From: ji@cs.columbia.edu (John Ioannidis)
Subject: Re: Firewall usage
Organization: Columbia University Department of Computer Science
Date: Tue, 28 Jul 1992 15:36:35 GMT

[[Too many articles to follow up on individually -- I do work instead
of reading news (for a change) and suddently there's a flamewar that
no firewall will stop (I know, bad pun)]]

I'll probably follow the suggestion offered and write a "Firewalls
Considered Harmful" paper. Meanwhile, here  are some points:

* I'm not advocating that companies should allow uncontrolled access
to their networks -- that would be stupid.

* A firewall is no excuse for lax internal security. To wit:

  - In a large organization, there are bound to be "bad guys" (either
    through malice, negligence, or sheer stupidity) inside the
    organization as well. No firewall is going to protect you against
    those. 

  - A firewall only protects you against *known* external threats. 

  - If your internal network is insecure, you are vulnerable to anyone
    who can get physical access to it. Today this involves tapping
    ethernet cables, but tomorrow it may just involve dropping by with
    a laptop with a wireless interface. I have a vested interest in
    seeing wireless LANs  take off -- I don't want t hem stifled
    because of security concerns.

  - Think of the Maginot Line.

* The network should switch bits and enforce routing policies -- not
  cover up for insecure applications.

* It should not be the job of the millions of system administrators to
  patch known holes -- the vendors should be doing that. There is
  simply no excuse for vendors shipping us insecure code. (Is it true
  that SunOS is still distributed with /etc/hosts.equiv containing a
  single '+"? Why do we still have login programs that only accept
  eight-character passwords, password files that are publicly
  readable, things like NIS that allow uncontrolled access to their
  information, etc? At least we don't get sendmail shipped with the
  debug option turned on any more.

* Having firewalls reduces the urgency (that is, the pressure on the
  vendors) of patching those security holes. It's a vicious cycle.

* We've seen analogies such as putting locks on the front door rather
  than each individual room, and that it's perfectly acceptable
  capitalist behavior to put a firewall gateway in front of your
  network. I claim that this is far from being capitalistic; you're
  beeing communist inside, and hiding behind an Iron Curtain.

* The argument "naive users and administrators don't want to deal with
  security" has been kicked around. I say that the systems should be
  secure from the beginning. I hope it's not too late to do that.

* There are a lot of other security concerns in networked systems that
  should be addressed, that have nothing to do with firewalls. If
  those concerns are dealt with, firewalls will stop making. For
  example, I don't want anyone with the root password to be able to
  read my files, or log onto my machine and spy on what I'm doing.
  That includes the head of the security department, as well as the
  guy down the hall that I just had an argument with and wants to kill
  my files in revenge. While the latter is probably unavoidable, the
  former can be dealt with with proper cryptographic techniques. 

Finally,

* Firewalls are an easy solution to a very real and very serious
  problem. My point, if a bit idealistic, is that we should *fix* the
  problem, rather than patch its manifestations.

* Security, like good manners, starts at home. 

/ji

In-Real-Life: John "Heldenprogrammer" Ioannidis
E-Mail-To: ji@cs.columbia.edu
V-Mail-To: +1 212 854 8120
P-Mail-To: 450 Computer Science \n Columbia University \n New York, NY 10027
Newsgroups: comp.protocols.tcp-ip