0

In the past, we were often taught that we should have at least two layers of firewalls and it was best to use different brands so that at least it would make it more difficult for hackers to penetrate. This is not an issue, but I am mostly seeking comments on such a firewall design in today's context. Firewalls are not the targets anymore, so is it still relevant that we need to have at least two layers and using different brands? Further, the firewalls nowadays come with more features such as application layer protection etc.

I tend to subscribe to the idea of using one layer but placing more emphasis on the configurations and make sure there is 100% no misconfigurations in the firewall rules, plus making full use of the features that comes with next generation firewalls. There is actually no need for two layers?

Improve this question
4
  • 1
    "Firewalls are not the target anymore": please quote the origin of this information which look surprising. Did you look at the log of your firewalls?
    – dan
    Oct 11, 2015 at 10:13
  • I am specifically talking about network based firewalls...because why would anyone want to target networks firewalls instead of those that it already pass through? for example, web applications, xss, sql injections etc..it's easier that way right?
    – JinPangPang
    Oct 13, 2015 at 1:05
  • 1
    @PangSerLark: why attack a single computer if you could own the full network by attacking the firewall. Attacking depends not only on how weak the target is but also on how much impact the attacks has. Ideal would be then firewalls with a weak self-defense.
    – Steffen Ullrich
    Oct 13, 2015 at 5:15
  • Which function are you thinking of when you specify "next generation" firewalls?
    – dan
    Oct 13, 2015 at 7:30

2 Answers 2

Reset to default
9

... Firewalls are not the targets anymore...

Broad claim and I would suggest it is wrong. A single firewall has a strategic position in the network as it is reachable from inside and outside. Thus compromising it from outside gives you full access to the inside. Sounds like an ideal target for me. Having a second firewall which limits attacks from outside to the internal network could definitely help in case the first firewall got compromised. But without the second firewall the attacker has unrestricted access to the internal network.

Apart from that no firewall is foolproof and by combining firewalls you might have a better protection, similar to combining antivirus from different vendors. As a side effect of my research (bypassing firewalls at the HTTP layer) I've noticed that a multi-layered approach can help to reduce the evasion possibilities. But I've also noticed that different vendors often make the same mistakes, which means that multiple layers will not necessarily help to make the protection more robust to evasions.

Improve this answer
9
  • The tens of direct attacks per day (most automatics and some targeted) on our firewalls lead me to think this probability is still far from 0 and will stay such for a long time. A firewall is one of the most interesting target (for robots and criminals) of a network .
    – dan
    Oct 11, 2015 at 10:10
  • If a firewall got compromised, 1) you did not patch, 2) you misconfigured. Is that correct?
    – JinPangPang
    Oct 13, 2015 at 1:09
  • 1
    @PangSerLark: do you believe in absolute security, i.e. anything which is fully patched is fully secure? If this would be the case then why would you need patches anyway? If not then consider a firewall possible vulnerable even if fully patched.
    – Steffen Ullrich
    Oct 13, 2015 at 5:11
  • @Steffen Ullrich: nice proof through basic logic ;).
    – dan
    Oct 13, 2015 at 7:25
  • 1
    @PangSerLark: Flash is actually a good example of security in depth. I don't trust Flash alone even if fully patched because of the history of insecurities. But I still use it (but only with click to play) inside Chrome since they have the patches faster and it has a integration into the Sandbox of Chrome, i.e. security in depth. Looking at Pown2Own I know that this does not give 100% security either but that the stakes for the attacker are very high.
    – Steffen Ullrich
    Oct 16, 2015 at 9:17
2

A firewall is used to monitor and control incoming and outcoming network traffic between a trusted network and (an) other untrusted one(s). So by definition, a firewall is one of the primary targets of an attacker. It is just a security barrier that has always its own limitations so attackers developed lot of techniques to bypass it (Techniques used for bypassing firewall systems)

As the types of attacks are various, more than 2 layers of firewalls is even better as a part defense in depth which is always useful and protective if done properly.

Improve this answer
6
  • Is defense in depth still relevant today?
    – JinPangPang
    Oct 13, 2015 at 1:08
  • 1
    @PangSerLark: probably more relevant then ever. If you get a targeted attack against your network you need to limit the impact of the attack, e.g. make sure that the attacker cannot easily move within the network and maybe also attack connected industry control systems (just search for attacks against ICS and SCADA). Thus segmentation and segregation are more relevant then ever.
    – Steffen Ullrich
    Oct 13, 2015 at 5:18
  • rsaconference.com/blogs/is-defense-in-depth-dead.
    – JinPangPang
    Oct 13, 2015 at 9:06
  • businessofsecurity.com/docs/…
    – JinPangPang
    Oct 13, 2015 at 9:07
  • @PangSerLark I can provide links like yours stating everything we think is good for the sake of security is bad, or not that good anymore, but you have to know there are sensationalist articles to make a buzz, to attract readers or just to differentiate from the standards. You have to be careful of such articles and relate on trusted ones such as OWASP guide where you can read objectively about defense in depth. Regards
    – user45139
    Oct 13, 2015 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .