Re: Sony: No firewall and no patches

["Dobbins, Roland" <rdobbins () arbor net>]

On May 11, 2011, at 10:03 PM, phocean wrote:

>  - DDoS : anyway, a firewall isn't more susceptible to DoS than the server it protects. If you look at the hardware 
> performance of modern 
> firewalls, if an attacker has the ability to DoS it, then only a considerable server farm that very few companies can 
> afford will be able to sustain it.

My operational experience, including that acquired during my tenure working for the world's largest manufacturer of 
firewalls by units shipped, contradicts this statement.

>  - stateless scales badly on large networks, because it requires much more complex and lengthy rules if you are 
> serious with security.

This is a) untrue and b) a near non-sequitur.  In general state is much more harmful on larger networks than on smaller 
ones; and there's no correlation at all between the size of a network and the complexity of network access policies.

> Another advantage of stateful is that there is a first sanity check of the sessions on a specialized hardware rather 
> than on a generic TCP/IP 
> stack of a bloated server OS.

Marketing aside, those 'sanity checks' take place in software, not in hardware; and they actually constitute a greatly 
broadened attack surface (look at the multiple vulnerability notices/patch notices for any commercial stateful firewall 
you can name, as well as for open-source stateful firewall packages).

> For instance, the network stack of Windows is probably much more prone to bug/crash due to poor handling of crafted 
> packets than a dedicated 
> firewall (Checkpoint, Cisco, Fortinet...) may be.

Sadly, this is also not borne out by experience.  Quite the opposite, actually.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

                The basis of optimism is sheer terror.

                          -- Oscar Wilde

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/