> From: "Hallam-Baker, Phillip" <pbaker@xxxxxxxxxxxx>
Oh, one other thing I wanted to rant about:
> I don't know of any serious security professionals who now claim that
> firewalls are bogus or that they will go away as the myth has it.
> Perimeter security is here to stay.
Perimeter security is brittle, inflexible, complex security. You have to have
understanding of the semantics of an application at the perimeter to check
whether the operation is allowed - which is bad so many ways I don't feel
like listing them all.
(The old security breach where people had debugging turned on in their SMTP
server is an example of this. If would have flown right through a simplistic
firewall. Yes, we've fixed that one - but imagine e.g. a bug where a field
overflow in an SMTP transaction allows a break-in. Generalize to all security
problems caused by bugs in applications. And there are lots and lots and lots
of lines of code to find bugs in.... Yes, the bad guys aren't using that
technique at the moment - because they don't have to. When the easier holes
get plugged, they will.)
The CS community *was* on the right track for the real solution - about
thirty years ago, with Multics' AIM boxes. We made a bad mistake when we saw
workstations as "personal machines, so we don't need any of that security
stuff".
Wrongo.
As soon as you connect your "personal" machine up to a network, and start
interacting in any but the most basic ways, it's not "personal" any more.
Hell, we should have learned that lesson from floppy viruses. If they could
spread so easily with such a lame transmission medium, how would they do with
instant communication over a network?
And don't get me started on the ignorance/cupidity/stupidity/arrogance/etc of
certain software companies who distributed applications which basically
downloaded arbitary chunks of code from the network and ran it...
But even without that level of incompetence, bugs in applications aren't
going to go away anytime soon.
Noel