Re: IPSEC == end of firewalls

While IP level security & authentication will go a long way to help 
prevent abuses and reduce unauthorized accesses, I doubt if it will
provide enough protection by itself.  While I would love to be proven 
wrong, I believe firewalls are here to stay (at least for the next 
year or two).  A couple of reasons why:

o Node Spoofing will probably still be possible
o The connections will probably also be subject to man-in-the-middle attacks
   (Never underestimate the creativity of people who want to compromise your
   networks)
o Authentication by itself will *not* provide adequate protection against 
   many abuses
o End-to-end encryption by itself won't completely solve the problems either
   (however, it *does* go a long way to prevent man-in-the-middle attacks 
o While IP security & authentication helps to secure the pipe between the 
   two systems which want to communicate with each other, it does not provide
   any security about the applications running over the pipe.  

   (ie - if you and I have a secure pipe between your system and mine & you
have 
   a worm running loose on your network, the only thing the secure pipe will do 
   is ensure that other systems (not in the pipe) won't be damaged as the worm
   propagates out of your network into mine).

   Also.  Which version of sendmail are we up to now?


As far as the future of firewalls goes, I would probably guess that the 
functionality of most firewalls would eventually be an add-on application 
option for Operating Systems and that eventually it will be a standard 
part of every Operating System.  Until then, we have to punt & keep using 
firewalls.  

I suspect even when firewalls are embedded in the O/S, that some type of 
firewall will still be needed to quasi-isolate a company's network from 
the Internet (and establish them as one entity) and to contain potential
networking problems which arise when someone configures their system with 
the wrong IP address (or other type of problem).

IMHO, the first company to include a firewall as a standard part of their
Operating Systems has a real good shot at increasing their market share.  
Perhaps the O/S vendors are paying attention to this list & will implement
this (would be nice).  8^)  Of course, it would also help, if their systems 
were delivered secure - out-of-the-box and we didn't have to spend so much 
time continually locking them down & keeping up with the latest CERT Advisories.
8^)  8^)

Best Regards,


Frank
Fortified Networks Inc. - Management & Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com/fortified/

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Frank Willoughby writes:
> While IP level security & authentication will go a long way to help 
> prevent abuses and reduce unauthorized accesses, I doubt if it will
> provide enough protection by itself.

I agree with this, but...

> o Node Spoofing will probably still be possible

Nope. It won't.

> o The connections will probably also be subject to man-in-the-middle attacks
>    (Never underestimate the creativity of people who want to compromise your
>    networks)

No, they won't be subject to such attacks any longer.

The real problem, as you noted, is that our applications aren't very
secure.

> I suspect even when firewalls are embedded in the O/S,

That would be somewhat meaningless. The point of a firewall, as others
here have noted, is that it is easier to secure one machine than five
hundred or ten thousand.

> IMHO, the first company to include a firewall as a standard part of their
> Operating Systems has a real good shot at increasing their market share.  

Again, somewhat meaningless, as a real firewall involves defense in
depth (screening routers, a bastion proxy host, etc) and is more of a
configuration issue than an O.S. issue.

Perry

> functionality of most firewalls would eventually be an add-on application 
> option for Operating Systems and that eventually it will be a standard 
> part of every Operating System.  Until then, we have to punt & keep using 
> firewalls.  

I'm not so convinced that adding 'firewall functionality' to an OS is 
such a good idea.  The idea behind having a firewall is that 
	*	You have a hardened host that has been stripped of
		anything that could be used by an attacker to compromise
		other systems
	*	You have a single machine that serves as the sole port of
		entry into your domain.  By keeping your defense perimeter
		nice and small it makes it manageable to maintain.  

When you start trying to swtich firewall functionality to an OS you lose 
both these advantages.  You no longer have a system that is stripped of 
compilers, scripting languages, etc, and you now have a much larger 
security perimeter.

Ben.
____
Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then
I will never know happiness. For I am possessed by a fever for knowledge,
experience, and creation."                                      -Anais Nin
PGP Encrypted Mail Welcomed        Finger samman@suned.cs.yale.edu for key
Want to hire a soon-to-be college grad? 		Mail me for resume

I once worked for a company where to get an outbound telnet connection
or to put a file with ftp, you needed to go through a gateway which
required us to use a hardware device to participate in a
challenge/response authentication scheme.

While this may be extreme, it points out a use of firewalls people
seem to be ignoring in this descussion:  enforcing policy.  Most
employees will have physical access to the network, and physical
access (=root privileges) to their workstations.  If you want to
enforce a policy of "no http servers, ftp servers, or anything else",
you can't allow any incoming Syn packets.  If you don't want to trust
every single person to configure his/her workstation to reject Syn
packets from outside, you need to do the filtering where most people
can't bypass it.

Now replace Syn above with whatever TCP/IPv6 uses, and the same will
hold.

That said, I hate firewalls.  I find being behind a firewall
incredibly painful.  I hope firewalls do die with IPv6.

David