Re: tunnel vs open a hole

[Barney Wolff <barney () pit databus com>]

On Sun, Apr 06, 2003 at 09:26:07PM -0700, Crispin Cowan wrote:
> > (BW wrote)
> > With all due respect, this is something of an overstatement.  Tunneling
> > requires a cooperating agent on the inside.  The security policy of
> > that agent becomes part of your firewall.
> The scary "gotcha": what if the "cooperating agent" on the inside is a 
> worm or a virus?

Once the enemy is within your perimeter, the game is mostly over no matter
what, because as mjr has pointed out connecting from inside to outside
is rarely impossible or even difficult, and that connection can then be
used to tunnel commands from outside in.

But saying that firewall technology is imperfect is different than saying
it's not worth using.  Would any expert go that far?  The message is
instead that defense in depth and strategies for detecting and handling
breaches are required.

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards