Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been exploring the gamut of free Windows firewall applications recently and have encountered the following problem:

The better firewalls are excellent at stopping other apps from phoning home for user reporting, unsolicited patches and other suspect behaviour; but the firewall apps themselves can and often do whatever they please*.

So who watches the watchmen?

Or in more concrete terms: How do security experts resolve this problem?

(Two firewalls somehow competing for the same low-level network library?)

* I won't name names here.

share|improve this question
    
An answer covering personal computing with a Windows operating system would be excellent. :-) –  LateralFractal Nov 1 '13 at 2:32
add comment

1 Answer

The built-in Windows firewall is now advanced enough that third-party firewalls typically don't have anything left that is useful and novel to bring to the table.

So security experts generally don't use third-party software-based firewalls. There's value in hardware firewalls, which offer a layer of protection against a compromised host, and there's a value in software firewalls, which offer a zero-cost baseline level of protection for all devices or a fall-back secondary layer of protection beyond just an external HW firewall. But really the one that comes with newer versions of Windows is more than sophisticated enough to fit that role. The additional security to be gained by installing a third-party alternative rounds to zero.

As for the general question of trust; that really is the kicker. I trust Microsoft to patch Windows because... I have to. Do I trust Adobe to update flash correctly? Oh, how about this: do I trust Oracle to ship spyware-free updates to Java? (Stupid Ask toolbar). But if I can't trust Oracle, then who can I trust to update Java. Or... do I just have to abandon Java altogether?

You don't so much watch the watchers so much as you pick the watchers when it comes to application security. Either you trust the vendor and install their software, including its updating and tracking behavior, what every that may be ... or you don't.

share|improve this answer
    
It seems counter-intuitive, but in InfoSec "trust" is a bad thing - you only trust someone because you have no other choice! –  Graham Hill Nov 1 '13 at 11:21
    
"Someone you trust" really means "someone who has the power to betray you". –  Tom Leek Nov 1 '13 at 22:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.