Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why firewalls won’t matter in a few years

etherealmind.com

Post reply on HN
Print view View original

91–100 of 139 posts

Re: Why firewalls won’t matter in a few years

#91

Post by kibibu »

joshrivers wrote: post #83
sliverstorm wrote: post #61

Earlier quoted context omitted.

You're probably right that firewalls allow negligence elsewhere. But if they can't secure their one firewall, what makes you think they can secure their complex network of a plethora of interdependent services running across many subdomains on a whole roomfull of machines? "Simple" is a key step to effective security, and I think the reason we've latched on to firewalls is they are often the simplest, most contained,…

I think in many cases you will be right and 'they' won't be able to secure it. This will force them to contact out those applications to someone who can. Plenty of SaaS providers able to secure a network. Just because my incompetent I.T. Guy can't properly harden a mail server doesn't mean we can't hire Rackspace or Microsoft or someone else who can. Let's incentivize competence, not hide incompetence.

Not all services are capable of "hardening" due to software quality. Not everything is written as tightly as Qmail

Re: Why firewalls won’t matter in a few years

#92

Post by dlitz »

windexh8er wrote: post #77
nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

"Firewalls are just some stupid crap industry made up and went with." -- I can't even begin to unravel how short sighted that comment actually is. I'm not sure you really understand the state of the firewall industry at this point in time if I'm allowed to be blunt. While I do think that traditional firewalling (L3/L4) has lost it's overall efficacy there are solutions on the market that address application control,…

> Firewalls at the enterprise level are FULLY required for business to operate in a relatively secure manner today.

They're also completely unsustainable, because "firewall traversal" will always be a thing. The result is a tit-for-tat arms race between firewalls and applications, with application protocols being encapsulated deeper and deeper, and firewalls trying to inspect packets deeper and deeper. The overall system complexity skyrockets, and we all know that complexity is antethetical to security.

I predict that within the next few years, we'll see attackers successfully targeting vulnerabilities in firewalls and antivirus software directly. Add BYOD to that and the entire mess will collapse in a decade or two---probably much sooner.

Firewalls are a temporary workaround for poor application security, nothing more. They are pollution---they hurt everyone by turning connectivity into a hard problem. Once we have good appsec (which we already know how to do; we just haven't done it), the cost of firewalls will vastly outweigh their benefits, and they'll quickly disappear.

Re: Why firewalls won’t matter in a few years

#93

Post by tomjen3 »

tptacek wrote: post #40
nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

Pentesters always win. The isn't a network that is absolutely secure and if you really need to, you can always spearfish the secretary.

Re: Why firewalls won’t matter in a few years

#94

Post by iyn »

cm2187 wrote: post #89

One of the bullet points says "DNSSEC is dead". But what is the plan then? it sounds odd to rely on a completely insecure, unencrypted service for DNS (plus all the new ways in which a secure DNS service could be used, to distribute public keys for instance).

I'm also interested in this. DNSCurve? Something else?

Re: Why firewalls won’t matter in a few years

#95

Post by TheLoneWolfling »

josai wrote: post #82
TheLoneWolfling wrote: post #75

Earlier quoted context omitted.

...Which is why I said "over a secure connection". This method is no less secure than the standard "client sends server password over HTTPS" scheme.

> ...Which is why I said "over a secure connection". ... and how do you set up a secure connection without a pre-existing password? Your solution has a chicken-and-egg problem.

HTTPS, the same way everything else solves this problem.

Re: Why firewalls won’t matter in a few years

#96

Post by cm2187 »

tptacek wrote: post #40
nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

They are certainly useful. But all these users behind the firewall frenetically clicking on every link they can find and opening any attachment from any email received are effectively an army of trojan horses which to me is an order of magnitude more of a problem than latency.

Re: Why firewalls won’t matter in a few years

#97

Post by barrkel »

bnewbold wrote: post #51

I'm not sure I agree with the argument that faster line rates creating a speed limit for firewalls. It seems like firewall hardware could parallelize internally at layer 3, sharding by source/destination IP or port, so all packets from a single flow will go through the same processing core, no? This would add a finite latency, but I don't think it would impact throughput. Am I missing something?

Cost; specifically, power costs and scaling curves.

If you watched the video, you'd see Alex pointing out the disparity between the best dumb switch he could buy (30Tbps, 5kW) and the best firewall (120Gbps with some, but not all features turned on, using 2.4kW). Point being, he could run a datacentre with one switch using 5kW, but would need 250 firewall boxes using 600kW. And trends are driving the two apart; hardware firewalls aren't keeping up.

Re: Why firewalls won’t matter in a few years

#98

Post by nawitus »

nickpsecurity wrote: post #32
sqeaky wrote: post #22

Earlier quoted context omitted.

I would argue a publicly auditable software stack would be a strong alternative to the self audited stack. I run a completely open source OS and run all non open software on a machine I don't trust. If someone can't have that then surely it would at least be good to a system that doesn't autorun things automatically, and stops common attacks like bootloader virus, email virus, etc... I think AV is meant to deal with…

I would argue that almost all FOSS is insecure and many (OpenSSL) have had easy to spot vulnerabilities for years. The important part of closed or open software assurance is review . People also often focus on the open or closed part as if it's a dichotomy rather than a spectrum. To help, I wrote an essay illustrating the security levels offered at various points in spectrum of open vs closed source here: https://www…

I would argue that almost all software is insecure. Proprietary is not any better.

Re: Why firewalls won’t matter in a few years

#99

Post by pyvpx »

windexh8er wrote: post #77
nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

"Firewalls are just some stupid crap industry made up and went with." -- I can't even begin to unravel how short sighted that comment actually is. I'm not sure you really understand the state of the firewall industry at this point in time if I'm allowed to be blunt. While I do think that traditional firewalling (L3/L4) has lost it's overall efficacy there are solutions on the market that address application control,…

in order to achieve 100Gbps at line rate, you have 6.7ns per frame. not a myth, but simple arithmetic.

Re: Why firewalls won’t matter in a few years

#100

Post by jimktrains2 »

TheLoneWolfling wrote: post #75
jimktrains2 wrote: post #74

Earlier quoted context omitted.

What is being sent to the server then? And by plain-text, I mean the server receives information that could then be used to authenticate later. For instance, if you send the sha of a password, and then store the sha of the sha, you're still sending the password in plaintext, it's just that it's not the password the user entered.

...Which is why I said "over a secure connection". This method is no less secure than the standard "client sends server password over HTTPS" scheme.

The connection doesn't matter, you're still sending the plain-text password to the server. The server still has the password.
Post reply on HN