>> Putting a "firewall" on the machine that winds up protecting
>> itself is something of a bad idea. A firewall really wants to
>> be an entity which has all the packets in the network flowing
>> past it, where it makes determiniations about them.
>I'm going to have to disagree here - putting a firewall directly on a
>client or server system is a great line of defense. If it is set up
>properly, it is a great aid to the defenses of that system. I would
>liken a local system firewall to locks on the front door (or maybe
>better, the windows and side doors where you don't normally expect
>entry), whereas an enterprise-wide firewall is like a border check
>station at the city limits. There are benefits to the border firewall,
>but as has been pointed out, it doesn't protect from the attack within.
>And one significant issue we face is that there are VERY few products
>available (count on one hand) which can even begin to handle a data
>stream of 800+ Mbps, which is our current Internet load (we'll need 2
>Gbps within a year, I'm sure).ug:
Shouldn't firewalls be like bottle necks ie.. the one location through which
the packets must travel before they get to the Computers that are behind it.
That way they can monitor these incoming and outgoing packets to check the
sources and destinations (addresses) of these packets. This way you can
perform some type of egress filtering, and discard packets from certain
addresses and address ranges? This can prevent hacking but also prevent the
hijacking of computers for use in a Denial Of Service Attack.
It is understandable that there is overhead in checking each and every
packet, and this could potentially slow down throughput.
I don't know about the way the university does it, but I know the major
government organizations do not use software firewalls installed on each and
every separate computer. They use a bottleneck approach to protect large
numbers of computers and ensure the validity of the configuration and
firewall rules.
Wouldn't it be more logical to have one firewall for a building or floor of
a large multi departmental building , instead of purchasing 55 copies of
black ice and having 54 different firewall configurations?
Lee Duynslager
Lee Duynslager
Michigan State University
Center for Integrated Plant Systems
Information Tech. Professional
(517)432-5296
-----Original Message-----
From: MSU Network Administrators Group [mailto:[log in to unmask]] On
Behalf Of Doug Nelson
Sent: Thursday, January 16, 2003 4:26 PM
To: [log in to unmask]
Subject: Re: BlackICE
>
> Putting a "firewall" on the machine that winds up protecting
> itself is something of a bad idea. A firewall really wants to
> be an entity which has all the packets in the network flowing
> past it, where it makes determiniations about them.
I'm going to have to disagree here - putting a firewall directly on a
client or server system is a great line of defense. If it is set up
properly, it is a great aid to the defenses of that system. I would
liken a local system firewall to locks on the front door (or maybe
better, the windows and side doors where you don't normally expect
entry), whereas an enterprise-wide firewall is like a border check
station at the city limits. There are benefits to the border firewall,
but as has been pointed out, it doesn't protect from the attack within.
And one significant issue we face is that there are VERY few products
available (count on one hand) which can even begin to handle a data
stream of 800+ Mbps, which is our current Internet load (we'll need 2
Gbps within a year, I'm sure).
Doug Nelson [log in to unmask]
Network Manager Ph: (517) 353-2980
Computer Laboratory http://www.msu.edu/~nelson/
Michigan State University
|
