Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read an article (can't find link) recently that advocated dumping software firewalls if you had a hardware firewall.

I was just curious as to the take on Firewalls in general for a small-medium office. Assume we had a router with a dedicated hardware firewall behind it that filtered and routed traffic before it hit the LAN.

Would it be worth the effort to maintain the firewall software that typically comes with A/V or Windows these days? I've seen many times where we are diagnosing PC issues and once the firewall is off, the problem goes away. Typically this leads to us turning the software firewall back on though after customizing the rules for the application which had issue.

Does anyone agree with the idea that a hardware firewall is enough of a defense or is it worth having the software firewall also?

Per fianchetto - When I say hardware vs software I should clarify to gateway firewalls (At the perimiter or router level) and endpoint firewalls (software firewalls on the desktop or laptop).

share|improve this question
add comment

4 Answers

up vote 15 down vote accepted

First, all firewalls are software firewalls. Some have 'fastpath' technologies which offload packets matching fingerprints which have already been evaluated in software to ASICs or realtime systems, but firewall decisions are made by software stack. Most firewalls run on a variant of linux or BSD, with their own kernel modules implementing low-level firewall tasks and userland code handling packets which the kernel module deems must be inspected at a higher-level, but some, primarily Cisco, have their own operating system. In either case, the firewall architecture is not 'hardware' or 'black magic'.

I think that you are making a false differentiation and what you should actually be comparing is "endpoint firewalls" versus "gateway firewalls". Pedantry notwithstanding, it is important to note that this is the actual distinction rather than hardware versus software.

Second, it is a best practice (nist 800-41), and a compliance requirement in any sizable organization, to have segmentation not only at the perimeter, but internally as well. In some cases (specifically, laptops, which move from security zone to security zone...and even to places where there is no security at all), it is extremely difficult to meet this requirement with gateway firewalls. In such situations, endpoint firewalls are useful.

My personal experience and preference with regards to endpoint firewalls is not to use them to meet security requirements, except when absolutely necessary (like laptops). I rather see them as an added bonus. Being that it is extremely difficult for me to manage centrally, and for me to ensure that all system owners are compliant, I must have network-level control. If a sysadmin wants to manage iptables in addition to that, I commend them, but I cannot rely on that.

share|improve this answer
1  
+1. I'm finding that end-point firewalls combined with centralized logging and analysis is the best IDS you can't buy for money. If servers start connecting to various hosts or a client starts scanning every other client, you know something's up. –  Alex Holst Feb 25 '11 at 10:05
    
Great catch on the differentation. I like this answer a lot i'll also edit my question to clarify thanks –  CogitoErgoSum Feb 25 '11 at 18:48
add comment

If it's available, you should use it. If a particular firewall is preventing an application from working, well, then you need to take the time to reconfigure the firewall and/or application appropriately.

share|improve this answer
add comment

There have been arguments in the recent past for disabling PC firewalls, as some caused issues, especially if the PC was fixed location. These days, with a preponderance of laptops and windows 7, I would heartily recommend using the firewall software built in to Windows if that is all you have, or for mobile laptops, a firewall which enforces strict VPNs, denies split tunnelling and prohibits access to the core network until security pre-requisites have been met.

share|improve this answer
    
What's the difference with laptops and PCs as long as we don't use wireless and connect to everywhere we go? –  Pacerier Aug 15 '13 at 20:38
add comment

Short answer is yes, each PC should have their firewall enabled.

Long answer is that it depends on the environment. What is the cost of managing each PC's firewall? Is it more than the cost associated with an attack because the firewalls were disabled?

How do you calculate the cost of an attack? What sort of data is on those machines? Mission critical stuff? Business-critical? Military/government stuff? Grandma's latest cookie recipe?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.