RE: [fw-wiz] Vulnerability Response (was: BGP TCP RST Attacks)

From: Marcus J. Ranum (mjr_at_ranum.com)
Date: 05/27/04

  • Next message: Ben Nagy: "RE: [fw-wiz] Vulnerability Response" 
    To: "Ben Nagy" <ben@iagu.net>, "'Claussen, Ken'" <Ken@kccweb.com>
Date: Wed, 26 May 2004 18:30:10 -0400

    Ben Nagy wrote:
    >To me, amongst the plethora of product, service and snake oil there are two
    >evolving solution spaces that solve real problems. Host based vulnerability
    >mitigation

    The big problem with host based anything is that the management effort
    scales with the number of hosts. That's just a losing battle in the long-term
    because nobody's host-count is shrinking. Basically, the host-side problem
    is the same as the system administration problem - and the industry has
    made a frightening bodge out of its attempts to "solve" that issue.

    > and anything that allows an organisation to condense and
    >prioritise information about where they are exposed to known vulnerabilities
    >in realtime.

    Asset management, change control, and security workflow are all
    good, yes. Condensing and prioritizing is just part of it. I'm not
    at all convinced that it's enough. After all, if you condense and
    prioritize the "must fix: disaster" list for many companies you'll get
    a list so long that they'll decide to do something else, instead.
    Anything else, in fact. :)

    > Firewalls remain a critical part of any infrastructure, of
    >course, but, to be frank, they just don't work as well anymore.

    Firewalls are perfectly good tools that are regularly mis-used.
    It says more about the intellectual state of security than it
    does about the technical usefulness of firewalls.

    The problem is that firewalls are a tool that was intended to be used
    in "default deny" mode and the technical user community is operating
    in a "vulnerabilty centric" mode. Rather than focusing on doing a few
    things safely, the idea is always to figure out what the current threats
    and vulnerabilities are, and whack those. That's a really useless
    approach in the long run. I'd guess that a significant number of the
    firewalls I've seen are being used to knock down "well known bad things"
    instead of "only allow a few good things." I did a talk the other day
    in which I outlined the "old-school" secure firewall approach (non-routed
    networks, proxy everything, default deny, audit policy violations) and
    people in the room were amazed: "None of our users would accept
    that kind of solution!" they cried. Therein lies the rub. As long as something
    so important as security is the tail trying to wag the dog, it's not going
    to go anyplace.

    You *think* host-based vulnerability mitigation (what *is* that,
    by the way? it sounds like marketing...) is going to work. But
    that's just because not enough users have TRIED it enough to
    figure out how to politically sandbag it, yet. But don't worry, they
    will. Remember, users are supposed to be running host-based
    antivirus, too. :P

    mjr.

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Ben Nagy: "RE: [fw-wiz] Vulnerability Response"

    Relevant Pages

    • RE: Firewalls (was Re: IDS evaluations procedures)
      ... firewalls will work much better than network firewalls, ... God know that if there existed brain based personal firewalls, ... So far, most host based solutions I've seen are not ...
      (Focus-IDS)
    • PIX firewall (501 and 506) outside subnet not available to inside hosts
      ... They are behind PIX firewalls. ... The firewalls are configured for interface PAT. ... "static" entry for the server. ... Neither server is able to connect to any host on the same ...
      (comp.dcom.sys.cisco)
    • Re: Untersuchungen
      ... Personal Firewalls kaum geeignet sind, ... Personal Firewalls und z.B. 'host based packet filters' ... privat genutzten PC als Client unterhalten, ... Für einen privat genutzten PC als Client, ...
      (de.comp.security.firewall)
    • Re: VOIP Security
      ... where each of has own specific vulnerabilities. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ... login pages, dynamic content etc. Firewalls, SSL and locked-down servers are ...
      (Pen-Test)
    • Re: Untersuchungen
      ... >>| Hier wird gerne und häufig Personal Firewalls ein Sinn herbei zu ... > Installation eines 'host based packet filters') werden soll. ... Next by Date: ...
      (de.comp.security.firewall)