RE: Why should one buy (or not) an Appliance-based security gateway?

["Todd Towles" <toddtowles () brookshires com>]

I haven't done too much research into appliance-based devices but you would
guess that are set up for one purpose.

If I was going to build a Snort IDS box, it wouldn't have telnet open and it
wouldn't use HTTP (unless I was using ACID, then I would use SSL). 

If I wanted to make a DHCP server - I would take Linux and strip the kernel
of all unneeded modules and recompile. Turn off all unneeded services and
make the image reuseable. 

Appliance-based devices should use the same idea. But maybe they are like
cars. You can buy a sports car...which is designed for speed. Yet the fuel
map isn't tuned like it could be and that is a lot of back pressure in the
exhaust. 

Basically, it comes down to how much do you want to learn about network
security and how secure do you want to me. Will properly fine-tuned homemade
system beat an applicance? - yes!. But can everyone built that system, No!

Wow did that make any sense? lol

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Paul Schmehl
Sent: Friday, July 30, 2004 1:34 PM
To: Bernardo Santos Wernesback; full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] Why should one buy (or not) an
Appliance-based security gateway?

--On Friday, July 30, 2004 02:55:04 PM -0300 Bernardo Santos Wernesback 
<bernardo () ish com br> wrote:
> A few colleagues and I started a discussion as to why one should or
> shouldn't buy an appliance-based firewall, ids/ips or other security
> appliance instead of installing software on a server.
>
> We thought about patching, performance, and other reason for each option
> but I'd like to hear what other people think.
>
> I would really appreciate if you could share your thoughts with me.
1) Most appliance-based devices do not allow access to the operating system 
from the application.  In fact, they don't even allow access to the 
application, except for its configuration.

2) Most appliance-based devices have a kernel and OS that is specifically 
built (or the latest buzz word "purpose-built") for the service they 
provide, making them capable of running on lower speed processors and lower 
memory footprints than a general purpose OS (or conversely, capable of 
doing a great deal more with the same CPU speed and memory footprint.)

Those are the two main benefits that I hear most often touted.  I haven't 
done any research into those claims.  Perhaps someone else has?

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html