Burning issues for network firewalls

An unprotected PC or server connected to the Internet has about 65,500 open ports. That translates into thousands of possible points of attack for hackers.That's pretty scary.A variety of tests by the Honeynet Project (), a nonprofit research organization dedicated to improving Internet security, have shown that an unprotected connection will usually be attacked within minutes.Firewalls are your primary defense against threats from the Web or wireless connections.Networks have to be protected by robust firewalls'which are expensive and difficult to configure, and require regular maintenance as threats and user needs change.Telecommuters, road warriors or even those with especially sensitive data on their workstations probably need further protection in the form of a personal firewall.Personal firewalls are much simpler to configure than enterprise-grade or even small network firewalls, but they still offer solid protection when properly used. Unfortunately, plugging all the leaks can be nearly impossible, even if you hire a team of plumbers.At the enterprise level, the latest buzzword in the security field is Unified Threat Management, which is nothing more than placing all your perimeter security eggs in one, easier-to-manage basket. UTM is a new acronym but not really a new concept.A UTM includes firewall, antivirus and intrusion-protection tools in one package.In some instances, notably the UTMs from Symantec Corp. of Cupertino, Calif., all the software comes from a single vendor, while others use some of the UTM vendor's software but add specialty tools, such as antivirus software, from other vendors.The UTM concept is very appealing because it should greatly simplify management chores, improve security by making certain every leak is plugged, and, at the same time, save money by eliminating duplication of technology and effort.The problem, as you might suspect, is whether these UTMs offer the complete protection you can get from picking and choosing among various specialized tools.Another major problem with UTMs is the fact that their heavy processing demands tend to bring a network connection to its knees.In particular, antivirus tools deployed at a firewall tend to be grindingly slow, not because of any fault in the antivirus software but simply because you can't properly scan incoming data without assembling the entire file.Content filtering technology is also resource-greedy, although not as bad as virus scanning.[IMGCAP(2)]When you combine all these tools into one package, the delays can dramatically degrade overall performance, even if this is mostly an illusion because all of the functions would have had to be handled separately with all the inherent separate delays.Specialized chips and faster processors have alleviated a lot of this problem, which is why UTMs are getting more attention these days.While it is true that these UTMs can reduce the amount of management required over that needed for individual protection products, some security observers feel this must be balanced against the potential troubleshooting problem if something goes wrong and you can't tell which security tool has failed.That problem has two aspects. Where all the software comes from one vendor, it may be tightly integrated. That's fine. On the other hand, blended UTMs may have software supported at the core by two or even three different vendors. That's trouble.Since a firewall is nothing more than a tool to enforce access policies and port usage, that policy is important and must be developed with care.Don't attempt to create policies from scratch'it's too easy to miss something.A good place to start is the Carnegie Mellon Software Engineering Institute's CERT Coordination Center's packet filtering page (, GCN.com/442.)The National Institute of Standards and Technology provides an additional list of services that should always be blocked or filtered. It can be found in Special Publication 800-41 (www.GCN.com/443).But establishing the policy is only the first step. You also must schedule regular tests to see if the policy being applied by the firewall is the same as the written one, perhaps by comparing a printout of the firewall settings with the written policy.It's hard enough setting a really good policy without having a firewall that doesn't enforce it exactly as planned.Once you are certain the firewall is set the way your policy requires, you must also run periodic, real-world tests of the firewall that include attempts to penetrate the network. That shows not only that the firewall is doing what it is supposed to do, but also that your policies are correct.You should probably make periodic adjustments to block ports when any new vulnerability is discovered in the security software itself (which will happen). You also need to review the policy to see if formerly necessary ports are no longer needed after a change in applications.A quick outside port test is available from Gibson Research Corp. of Laguna Hills, Calif. (), which makes ShieldsUP, a free firewall-testing program you run online to test the first 1056 TCP ports.Even if you don't use the test, this is a good online reference to what each of the ports is intended for.In many instances, and certainly for every enterprise firewall, you need to purchase commercial testing software to verify that firewall protection is complete.