Re: Firewall best practices

There is one, and it is aggressively marketed as "next generation" firewall (again).
I was thinking about this idea as well, but found its practical value insufficient
to match the effort. Marketing hypes have little to do with practical value, though.
(another comment inline, scroll down ;-)

On Tue, Apr 27, 2010 at 04:41:04PM -0500, Carson Gaspar wrote:
> Once upon a time I did some serious thinking about a signature based 
> firewall, that cared only a little about port numbers, and a lot about 
> packet content. It would necessarily involve an update cycle similar to 
> anti-virus signature updates.
> 
> I've seen some work on this, mostly from a traffic shaping / IPS / IDS 
> slant, but I haven't seen anything serious from the firewall front. But 
> then I haven't been doing firewalls for several years, so I may just be 
> behind the times.
> 
> >You're completely right about the "if the application
> >emulates HTTPS traffic" problem. I don't have an answer
> >to that one other than "we warned everyone that that
> >was going to be a problem." At this point, it's less
> >of technical problem than a social one. It seems to me that
> >an organization cannot claim to be concerned about
> >security while allowing user-oriented encrypted outgoing
> >links to any target. That's just foolishness. The fact
> >that "everyone does it" doesn't make it any less foolish.
> >Back in the proxy days we advocated tying outgoing
> >connections to an authenticated user; that's another
> >important aspect of the problem that gets short shrift.

Well, we are already capable of inspecting web mail just like traditional
email messages (well, exactly. and it works both ways, so all limitations
apply)

> See my previous (or possibly next, post moderstion...) post re: SSL MITM 
> proxies. Of course that just puts you back at the first problem, except 
> you may detect rogue apps by their non-acceptance of your magic CA cert.
> 
> -- 
> Carson
> _______________________________________________
> firewall-wizards mailing list
> [email protected]
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
> 
> email protected and scanned by AdvascanTM - keeping email useful - 
> www.advascan.com 
>