Re: Firewalls and Cryptography

BobS <noone@xxxxxxxxxxx> wrote:
A Virus Scanner is something, that detects malware in streams or in
persistent data ("detecting negative things"). I'm not using virus
scanners, which search RAM, because I think they're useless.
A Gateway AV solution is an on-the-fly solution so while the packet(s) are
being inspected, it's typically at wire speed on the bigger/better
appliances. Whether they're using a high-speed shift register or buffering
it in RAM, I don't know but supposedly, the "time hit" is only slightly
greater than a firewall only device. Manufacturer dependent. So, the AV is
not searching through RAM in this architecture.

I agree. Of course, implementation needs RAM here. But it's not the RAM
of the computers which should be protected.

You can say, that a Virus Scanner can be a special case of firewall on
layer 7 according to RFC 2979, if it filters away data with malware.
You can say, that a Firewall can be a special case of a virus scanner,
according to RFC 2979, if it filters on layer 7 and removes mails and
transmitted files with malware.
I would not prefer to define in such a way, because this mixes terms. I'd
prefer to define, that if a firewall implementation filters that
way, it additionally has a virus scanner component (as I did).
Clear now?
Almost.....;-)
Your reference to RFC2979 made me go looking and digging a bit and I can't
see where this version http://rfc.net/rfc2979.html dated Oct 2000 allows
for those two statements - not even in the broadest sense. RFC's do change
and I may not have found the latest version.

From there (Chapter 1. Introduction, second paragraph):

| A "firewall" is an agent which screens network traffic in some way,
| blocking traffic it believes to be inappropriate, dangerous, or both.

You make a valid point about not wanting to group the two terms together
from a purists viewpoint but the industry has already done so and they call
it, UTM (Unfified Threat Management).

Yes. I just want to differ for better describing the behaviour of some
products.

[Virus Scanners]
Is it good enough for the IBM's, GE's, AMEX type company's - absolutely not
since they are big targets. But for a small business, yes, it's a
reasonable and efficient solution. Not perfect by a long shot but what esle
would you recommend?

Secure configuration, which is called by some people "hardening". And
intelligent use. Maybe usage of not-so-b0rken software.

Yours,
VB.
--
"Ich lache nie."
Besim Karadeniz in d.c.s.m.
.

Relevant Pages

  • Windows Firewall and Antivirus Security For Both Win ME and XP
    ... I have two systems one running Windows ME ver4.90 on a PC ... for virus and security protection, ... is fast enough etc. for Xp and the firewall and virus ... The second system is running Win XP Pro 512 ram with oneG ...
    (microsoft.public.security)
  • Re: Trojan virus
    ... > Virus Command Line ... > download the files and perform a scan in Normal Mode. ... It is suggested to run the scanners in both Safe Mode and Normal ... > FireWall to allow it to download the needed AV vendor related files. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Spyware going thru firewall
    ... >seems some kind of virus or spyware that was logging my internet profile ... >I was regularly using antiviral and had firewall ... Try other av scanners and/or Trojan ... See my web site for several firewall ...
    (comp.security.firewalls)
  • Re: Spyware going thru firewall
    ... >seems some kind of virus or spyware that was logging my internet profile ... >I was regularly using antiviral and had firewall ... Try other av scanners and/or Trojan ... See my web site for several firewall ...
    (comp.security.firewalls)
  • Re: Spyware going thru firewall
    ... where to look for virus? ... Try other av scanners and/or Trojan ...
    (comp.security.firewalls)