|
-
August 10th, 2003, 05:37 AM
#10
A dedicated firewall is neither necessary to achieve good security, nor is its mere presence sufficient to achieve good security. However, having a dedicated firewall can help you improve the security of a network.
A dedicated firewall gives you an opportunity to improve your security in several ways:
Central audit/control point
This is the most popular reason that people use dedicated firewalls. It's much easier to keep all your security and access controls in one place. If you have a large network, it's inevitable that someone is going to have a highly unsecured machine. Having a dedicated firewall between that machine and the "bad guys" means that machine might not be immediately compromised. Unfortunately, this kind of thinking gets people in trouble. First of all, you probably want to let some traffic in. Having a super-cool firewall means little if your web server allows perfectly innocuous-looking requests to take control of the machine. Secondly, people tend to assume that the bad guys are all on the outside of the firewall. This ignores trojans, disgruntled employees, modems inside the firewall, virus infected floppy disks, etc. Lastly, this approach has limited applicability if your firewall is not secure. In response to IT manager's over-reliance on firewalls, many security experts tend to downplay their utility. This is just as foolish as treating them as magic bullets, for the reasons below.
Defense in depth
If you're running a network of Linux and Windows machines, for example, you can increase you security by putting them behind an OpenBSD - based firewall. This can mean that, in some cases, an attacker will have to break into 2 systems in order to compromise a system that you are trying to protect. Let's say that your Linux boxes have a built-in firewall, and you're using it. Now say that there's a vulnerability in that firewall that allows an attacker to bypass it. If that vulnerability does not exist in the dedicated firewall, then the attacker cannot exploit the Linux vulnerability.
Dedicated firewall can be more secure than other machines
One advantage of having a dedicated firewall is just that: it is a dedicated firewall. It doesn't need to have a web server, or allow ssh, or anything of the sort. It can just sit there in a locked room with a keyboard and monitor. Some firewalls don't even need an IP address. This makes them much more resistant to attack than other servers, which have this pesky habit of interacting with remote users. Many firewalls allow remote administration. This makes them more convenient, but less secure.
So, if all the machines on your network are perfectly secure, there's no reason to have a firewall. Alternately, if your firewall is perfectly secure, and your machines are perfectly protected against back channels and subversive users, there's no reason to have them be secure. However, out here in the non-theoretical world, you really should have both.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|