Security

Ask something
Discussion Locked

Include firewalls in security strategies

0 helpful
12 replies

by debate

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Do you agree with Jonathan Yarden that a hardware firewall is more effective than a software firewall? How do firewalls fit into your organization's security strategy? Share your firewall experiences, as discussed in the July 21 Internet Security Focus e-newsletter.

If you haven't subscribed to our free Internet Security Focus e-newsletter, sign up today!
https://www.techrepublic.com/techmails.jhtml?repID=r001

12 replies

by aja1

The danger inherent in Jonathan Yarden's article is that many sites may settle for a setup that is too simple and hence give a false sense of security.

In this event, having no firewall attal may be more secure than having an inadequate one, becuase the heightened sense of awareness - paranoia - may serve as a better protection.

Ultimately, we have to rely on people not on technology. There are always, for example, new attacks and new viruses that the current config and a/v database are't aware of but alert individuals can spot the anomalies and take action.

Other recomendations that Johnathan makes, such as port forwarding rather than a DMZ, also bother me. Over-simplification is a dis-service to one's clients.

What I would recommend and what I have been advocation for well over a decade, is protection based on robust architecture. The reality is that this works out not only less expensive that "adding features" but is also more manageable, scalable and easier to monitor and maintain.

Anton J Aylward - aja@si.on.ca
System Integrity - Information Risk Management

by gerra

I did not get the sense that Mr. Yarden was over-simplifying the subject of firewalls. I thought that he was rather trying to increase awareness of the fact that any computer connected to the Internet needs protection, and the first line of defensewould possibly be a firewall. I thought that he was very clear on the fact that a firewall is not enough, and that other measures are needed to accomplish the protection needed in most setups.

There are just so many things one can say in an article such as this one. Jonathan could not possibly have gone into all of the nuances needed to completely cover a simple (let alone a complicated) situation.

As a relative newcomer to the field of computer security, I need these types of comments as well as the more in-depth ones to learn the most I can about the subject.

by aalger

I agree, good article! I would just like to add that another reason to use a hardware firewall rather that a software firewall is that they are usually much easier to configure than a software firewall and that hardware firewall creates the physicalseperation between the Internet and the network or device they are trying to protect which is always a good idea.

by my_folders

It actually is, but the cost is another thing.
Softwares are always cheaper 'cos you only but the softwares but for hardwares you buy the device with the software written inside (firmware).
Though hardwares are easier to use 'cos you don't go into so much trouble to set them up they are more expensive.
softwares can be interchanged on the machine to which they are running should incase there is a system crash but a hardware would need to go for repairs.

by aspowell20

Jonathan Yarden's article is commendable. The issue of network security is a serious one. I would like Jonathan to help with example of how the hardware firewall can be set up.

Though the hardware could cost some few dollars, they cannot easily be duplicated like software.

by petraje

I currently use both types of firewalls. I use a hardware firewall to create a DMZ for my web servers along with using ZoneAlam Pro on the server. I think this article was very good on helping one make a decision on what to use. I use also other procedures along with the firewall to to protect the enterprise.
The author was also right in pointing out that a layered approach is an optimal for security.

by tina h. o'neill

It was a very good article, especially for newbies. I almost always recommend a hardware firewall for small businesses or even for a single PC. Zonealarm makes a good software base firewall, but I have some clients that just don't want to deal with the setup. I have been using Linksys firewalls for the last 5 years and have not had any problems with the 10 PCs I have in my home based business.

by markrem

The best combination is a Hardware firewall (I use the SMC Barricade Router) and ViRobot Antivirus software. This combo has worked extremely well for my home network.
Best regards.

by thisisme

Mark,
I have no doubt that the combo you use is very good and has worked in your situation, but there is no such thing as the best combo. There are literally hundreds, if not thousands of firewall/antivirus combinations available, of which a majority would equal the security of your chosen combination.
It's very dangerous to be so confident in a single combo as it can give you an over inflated sense of security, which can lead to complacancy, which will lead to vulnerabilities.

Cheers,Chris

by j.g.

How to set up a firewall?
It's easy for the low-end firewalls: I've set up Netgear (tm) hardware f/ws, and another TR member says he sets up Linksys ones.

There is one "IN" ethernet port, for a DSL- or cable-modem (or other router, etc. thatprovides yor internet traffic). There's another ethernet port or several ports ("OUT") for your switch (or router, or computers). Sometimes they come with a built-in hub/switch, with 4 or more ports.

Most firewalls have a built-in web mini-server. That's how you set up the external TCP/IP address settings, VPN configurations (if any), and basic IP traffic filtering, and so on. Surf to the default internal IP address of the firewall, and config!

I've sone this for a few customers, with at most a dozen users. They are happy as the proverbial clam(s). Any questions?
###

by thisisme

As a whole, I agree with Jonathan's article. Firewalls are a 'must have' in any network accessing the internet.
However, I don't necessarily agree that a hardware firewall is any better than a software firewall.
Each type has it's arguments for and against.
A software firewalls achilles heal will always be the OS its running on, but if it's locked down well then that isn't as big an issue.
I currently run a software firewall that (thankfully) hasn't been breached, yet. Although it's tightly locked down, as is the OS, I still intend on adding a hardware firewall to the network as well, thus giving any would-be attacker 2 different hurdles.
I also use NAT on the internal network, as well as dial-on-demand servers that sit between the workstations and the firewall, which cuts out an attacker from accessing the network, even if they do breach both firewalls! The NAT alows me to use multiple subnets, which is another hurdle.
Overall, I don't see any great benefits a hardware firewall has over a software, but one of each gives me the best of both worlds!

Cheers,

Chris

This discussion is closed to new replies.