--On torsdag, juni 19, 2003 22:00:48 -0400 Keith Moore <moore(_at_)cs(_dot_)utk(_dot_)edu>
wrote:
> I believe the primary purpose of firewalls should be to
> protect the network, not the hosts, from abusive or
> unauthorized usage.
I do not agree with this. The primary purpose of firewalls is to protect
BOTH the network and the hosts.
the reason I disagree is that fundamentally, there's no way that a
firewall can reliably distinguish legitimate traffic from illegitimate
traffic, and there's no way that a firewall can exclude all (or in many
cases even most) threats. to do that it would have to be smarter than
the application.
I actually agree with both of the statements that are double-quoted above...
- the primary purpose of firewalls SHOULD BE to protect the network
- the primary purpose of firewalls IS to protect the hosts
The reasoning is that I think most hosts SHOULD be hardened enough to do
their job while standing "naked" on the network, while in the current state
of affairs, the proportion of hosts that are capable of standing up to
serious attacks from the Internet without the firewalls' comfort blankets
is probably better measured as parts per million than as a percentage.
(the proportion of hosts that are able to survive serious attacks WITH the
firewalls' help may be all the way up into single digit percentages....)
Harald