Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are current generation firewalls ( both commercial and open source) good enough to combat current generation attacks (of course when properly configured) ?

By large , what do current generation firewalls lack ?

share|improve this question
    
I think that question should be asked the other way round: What do they offer/protect against? –  CodesInChaos Jun 18 '12 at 11:14
    
my intention was to see what they are missing by large rather than what they support –  sashank Jun 19 '12 at 4:12
add comment

1 Answer

up vote 3 down vote accepted

I'd have to say no, they're not good enough. I think they're necessary and very useful in their role as "a bouncer" where they can restrict what goes in and what goes it but with a lot of modern attacks, they're simply bypassed as the attack goes over an allowed or encrypted protocol.

If you consider things like Flame and Stuxnet (which are several years old), then firewalls (as of very recently) didn't detect those but then that isn't necessarily their role (more anti-virus, anti-malware type detection). However, you could argue that they should detect anomalies based on the CC traffic generated subsequent to a successful compromise of their target.

A lot of successful attacks are successful because the vulnerability they exploit is human stupidity and as of yet, I haven't come across a firewall (open-source or commercial) that has a stupidity filter :) The Aurora attack, from memory, exploited the naivety of Google employees (though others say the internal person willingly colluded). Quite a lot of companies have very open outgoing policies, simply allowing all http, https and dns out......if you do this, you're asking for trouble. The other element of human error is a misconfigured firewall, which happens very frequently - everyone's put in a rule or policy change that was incorrect.

In my experience, the firewall administrator/security team can put a fight against opening ports, enabling silly rules but I've found that the business area,for the most part, wins and whatever rule is required to allow them to do their business (regardless of its insecurity) will usually be enabled. No (modern) firewall can prevent this power-play that all too regularly happens.

A lot of firewalls come with IPS features, which have been enhanced over the last 3-5 years. In my experience, the majority of people simply disable this technology because it causes too many false-positives, although it is becoming better and more accurate.

It has taken longer than Gartner said, but security devices are collapsing into the one-fits-all and modern firewalls show that with features like IPS, URL filters, even anti-virus, application protocol checks etc, but this affects their wire speed and as you know, if things slow down, extras are turned off. Putting all these extra features onto your box to supposedly secure things more affects performance as there's going to be significant hits on CPU and RAM, whilst also collapsing everything down to one device can potentially give a nice single point of failure.

One of the big arguments for WAFs is/was that traditional firewalls allow HTTP and SSL. Traditional firewalls can typically validate those application protocols against their respective RFCs etc, however, they can't say how the application at the back-end will react or treat the traffic. So that true knowledge of the back-end is still missing but is it really the correct device for that? I don't think so but for app sec, imho, a traditional firewall is not the solution. Additionally, I mentioned SSL, there's a lot of encrypted traffic that simply flows through a firewall that it can't analyse and even where it's possible, I think it'd be a crazy decision to start to perform SSL offload on the firewall - the CPU hit on the SSL handshake would be very significant.

One of the greatest challenges in managing firewalls (especially on an Internet-facing perimeter) is separating the noise from the real attacks. Most firewall administrators are busy folk and don't have time to be trawling through logs, afaik all firewall solutions are still missing the ability to be true "Network Security Monitoring" devices that give the administrator visibility of their network. You can obviously integrate something like Splunk or Elsa but a centralised logging and monitoring solution is a lot of work for most companies and with many different vendor products around the network, often hard to integrate . if you look at something like the Security Onion linux distro (not a firewall), it turns an IDS (Snort or Suricata) into a true "Network Security Monitoring" device by providing the analyst with pre-configured tools such as Snorby, Sguil, Squert etc so that the analyst has visibility of what's really going on in the network.

I don't think a traditional 'current generation' firewall (open-source or commercial) can be thought of as a silver bullet or expected not to be lacking anywhere because it's there to do a specific job as part of a tiered defence-in-depth strategy and other elements (NIDS/NIPS, HIDS/HIPS, WAF, (Reverse) Proxies, SDLC, AV, Secure Coding, DLP, Incident Handling plan).

Having a talented, knowledgeable firewall administrator is more important that having a firewall with all the latest bells and whistles that no-one understands (just my 0.02c that went on longer than I expected).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.