Why firewalls won’t matter in a few years • Hacker News Board

Re: Why firewalls won’t matter in a few years

#61

Post by sliverstorm » Sat, May 30, 2015, 1:10 AM UTC

joshrivers wrote: post #49

tptacek wrote: post #40

Earlier quoted context omitted.

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

'Game over': I think this is exactly the problem. In all the organizations I've been in, firewalls have been an excuse for negligence. 'We don't need to think about security because we are behind the firewall.' Right now the compliance world is addicted to firewalls, to the detriment to reasonable appsec. In my fantasy world, I'd like the auditors to be telling companies 'in 5 years, you won't be allowed to firewall…

You're probably right that firewalls allow negligence elsewhere.

But if they can't secure their one firewall, what makes you think they can secure their complex network of a plethora of interdependent services running across many subdomains on a whole roomfull of machines?

"Simple" is a key step to effective security, and I think the reason we've latched on to firewalls is they are often the simplest, most contained, and most standard way to reduce the attack surface of your network.

Re: Why firewalls won’t matter in a few years

#62

Post by kator » Sat, May 30, 2015, 1:38 AM UTC

Years ago at a large car manufacturer I had an argument with the "Data Security" team about firewall settings. They had some crazy dumb ideas of what had to be on the firewall and it was constantly causing us pain. I went to visit this person in charge and argue my case. He was in another building outside of the "Secure Datacenter".. He argued with me for about 45 mins about how nothing leaves that data center and the firewall is our last line of defense. I pulled a 5Gb 8mm tape out of my pocket, dropped it on his desk and said "That's a copy of every single customer in our database and our entire parts catalog with all order history so much for your firewall".

The next day we had more intelligent discussions about firewall settings, and permissions on the mainframe for tape backups...

Additionally my favorite trick to this day when visiting a company is just plugging in a laptop to various random ethernet ports. I was recently as at a place where they have a "Guest Wifi" that changes passwords every week and the password is emailed to everyone. Sitting in a random conference room I plugged in and had 100% access to their corporate network. In today's work of IOT this is basically gross negligence to only rely on a firewall for security.

To think a firewall is much protection at all is to stick your head in the sand and pretend everything is ok.

Re: Why firewalls won’t matter in a few years

#63

Post by nickpsecurity » Sat, May 30, 2015, 2:25 AM UTC

tptacek wrote: post #40

nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

Re-read the comment and you'll see your answer. The choice of insecure endpoints, insecure protocols, insecure networking standards, and connections to an insecure internetwork of malice means that trusting security to a low assurance filter of internetworking part is... a joke. Might be why having a firewall didn't reduce odds of any major I.P. and data breaches I've read about.

You want network security? Use a guard [1] with additional security checks at the endpoints and working with software on the guard for protocols such as email or HTTP. Want to stop script kiddies all day long and get silently breached by the exact people that really worry you? Get a firewall: the cheap, knockoff of guards specifically designed to save money they would've spent on real security. I hear they even come with OS's that brag on hundreds of CVE's under their belts. ;)

Oh, and you need to do the endpoint security, too. My posts on HN regularly mention prior work immune to many forms of malware by design. The DARPA, NSF, and Euro funded teams are cranking out one good hardware and software TCB after another with strong arguments against leaks, injection, and so on. At this point, unless I.P. is withheld, there's no excuse for industry or FOSS not building clean-slate efforts on something like that.

[1] https://en.wikipedia.org/wiki/Guard_%28information_security%...

Note: To be clear, I'm not counting guards built on crap such as Linux. Many in medium to high assurance industry are doing the same cost-cutting crap as COTS. Sadly, they tell me the reason is "no demand for high security systems." I've heard that in U.S. and U.K. Pre-Snowden, though. Maybe there's hope.

Re: Why firewalls won’t matter in a few years

#64

Post by [deleted] » Sat, May 30, 2015, 2:25 AM UTC

nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

[deleted]

Re: Why firewalls won’t matter in a few years

#65

Post by nickpsecurity » Sat, May 30, 2015, 2:26 AM UTC

badsock wrote: post #47

nickpsecurity wrote: post #21

Earlier quoted context omitted.

re antivirus. It doesn't work: they dodge it constantly. They can also use it to improve their odds of beating it by tuning the malware against it. Need I say more about why its barely a defense? Back in 1961, Burroughs designed a mainframe [1] that anticipated all these problems. They tagged their memory with bits to protect pointers or differentiate code vs data. That's two bits per word of data with almost no perf…

You may be aware already, but the LowRISC people are planning on putting tagged memory into their chip. Yay!

I saw that! I think they were also calling their cores minions. That's great lol. I forgot to send them a list of all the tagging schemes I know, esp patent immune. Might help them out.

Re: Why firewalls won’t matter in a few years

#66

Post by atap » Sat, May 30, 2015, 2:27 AM UTC

danellis wrote: post #11

"You can’t use firewalls to secure East/West data flows in the network." What does that mean?

Cool-kid words for cloud infrastructure in-groups. Somewhere along the line someone with clout and a laser pointer directed the attention of a roomful of people to an analogy in a Powerpoint presentation, and to curry favor and demonstrate loyalty, dear leader's clones started parroting each neologism.

Re: Why firewalls won’t matter in a few years

#67

Post by nickpsecurity » Sat, May 30, 2015, 2:31 AM UTC

ScottBurson wrote: post #48

tptacek wrote: post #40

Earlier quoted context omitted.

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

Hi Thomas, I recall you saying at one point that you are not a fan of static code analyzers for improving application security. Could you elaborate? "None of them found Heartbleed" might be one reason, I suppose, but it seems to me they do find a lot of more ordinary XSS, SQL injections, etc. Do you really think it's not worth using them at all?

The best way to use analysis tools is to code in a way that makes it easier for them. Old Orange Book B3/A1 systems had to be coded in a very layered, modular, and internally simple way to facilitate security analysis. Likewise, many of the analysis tools will get lost once you start coding a certain way. Each one also has its strengths and weaknesses.

So, my normal recommendation for people that can't waste time is to use those with few to no false positives combined with a coding style making it easy. For instance, I coded in a structured programming style with relatively simple control flow, quite functional in each unit's structure (see Cleanroom methodology), and avoided hard to analyze things. That made it easy for the tools.

The cool thing is that tools such as Astree and SPARK can prove portions of your code immune to certain defects. Others can do this for concurrency problems. And plain old reviews of design, code, and configuration with a list of common issues can help a lot by itself. That each of these methods has positive results for teams that use them speaks for itself. Them together can be quite powerful.

Re: Why firewalls won’t matter in a few years

#68

Post by nickpsecurity » Sat, May 30, 2015, 2:41 AM UTC

lifeisstillgood wrote: post #44

nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

Could you expand on your last para please - it seems to promise there is a solution to software security already available ... E-language seems a bit out dated from the intro I can find, What's an IO offload engine? What do you means about unified model (capability based / distributed implies E-language again?) Is this using strong data types to base security capabilities on? And how does hardware for in here I ask f…

I covered a lot of ground in this counterpoint to Dan Geer on why our security sucks:

https://www.schneier.com/blog/archives/2014/04/dan_geer_on_h...

Read it, its two links, and whatever they link to for plenty of inspiration. If you want, I'll email you a list of my designs and essays on there. I use his blog to reach as many people as possible. I can't make money on high assurance without selling out to the enemy so I just posted my stuff online for free anyway. The discussions and peer review over there were grade A with a few high assurance guys as regulars. This site is good, too. I'll get you those links if you want.

Re: Why firewalls won’t matter in a few years

#69

Post by nickpsecurity » Sat, May 30, 2015, 2:44 AM UTC

tptacek wrote: post #40

nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

I should've added that I'm not saying they're useless: just not a solution to the root problems or even the best solution to their problem. I use them if I have nothing else or just want to reduce traffic (DDOS) on a guard. Hell, using an obscure processor architecture while removing anything in traffic IDing it got me more security than any AV or firewall. I retired that strategy after 5+ years of it working with eBay hardware lol...

Re: Why firewalls won’t matter in a few years

#70

Post by nickpsecurity » Sat, May 30, 2015, 2:50 AM UTC

sprkyco wrote: post #41

tptacek wrote: post #40

Earlier quoted context omitted.

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

Stamos seemed to be making a point about the progression and resources being spent on security solutions. Firewalls are deterrents, but there seems to be a general consensus that they are not feasible for the future and the closest approximation that can be achieved to a "fully secure" system is by focusing on Applicaiton Security. During the video Stamos admits and an audience member loudly agrees that "we suck at a…

See my post here to Geer:

https://www.schneier.com/blog/archives/2014/04/dan_geer_on_h...

We just need to do what was done in the past, present, and ongoing in various circles: architect the hardware and tools in a way that makes security (esp integrity) an easy default rather than a nightmare. Then we work from there esp making that faster. I've seen Linux and FreeBSD run on such systems with little modification so I know it can be done. It's why I spread the word.