“There's a firewall on the router into the building so you can turn the one on your computer off”

Question

I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows PC's can be switched off. These people work in IT.

I disagree with this and I need a solid argument to go back with. I am thinking that, if a computer on the network becomes compromised with malware, then an attacker taking control of this computer has already gotten past the routers firewall, and because the Windows firewalls are switched off they can then stroll through our LAN accessing any computer they wish.

Firstly, is my analysis correct? Secondly, what would you add to/remove from the argument I have presented above?

Thanks

Answer 1

Your argument is a very good one. I agree with you.

If it is too abstract for your IT folks, here is a way to make it more concrete. Suppose one of your fellow employees catches a virus/worm while travelling, then brings his/her laptop back and connects it to your company network. The worm will then be free to spread within your company network, without any firewall to stop it. I have seen this happen in practice several times, and it is painful.

It is possible that your IT staff are concerned about the support cost of dealing with the firewall, and are worried it might break functionality and trigger more support calls to the IT folks. Keep in mind that if your company deploys a local firewall on all your Window PC's, it is the IT staff who will have to deal with any increased level of support. So their concerns may be legitimate.

If it were me making the decision, I think I would look at what are the downsides of running a firewall on your Window PC's. If a local firewall would disrupt access to critical systems or would interfere with your business's core mission, then I would not run a local firewall: I would look for some other way to protect the internal machines. However, if in your situation the local firewall wouldn't disrupt employees use of computing and wouldn't incur unreasonable support costs, I would enable the local firewall.

If people are unsure, you could start with a pilot: enabling the local firewall on a handful of Window PC's (maybe the ones handling the most critical information: e.g., payroll, or core intellectual property) and then track whether it causes problems. The pilot could then give your company useful information to decide whether to enable the local firewall throughout the rest of the organization.

Answer 2

Malware can enter an organization in many ways, such as email attachments and malicious web sites, or a USB stick brought in from home. Conficker was able to spread from computer to computer within an organization. Defense in depth as previously mentioned is a best practice to ensure the protection of the organization. Make sure all computers are regularly patched (Microsoft, as well as Adobe & Java), use antivirus and keep it up to date, and use both perimeter and individual firewall protection.

Answer 3

In addition to what's been said before, I think it's important to note that the type of firewall might actually differ. If the perimeter firewall is stateless the protection provided by the stateful firewall on your desktop can add to the stateless protection of the perimeter (e.g. as it can use knowledge of the processes initiating a connection to judge the return traffic destined for this process).

Answer 4

I always say there is NO such thing as protection against Zero Day, so think designing everything in layers. The firewall has IDS and say Kaspersky AV, the systems have Sophos with it's firewall turned on and ONLY allowing the traffic needed to do the job. Block known sites both as a content filter on the gateway and also deploy hosts files on the local machines routing trash traffic to 127.0.0.1 Everything can be designed in laters utilizing different vendors technologies (kaspersky [firewall] and sophos [local machine] hosts file [lowest software layer]) to make it MORE difficult to get infected or compromised. Lastly, sniff your own network to make sure nothing weird is going on and only your machines and MAC addresses are on it.

Answer 5

"A network should be hard on the outside and on the inside, not with a gooey center that is easy to penetrate.." Basically, even if you have a hardened security on the outside, it is still needed inside. Who is to say that some worker does not take their laptop home and leave the firewall off, get a virus, and bring it back to work to spread around the network? Or what if some user fell for a scheme like 'the missing flashdrive' and downloaded something accidently to their computer? Network security needs to be everywhere, not just on the outside. They will figure this out sooner or later if they haven't by now =p