Re: [Full-Disclosure] Why should one buy (or not) an Appliance-based security gateway?

Valdis.Kletnieks_at_vt.edu
Date: 07/30/04

  • Next message: Todd Towles: "RE: [Full-Disclosure] Why should one buy (or not) an Appliance-based security gateway?" 
    To: Bernardo Santos Wernesback <bernardo@ish.com.br>
Date: Fri, 30 Jul 2004 16:45:46 -0400

    On Fri, 30 Jul 2004 14:55:04 -0300, Bernardo Santos Wernesback <bernardo@ish.com.br> said:

    > A few colleagues and I started a discussion as to why one should or shouldn't
    > buy an appliance-based firewall, ids/ips or other security appliance instead of
    > installing software on a server.

    Does "installing software on a server" mean:

    a) Building your own sentinel/gateway box and installing security software on it
    or
    b) installing security software directly on the server that needs protection?

    > We thought about patching, performance, and other reason for each option but
    > I'd like to hear what other people think.

    An often overlooked issue is that the right choice for a clued and technically
    competent site is quite often a poor choice for a site that's not able to
    get its clue together. And there's a lot more of the latter than the former.

    The best thing about an appliance is it's an *appliance* - a site can get
    it, park it in its spot, plug the DMZ-side and inside-side cables into it,
    do a little bit of basic config, and it works. The more configuration
    knobs, the more chances to break it by accident.

    And if you're installing software directly on the server that needs protecting,
    that's just a disaster waiting to happen, especially in the Windows world -
    the last thing a low-level admin needs is for the security software to install
    a DLL that's incompatible with the service to be protected.....

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Todd Towles: "RE: [Full-Disclosure] Why should one buy (or not) an Appliance-based security gateway?"

    Relevant Pages

    • Re: reading web page content
      ... Installing software without installing its documentation ... How does doing development on such a server affect the attack surface? ... The OP said he worked in an environment where perldoc does not work. ... I said that that was a silly environment to work in. ...
      (comp.lang.perl.misc)
    • Re: Installing software in TS session
      ... All of my updates are done on both the server and client machine. ... Server is running Win2k3 server enterprise. ... I need to install a proprietary software to each terminal services profile ... installing software on terminal server is NOT same as other windows ...
      (microsoft.public.windows.terminal_services)
    • Re: Installing software in TS session
      ... All of my updates are done on both the server and client machine. ... Server is running Win2k3 server enterprise. ... I need to install a proprietary software to each terminal services profile ... installing software on terminal server is NOT same as other windows ...
      (microsoft.public.windows.terminal_services)
    • Re: Downgrading frustrations
      ... Forget the tweaking to "dumb it down" it wont help when it comes to installing software. ... When he finds out he is going to have to pay $250.00 to by an antivirus version that runs on a server instead of $50.00 to run on a non server version, ... [For running applications than XP.] ... And without breaking my brainbox - Why isn't it stable/fast when running apps, if it's can handle the duties of a server? ...
      (microsoft.public.windows.server.general)