| About InfoWorld : Advertise : Subscribe : Contact Us : Awards : Events : Store |
 |
||||
|
||||
 |
||||
 |
|
|||
 |
||||
|
|
|
||
|
|||||||||||||||||||||||||||||||||||||||||
 COLUMN
Desktop firewalls require a revolution in their management to be truly effective ABOUT A DECADE AGO, I learned the hard way why protecting the desktop is one of the most difficult tasks. A virus infection came into our shop through an outside contractor, and it spread everywhere. I spent the better part of the next two weeks scanning local drives and floppy disks, but I eventually declared victory. The lesson from that experience is best expressed by Walt Kelly's Pogo: "We have met the enemy, and he is us."
Although we all know that perfect security is impossible, a lot can be gained by beefing up your current set of tools. For example, 10 years ago, you may have installed anti-virus software only on key machines. Today, many PCs come with it pre-installed, and most companies use anti-virus software on the desktop, file server, and mail server. It's time that we treated "desktop" or "personal" firewalls with the same seriousness. In the last couple of years, the personal firewall market has exploded with the increasing use of cable modems and DSL. Although dial-up connections are also subject to attack, the "always-on" nature of cable and DSL technologies makes it a lot easier for attackers to compromise systems. The personal firewall software scans network traffic to and from the PC, and permits or denies the passage of packets based on predetermined rules, just like the firewall at the edge of a network. Personal firewalls usually offer remote workers a number of predetermined traffic rules, and users rarely have to perform any configuration. For example, certain types of application traffic might be allowed if the application is active on the desktop, but not if it's coming from a background process. The current generation of personal firewalls for Windows systems isn't perfect. The most glaring problem is that they don't check on applications trying to pass data through the firewall. If the executable's name matches one on the "approved" list, passage is granted. This vulnerability allows a Trojan horse to pass itself off as, say, netscape.exe or another application that has transit rights. The other problem with most personal firewalls is that they don't play well in an enterprise environment. Although many vendors tout their remote installation and configuration, too often that's the limit of the product's manageability. We learned a long time ago with anti-virus software that products without central management and reporting aren't worth using. Unfortunately, it seems that most of the people selling personal firewalls missed this lesson. So for their benefit, let's dust off the Commandments of Manageability: I Thou shalt enable remote management of desktop configurations. II Thou shalt send alerts via e-mail, pager, and SNMP trap. III Thou shalt provide reporting tools that focus on exceptions, not norms. IV Thou shalt not update the product by repackaging the entire code. V Thou shalt protect the client even if the network connection is broken. VI Thou shalt provide the administrator with defaults that match best practices. VII Thou shalt provide the administrator with complete control over how and when clients are updated. One vision that might provide a model for delivering enterprise security is McAfee's Security.NET service, an ASP (application service provider) approach that offers an alternative to "boxed" security packages. Whether companies are comfortable with this approach is another matter. If you aren't already considering personal firewalls as part of your security strategy, now is the time to do so. P.J. Connolly is a senior analyst in the InfoWorld Test Center; he has almost 15 years of IT experience building, maintaining, and securing networks and clients. Write to him at pj_connolly@infoworld.com.  RELATED SUBJECTS  SecurityWeb TechnologiesMORE > SPONSORED WHITE PAPERS 
SPONSORED LINKS
|
|||||||||||||||||||||||||||||||||||||||||
|
||||||||||
|
||||||||||
