Re: Arguing against using public IP space

[Valdis.Kletnieks () vt edu]

On Tue, 15 Nov 2011 17:16:23 GMT, Leigh Porter said:
> Quite right.. I bet all Iran's nuclear facilities have air gaps but they let
> people in with laptops and USB sticks.

And that's the point - *most* networks have so many bigger issues that the
whole "NAT makes us secure" mantra is dangerous self-delusion.

If you have machines in the NAT area where you're actually concerned that "ZOMG
the firewall might fail and expose them", why aren't they airgapped? As the
Iranians discovered, if the attacker gets a foothold inside the NAT you're
screwed anyhow, and *that* is probably a lot more likely scenario than a
fail-open firewall..

Attachment: _bin
Description: