RE: Distributed Firewall

From: David Gillett (gillettdavid@fhda.edu)
Date: 04/23/03

  • Next message: David Vertie: "Re: Stealth DMCA. Be afraid. Be very afraid..." 
    From: "David Gillett" <gillettdavid@fhda.edu>
To: "'Kendric'" <Kendric@hotpop.com>, <security-basics@lists.securityfocus.com>
Date: Wed, 23 Apr 2003 10:10:34 -0700

    > -----Original Message-----
    > From: Kendric [mailto:Kendric@hotpop.com]
    >
    > Hi, just wondering if any of you guys heard of this concept
    > of distributed
    > firewall? I have done some research on it and found it to be quite a
    > wonderful concept into bringing the firewall platform to each
    > client/server
    > end with a central management policy. In other words, it is
    > like having a
    > personal firewall on each individual machine, but centrally
    > managed by a
    > remote management console. In this way, we will not have to
    > put any trust
    > even on the machines on the intranet. Any comments?

      I think the idea probably has some merit as part of a "defence
    in depth" approach.
      But I don't think it's sufficient on its own, because the
    resources that need to be protected do not exist just on the
    individual machines. The network which connects them -- upon
    which this approach DEPENDS rather heavily! -- lies outside
    the boundary of what can be protected this way.

      A network which includes both gateway firewalls and individual
    host security is going to be a harder nut to crack than a network
    that relies on only one or the other approach. And centralised
    administration of individual-host firewalls is an idea whose time
    is surely here.

    David Gillett

    ---------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
    world's premier event for IT and network security experts. The two-day
    Training features 6 hand-on courses on May 12-13 taught by professionals.
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor
    sales pitches. Deadline for the best rates is April 25. Register today to
    ensure your place. http://www.securityfocus.com/BlackHat-security-basics
    ----------------------------------------------------------------------------

  • Next message: David Vertie: "Re: Stealth DMCA. Be afraid. Be very afraid..."

    Relevant Pages

    • RE: can ping but not browse
      ... I have stopped the firewall. ... # are safed from all (security) hazards. ... firewall/bastion host to the internet ... # internet and to an internal network, ...
      (Fedora)
    • Re: Log management software for Windows
      ... Log management software for Windows ... I want to retain security and event log data on a Windows machine that is ... for example: the IDS log from my firewall. ... Better Management for Network Security ...
      (Security-Basics)
    • Re: Why not use NETBEUI on Windows XP ??
      ... Trusted zones means that firewall rules will be bypassed for any or certain ... not count on netbeui being a defense for such as long as smb connectivity ... while the connection is open. ... > Microsoft Networking components on my network. ...
      (microsoft.public.windowsxp.network_web)
    • Re: Why not use NETBEUI on Windows XP ??
      ... Trusted zones means that firewall rules will be bypassed for any or certain ... not count on netbeui being a defense for such as long as smb connectivity ... while the connection is open. ... > Microsoft Networking components on my network. ...
      (microsoft.public.win2000.networking)
    • Re: SP1 enables Windows XP firewall how to turn it off?
      ... it's home computers that VPN in that infect office computers... ... If only 10% of network admins would have wanted that on.... ... Got news for you, but with a properly configured firewall, proper filtering of HTTP sessions, proper blocking of attachments, and such, there is little that can make it inbound to the users desktop. ... In a properly configured domain, "Users" have little access across the network to others systems, only the management has the type of access you suggest, and that's the way it should be. ...
      (microsoft.public.windows.server.sbs)