0

In the past, we were often taught that we should have at least two layers of firewalls and it was best to use different brands so that at least it would make it more difficult for hackers to penetrate. This is not an issue, but I am mostly seeking comments on such a firewall design in today's context. Firewalls are not the targets anymore, so is it still relevant that we need to have at least two layers and using different brands? Further, the firewalls nowadays come with more features such as application layer protection etc.

I tend to subscribe to the idea of using one layer but placing more emphasis on the configurations and make sure there is 100% no misconfigurations in the firewall rules, plus making full use of the features that comes with next generation firewalls. There is actually no need for two layers?

  • 1
    "Firewalls are not the target anymore": please quote the origin of this information which look surprising. Did you look at the log of your firewalls? – dan Oct 11 '15 at 10:13
  • I am specifically talking about network based firewalls...because why would anyone want to target networks firewalls instead of those that it already pass through? for example, web applications, xss, sql injections etc..it's easier that way right? – Pang Ser Lark Oct 13 '15 at 1:05
  • 1
    @PangSerLark: why attack a single computer if you could own the full network by attacking the firewall. Attacking depends not only on how weak the target is but also on how much impact the attacks has. Ideal would be then firewalls with a weak self-defense. – Steffen Ullrich Oct 13 '15 at 5:15
  • Which function are you thinking of when you specify "next generation" firewalls? – dan Oct 13 '15 at 7:30
9

... Firewalls are not the targets anymore...

Broad claim and I would suggest it is wrong. A single firewall has a strategic position in the network as it is reachable from inside and outside. Thus compromising it from outside gives you full access to the inside. Sounds like an ideal target for me. Having a second firewall which limits attacks from outside to the internal network could definitely help in case the first firewall got compromised. But without the second firewall the attacker has unrestricted access to the internal network.

Apart from that no firewall is foolproof and by combining firewalls you might have a better protection, similar to combining antivirus from different vendors. As a side effect of my research (bypassing firewalls at the HTTP layer) I've noticed that a multi-layered approach can help to reduce the evasion possibilities. But I've also noticed that different vendors often make the same mistakes, which means that multiple layers will not necessarily help to make the protection more robust to evasions.

  • The tens of direct attacks per day (most automatics and some targeted) on our firewalls lead me to think this probability is still far from 0 and will stay such for a long time. A firewall is one of the most interesting target (for robots and criminals) of a network . – dan Oct 11 '15 at 10:10
  • If a firewall got compromised, 1) you did not patch, 2) you misconfigured. Is that correct? – Pang Ser Lark Oct 13 '15 at 1:09
  • 1
    @PangSerLark: do you believe in absolute security, i.e. anything which is fully patched is fully secure? If this would be the case then why would you need patches anyway? If not then consider a firewall possible vulnerable even if fully patched. – Steffen Ullrich Oct 13 '15 at 5:11
  • @Steffen Ullrich: nice proof through basic logic ;). – dan Oct 13 '15 at 7:25
  • 1
    @PangSerLark: Flash is actually a good example of security in depth. I don't trust Flash alone even if fully patched because of the history of insecurities. But I still use it (but only with click to play) inside Chrome since they have the patches faster and it has a integration into the Sandbox of Chrome, i.e. security in depth. Looking at Pown2Own I know that this does not give 100% security either but that the stakes for the attacker are very high. – Steffen Ullrich Oct 16 '15 at 9:17
2

A firewall is used to monitor and control incoming and outcoming network traffic between a trusted network and (an) other untrusted one(s). So by definition, a firewall is one of the primary targets of an attacker. It is just a security barrier that has always its own limitations so attackers developed lot of techniques to bypass it (Techniques used for bypassing firewall systems)

As the types of attacks are various, more than 2 layers of firewalls is even better as a part defense in depth which is always useful and protective if done properly.

  • Is defense in depth still relevant today? – Pang Ser Lark Oct 13 '15 at 1:08
  • 1
    @PangSerLark: probably more relevant then ever. If you get a targeted attack against your network you need to limit the impact of the attack, e.g. make sure that the attacker cannot easily move within the network and maybe also attack connected industry control systems (just search for attacks against ICS and SCADA). Thus segmentation and segregation are more relevant then ever. – Steffen Ullrich Oct 13 '15 at 5:18
  • @PangSerLark I can provide links like yours stating everything we think is good for the sake of security is bad, or not that good anymore, but you have to know there are sensationalist articles to make a buzz, to attract readers or just to differentiate from the standards. You have to be careful of such articles and relate on trusted ones such as OWASP guide where you can read objectively about defense in depth. Regards – user45139 Oct 13 '15 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.