Re: Host-Base Firewall

[Adriel Desautels <adriel () netragard com>]

Incorrect, but firewalls do not equal security. They equal a component 
of security that provides you with a reasonable demarcation point 
between one network and another. Good and strong security is a process 
that includes well written policies, procedures, training, technology, 
etc. Technology is near useless if the people that are using it are not 
trained properly and are unaware of what threat they are trying to 
defend against.

Fancy door licks, card/biometric authentication, and mantraps can all be 
circumvented, especially if well trained people are not present.

I remember once we were testing a facility that had a mantrap with 
biometric hand scanners. I watched one of the employees let me into the 
server area and took note of his pin code as he typed it into the hand 
scanner. Later on during the test I managed to take his card from his 
desk, stick my hand in the scanner, and type in the code and the door 
opened! As it turns out the so called biometric scanner only measured 
the size of my hand which was nearly the same size as his (pretty weak).

So, not all scanners, door locks, etc are effective. IMHO, most 
biometric scanners, not all, are good for show and thats about it. There 
are other more obvious ways to bypass such technologies, but I won't go 
into those unless people want to hear it.

Had the security guard been well trained and not let me see his pin, not 
left his card on his desk in his open office, then I would have had to 
use a different technique to get in. Had the policies and procedures 
that were written been followed, I would not have been able to get in.

Technology is far from useless, but it can become ineffective when the 
people supporting it don't know how to do their jobs, or just become lazy.

Regards,
        Adriel T. Desautels
        Chief Technology Officer
        Netragard, LLC.
        Office : 617-934-0269
        Mobile : 617-633-3821
        http://www.linkedin.com/pub/1/118/a45

        Join the Netragard, LLC. Linked In Group:
        http://www.linkedin.com/e/gis/48683/0B98E1705142

---------------------------------------------------------------
Netragard, LLC - http://www.netragard.com  -  "We make IT Safe"
Penetration Testing, Vulnerability Assessments, Website Security

Netragard Whitepaper Downloads:
-------------------------------
Choosing the right provider : http://tinyurl.com/2ahk3j
Three Things you must know  : http://tinyurl.com/26pjsn


krymson () gmail com wrote:
> So, are you saying that because a firewall can't make every perfect decision, they do not equal security? I wonder, do 
> they add any value to you at all? What if they do DPI and make smarter decisions?
>
> So if security cannot be found in hardware, does that mean a fancy door lock, card/biometric authentication, and 
> mantrap have no value?
>
> Personally, I find value in firewalls. Sure, the security they offer is not perfect, but that doesn't discount them as 
> being a part of a solid security regimen. In fact, while there are journalists and other part-time ITers who regularly call 
> out about the widening or diminishing perimeters, there is still a definite need to separate networks of different trust 
> levels to some degree or other.
>
>
>
> I know there will be some here that can smell the straw for the hay in the above, but such a tactic can be useful to 
> find the boundaries.
>
>
> <- snip ->
> All,
> Firewalls are packet control devices. They do little more than control 
> the flow of traffic into and out of your network. Some of them contain 
> "defensive" capabilities such as IPS. Those defenses make decisions 
> based on the nature of the traffic. Those decisions aren't as accurate 
> as they should be because the very medium from which they are forming 
> "opinions" is flawed. Traffic can be spoofed/forged/manipulated, so how 
> can one trust it.
>
> Security is more of a process than anything else. It is enforced by 
> policies, procedures, and the people using technology. Security can not 
> be found via hardware. This is a bit philosophical, but I can back this 
> up if anyone doesn't understand my perspective.
>
> Regards,
> Adriel T. Desautels
> Chief Technology Officer
> Netragard, LLC.