Kicked off a lot of brain CPU cycles with that post. Good.
I reworded a statement made by management and programers in an
understandable format. I've been asked; "Why would we need a
firewall if my peer-to-peer connection is secure?". I do get
strange looks when I reply, "Uh, centralized control?". That
answer does not justify a $15K purchase in some circles. Another
challenge feeding this is Microsoft Marketing 'You don't really
need a firewall, NT is secure' mentality.
I will be the last to say NT Network Security is tight, even
though they are implimenting tighter authentication and encryption.
For example, I think one can break into administrative shares
without needing passwords on NT internet webservers by simply sweeping
through SMB UIDs for previously cached \c$ connections (more homework
to follow) and I'm guessing most NT IIS boxes on the web do have
shares/server service running. I also think firewalls will need
to deal with stronger client application authentication and encryption.
Part of me also thinks that moving firewall functions to the
desktop is like moving from 'castle wall' perimeter security to
more modern building 'doorlock' security, but admittedly it won't
protect 'the network' against oversize or syn packet attacks, or
users installing insecure services.
Next I'll need protection from ISPs who raise their T1 rates 30%,
and only send a letter to accounts payable, not the domain contact.
Though I won't mention Internex's name (Jab).
Bill Stout
_______________________________________________________________________________
Senior Systems Admin NT/Backoffice/Solaris/WWW-Db/Firewalls/Cisco/VM-UNIX/VMS
Hitachi Data Systems 408-970-4822 --- Disclaimer: I speak only for myself
Follow-Ups:
|
|
