When firewalls fail: Lessons learned from firewall testing

✍ Scribed by E.Eugene Schultz

• Book ID: 104393272
• Publisher: Elsevier Science
• Year: 1997
• Tongue: English
• Weight: 479 KB
• Volume: 1997
• Category: Article
• ISSN: 1353-4858
• DOI: 10.1016/s1353-4858(97)86649-4

✦ Synopsis

Firewall testing, if properly conducted, is advantageous in revealing specific ways that firewalls can be breached or bypassed. A previous issue of Network Securify (March 1996) describes a systematic methodology for testing firewalls that SRI Consulting uses. SRI Consulting has conducted a sufficient number of tests to be able to generalize about how firewalls in real-life environments have succumbed to attacks based on this methodology. Unscreened services in hosts protected by the firewall have been the most frequently exploited exposure, followed by exploitation of services that run on the firewall itself, then by exploitation of a dangerous relationship between a firewall and an external router or host on the DMZ. Because testing results depend on the particular testing methodology used, these illustrate that negative entropy in firewalls does occur. This article also provides a list of action items for firewall and network administrators to ensure that firewall defences are adequate.