Firewall Wizards: RE: External Load Balancing

[Mark.Boltz () stonesoft com]

> > One advantage of the Radware products is that they are true
> > appliances, and you can tightly lock down remote management protocols.
> On BigIP units, the web-interface, SSH, and the serial console can 
> all be disabled. Perhaps you should do your homework first :-)
So you *can* tightly lock down Radware and apparently BigIP gear as well. 
But the real question is, why are these enabled by default then, as you 
imply?

Default insecure, but can be made secure is bad. Default secure, but you 
can make it less so if you really, really want to, is better. Only 
providing reasonably secure options like SSH but not plain HTTP is a bit 
better, especially when they are not on by DEFAULT. Arg. When will vendors 
stop this nonsense? When the customers finally stop accepting it and 
DEMANDING better products!

Mark Boltz
Sr. Security Consultant
Stonesoft Inc.