Firewalls made of Straw

Yes, I paraphrased the actual title of the article.... A very interesting article that, if nothing else, compliments my argument against software firewalls....

Source

The killer for the corporate world is this:-

Quote:

---

The problem is that many of these other defensive appliances are rarely monitored. That is a sad but true statement in many cases. Furthermore, even when these appliances are monitored there is a strong possibility that the person who is reading the output does not have the requisite training, or knowledge, to understand the information they are seeing. In some cases, large networks receive hundreds of thousands of alerts every day.

The problem of an intrusion detection system going unmonitored, or misinterpreted is unfortunately an all too common one. Too many corporations invest in the technology yet do not invest in the human side of the equation to manage and monitor the equipment.

---

We've seen that phenomenon before when PC-XTs were new in the market. Companies buy computers and then announce that they are "now computerized" even when they really don't have the full grasp of the potential utilities a computer system would have to their business needs.

So, we see the same "fire and forget" mindset when it comes to security. If I understand the various threads here in AO alone: just because you have a firewall, it does not follow that you're safe.

If a company dares invest in the hardware and software, why not include the investment in the "wet-ware"?

From the Introduction:

Quote:

---

the firewall's operation can be circumvented by inserting a malicious Trojan into the network stack itself.

---

One of the very first text files I read, having found AO, was how to by pass Zone Alarm. A rather scathing attack on ZA also. ( that was 3 years ago ) The above quote is a paraphrase from that text. Or I should say looks like it is.

Amazing what sticks in the mind.

Quote:

---

Though our attacker now has system level access to the server, it is far stealthier to communicate to it via the LSP Trojan to decrease the chance of detection at any point in the future.

---

At this point is not the trojan the only method our attacker has to access the server?????????

Quote:

---

compliments my argument against software firewalls....

---

I agree with you here. I have no problem with a properly implemented software firewall solution. The only properly implemented software firewall being one placed behind a hardware firewall. A software firewall is only as secure as the operating system that it is running on, and is not a acceptable amount of security for a corporate network.

It is an interesting read though, thanks.