Re: Firewall configuration statistics

From: Justin Pryzby (justinpryzby_at_users.sf.net)
Date: 06/20/03

  • Next message: DeGennaro, Gregory: "RE: 40-bit VS 128-bit Encryption" 
    Date: Fri, 20 Jun 2003 07:33:54 -0700
To: "security@rexwire.com" <security@rexwire.com>, security-basics@securityfocus.com

    Well, seeing as I just received duplicates of last months mail, I guess
    I may as well respond.

    My intent in giving SKP two opposite and conflicting statistics is to
    reveal the meaningless nature of the question. Whether marketing
    material says 2% of firewalls are misconfigured or 98% are doesn't
    matter.

    It is a matter of opinion, and I have given SKP my own meaningless
    authority to state whatever he wants. I hope I have also given him the
    motivation to realize that what he wants is an arbitrary number to feed
    to people; I want him to get neither satisfaction nor sales from
    publishing whatever number he decides to use.

    Justin

    On Fri, Jun 20, 2003 at 04:48:02PM +0000, security@rexwire.com wrote:
    >
    > Thank you Greg. I totally agree. If people would just answer questions based
    > on real life experience and knowledge and leave the philosophy to the
    > politicians I think everyone in this group will be happy.
    >
    >
    > -SKP
    >
    > -----Original Message-----
    > From: NC Agent [mailto:NC_Agent@kueppers-familie.de]
    > Sent: Friday, June 20, 2003 12:01 PM
    > To: security@rexwire.com; justinpryzby@users.sourceforge.net
    > Cc: security-basics@securityfocus.com
    > Subject: RE: Firewall configuration statistics
    >
    >
    > What you received is the reason why I will not post a serious question
    > to the list. The list has fallen into one of opinion not fact. So folks,
    > as SKP gets more and more frustrated, and stops using the list for
    > serious business, maybe it has become time for us to get back to
    > business. Just my .005 worth.
    >
    > Greg Kane
    > SAIC
    > Senior Systems Security Engineer
    > CTSF-IA
    > Fort Hood, TX
    >
    > -----Original Message-----
    > From: security@rexwire.com [mailto:security@rexwire.com]
    > Sent: Saturday, June 07, 2003 6:16 PM
    > To: justinpryzby@users.sourceforge.net
    > Cc: security-basics@securityfocus.com
    > Subject: RE: Firewall configuration statistics
    >
    > That makes absolutely no sense. Plus I am not looking for a
    > philosophical
    > answer. I was looking statistics for marketing. Does anyone know of a
    > good
    > reference site for firewall and other security statistics.
    >
    > SKP
    >
    > -----Original Message-----
    > From: Justin Pryzby [mailto:justinpryzby@users.sourceforge.net]
    > Sent: Friday, June 06, 2003 6:18 PM
    > To: security@rexwire.com
    > Cc: security-basics@securityfocus.com
    > Subject: Re: Firewall configuration statistics
    >
    >
    > Security,
    >
    > 100% of firewalls are misconfigured. I guarantee that no firewall
    > administrator has considered all of the posibilities that are out there.
    > Moreover, there are guaranteed bugs in the firewalling software itself.
    >
    > No firewalls are misconfigured. Computers do what they are told, and
    > the occasion cosmic ray bitflip is insignificant compared to human
    > error. FW admins who use broken software or write bad FW policies
    > deserve to suffer the consequences.
    >
    > Take your pick. As a user, I think all firewalls suck because at best
    > they are another layer for things to get f()'d up, and at worst they
    > prevent me from doing stuff. As an admin, I know of no more problems in
    > my current firewall configuration (-j DENY), but let me check.
    >
    > Unless you elaborate on whichever number you quote, it is meaningless.
    > Anyone who has ever deal with a firewall will know that. You will,
    > however, impress 99% of everone with a cool word like ''firewall''.
    >
    > Justin
    >
    >
    > On Sat, Jun 07, 2003 at 12:42:26AM +0000, security@rexwire.com wrote:
    > >
    > > I remember once reading that X amount of firewall's are misconfigured.
    > Does
    > > anyone know where I can get this statistic from? We are making some
    > new
    > > marketing material and I would like to include this stat in it. A
    > quotable
    > > source would be great.
    > >
    > > Thanks
    > >
    > > SKP
    > >
    > >
    > ------------------------------------------------------------------------
    > ---
    > >
    > ------------------------------------------------------------------------
    > ----
    > >
    >
    > ------------------------------------------------------------------------
    > ---
    > Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top
    > analysts!
    > The Gartner Group just put Neoteris in the top of its Magic Quadrant,
    > while InStat has confirmed Neoteris as the leader in marketshare.
    >
    > Find out why, and see how you can get plug-n-play secure remote access
    > in
    > about an hour, with no client, server changes, or ongoing maintenance.
    >
    > Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
    > ------------------------------------------------------------------------
    > ----
    >
    >
    > ---------------------------------------------------------------------------
    > Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
    > The Gartner Group just put Neoteris in the top of its Magic Quadrant,
    > while InStat has confirmed Neoteris as the leader in marketshare.
    >
    > Find out why, and see how you can get plug-n-play secure remote access in
    > about an hour, with no client, server changes, or ongoing maintenance.
    >
    > Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
    > ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
    The Gartner Group just put Neoteris in the top of its Magic Quadrant,
    while InStat has confirmed Neoteris as the leader in marketshare.
         
    Find out why, and see how you can get plug-n-play secure remote access in
    about an hour, with no client, server changes, or ongoing maintenance.
              
    Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
    ----------------------------------------------------------------------------

  • Next message: DeGennaro, Gregory: "RE: 40-bit VS 128-bit Encryption"

    Relevant Pages

    • Re: Firewall and DMZ topology - Thanks for all the information
      ... Thank you all for your reply to my question regarding Firewalls and DMZ ... > Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ... > about an hour, with no client, server changes, or ongoing maintenance. ...
      (Security-Basics)
    • RE: Firewall and DMZ topology
      ... Meaning having two firewalls with two different rule sets on two ... diffrent systems will open up a greater risk of human failure within the ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ... and see how you can get plug-n-play secure remote access in ...
      (Security-Basics)
    • Re: Firewall on server itself
      ... etc) and then set the individual hosts' firewalls to do things like ... "allow only establisted connections and connections to tcp:80, ... > Are there any advantaqes or disadvantages to having two firewalls set up ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
      (Security-Basics)
    • Re: Firewall and DMZ topology
      ... >> someone was able to crack the outer firewall, ... If different types of firewalls are used for each, ... But steel - cold steel is master of them all." ... Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! ...
      (Security-Basics)