Re: One for the Security Guru's

["Henning P. Schmiedehausen" <hps@intermeta.de>]

Gerhard Mack <gmack@innerfire.net> writes:

>Actually at the place that just went bankrupt on me I had a Security
>consultant complain that 2 of my servers were outside the firewall.  He
>recommended that I get a firewall just for those 2 servers but backed off
>when I pointed out that I would need to open all of the same ports that
>are open on the server anyways so the vulnerability isn't any less with
>the firewall.

So you should've bought a more expensive firewall that offers protocol
based forwarding instead of being a simple packet filter.

packet filter != firewall. That's the main lie behind most of the
"Linux based" firewalls.

Get the real thing. Checkpoint. PIX. But that's a little
more expensive than "xxx firewall based on Linux".

Actually, there _are_ security consultants, that know what they're
talking about. Unfortunately they're drowned out most of the time by
the drone of so called "self-certified Linux experts" which believe,
everything can be handled by using the only tool they know.

>Never trust Security Consultants.

BS. Invest money in real consultants that know their trade. They
simply might not be the cheapest and they might tell you solutions
that hurt (e.g. training your staff) but of course there are lots of
people that know what they're talking about.

	Ciao
		Henning

-- 
Dipl.-Inf. (Univ.) Henning P. Schmiedehausen       -- Geschaeftsfuehrer
INTERMETA - Gesellschaft fuer Mehrwertdienste mbH     hps@intermeta.de

Am Schwabachgrund 22  Fon.: 09131 / 50654-0   info@intermeta.de
D-91054 Buckenhof     Fax.: 09131 / 50654-20