A fluid line of defense

By John McCormick

Connecting state and local government leaders

| June 18, 2004

Firewalls are an essential element of network protection, though they're not the whole package.

Firewalls are an essential element of network protection, though they're not the whole package.Selecting the most appropriate firewall for your network configuration is only part of the job; you must also configure it correctly and maintain it properly, both by keeping it updated to reflect newly disclosed vulnerabilities and by closing ports against new network threats.The first step is to set a policy for firewall use. The policy you choose is far more important than the brand of firewall, as long as the firewall is sufficiently robust to handle your policy rules and the traffic load.Specifying and maintaining an up-to-date policy based on threat levels'including newly discovered or emerging threats'the value of your information and the specific network configuration is critical. Despite the fact that this is a moving target and each firewall configuration is specific to your installation, there are some general rules:If the firewall runs on a host operating system, that OS must be hardened as completely as possible or hackers will simply go around the firewall through known or newly disclosed OS vulnerabilities.The National Institute of Standards and Technology's Special Publication 800-41 recommends the following types of network traffic always should be blocked:In addition, there is no such thing as a set-and-forget firewall. New threats emerge all the time and often the best or only way to protect a network is to block some specific port until vendors release patches and you have time to apply them. This is no rare event; it occurs every month or so for many networks.Finally, there must be a fixed schedule for verifying that the written policy is actually being applied by the firewall. This should probably be a combination of regularly checking hard-copy printouts of the actual firewall settings against the stated policy and actual testing.No system can be considered secure without periodic real-world tests of firewall policies, in which you attempt to penetrate the firewall, confirming not only that policies are programmed but that the firewall is able to properly apply them in every instance.This physical test should certainly be made after any vulnerability in the security software is discovered and patched.For any agency permitted to use outside tests, Gibson Research Corp., at , makes ShieldsUP, a free firewall testing program you can run online to test the first 1,056 TCP ports. You might want to bookmark this even if you only use it as a quick reference , because moving the cursor over the map generated by the site gives a quick report on each port's function.ShieldsUP also displays your browser's Web server requests, which may be revealing information you don't want freely disseminated'such as your server's software and version.If nothing else, the GRC site provides a lot of basic security-related information.Many agency installations will likely need to purchase commercial test software to verify firewall protection.It would be nice if you could simply install a firewall and feel secure. But even properly configured firewalls are far from perfect, especially since they themselves have been found to contain bugs or vulnerabilities.Check Point Software Technologies Inc. has reported vulnerabilities in its VPN-1 and FireWall-1 products so far this year. All of these vulnerabilities were patched, but the threats were highly critical because most would allow a remote attacker to run arbitrary code.Zone Labs' ZoneAlarm firewall was discovered to have a highly critical vulnerability in February, one that would allow an attacker to bypass the firewall and take control of the network.These aren't the only vulnerable firewalls, just a few recent threats that received wide publicity.Every firewall or other security tool is likely to have some hidden vulnerability that will someday surface with greater or lesser impact, so administrators need to monitor new threats not just to operating systems and applications but also to their security software itself.

Firewalls are an essential element of network protection, though they're not the whole package.

Related Links