You don’t need a Firewall Security Policy

A member of a discussion list I subscribe asked for a Firewall Policy template.

A usual, I was alarmed enough by this to want to comment and drag it back to the discussion on “assets”.

I don’t think you should have a “Firewall Security policy”.
This is why.

A great book on firewalls once described the firewall as

The network’s response to poor host security

You can occasionally see articles on host-centric security drifting by …

A firewall is a “network PERIMETER protection device”.

Do you have a well defined perimeter to which you can apply enforcement policies, or is your ‘perimeter’ like so many businesses these days, a vague and nebulous concept that is weakly defined? One thing that is “in” these days is “De-perimiterization“. See “The Jericho Forum“.

The firewall model is inherently one of a ‘hard outer shell and soft vulnerable centre’. As I said, its based on the idea of poor host security. Good host security will mean that the hosts don’t have any un-necessary open ports. Scan you network. If there are no open ports why do you need a firewall?

Oh, right: port 80. And all the hundreds of services behind it.
In effect those are your ‘open ports’. Yes, there are firewalls that claim to do ‘deep packet inspection’.  Check what they actually do.

There are other uses for a firewall?   Well some people use it as a NAT device. Some people use it to control outbound connections – “data leakage”.   What they are really saying is that they haven’t built their information architecture in a robust and secure manner.  Back to the ‘poor host security’.  Perhaps you should be doing this sort of thing in your switch or router with ACLs.  Partition your network.

So why did I start by saying “assets”?
Some people think that the assets are the hardware.
Focusing on the hardware as opposed to the services, the information and the processes leads you to think in terms of things like ‘firewalls’ rather than in abstracts like “perimeters” and “access controls”.

By addressing a “Firewall policy” you are focusing on equipment rather than fundamentals.

Enhanced by Zemanta

About the author

Security Evangelist

Leave a Reply