Re: Personal Firewall for Business use

[Ivan Hernandez <ivan.hernandez () globalsis com ar>]

Ansgar -59cobalt- Wiechers wrote:

> On 2003-10-27 Ivan Hernandez wrote:
>
> [ Windows TCP filtering ]
>  
>
> "Application level protection" is ridiculous if the protecting agent is
> running on the same box. I keep wondering how people can expect software
> that allows user interaction (like most personal firewalls do) to
> prevent other (malicious) software from doint whatever it pleases.
> Regards
> Ansgar Wiechers
>  
I would reccomend you to read the good information about on the Gibson 
Research site at http://www.grc.com
Try the information leak utility that's very usefull with all the other 
toys written in assembly. It's a nice and educational site. Windows 
Kernel Filtering will not stop a trojan from making connections on the 
internet, and that's one of the most important risks on a personal 
computer. Most worms are going via email today, and the filter will do 
nothing with that, but with some application level filtering, like Zone 
Alarm has, you can catch them before they go to the internet. Windows 
Kernel Filter also is very bad option to filter UDP traffic. For 
example... you would, just want to recieve responses of DNS queryies you 
have made, but this is just impossible because you have no way to keep 
track of your connections.
I think you must take a little more time before saying that somthing 
that other said is "ridiculous" and, in doubt ask first what did the 
other exactly mean, and ask for more information if necessary.

Cheers...

Ivan Hernandez
http://biromeponja.8k.com


---------------------------------------------------------------------------
Forum Systems PRESIDIO: PGP / XML GATEWAY APPLIANCE
The Presidio integrates PGP data encryption and XML Web Services security to 
simplify the management and deployment of PGP and reduce overall PGP costs 
by up to 80%.
FREE WHITEPAPER & 30 Day Trial - 
http://www.securityfocus.com/sponsor/ForumSystems_security-basics_031027 
----------------------------------------------------------------------------