Re: Going meta (was RE: [fw-wiz] Ok, so now we have a firewall...)

From: Scott Stursa (stursa_at_mailer.fsu.edu)
Date: 06/02/05

  • Next message: Chuck Swiger: "Re: [fw-wiz] Is NAT in OpenBSD PF UPnP enabled or Non UPnP?" 
    To: "Marcus J. Ranum" <mjr@ranum.com>
Date: Thu, 2 Jun 2005 16:28:42 -0400 (EDT)

    On Thu, 2 Jun 2005, Marcus J. Ranum wrote:

    > Bill McGee (bam) wrote:
    > >This is a classic "perfect world" versus "real world" scenario. I think
    > >Chris Blask nailed it on the head earlier when he said we have to
    > >acknowledge (and live with) the limitations of what we have while
    > >working to build something better. That's a challenge to be taken
    > >individually AND as a collective.
    >
    > I must disagree.
    >
    > As I read your posting, I had to take a couple of deep breaths
    > because it triggered a really strong emotional response in me,
    > and I wasn't sure why.

    Likewise yours triggered a strong response in me, and I know exactly why.

    Not that I disagree with you - I don't. In fact, I've had a lot of respect
    for you since attending the IDS tutorial you gave at the 2000 USENIX
    Security conference.

    Plus, like me, you own a Harley (yours may be prettier, but I'm sure mine
    is faster).

    And I agree with most of your post; where I have an issue is with the
    "standing up to the manager" bit.

    ----<major snip>-------

    > Some possibilities:
    > - Some of the products we're buying simply don't work

    Too true.

    > - Some of the products we're buying aren't being used
    > properly

    "Some"? Don't you mean "most"?

    > - There is no correlation between cost and effectiveness
    > of security products

    There may be, but it's very low.

    > To me, the stellar example remains the whole firewall
    > "debate" of the early 1990's. Let's not beat around the
    > bush: convenience kicked security's ass in 1994 and
    > has been kicking it ever since. Yes, there are lots of
    > perfectly good-sounding "business justifications" for
    > doing it, but today's firewalls let too much stuff back
    > and forth. To me, the fact that organizations with
    > firewalls continue to get brutally hacked is empirical
    > proof of that view.

    I've audited a number of FWs here (mostly PIXs) and most have rulesets so
    loose that running the firewall is pointless.

    > I know a handful of organizations
    > that have very strict firewalls with draconian and
    > unpopular rulesets - and they simply don't get
    > hacked.

    That's true for the one I administer. They've not been hacked since I took
    it over, but they complain about not being able to do msn messenger.

    > I am totally sympathetic to the plight of the security
    > practitioner who isn't willing to put his job on the line
    > by telling the CTO he's a moron. I completely understand
    > why people feel they need to compromise. But I still
    > think compromise is for sissies.

    THIS is what got me riled.

    Last spring we completely re-engineered the network for a large school
    here at the university. I redesigned the network to put different
    populations of hosts into separate network segments; internal-use-only
    servers on one, desktops on another, etc. I implemented port security on
    the switches so that they can't just walk in an plug in a laptop. We put
    wireless on its own segment and force authentication through a BlueSocket.
    All these segments are set up on separate VLANs and communicate with each
    other via a PIX, utilizing the VLAN support introduced in 6.3 code). IRC
    and "fun" stuff (e.g., msn messenger) are blocked, inbound and out.

    To a great degree I relied on the principles outlined by you in your "Re:
    ISO 17799" post to this list on 20 July 2004.

    This plan put me at odds with my manager (an arrogant young man who
    considers himself God's Gift to IT), who felt that "our first goal
    should be to get the network up and stable - we can go back and make it
    secure later". I countered with, "An insecure network is an unstable
    network - just ask the [protect-the-clueless] department". He didn't have
    an answer for that.

    So I held my ground and we did it my way. The result - no compromised
    hosts since then (beginning of March).

    But I've paid for that. Two months ago he did a performance appraisal on
    me, giving me the first "unsatisfactory" rating I've received in 26 years
    of working for the university. I'm on probabtion and having to document
    literally every minute of my day. Not that it will make any difference - I
    fully expect to be unemployed when my contract expires in August.

    This is the price I'm paying for *not* being a "sissy".

    - SLS

    p.s. Harley for sale - priced for quick sale!

    ------------------------------------------------------------------------
    Scott L. Stursa 850/644-2591
    Network Security Analyst stursa@mailer.fsu.edu
    OTI Enterprise Security Group Florida State University

                         - No good deed goes unpunished -
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Chuck Swiger: "Re: [fw-wiz] Is NAT in OpenBSD PF UPnP enabled or Non UPnP?"

    Relevant Pages

    • Fwd: CERT Advisory CA-2003-08 Increased Activity Targeting Windows Shares
      ... poorly protected file shares. ... Intruders have been able to leverage poorly ... The network scanning associated with this activity is widespread but ... W32/Deloder attempts to compromise the Administrator ...
      (Bugtraq)
    • Re: ISA 2006 configuration question - multiple VLANs and domains
      ... very familiar with network segments vs. domains et. al. ... multihomed ISA 2006 server forward a DHCP request to the proper VLAN ... ISA is a Firewall Product designed to protect a network from the Internet. ...
      (microsoft.public.isa.configuration)
    • RE: [fw-wiz] Firewalls v. Router ACLs
      ... people to take in consideration in network design and layout. ... here and the old firewalls list often emphasized an approach that avoided ... The logging alert features alone turn this layer into a IDS as ... > An appropriately sized router will not have any performance problems. ...
      (Firewall-Wizards)
    • [fw-wiz] IDS/IPS and LOGS
      ... nasty behavior is happening on your network (where your network is ... easily turn your IPS into a big denial of service attack. ... My guess is that most of the Worlds firewalls and IDS/IPS only have half ... I noticed that there is a big emphasis on log parsing while there should ...
      (Firewall-Wizards)
    • Re: Establish persistant outbound connection for covert application
      ... which firewalls are running etc.) and then communicate its ... the actual network layer. ... They do have 2 network interfaces in case I want to chain them between a PC ... They also have a wireless interface so I can hook into the machine if I am ...
      (Security-Basics)