Re: Firewall RISKS

[Lance Spitzner <spitzner () dimension net>]

On Thu, 3 Jun 1999, Stephen P. Berry wrote:

> Firewalls are mechanisms for policy enforcement.  Auditing information
> that comes out of them isn't necessarily useless, but there are 
> many things which they will be intrinsically unable to tell you.  I.e.,
> what traffic your firewall is passing that it shouldn't be.  An IDS
> machine configured such that it sets off an alarm whenever it sees a
> packet that should've been blocked by the firewall will almost invariably
> give you more interesting information about actual intrusions than your
> firewall logs will.

FW logs are just as valuable as IDS logs.  As most FWs deny everything,
except that which is expreselly allowed, the logs can show you what
vulnerabilities people are scanning for, information your IDS will
never see since the packets are blocked.  This information can be critical
in keeping current with latest exploits/tools.  I am not say FW logs
are more/less important then IDS logs, I am saying they share an equial
value.  I have had great success tracking attacks using an IDS script and
FW-1.  For more info, http://www.enteract.com/~lspitz/intrusion.html

> (for example) bind 8.2 .  You turn off all other services on the machines,
> and you're using an OS you know how to harden.  You configure your border
> router to drop all traffic directed at these two boxen that is not
> directed at either port 25 or port 53 (respectively).
>
> Explain where a firewall would be -essential- in such a setup.

Ahh, your router is the Firewall.  Most Firewalls deny traffic, your 
router is now denying traffic.  It does NOT matter what the 
platform/application is (ipchains on Linux, FW-1 on Solaris, 
ACL's on a router) you are now Firewalling.

Lance Spitzner
http://www.enteract.com/~lspitz/papers.html
Internetworking & Security Engineer
Dimension Enterprises Inc