RE: What firewall for small medical research lab

["adnan () techiesonly com" <adnan () techiesonly com>]

I'm agree with
Damien Dinh, as he said about PIX-501, even I had used this firewall long
time back and it worked fine. Moreover you can hookup a PC as a Syslog
server so this PIX firewall will fwd all the packets to that PC if you
really want to know what's going on inside and outside.

Going for a hardware based firewall is the best idea. You can also consider
3COM firewall with VPN and they are very simple to configure. You check the
prices and features for both 3Com and Cisco yourself by contacting the
reseller. There are some other brands like Sonicwall, Tippingpoint,
Netscreen etc but i think these are more expensive.

Do your home work dude.

Regards
Adnan Rafik
UG Leader Techies
www.techiesonly.com


Original Message:
-----------------
From: Damien Dinh DDinh () sycuan com
Date: Fri, 28 Apr 2006 09:10:23 -0700
To: rmillisl () millis-it com, firewalls () securityfocus com,
security-basics () securityfocus com
Subject: RE: What firewall for small medical research lab


IMHO, I would personally stay away from re-commissioned hardware to be
used as a primary perimeter protection device.  The availability
component of the CIA triad will surely be impacted through hardware
failure.  Additionally, configuring IPtables and OS hardening can be
time consuming and an ongoing headache because you have to check the
rules frequently due.  OS updates add complexity as well.

Your best solution is to get a PIX 501 ($300-$400); it does full
stateful inspection (same function as their enterprise fw) with 4
interfaces to section out your network.  It even has VPN.

I have used this product for branch offices of up to 50 users and it's
pretty much set and forget (almost - need to updates code once in a
while).  Cisco has an awesome forum on their site that product
developers and CCIE frequently answers any questions you may have.

Hope this helps,

Damien Dinh
MSNS, GSEC

-----Original Message-----
From: rmillisl () millis-it com [mailto:rmillisl () millis-it com] 
Sent: Wednesday, April 26, 2006 7:55 PM
To: firewalls () securityfocus com; security-basics () securityfocus com
Subject: What firewall for small medical research lab

I have been asked to research what good, low cost, firewall solutions
might prove suitable for a medical research lab at a local University to
protect confidential patient data from outsiders.

In addition to other research I though I would ask here.

I realize a firewall is just one component of an overall security policy
/
implementation.

Basically what is needed is a simple NAT box that generally keeps
outsiders out, and allows authorized lab servers and workstations to
access certain services out on the main building network (DNS, IMAP,
POP,
SMTP, HTTP, HTTPS, FTP, SSH) and through that network to the Internet
(through the main building campus/network).

Cost is a very important factor so suggested solutions have been:

- Pay someone to set up a PC based firewall running on surplus hardware
using either Fedora Core 5 and Shorewall 3.0.6 (to allow easy
configuration of iptables rules).  The hardware and software cost are
low.
The time could add up. I have considerable experience with this so this
would be the lowest learning curve. Problem is Fedora with its frequent
updates may make managing this more of a chore.

- Pay someone to set up a a PC based firewall running on surplus
hardware
using either OpenBSD 3.7 or 3.8 and pf. The hardware and software cost
are
low. The time could add up. I have some OpenBSD experience and no pf
background.

- Pay someone to set up a a Linksys or D-Link broadband
switch/firewall/router. The hardware cost is low. The time to set up may
be minimal (Plug&Play + some common sense and provided firewall/filter
capabilities). Are these a serious and secure enough solution?

- Some other low cost hardware or software based alternative. What else
might be out there that I don't know about that might be comparable in
cost to the D-Link or Linksys options.

The PC based solutions I personally have the most confidence in with
respect to hand crafting a minimal OS build and hardening and patching
the
OS and doing rules mostly by hand. With pf there is some concern of
errors
introduced due to learning curve.

Comments? Suggestions?


-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------



--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .



-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------