Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why firewalls won’t matter in a few years

etherealmind.com

Post reply on HN
Print view View original

111–120 of 139 posts

Re: Why firewalls won’t matter in a few years

#111

Post by nickpsecurity »

kstenerud wrote: post #16

Note that there is a difference between isolating devices and firewalling in the sense of packet inspection. You're still going to want selective routing and packet forwarding (like port forwarding). Firewalls will continue to be useful for complex devices that connect directly to the internet (like laptops on public wifi), where all sorts of things you wouldn't want others accessing are exposed by default.

I think you and snuxoll are right that whats throwing our discussion is that firewalls are such an overloaded term with diverse functionality that we're all talking about different things. A taxonomy of them that industry agrees on might be helpful.

Re: Why firewalls won’t matter in a few years

#112

Post by bortels »

cm2187 wrote: post #89

One of the bullet points says "DNSSEC is dead". But what is the plan then? it sounds odd to rely on a completely insecure, unencrypted service for DNS (plus all the new ways in which a secure DNS service could be used, to distribute public keys for instance).

It simply means you cannot rely on DNS (and domain names and such) for your security; your security must be achieved via other means (user auth or such). DNSSEC does not help that much, in reality, despite the implication it might, and that's part of why SSL and Signed Certs exist - it's a given that when I connect to www.microsoft.com from starbucks wifi, the IP DNS returns may or may not be microsoft's. With DNSSEC - presumably you may have a higher level of assurance the IP is from Microsoft, but it is not really practical to implement everywhere due to complexity, so you cannot depend on it to solve for this sort of issue.

Re: Why firewalls won’t matter in a few years

#113

Post by bortels »

Awesome Stamos talk (as per usual), but the headline here is a tad clickbaity. Perhaps more accurate to the talk is that they will matter less and less as time goes by. If you don't like that headline - do go watch the talk, there's a lot more subtlety than 8 words convey, and Alex is a fun speaker, with one of the highest signal-to-noise ratios around.

Heck - if you agree with the headline, still go watch the talk. If you care the slightest bit about security, you won't be sorry.

Firewalls are not a 100% solution, nor have they ever been. Defense done correctly is always defense in depth, and hardware firewalls are always likely to be part of that solution.

Alex's point in the video - and one well-made, I think - is that as the landscape evolves, the value-add of hardware firewalls becomes less and less, because assumptions about the environment they are in are changing. Anyone depending only on firewalls (I have called this the "hard candy shell" in the past) was vulnerable before - and as time passes, they are becoming increasingly vulnerable, because the things a firewall can be useful about are becoming less relevant, due to architectural changes and exploits moving up the stack toward the app.

I've said for a long, long time - I don't care how good your perimeter defenses are, you gotta harden the hosts. And in the end, this also is moving up the stacks. Your hypervisor may be secure as all-get-out, but if your app is open to trivial exploits, you're still screwed. You need to do a reasonable amount of security at all levels, including bits like user evangelism (disallowing of insecure passwords, perhaps promotion of MFA) if you want to have an expectation of security founded in reality.

The human element - users and passwords - cannot be underestimated, because a chain is only going to be as strong as it's weakest link, and if you do all of YOUR shit right - that's gonna be the end-user. Someone who can figure out how to replace passwords with a mechanism that ties access and authentication to a single human being in a non-trivially spoofable and inexpensive manner could become very rich...

Re: Why firewalls won’t matter in a few years

#114

Post by nickpsecurity »

nawitus wrote: post #98
nickpsecurity wrote: post #32

Earlier quoted context omitted.

I would argue that almost all FOSS is insecure and many (OpenSSL) have had easy to spot vulnerabilities for years. The important part of closed or open software assurance is review . People also often focus on the open or closed part as if it's a dichotomy rather than a spectrum. To help, I wrote an essay illustrating the security levels offered at various points in spectrum of open vs closed source here: https://www…

I would argue that almost all software is insecure. Proprietary is not any better.

I'd agree with that argument for the general case. Yet, there have been proprietary systems that resisted attacks in their attack model (with source code!) for years and all were designed with established methods for increasing assurance. There's dozens of done that way, esp in defense and smartcard markets. There's a few OSS projects with either good design or code review (medium assurance) that were done by pro's and open-sourced. Far as the actual FOSS development model, there are zero high assurance security offerings done that way. That's despite decades of examples with details published in journals, on the web, etc to draw on. So, FOSS has never done high security, NSA pentesters did give up on a few proprietary offerings, and therefore FOSS is inferior to proprietary in high security because only one has achieved it. Matter of fact, the open-source, commercial MCP OS of Burroughs was immune to pointer manipulation and code injection in 1961 via two bits of tag. FOSS systems haven't equaled its security in five decades.

They need to catch up really quick because they could be the best thing for high assurance. The mere fact that there's tons of labor, they're free, and not motivated by commercial success avoids the main obstacles to high assurance, commercial development: that the processes are labor-intensive, difficult to integrate with their shoddy legacy stuff, and hard to sell. If FOSS ever groks it, they could run circles around the other projects and products in terms of assurance. Closest thing is the OpenBSD community but they use low-assurance methods that lead to many bugs they fix. Their dedication and numbers combined with clean-slate architecture, coding, and tools would produce a thing of beauty (and security).

And, yet, the wait for FOSS high assurance continues. If you know anyone wanting to try, Wheeler has a page full of FOSS tools for them to use:

http://www.dwheeler.com/essays/high-assurance-floss.html

Re: Why firewalls won’t matter in a few years

#115

Post by dlitz »

auganov wrote: post #103
dlitz wrote: post #92

Earlier quoted context omitted.

> Firewalls at the enterprise level are FULLY required for business to operate in a relatively secure manner today. They're also completely unsustainable, because "firewall traversal" will always be a thing. The result is a tit-for-tat arms race between firewalls and applications, with application protocols being encapsulated deeper and deeper, and firewalls trying to inspect packets deeper and deeper. The overall sy…

Enterprises already run very heterogeneous stacks/software and more often than not a large portion of that is proprietary or outside of their direct control in other ways. I don't see why any enterprise would take the risk of not having additional layers of security, layers that they can actually control. I only see that going away if all software is reliably mechanically auditable for security. Edit: actually thinki…

> there's still many firewall features that one wouldn't want to reimplement app-level each time like rate limiting, network access logging

One of the major things that was learned in the NCP->TCP/IP transition was that it's better to put complex logic in the endpoints, rather than in the network.

> basic routing

Routing isn't what a "firewall" does. Routing is what a "router" does.

> I'm not sure what definition of "firewall" you all are thinking about.

I'm talking about packet filtering that looks at more than the source & destination addresses, stateful packet filtering, "deep packet inspection", etc., especially when they're set up as default-deny.

Application developers shouldn't have to worry that their packets will succeed or fail to be delivered depending on their content.

Re: Why firewalls won’t matter in a few years

#116

Post by tikums »

nickpsecurity wrote: post #68
lifeisstillgood wrote: post #44

Earlier quoted context omitted.

Could you expand on your last para please - it seems to promise there is a solution to software security already available ... E-language seems a bit out dated from the intro I can find, What's an IO offload engine? What do you means about unified model (capability based / distributed implies E-language again?) Is this using strong data types to base security capabilities on? And how does hardware for in here I ask f…

I covered a lot of ground in this counterpoint to Dan Geer on why our security sucks: https://www.schneier.com/blog/archives/2014/04/dan_geer_on_h... Read it, its two links, and whatever they link to for plenty of inspiration. If you want, I'll email you a list of my designs and essays on there. I use his blog to reach as many people as possible. I can't make money on high assurance without selling out to the enemy s…

> I'll email you a list of my designs and essays on there

Yes, please.

Re: Why firewalls won’t matter in a few years

#117

Post by EtherealMind »

gaius wrote: post #36
sqeaky wrote: post #22

Earlier quoted context omitted.

I would argue a publicly auditable software stack would be a strong alternative to the self audited stack. I run a completely open source OS and run all non open software on a machine I don't trust. If someone can't have that then surely it would at least be good to a system that doesn't autorun things automatically, and stops common attacks like bootloader virus, email virus, etc... I think AV is meant to deal with…

I would argue a publicly auditable software stack would be a strong alternative to the self audited stack. I run a completely open source OS and run all non open software on a machine I don't trust. One word: Heartbleed.

Heartbleed is far more common on closed crypto software than often.

One word: wrong.

Re: Why firewalls won’t matter in a few years

#118

Post by EtherealMind »

atap wrote: post #66
danellis wrote: post #11

"You can’t use firewalls to secure East/West data flows in the network." What does that mean?

Cool-kid words for cloud infrastructure in-groups. Somewhere along the line someone with clout and a laser pointer directed the attention of a roomful of people to an analogy in a Powerpoint presentation, and to curry favor and demonstrate loyalty, dear leader's clones started parroting each neologism.

Yep, all IT disciplines have their language. I get the same problem when listening to developers & DevOps spout their lingo.

Re: Why firewalls won’t matter in a few years

#119

Post by EtherealMind »

nickpsecurity wrote: post #107
erglkjahlkh wrote: post #104

Earlier quoted context omitted.

I have tried preaching similar message while I have worked for a C4I unit. I found it extremely hard to get anyone understand what the actual point was, and even after that I got mostly "but we're all COTS now" with a shrug. The previous, while working with netsec, stands practially for abandoning the sound principles and going for superficial compliance models. There is no real security architecture in place for mos…

Appreciate the corroboration from the inside. I've suspected as much given that even the "controlled interfaces" are usually EAL4 at best. Did you know Navy people built an EAL7 IPsec VPN? I'm sure you can immediate realize (a) how awesome that is and (b) what value it has for our infrastructure/military. Yet, it got canceled before evaluation because brass said "no market for it." Virtually nobody in military or def…

EAL criteria are so operationally restrictive that useful work is effectively prevented from happening. No one needs worse security, we need better security.

Re: Why firewalls won’t matter in a few years

#120

Post by EtherealMind »

drcross wrote: post #42

I also wonder how the move to IPv6 will also affect the current paradigm. Internet facing firewalls were typically also NAT machines to save IPv4 address space but all of that is gone in IPv6 meaning your global address is now exposed and a hacker can persistently try to compromise your machine if you don't firewall.

A firewall doesn't prevent compromise. An attacker can always reach your Internet connected system, and attack through the firewall.

Firewall is useful for protecting servers that don't have well managed IPTables or similar.

Post reply on HN