Skip to main content

Firewall's best practice holy cows

Kevin Beaver has written a best practice firewall document. He doesn't mention the holy cows in the list. The holy cows are:
  • The firewall is security. It is all about the perimeter.
  • Take your time to approve each firewall rule set, as this is risk mitigation. There is no need for a set of standard changes, as each change needs to be viewed separately. 
  • Don't document. This is insecure as someone will steal it.
  • Don't use virtual firewalls. They are unreliable and more vulnerable.
  • Don't use VLANs. They are insecure and leak.
  • Always use two firewalls from different vendors in a cascaded installation. Nothing will ever go wrong twice but there will be at least two salesman earning commission.
  • Don't allow any UDP or ICMP (even for something as useful as network management.) Out of site is out of mind.
  • Don't have geographical fail over's connected at layer 2. Layer 3 is always more secure.
  • Don't allow dynamic routing (or for that matter any network related function.) A firewall is not a router.
  • The only way to secure Internet Browsers is to use a forward proxy. Nothing else can scrub traffic.
  • Cloning MACs on different firewalls makes them highly available.
My opinion about these best practice holy cows is that they should be minced into hamburger patties. These holy cows are not part of any risk management methodology. I don't know from where these holy cows originate (the source is protected by holy cow number three!) What I also don't know is who or what determined them as "best"?
I know of no major incident that has occurred where one of these holy cows would have been a suitable countermeasure. In reality, these have often been part of the causes of major incidents (which is defined as an incident of severe negative business consequence) or needlessly extended resolution times in the expanded incident life cycle.
Are vendors who provide equipment that don't follow these "best practices", delivering "bad practices?" If we look at virtual firewalls it is my experience that it is easier to administer 10 firewalls with 20 rules each, than to manage 1 firewall with 200 rules. Virtual firewalls make reviewing rule sets easier, and thus by definition are a better risk mitigation.
PS; The MAC cloners are also prime bullsh#tters.


Popular posts from this blog

LDWin: Link Discovery for Windows

LDWin supports the following methods of link discovery: CDP - Cisco Discovery Protocol LLDP - Link Layer Discovery Protocol Download LDWin from here.

easywall - Web interface for easy use of the IPTables firewall on Linux systems written in Python3.

Firewalls are becoming increasingly important in today’s world. Hackers and automated scripts are constantly trying to invade your system and use it for Bitcoin mining, botnets or other things. To prevent these attacks, you can use a firewall on your system. IPTables is the strongest firewall in Linux because it can filter packets in the kernel before they reach the application. Using IPTables is not very easy for Linux beginners. We have created easywall - the simple IPTables web interface . The focus of the software is on easy installation and use. Access this neat software over on github: easywall

STG (SNMP Traffic Grapher)

This freeware utility allows monitoring of supporting SNMPv1 and SNMPv2c devices including Cisco. Intended as fast aid for network administrators who need prompt access to current information about state of network equipment. Access STG here (original site) or alternatively here .