Re: Forrester Research foresees death of firewalls

[Rick Smith <rick_smith () securecomputing com>]

Regarding this excerpt from a Forrester report:

> > In a section titled "Today's Approach To Security Is Flawed," Forrester
> > says, "An emphasis on locking everything down has caused most firms to
> > invest almost exclusively in perimeter security like firewalls.  As a result
> > of this restrictive approach, many firms are oblivious to new technologies
> > like application security middleware that enable easy access to corporate
> > systems.  These companies miss the eCommerce boat as more progressive
> > competitors seek alternative ways to open up the back-end."

There is a chunk of Machiavellian truth in this, as shown by the finanical
successes of the long distance telephone, credit card, and analog cell
phone business: if you generate enough revenue from a service, you can
absorb a good deal of fraud and still make good profits.

A few years back I attended an Internet trade show with a couple of our
sales people. The Internet was (and still is) about excitement and risk
taking and pulling huge profits. Security plays very poorly to that
mindset. People would instinctively move away from our booth and towards
the more exciting "Java Enabled!" booths.

> > The proposed rules of Inverted Security are: foster openness, shun
> > complexity, share responsibility, and emphasize accountability.  On this
> > last point, the report notes, "Real-world business relationships are built
> > on trust backed by accountability, not prevention."

This is true, but it drives you back to firewalls. If you let every packet
in, you don't have any accountability.

Personally I think we'll always have firewalls for the same reason we all
have bigger locks on our front doors than we have on bedrooms or bathrooms.
The problem is that there isn't that big of a market for "really good"
front doors with good locks. Most people buy stuff from Menard's unless
they live in a city apartment, but then they usually must rely on the
building owner to provide good locks.

> This report sounds more like the "Revenge of the Users".

They deserve their revenge, since security products have tended to be
excessively authoritarian in tone, and they've had enough of it. I suspect
we're headed for a period of much greater risk taking, until people get
sick of having their sites hacked. Once everyone has been hacked a few
times we might see some interest in serious security.

> > Expanding on the notion of sharing responsibility, the report says,
> > "Deploying firewalls to deny bad connections, inspect content, authenticate
> > users, and encrypt traffic will result in network traffic grinding to a
> > halt.  Instead, distribute protection throughout the enterprise using
> > routers, Web servers, and application servers.  Unite these components
> > through hooks to x.509 certificates, LDAP directories, and policy management
> > systems like Axent's Enterprise Security Manager."

Uh, how can you have this vaunted "accountability" if you avoid those
naughty firewalls that authenticate users? If you build it directly into
the application, then it makes the applications more costly to build.

I was recently shoved into the deep end of pattern based object oriented
software architecture, a big thrust in the enterprise applications
development arena, and I see *nothing* about useful security patterns.
Nothing about authentication, binding of identity to action, access
control, or selecting responses based on identity.

> > Finally, in a sort of footnote to the article, there is a small paragraph
> > titled "Firewalls are overblown."  "According to Jeff Schiller, security
> > area director for the Internet Engineering Task Force, 'Firewalls have set
> > the security industry back years.  Not only are many firewalls riddled with
> > holes, but they assume that there is a perimeter at the edge of the company,
> > which just isn't true for the virtual corporation.' 

Schiller is reiterating a fashionable attitude: that the physical reality
underpinning our virtual world is irrelevant. In fact, all security
measures are grounded in physical protection and in the accurate
identification of physically secure perimeters. If I use a laptop in a
hotel room, I might not trust the confidentiality or integrity of the phone
line, but I assume I'm the only person in my room and that the integrity of
my laptop hasn't been breached. These are not 100% certainties, but it's
where we have to start. Shiller's "virtual corporations" all exist as
islands of physical security, and firewalls (if appropriate) mediate the
electronic ports of entry.

Enough ranting for now.

Rick.
smith () securecomputing com
"Internet Cryptography" at http://www.visi.com/crypto/