Re: Firewall for laptops, corporation with 1,000 laptops

From: Karl Levinson [x y] mvp (jamescagney90210@excite.com)
Date: 11/01/02 

From: "Karl Levinson [x y] mvp" <jamescagney90210@excite.com>
Date: Fri, 1 Nov 2002 11:12:03 -0500

I disagree completely that all you need is a PIX to protect your network,
laptops and remote users. That's exactly how Microsoft was hacked last year
and source code stolen. First, PIX does nothing to protect you from VPN
users using RAS. [Yes, I know you could use RAS filters on a Windows 2000
RAS server, but it's not a full featured firewall, and I think logging and
alerting, which are essential to a firewall solution, are lacking.]

Second, the PIX firewall does nothing to protect a roaming laptop from
becoming infected and leaking documents, passwords, or otherwise being
abused or getting DoS-ed while on a business trip to Japan.

Third, the PIX firewall doesn't protect you when your trojaned / compromised
laptop comes back from Japan and compromises your web server and other
internal hosts. This is the lesson we learned from Nimda and Code Red. I
happen to know that a scenario like this happened to one of the top 10
largest banks in the US and caused huge loss of money and man-hours. The
firewall doesn't protect internal hosts from other internal hosts.

Fourth, if the trojan software on the laptop uses a permitted port to
communicate, such as TCP 80 or ICMP, the PIX firewall won't even tell you
that the laptop is compromised, let alone block it. A thousand hackers
monitoring a certain IRC group suddenly have remote control of a computer on
your internal network. I bet most PIX firewalls out there are set up so
that they aren't going to alarm when trojan software on an internal laptop
tries to communicate out.

I also bet that most of the VPNs out there aren't configured to do any port
blocking. In other words, a trojaned computer completely bypasses the
firewall and has full, unlogged access to the internal network over any
port.

Fifth, a PIX has no idea what executable is using a certain port. Only a
personal firewall will know that. The PIX only knows port number and IP
address.

Last, you want defense in depth. You want to avoid relying on just one
firewall from just one manufacturer.

A software firewall is a fine idea for laptops and also home users usuing
remote access, IMHO. We used them and I was happy with the way it worked
out. It does take some work and can introduce networking problems, but
that's always the cost of increased security.

Then again, if you're a small shop with a low budget and lax security needs,
running a software firewall might not be cost effective. However, such a
company would not be likely to be running a PIX firewall with thousands of
laptops.

Just my two cents.

> > "Lanwench [MVP - Exchange]"
> > <lanwench@heybuddy.donotsendme.unsolicitedmail.yahoo.com> wrote in
message
> > news:uDmdJxOgCHA.1720@tkmsftngp11...
> > > The point is, PIX is a firewall, not just a mechanism for getting VPN.
> > >
> > > I would not put a local firewall app on any networked computer. Tell
> users
> > > that if they want to use VPN from home, they need to invest in a small
> > > firewall device. These are cheap, and broadband users should have them
> > > anyway.
> > >
> > >
> > > "Marlon Brown" <marlon_brownj@hotmail.com> wrote in message
> > > news:ONmafWJgCHA.2284@tkmsftngp11...
> > > > What do I need to read on PIX ?
> > > > If users take laptops from work and bring home, without any type of
> VPN
> > > > connection, what the PIX at work has to do with that ?
> > > >
> > > >
> > > >
> > > > "msnews" <ef_hutton@hotmail.com> wrote in message
> > > > news:#5#0IQJgCHA.1736@tkmsftngp11...
> > > > > Sounds like you need to read up on PIX
> > > > >
> > > > >
> > > > > "Marlon Brown" <marlon_brownj@hotmail.com> wrote in message
> > > > > news:eZWMnuIgCHA.2392@tkmsftngp08...
> > > > > > Firewalls for laptops.
> > > > > > I do have PIX already for desktops.
> > > > > >
> > > > > >
> > > > > >
> > > > > > "Lanwench [MVP - Exchange]"
> > > > > > <lanwench@heybuddy.donotsendme.unsolicitedmail.yahoo.com> wrote
in
> > > > message
> > > > > > news:#5aWOnHgCHA.2256@tkmsftngp12...
> > > > > > > Cisco PIX to protect your network. Why would you want local
> > software
> > > > > > > firewalls?
> > > > > > >
> > > > > > > "Marlon Brown" <marlon_brown@hotmail.com> wrote in message
> > > > > > > news:uakG3PGgCHA.2400@tkmsftngp11...
> > > > > > > > Do you recommend any firewall that I can deploy on the
network
> ?
> > > > About
> > > > > > > 1,000
> > > > > > > > Win2K/WinXP machines.
> > > > > > > >
> > > > > > > > How is Mcafee firewall ?
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: New Printer problem--Help please!
    ... I was able to successfully turn off all firewalls on the laptop, and I believe I also was successful with turning off all firewalls, virus protection, etc on the desktop. ... I have re-set up the network using the home network wizard. ... Following the suggestion I found elsewhere, I set up the network "wrong" (chose incorrect connection method), then set it up again "right". ... the presence of the Symantec VPN driver raises the possibility that the laptop has a Symantec firewall installed. ...
    (microsoft.public.windowsxp.print_fax)
  • Re: Printer sharing
    ... Then I have a laptop which connects wirelessly to the router. ... Problems sharing files between computers on a network are generally caused by 1) a misconfigured firewall; or 2) inadvertently running two firewalls such as the built-in Windows Firewall and a third-party firewall; and/or 3) not having identical user accounts and passwords on all Workgroup machines; 4) trying to create shares where the operating system does not permit it. ... If you need Pro's ability to set fine-grained permissions, turn off Simple File Sharing and create identical user accounts/passwords on all computers. ...
    (microsoft.public.windowsxp.general)
  • Re: simple solution!
    ... >To filter network access, use a software or hardware ... Sygate is a software firewall that will let you ... laptop a static IP ...
    (microsoft.public.security)
  • Re: File sharing - why is it so difficult?
    ... I am having the same file sharing symptoms as lots of other people though the usual solution of switching off firewalls, enabling Netbios or starting programmes sevices folder. ... I also have a laptop also running windows XP but running the free AVG anti-virus software. ... The strange thing is the laptop can ping the PC once the firewall has been turned off but it can't access any files through windows. ... They are both part of the same workgroup and if you view that workgroup in network places on the PC you can see the laptop and on the laptop you can only see the laptop. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Simple networking?
    ... New laptop using XP Media Centre/SP2. ... I have turned off XP firewall on both since I'm using Zone ... Run the Network Setup Wizard on both computers, ... Simple File Sharing and create identical user ...
    (microsoft.public.windowsxp.general)
Loading