Re: ISA Server or Firewall Appliance?

From: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (sbradcpa_at_pacbell.net)
Date: 11/16/05

  • Next message: Abe Getchell: "Re: ISA Server or Firewall Appliance?" 
    Date: Wed, 16 Nov 2005 09:50:48 -0800
To: mailing.list.spooler@gmail.com

    I've seen/read the CISCO security guides on NSA... I've seen
    misconfigured appliance firewalls. There's a lot of complexity out
    there even in these dedicated devices.

    I'm not convinced 'the vast majority of that complexity doesn't exist'
    is a valid statement anymore in what we have going through our
    firewalls these days and what we have installed.

    I'm a SBSer so throw me out the best practices window anyway as I break
    all of 'em ... but take a box [a], stick a secure.inf template on it or
    run the Secure Configuration Wizard, I'm just not convinced that unless
    you have folks that understand that firewall you can make such blanket
    statements these days.

    Cisco Router Security Recommendation Guides // National Security Agency //:
    http://nsa2.www.conxion.com/cisco/

    [a] and when I say ..take a box... that means Windows 2003 only, 2000
    even with .inf's applied just isn't the same beast.

    Abe Getchell wrote:
    > Susan,
    >
    > ISA is a very flexible piece of software, as mentioned previously in
    > this conversation. In technology, flexibility usually implies
    > complexity. In this case, that implication is very true, as both ISA
    > and Windows are extremely complex pieces of software. Complexity is
    > not something you want in a firewall, under any circumstances, but
    > especially not on the perimeter (given a "buffer" which usually exists
    > in regards to an internal firewall). Complexity means more moving
    > parts, more things to break, more things to misconfigure, more things
    > to manage... With an appliance (or appliance-like) solution, the vast
    > majority of that complexity doesn't exist. This theory is a simple
    > "best practice" which many organizations follow, or should, if they
    > don't.
    >
    > Another problem I have, personally, with ISA is the fact that it's
    > (usually) tied into the same directory which an organization uses to
    > manage the rest of their business systems. This functionality should
    > be completely separate in theory (in accordance with "best practices"
    > as well as what Microsoft has stated in numerous whitepapers), but in
    > practice, it usually is not. Managing your perimeter firewall via the
    > same directory you use to manage the print server which is on your
    > internal network is NOT a good idea, for any number of reasons.
    >
    > Abe
    > 

    -- 
Letting your vendors set your risk analysis these days?  
http://www.threatcode.com
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Abe Getchell: "Re: ISA Server or Firewall Appliance?"

    Relevant Pages

    • Re: New?? firewall idea, self-learning?
      ... put parts of the firewall in the kernel. ... No, it _Decreases_ complexity.. ... those command-line nerds that thinks GUIs are evil. ... "Anything worth having is worth fighting for" ...
      (comp.security.firewalls)
    • Re: Dont use a Firewall other than Windows Firewall?
      ... "Sam" wrote in message ... > Windows Firewall, and of course an antivirus scanner? ... I don't believe in increasing complexity without good reason. ... This makes it easier for me to secure it. ...
      (comp.security.firewalls)
    • Re: ISA Server or Firewall Appliance?
      ... ISA is a very flexible piece of software, ... Complexity is not ... in regards to an internal firewall). ... internal network is NOT a good idea, ...
      (Focus-Microsoft)
    • Re: Free AV
      ... I agree that this is typically the complaint leveled at Windows Firewall ... the multilayered approach adds complexity. ... >I think many people recommend an alternative firewall because the Windows ...
      (microsoft.public.security.virus)
    • Re: Fazing out x86
      ... important are fighting on old core. ... we have simple ISA, we can have simpler core, many of them, why not 2 ... x86 core and 4 new core and BIGGER caches!? ... but at the expense of complexity. ...
      (comp.arch)