home
NEWS       BLOGS       FORUMS       NEWSLETTERS       RESEARCH       EVENTS       DIGITAL LIBRARY       CAREERS  
Network Computing Network Computing Powered by InformationWeek Business Technology Network

IMMERSE YOURSELF:

SOA

  |

Data Center

  |

802.11n

  |

Data Privacy

  |
APO  |

Virtualization

  |

NAC

  |

Security

  |

Network Mgmt

  |

Enterprise Apps

  |

Storage & Servers












Fortifying your Firewall

By Peter Morrissey   Wouldn't it be nice if securing your network against unauthorized Internet or intranet access was as easy as finding the best firewall for your money, plugging it in and moving on to your next networking challenge? Dream on. The reality is not that simple. Even firewalls that have endured stringent testing to earn industry certification are not guaranteed to protect your network from harm.

For one thing, firewalls have to be installed correctly. For another, it's a sad fact of life that the odds are fairly good that eventually someone will find a novel way to undermine your defenses. However, a good firewall usually will make this more of an effort than it is worth.

To view the Report card.
Although firewall selection, installation and administration involve many rather complex and subtle technical and political issues, this security measure is likely to be one of your primary lines of defense against improper access to sensitive corporate data. Most of the firewalls we tested here use a method called "proxying" to screen data going into and out of the network.

Proxies generate a much finer level of control than a router or packet filter. Of the firewalls we tested, only CheckPoint Software Technologies' FireWall-1 products do not use proxies; instead, they use Multilayer Stateful Inspection, which is a filtering technology that is much more advanced than packet filtering and may provide better performance than proxying.

Also hot on the firewall scene are GUIs that simplify administration. A pretty GUI will not make your networ k more secure, but a well-designed one can ease the administrative burden and illustrate how well the firewall has implemented your security policy. All the products we evaluated have effective GUIs, with those in our winners--FireWall-1 Unix and CyberGuard--doing an especially good job.

We were equally impressed with other improvements in CyberGuard, which was purely text-based a year ago. Surpassing even FireWall-1, which has always had one of the best designed GUIs in the industry, CyberGuard now lets you configure network interfaces with IP addresses and add static routes by filling out simple forms.

Secure Computing Corp.'s BorderWare and Technologic's Interceptor use Web clients for administration, making it possible to perform this function from Unix, a PC or a Macintosh and generally ensuring consistency of the interface from one product to another. Chances are, most of these machines have the necessary browse r installed. This is convenient, but firewall administration is not apt to benefit from widespread access as much as other applications would. We found BorderWare and Interceptor to be much easier to administer than a text or command-line interface, but they were not very intuitive.

In choosing firewalls for this round of testing, we started by getting the latest list of products to receive certification from the National Computer Security Association (www.ncsa.com). NCSA's testing is quite thorough. Its certification program is devoted to ensuring that firewalls meet minimum requirements for reliable protection. The agency scans each firewall it considers to make sure the firewall performs as advertised. The agency also verifies that Internet applications continue to function as expected. Once a specific version of software is certified by the NCSA, you will have to monitor the agency's Web page or check with the firewall vendor for updates.

We were also anxious to ascertain whether any of these prod ucts could encrypt selected communications or support virtual private networks (VPNs). Because IPsec is supposed to provide a standardized method for encryption as long as you use manual key exchange, we were especially interested in products that advertised compliance. The only products willing to un dergo our scrutiny were BorderWare and Sidewinder. Since both products are from Secure Computing, we were optimistic about setting up an IPsec VPN between them. Unfortunately, our optimism was premature. Although we were assured that IPsec-standard VPNs worked great when using only BorderWare or only Sidewinder, we discovered that even when using manual key management, IPsec VPNs between firewalls just isn't there yet, even for products from the same company.

Make Room for Frame Relay
by David Willis


Updated Februayr 7, 1997








Ready to take that job and shove it?

Function:

Keyword(s):

State:
SPONSOR
RECENT JOB POSTINGS
CAREER NEWS
Aneesh Chopra is looking to other CIOs to advise him on fleshing out a more detailed agenda to best serve the president's IT agenda.

IT spending is expected to decline by 3.8 percent in 2009 according to Gartner.










2009 IT Salary Survey: Meager Raises, Solid Prospects
Though raises are notably smaller than a year ago, and job security’s shrinking, IT careers are looking safer than many others in this economic downturn. Get all the findings in InformationWeek's 2009 IT Salary Survey. Available FREE for a limited time.
 
ROLLING RIGHT ALONG
Follow key Network Computing Reviews from conception to completion. This Week: Holistic APM.



Network Computing Reports Emerging Enterprise Podcast Series: Secrets to Success








TechSearch


Microsite of the Week


Powerful Information at Your Fingertips



Techweb
Informationweek Business Technology Network
InformationweekInformationweek 500Informationweek 500 ConferenceInformationweek AnalyticsInformationweek Events
Informationweek MagazineGlobal CIOIWK Government ITbMightyByte and SwitchDark Reading
Digital LibraryIntelligent EnterpriseInternet EvolutionNetwork ComputingPlug Into The CloudDr. DobbsContentinople
space
TechWeb Events Network
InteropVoiceConWeb 2.0 ExpoWeb 2.0 SummitEnterprise 2.0Mobile Business ExpoNoJitter
Black HatGTECEnergy CampCloud ConnectGov 2.0 ExpoGov 2.0 Summit
space
Light Reading Communications Network
Light ReadingLight Reading AsiaUnstrungCable Digital NewsInternet EvolutionPyramid Research
Heavy ReadingLight Reading LiveLight Reading InsiderEthrnet ExpoTelco TVTower Technology Summit
space
Financial Technology Network
Advanced TradingBank Systems and TechnologyInsurance and TechnologyWall Street and TechnologyAccelerating WallstreetBST SummitBuyside Trading SummitIT Summit
space
Microsoft Technology Network
MSDNTechNetTotal IT ProTotal Dev ProNET Total Dev Pro CommunitySQL Total Dev Pro Community
space


App Infrastructure   |   Messaging & Collaboration   |   Network & Systems Mgmt   |   Network Infrastructure   |   Security  |   Storage & Servers   |   Wireless   |   Enterprise Apps
About Us  |  Contact Us  |  Site Map  |  Technology Marketing Solutions  |  Advertising Contacts  |   Briefing Centers
Copyright © 2009  United Business Media LLC  |  Privacy Statement  |  Terms of Service