Subject: RE: primary purpose of firewalls

From: "Michel Py" <[email-masked]>
Date: Fri, 20 Jun 2003 08:13:45 -0700

Stephen,

> Stephen Sprunk wrote:
> The biggest problem I've seen in Enterprise environments
> is that people running Internet-accessible servers (e.g.
> in the DMZ) often have no interest or motivation to follow
> security policy; security is secondary to functionality.

Sigh. Yes; to the point that they don't even apply services packs or
patches unless they bring more functionality.

> If you don't trust the owner, you have no reason to trust
> the machine, and a trusted firewall is the only place left
> to enforce security policies.

This is especially true in colos; not only it is simpler for me to
manage 2 firewalls instead of a farm of 300 servers but the fact of the
matter is that two thirds of this servers are colos that I don't have
control over and some of their owners are rather lame in terms of
security.

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Fri, 20 Jun 2003 08:13:45 -0700

Stephen,

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Sat, 21 Jun 2003 19:51:34 -0700

> Michael Richardson wrote:
> but firewall vendors have screwed that up so badly, that
> this is now better done by dedicated IDS.

I don't pretend to be a firewall expert but the IDS I use (and pasted
examples of earlier) is built-in the firewall and works for my needs. I
don't care much about an IDS that generates 100 alarms per second, the
reason being I have not enough qualified staff to analyze 100 IDS alarms
per second. IDS systems that generate tons of alarms are primarily a
means of selling an IDS system to the unsuspecting decision maker that
does not know jack about them.

Michel.