1 / 7

firewalls and fate zones: operational impact

firewalls and fate zones: operational impact. Terry Gray University of Washington S@LS workshop, Chicago 12 August 2003. firewall types. conventional integrated logical end-point. perimeters. physical topology: enterprise multi-subnet subnet sub-subnet endpoint logical topology:

jaime-willis
Download Presentation

firewalls and fate zones: operational impact

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. firewalls and fate zones: operational impact Terry Gray University of Washington S@LS workshop, Chicago 12 August 2003

  2. firewall types • conventional • integrated • logical • end-point

  3. perimeters • physical topology: • enterprise • multi-subnet • subnet • sub-subnet • endpoint • logical topology: • VLANs w/firewalls between • logical firewalls • IPSEC trust relationships

  4. issues • relation of NetOps and SecOps • central vs. decentralized control • stateful vs. not-stateful blocking • firewalling policy by • device MAC • device IP • user identity • policy definition, impacted users, enforcement point

  5. perimeter protection paradoxes • value vs. effectiveness • small is beautiful, but costly • end-point is best, but hardest to do • border vs. subnet firewalls--departments: both share and span subnets! • border: biggest vulnerability zone • border: easier to debug intra-campus problems • border: simpler rules? • lowest common denominator policy • avoid cross-subnet holes for bad protocols • still need per-address holes

  6. incident response • enet port disabling • TCP/UDP port blocking • IP blocking • NAT traceability • blocking hi-numbered ports without stateful firewalls

  7. discussion

More Related