Re: Firewall RISKS

["MIKE SHAW" <mas () sbscorp com>]

> It is true that in the `real world' we seldom get to impliment ideal
> infrastructures.  That does not mean that all nonideal setups have
> to be braindead.

I won't argue about  the definition of braindeath.

> I'm beginning to rather strongly suspect that the `real world' to which
> you refer is composed almost entirely of low-end commercial and academic
> sites.  But that's okay...I'll even stipulate your definition of
> the `real world', as I assume it includes folks at home using dialup
> ISPs.

Actually, I'm refering to:  large regional banks, hostpitals, investment companies and clearing houses, City and State 
governments, Companies with substantial federal government contracts, law firms that represent multi-billion dollar 
companies....

> Say I'm using my machine at home as for dialup.  It's running the latest
> rev of OpenBSD.  Inetd(8) isn't running.  I don't have any daemons
> accepting incoming connections.

> Demonstrate how a firewall is `essential' in my setup.  Alternately,
> demonstrate how using an OpenBSD desktop for dialup is not a credible
> scenario in your `real world'.

We've already been down the road of "create a scenario that is present < 1% of the installed sites out there."  
Present, not possible.

> Okay.  Stipulated.  Scribbling a firewall into the network diagram isn't
> going to change any of this.

No.  That's why I said effectively deploying one will decrease your vulnerabilities further, not plugging it in and 
expecting all your worries to disappear.

> What you have not done (and what I don't believe you---or anyone
> else---can do) is demonstrate that firewalls are the -only- things that
> can be used for containment (they aren't), or that the fact that firewalls
> can be used for containment somehow leads to the conclusion that they're
> essential' to all security infrastructures.  Barring the demonstration
> of one of these propositions (or something like them), your
> arguments about containment are moot (in this context).

Never said they were the only things.  But because they are so effective they are essential (for the record, I think in 
most cases an IDS is as well).  Going back to the car analogy:  you could theoretically drive to work without brakes.  
Would you want to?  Just because you can come up with some obscure and specialized example doesn't mean that the 
importance is not demonstrable.

> Doing strip searches of the office droids will almost always (which
> is as close to your `ALWAYS' as I'm willing to creep) enhance
> the physical security of an operation.  That doesn't mean that it
> is `essential'.  Requiring one-time passwds for all login sessions
> will almost invariably enhance login security.  One-time passwds aren't
> universally `essential', either.

Strip searches are impractical and impossible.  A firewall is both practicle and possible.  

> Stated more generally, the truth of `foo enhances bar' does not
> entail `foo is essential to bar'.

Depends on the level of enhancement and your definition of essential.  In your <1% cases, neither are met, but in the 
remaining 99% the probably are.

> Either you haven't been paying enough attention or you've been attending
> the wrong classes.  I find it surpassingly difficult to imagine any
> security professional worth their salt stating that, unilaterally,
> firewalls are an -essential- part of -all- sane security infrastructures.
> If you rephrase that as a `frequently useful' part of `many' security
> infrastructures, you might have a winner (although it would still
> be a bit of a contentious issue---just not a clearly false one as
> you've presented).

I won't argue this point.  See below.

> Visit more.  Look for ones, for example, whose security policies mandate
> the use Faraday cages.  Ask the local sysadmin types how they feel about
> your firewall-in-every-pot maxim.

Maybe one will answer this post and address this directly.  They probably don't fall in the criteria of "any" (see 
below).  If they do, then they might not have a white box with a monitor and keyboard labelled "This is the firewall" 
in thier faraday cage, but there is something performing the same functionality.

> Of course login(1) is not an essential part of a security policy.  I can
> specify plenty of policies involving no machines which natively use
> login(1).  I can specify (and have) that login(1) be replaced by a
> simple logging mechanism.  What's your point?

Again, this is <1%. (see below)

I'll admit that if this were a logic exercise the statement "a firewall is an essential element of any security scheme" 
would not hold up.  Why?  Because green men defending their Bizaacks on the planet Zorg probably don't have a use for a 
firewall.  Same with the security of a snack vending machine or the man behind the bulletproof glass in a gas station. 
These are security schemes and would be included in the word 'any'.  So let me define 'any situation' where a firewall 
would be applicable:

1) uses a network LAN/WAN with TCP/IP anywhere in the architecture.
2) has machines present in the architecture with OS' that are difficult or impossible to completely lock down (which is 
nearly all, especially with managers reading every day about how great NT is)
3) requires that a port or ports be open for functionality.
4) has actual services running on hosts/servers.
5) has end-users whose primary job does not involve network security (even if it is a secondary consideration).
6) has an interest in protecting information present in system(s) on that network or would be harmed by an abuse of 
that network.
7) has a budget.

This is the situation in the vast majority of networks now and over the next 5 or so years.  For all practical purposes 
this is the 'real world' for anyone giving security advice.  Now, you give me an example that fits those criteria and 
explain how a firewall is not essential in a good security plan. (And lets stay off planet Zorg. : P)

If your answer is "this is not the majority of networks", then let's move on to the quantitative data, and stop 
bantering about what is essentially an exercise in boolean logic.

-Mike