SIG Meeting December 1 1997
FIREWALLS

Unfortuantely our scheduled speaker became quite ill prior to the meeting, so our SIG meeting was mainly a discussion. We discovered we had many resources familiar with the topic of Firewalls. Here is some resource information that was brought out at the meeting.

  1. Firewall protection is a network issue not a system issue. It not only depends on protection provided by each of the operating systems on the network, but also on the attitude of those operating the systems on the network.

  2. Firewalls on machines with as little other functional responsibilities (other than being a firewall) are much more effective than adding firewall software to loaded servers. In other words, the best firewalls have been stripped of all other tasks which limits what an intruder can use them for.

  3. Successful Firewalls start with a well thought out Security Policy which in turn begins with a well reasoned factual assessment of the network environment: What do you have that needs protection, Who has to have what kind of access, Who is on the local network, what can you trust them for, what can't you trust them for, what don't you know about others on the network.

Here are some resources (some of them fun reading) for investigating this subject further:

***Note Credit to "[email protected]" who compiled this list for the [email protected] mail reflector.

Incidentally to join that list, which discusses firewall technology in considerable technical detail, send e-mail to [email protected], with the message: subscribe firewalls as the text. Here are some mail additional mail lists and web sites of interest to those concerned about securing systems on the Internet.

  1. Brent Chapman's Firewalls mail list.
  2. The official moderated exploit list is the Computer Emergency Response Team or CERT. They report most major significant security exploits although often not until the manufacturer has developed a fix that can be referenced. It is a relatively low traffic list.

  3. A very effective "unoffical" unmoderated list Bugtraq keeps its members aware of exploits sometimes within hours of their first appearance. It has a fairly high traffic volume.

  4. The Rootshell.com web page links to many of the exploits.

Lastly here is some advice about setting up a firewall that I picked up off the [email protected] mail list. It seems to make a lot of sense:

Step 1 --- Work with the corporate folks ... understand what they are planning to do firewall-wise. If you "go off on your own," then you will get hunted down and gathered back in the future. Also, for best company safety, you should really try to work with them to understand their policy, stance, firewall implementation type (app level, network level) ... and how it would be configured (authenticated proxies? porno filtering proxies? firewall protected on the "inside" also? what secure access mechanism? can connect from outside ? (to admin it?), etc, etc. --- all those details) Corporate Security is your friend ... or should be. Who are the company auditors? As long as you are on this corporate friend-building, talk to them -- do they have an understanding on the Internet and firewalls ? If not, you can work with them to form policy/standards/etc. (big win here!)

Step 2 -- Understand a bit more about the types of firewalls out there (not just product types, but firewall types: packet filtering, application level and hybrid ... and all the types in between). Read the Cheswick and Bellovin book, the Building Internet Firewalls, Brent Chapman and Liz Zwickey ... heck read most any firewall type book you can find :-) Take a class. etc.

Step 3 -- share some progress on the decision making to the firewalls mailing list. We'll listen, email back, etc. Don't share anything you wouldn't want the public to know.

Step 4 -- Hire someone with experience to help out if need be. There are some good consulting firms around ... there are some cheap, mediocre ones, also, so be careful.

Last updated 1/10/98 Published courtesy of RightNet, Inc. sponsors of the Internet SIG.