RE: [fw-wiz] Worms, Air Gaps and Responsibility

From: Carson Gaspar (carson_at_taltos.org)
Date: 05/06/04

  • Next message: Mordechai T. Abzug: "Re: [fw-wiz] Worms, Air Gaps and Responsibility" 
    To: firewall-wizards@honor.icsalabs.com
Date: Wed, 05 May 2004 22:28:26 -0400

    --On Wednesday, May 05, 2004 19:32:56 -0400 "Paul D. Robertson"
    <paul@compuwar.net> wrote:

    > On Wed, 5 May 2004, Carson Gaspar wrote:
    >
    >> I can answer for the financials - the user desktops _are_ production. If
    >> the homedir fileserver is compromised, you're in trouble, but you can't
    >> isolate it from the desktops...
    >
    > For some sets of companies, that's true, but that's certainly not true for
    > others- and even when it is, it isn't true of every desktop in the
    > organization.

    As I said, for the financials - many other industries are far less doomed
    ;-)

    ...

    >> VPN is a fact of life given 24/7 trading, and the client desktops need to
    >> access file servers. The best you can do is lock down the VPN clients,
    >> and manage the hell out of them.
    >>
    >> In many cases you can firewall your core back office data from everything
    >> else. Some companies try to firewall by business unit, but the inter-BU
    >> requirements quickly make those such swiss cheese that they're mostly
    >> useful as emergency fire doors when an outbreak happens.
    >>
    >
    > People keep telling me this, but at my last employer, I had a "firewall at
    > each end and fixed security policy" implementation for WAN connectivity
    > that worked just fine. Granted getting the capital for each node wasn't a
    > fun thing and took most of a year- but I think one worm in the last 5
    > years would have needed action with the policy as it was when I left.

    Again, financials are one of the worst case scenarios. New York needs
    access to Tokyo's data, from trader desktops, using proprietary apps, that
    can change their network requirements at whim, if you can even get the
    network requirements short of sniffing packets.

    ...

    > Rate of change on production networks should be slow, measured and under
    > change control- I think it's more a lack of ability to enforce good
    > network discipline and fear of "complaints" more than actual "We tried it
    > for a while and it wouldn't work."

    Again, financials are not normal. We roll out new versions of trading
    software every 2 weeks. It's a very controlled roll out, and we can roll
    back everything or specific projects, but it churns mightily.

    ...

    > I guess I'm just thinking that we should all take half a step back and
    > start asking the basic "should this be connected to that?" question again.

    I agree. My response was to you're "what excuse do they have" question. In
    my specific industry, they have a bunch. Most other industries don't make
    every single dollar based on timely, accurate, electronic information. When
    your entire business is manipulating flows of information, based on other
    flows of information, limiting who can see what is a very tough job. Not
    impossible, but extremely difficult, and very expensive. 

    -- 
Carson
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Mordechai T. Abzug: "Re: [fw-wiz] Worms, Air Gaps and Responsibility"

    Relevant Pages

    • RE: [fw-wiz] Worms, Air Gaps and Responsibility
      ... Some companies try to firewall by business unit, ... Even firewalling each subnet is a support nightmare in the ... "This set of things should never talk" isn't a difficult security policy ... > companies had patched XP desktops, ...
      (Firewall-Wizards)
    • RE: connecting to client desktop still not working
      ... I discovered it is indeed Trend Micro's PC-cillin Internet Security ... If I disable the firewall ... > desktops in my own network through RWW, although I can connect to the server. ...
      (microsoft.public.windows.server.sbs)
    • Re: Network settings ?
      ... access the laptop and vice versa. ... The desktops cannot access each other. ... installed, all 3 are win xp service pack 1, windows firewall is disabeled. ... "Carey Holzman" wrote: ...
      (microsoft.public.windowsxp.network_web)
    • RE: windows xp network problems
      ... > laptop, two of the desktops are Home xp sp1, the other two desktops are pro ... > not see the workgroup on my laptop with the firewall on or off. ... > suspecting it has something to do with sp2. ...
      (microsoft.public.windowsxp.network_web)
    • Re: Problem with Preoject Server 2003 SP1
      ... you have clients with hundreds of desktops, then your clients are likely to ... "Dries" wrote in message ... > hundreds of desktops aftewards and do brain surgery on each desktop. ... >> You can roll back the alarm now. ...
      (microsoft.public.project.pro_and_server)