here, but
I would not make a blanket statement like that. The firewall you select for
your site should be determined by your site security policy first.
char
+---------------------------------------------------------------------------+
char sample /* that really is my name */
e-mail: char @
v-one .
com
+---------------------------------------------------------------------------+
References:
|
|
