mozar
Highly Honored Mass-Poster
Posts: 1524
|
 |
… to be or not to be ? , by Phant0m
« on: Feb 14th, 2005, 8:35am » |
 Quote  Modify
|
Hello ,
A very interesting article by Phant0m concerning FW's Application Filtering component :
" ... Question is… to be or not to be? Stateful
Regardless what’s being thrown around for last couple of years, what makes a true software firewall is its packet filter. Began with ZoneAlarm, the definition of a firewall had been manipulated / expanded to include now application filtering.
ZoneAlarm has quite a few bells and whistles but let’s not forget why ZoneAlarm is required, to secure you from the OUTSIDE / INTERNET threats and attacks. When we re-install Microsoft Windows do we hurry to put ZoneAlarm on protect us from malicious activities generating from local/our own systems? No our concerns are for protections against outside / internet threats and attacks.
Let’s think of number one thing we do on an Internet-ready computer, BROWSE! Normally we do quite a bit of surfing around the Internet for knowledge and interesting downloads, so we aren’t exactly “trying” to stay hidden are we? Don’t worry even if you were trying, the threats and attacks all ends up finding you even if you merely idling on the internet with no client applications connecting/connected to internet.
Knowing packet-filtering is very critical, what is it about application filtering? My opinion and observations, when ZoneAlarm put out application filtering, many of Microsoft Windows clients and servers were triggering ZoneAlarm application filtering and popping with user choice to accept or deny. So there been so many questions whether this program (SVCHOST for instance) is legit and should be allowed. Because there been so much discussions it moulded means to be recognized by the public as becoming and become most popular Firewall used, and others curiosity and don’t wanting to be left out jumps to the more popular thang where a entire databases of questions/answers are found on the Internet with little to nothing searching. Now this made way for successful marketing, we don’t expect them to stop there, marketing is a boom! We have to keep improving and adding further additions to application filtering and draw in more and more and make it even more successful product out there, now other developers gets interested and begins to compete and add more stylish application-filtering. First thing that we come to see are everyone everywhere doing it, and everything seems to all be focussed on application filtering and died away from packet-filtering.
Now what we have? Application filtering is today’s technology; packet-filtering was yesterday’s technology so obviously you know being today’s technology means better then yesterday’s technology…
Now you see confusion is very likely when you aren’t knowledgeable in software security, so one can easily be taking for a ride.
This all being said, the standard packet-filtering gets designed but the real focus gets towards application-filtering, and who cares? Nobody except us few who are knowledgeable to software security and aware of what has been taking place for many years now.
And so now while application-filtering being improved to cover more outbound leaks, you all forgot what is more beneficial in the long run (packet-filter – Inbound threats/Attacks). And guess what? You who all using and supporting application filtering based software firewall are missing out on strong and properly maintained packet-filtering system which is a foundation of true software firewall.
I really hope some of the readers will begin showing some awareness and do some researching and start showing more concerns for packet-filtering improvements, more likely soon firewall developers will have too, but I’m sure not before it is to late for many of you! ... "
|
Mischel Internet Security Forum
Reply
Notify of replies
Send Topic
Print
Author
IP Logged
)
. 
Search
Members
Login
Register