Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A friend of mine installed a new firewall software at his company. Sometimes he works from home, and also has to maintain the firewall.

The firewall management software is a web site. My friend made the management software reachable by https://firewall.company.org.

Is this a good idea, or a bad idea?

If it was up to me, I would make the management software only reachable from within the company's network, and use a VPN tunnel to access the network from home.

share|improve this question
2  
You have answered your question. A VPN for remote management is required. –  Deer Hunter Feb 13 at 14:42
1  
Actually, my question was whether it is a good or bad idea to have a public website, which is the firewall management. –  Kiril Feb 13 at 14:44
add comment

3 Answers

Theoretically, if there aren't any problems with the authentication mechanisms of the website and it is implemented securely (using an SSL connection, no flaws in the implementation that can be exploited, etc) then it doesn't matter. That said, that is a BIG if.

It would be safer to remote in to the company through an already existing gateway, but if there isn't an existing gateway in, and depending on what the firewall is responsible for (if bypassing it wouldn't result in exposing the internal network from the outside, but only allowing things from the inside out), it could potentially be safer to administer the firewall this way than open up a gateway in to the entire network (since a VPN could potentially have a similar vulnerability.)

If the firewall being down would allow external attackers in, then it's no more safe than the VPN being added since a compromise would give access to the internal network. A VPN probably has a smaller attack surface area, so it's probably safer in that case.

Either way, he better be sure to put a lot of security in to the credentials for remote access and have them lock out quickly if a brute force attack is attempted. It would probably even be worth using a certificate based authentication as well since it is pretty much the keys to the kingdom. I wouldn't personally want to put such functionality on the Internet, even behind a secure portal, unless I absolutely had to.

share|improve this answer
    
If technically possible, I'd recommend restricting the access to the admin interface to only specific source IPs like the admin's home IP. –  Matrix Feb 14 at 7:18
    
basic auth via htaccess anyone? that + (self signed) ssl to protect the management-interface would be the minimum security controls i'd implement, additionally ssl-client-cert_auth on the reverse proxy that protects the firewall-interface. a small task for an admin, a big security-gain for the company. –  that guy from over there Feb 20 at 8:17
add comment

AJ Henderson makes absolutely great points. I do have one thing to add.

Most of the personnel I've dealt with that want a public facing firewall management solution have been afraid of doing something to cut themselves off from their management console.

As a workaround I have highly suggested picking up an inexpensive secondary firewall / VPN appliance - the Cisco ASA 55xx series comes to mind - which would provide independent access to the inside of the network. More than one of my clients have fallen in love with this idea - a few have even picked up a secondary internet line for independent access. :)

share|improve this answer
add comment

IMHO, it's an extremely bad idea to expose your firewall management to the internet via a web interface.

  • The entire company is a single userID/Password theft away from being completely owned.
  • The number of potential attackers has just increased exponentially. Any user with an internet connection can now attempt to compromise your firewall management server directly and anonymously.
  • The security of the web server hosting the firewall management interface is now critical to the well being of the company. Again, a single exploit away from being completely owned.

I'm quite floored that anyone would even consider exposing their firewall management to the internet. Again, my humble opinion.

share|improve this answer
    
Yet that's how the Linksys E-series (home-use) router-firewalls are shipped from the factory, and with version 2+ of their software, cloud management is the only interface. As a matter of fact, there's a worm running around right now that's violating thousands of these around the web. –  John Deters Feb 14 at 19:50
    
How is it any different from a VPN connection though? You could use a different username and password for VPN than internal, but that doesn't really give any significant gain if you use a complex enough password that isn't used anywhere else, you could use a client side certificate for the VPN, but that could be done for web authentication too. Certainly, the best security is to not allow any remote access, VPN or otherwise, but if remote access is allowed at all, a properly secured (big if) web interface isn't a hugely larger attack surface. –  AJ Henderson Feb 20 at 14:18
    
A VPN provides another layer of protection that ideally would use a physical token in addition to a password for authentication. I rarely, if ever have seen vulnerabilities surface that allow an attacker to exploit a VPN platform to gain unauthorized access. Usually it's an userID/password compromise. –  k1DBLITZ Mar 7 at 18:27
    
However, Web servers/applications on the other hand are notorious for merely being secure for a point in time. There's always another java/php/.net/Apache/IIS exploit right around the corner, and those are only the ones that are publicly discovered and/or divulged. If you or anyone else is comfortable with that risk, that's your/their prerogative. I'm not comfortable taking that risk for something as critical as the Firewall. :) –  k1DBLITZ Mar 7 at 18:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.