Re: IPSEC == end of firewalls
While IP level security & authentication will go a long way to help prevent abuses and reduce unauthorized accesses, I doubt if it will provide enough protection by itself. While I would love to be proven wrong, I believe firewalls are here to stay (at least for the next year or two). A couple of reasons why: o Node Spoofing will probably still be possible o The connections will probably also be subject to man-in-the-middle attacks (Never underestimate the creativity of people who want to compromise your networks) o Authentication by itself will *not* provide adequate protection against many abuses o End-to-end encryption by itself won't completely solve the problems either (however, it *does* go a long way to prevent man-in-the-middle attacks o While IP security & authentication helps to secure the pipe between the two systems which want to communicate with each other, it does not provide any security about the applications running over the pipe. (ie - if you and I have a secure pipe between your system and mine & you have a worm running loose on your network, the only thing the secure pipe will do is ensure that other systems (not in the pipe) won't be damaged as the worm propagates out of your network into mine). Also. Which version of sendmail are we up to now? As far as the future of firewalls goes, I would probably guess that the functionality of most firewalls would eventually be an add-on application option for Operating Systems and that eventually it will be a standard part of every Operating System. Until then, we have to punt & keep using firewalls. I suspect even when firewalls are embedded in the O/S, that some type of firewall will still be needed to quasi-isolate a company's network from the Internet (and establish them as one entity) and to contain potential networking problems which arise when someone configures their system with the wrong IP address (or other type of problem). IMHO, the first company to include a firewall as a standard part of their Operating Systems has a real good shot at increasing their market share. Perhaps the O/S vendors are paying attention to this list & will implement this (would be nice). 8^) Of course, it would also help, if their systems were delivered secure - out-of-the-box and we didn't have to spend so much time continually locking them down & keeping up with the latest CERT Advisories. 8^) 8^) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.
Frank Willoughby writes:
While IP level security & authentication will go a long way to help prevent abuses and reduce unauthorized accesses, I doubt if it will provide enough protection by itself.
I agree with this, but...
o Node Spoofing will probably still be possible
Nope. It won't.
o The connections will probably also be subject to man-in-the-middle attacks (Never underestimate the creativity of people who want to compromise your networks)
No, they won't be subject to such attacks any longer. The real problem, as you noted, is that our applications aren't very secure.
I suspect even when firewalls are embedded in the O/S,
That would be somewhat meaningless. The point of a firewall, as others here have noted, is that it is easier to secure one machine than five hundred or ten thousand.
IMHO, the first company to include a firewall as a standard part of their Operating Systems has a real good shot at increasing their market share.
Again, somewhat meaningless, as a real firewall involves defense in depth (screening routers, a bastion proxy host, etc) and is more of a configuration issue than an O.S. issue. Perry
functionality of most firewalls would eventually be an add-on application option for Operating Systems and that eventually it will be a standard part of every Operating System. Until then, we have to punt & keep using firewalls.
I'm not so convinced that adding 'firewall functionality' to an OS is such a good idea. The idea behind having a firewall is that * You have a hardened host that has been stripped of anything that could be used by an attacker to compromise other systems * You have a single machine that serves as the sole port of entry into your domain. By keeping your defense perimeter nice and small it makes it manageable to maintain. When you start trying to swtich firewall functionality to an OS you lose both these advantages. You no longer have a system that is stripped of compilers, scripting languages, etc, and you now have a much larger security perimeter. Ben. ____ Ben Samman..............................................samman@cs.yale.edu "If what Proust says is true, that happiness is the absence of fever, then I will never know happiness. For I am possessed by a fever for knowledge, experience, and creation." -Anais Nin PGP Encrypted Mail Welcomed Finger samman@suned.cs.yale.edu for key Want to hire a soon-to-be college grad? Mail me for resume
I once worked for a company where to get an outbound telnet connection or to put a file with ftp, you needed to go through a gateway which required us to use a hardware device to participate in a challenge/response authentication scheme. While this may be extreme, it points out a use of firewalls people seem to be ignoring in this descussion: enforcing policy. Most employees will have physical access to the network, and physical access (=root privileges) to their workstations. If you want to enforce a policy of "no http servers, ftp servers, or anything else", you can't allow any incoming Syn packets. If you don't want to trust every single person to configure his/her workstation to reject Syn packets from outside, you need to do the filtering where most people can't bypass it. Now replace Syn above with whatever TCP/IPv6 uses, and the same will hold. That said, I hate firewalls. I find being behind a firewall incredibly painful. I hope firewalls do die with IPv6. David
participants (4)
-
Ben -
David Mazieres -
Frank Willoughby -
Perry E. Metzger