Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO.

On the other hand, malware can change or alter Windows Firewall settings unbeknownst to the end user.

Has anyone, vendor, or even research group studied the impact and ramifications? What are your experiences with "programmable firewalls"* and should they be used?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Looking at the problem from the other side - it's not just about presenting a nice face to the user. Although I'm not aware of any tools for MSWindows which adapt the behaviour of the firewall, fail2ban is a very commonly dynamic response tool on Unix type systems. Most attacks cannot be differentiated from genuine traffic at the packet level - fail2ban looks for patterns in the logs (most commonly for ssh but can be used for anything which can write logs) and applies temporary bans.

share|improve this answer
    
Exactly what I needed, an example for the Unix folks who are nitpicking Windows when they have the same product... –  makerofthings7 Jul 3 '12 at 16:07

As with so many security controls, they should always be considered as part of a defence in depth strategy. A personal firewall on your machine adds useful protection, but should not be relied upon as the only protection.

(I say personal firewall here because the vulnerability you identify - if malware infects a machine and escalates privilege it can disable/modify a personal firewall running on the same machine - applies to all such products, not just the Microsoft one.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.