CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.1  Devices            9  3.1.1  Firewalls

Personal Firewalls 1 3.1.2  Routers

ICSA Labs reports that, “an alarming number of firewalls aren’t functioning as intended.”²⁶⁸ This is largely due to the “people” component in the firewall configuration process, rather than shortcomings in the firewalls themselves. Many firewalls are simply improperly installed or configured.

It appears that Tiny is getting out of the firewall business. Kerio and Tiny at one point appeared to be the same code base with different marketing. One of your authors has been both fooling around with a new version of Kerio and lurking on a newsgroup for the currently beta product²⁶⁹. Early indications are that the new Kerio is vastly more powerful, and in the current beta, equally more complex. Other users swear by the popular ZoneAlarm firewall.

So, it is important that staff is trained on proper firewall configuration and security techniques, and that firewall configurations and rules are documented. Again, security isn’t a one-time action that is taken and then is over with. It is a process! A single setting can sometimes turn on (and thus, OFF) packet inspection, turning a firewall with a well-designed rule base into a box that blindly passes along every packet it sees.

In addition to regular audits of your firewall rules and configuration, and perhaps an occasional penetration test by staff (or a consulting group) using an outside Internet connection, what else can be done to maximize the security of a firewall? Check with your firewall vendor regularly to ensure that you are running the most up-to-date software, which is likely to be the most resistant to known vulnerabilities.

Follow popular mailing lists like BUGTRAQ, and Usenet newsgroups related to your firewall platform to keep up with potential issues. As with any network device, if the vendor has a security bulletins list, sign up for it and take the recommendations posted on it. For example, sometimes a vendor suggests temporarily disabling a feature until a patch for a security vulnerability involving it is tested and released. Ignore these (we know many people will, often based on, “I don’t have the time”) at your own peril, and don’t say you weren’t warned.

Personal Firewalls 1 3.1.2  Routers