Thinking Security: Firewalls and Intrusion Detection Systems
- 5.1 What Firewalls Don't Do
- 5.2 A Theory of Firewalls
- 5.3 Intrusion Detection Systems
- 5.4 Intrusion Prevention Systems
- 5.5 Extrusion Detection
- 5.6 Analysis
This chapter is from the book
This chapter is from the book
This chapter is from the book
- Summoning grids—pentacles with attitude—have a number of uses. Unsurprisingly, summoning spirits from the vasty deeps of Hilbert space is one of them. They can also be used, by the foolhardy or terminally reckless, to open gateways to other spaces (most of which are utterly inhospitable to human-like life). Finally, they can be used to create a firewall, like a science fictional force-field only buggier and prone to hacking attacks by extra-dimensional script kiddies with pseudopods. Which is why nobody with any sense uses them casually.
The Apocalypse Codex
—CHARLES STROSS
5.1 What Firewalls Don’t Do
Since the dawn of the commercial Internet, firewalls have been a mainstay of the defense. Many books have been written about them, including two I co-authored [Cheswick and Bellovin 1994; Cheswick, Bellovin, and Rubin 2003]. That said, their utility, and in particular the protection they provide, has diminished markedly over the years. The time has come to ask whether the general-purpose firewall—the one protecting an enterprise—is still worth its capital, operational, and productivity cost.
When the world was young and Bill Cheswick and I wrote the first edition of Firewalls and Internet Security, laptops were rare, Wi-Fi and hotel broadband were non-existent, and smart phones weren’t even dreamed of. External users logged in to time-sharing machines via the firewall to read their email; companies had very few Internet links to other companies. Even the web was new; the section on it was one of the last things we added to the book before it went to press, and we declined the suggestion that something called a “URL” be employed to state the location of useful resources.
None of that is true today. There is a massive amount of connectivity through and around a typical large firewall, hundreds or even thousands of links. We noted quite some years ago that AT&T had at least 200 links to business partners [Cheswick, Bellovin, and Rubin 2003, p. xiii]; anecdotally, that sort of interconnection has grown greatly in the intervening time. Employees telecommute and travel, staying in touch all the while from a variety of devices including personally owned ones. Attempts to restrict what employees do from their own machines are generally futile (see Chapter 14). Furthermore, much of the important employee traffic to the company, especially email retrieval, is easily encrypted; adding a customs stop at the firewall can weaken security, since the encryption is no longer end to end. Whence, then, the traditional firewall? Does it actually do any good? Note carefully that I’m not saying that firewalls were wrong; I do not believe that at all. Rather, I’m saying that the world has changed and that the decision to rely on them should be reexamined and perhaps abandoned.
It helps to go back to what we wrote in Firewalls. The real problem, we noted, was buggy code; the purpose of the firewall was to keep the bad guys away from the bugs. Today’s firewalls demonstrably cannot do that. Web browsers on 
0 different devices are exposed to malware daily, and you can’t even start to use a hotel network until you turn off all proxying and VPNs. Similarly, all sorts of nastiness is emailed to people every day, often on their unofficial, unapproved, personally owned, external email accounts, accounts that they check from their employee laptops. (Yes, I know that many security policies prohibit such behavior. They also prohibit employees from copying data to flash drives so that they can get work done at home or while they’re on the road. Again, see Chapter 14.)
Beyond that, modern computers—though not (yet?) most tablets or smart phones—all have built-in firewalls; if those are properly configured (see Section 15.3), you may get more security at less cost by scrapping your customs booth. If we enhanced these devices still further to use cryptographically based distributed firewall technology [Bellovin 1999], we’d be in better shape still.