Slashdot Mirror
3Com to Sell Firewall-in-a-NIC
Broue Master writes "According to a UK ZDNet article, 3Com is commercializing a firewall into a NIC aimed at desktop and servers."
Interesting idea, although it'll be interesting to see if the idea catches on.
← Back to Stories (view on slashdot.org)
Hardly. If you read the article you'd see that its a $120 NIC, plus $50 for the firewall software, and requires a $1000 policy server.
The Masses, as you put it, are not the intended audience of this.
It isn't aimed at home users at all (though every home user should be protected by a firewall).
To quote the article "The product is aimed at enterprises, to provide centralised control over security."
I'm getting rather tired of these stripped down firewall implementations. I've used several (linksys and dlink DSL routers, and lrp), but I've always found them either
a) buggy, or
b) very inflexible
For the life of me, I couldn't get the linksys box to track an incoming FTP session. The D-link router would crash if you tried to pump too much traffic through it (I was running UDP netperf tests). lrp just didn't have the features I wanted. Eventually I just scrapped it all and installed RH 7.2 on a p166, and turned off everything except iptables, roaring penguin, and ssh. It tracks all my connections just fine, forwards ports appropriately, and I've got scripts set up to restart my IPSec tunnel and re-register my IP with a dynamic DNS server every time my IP changes. I get the same throughput and latency I got through the other solutions, too. Sure, I'm doing more complicated things than most users, but even when I wasn't, the 'firewall in a box' gizmos still gave me headaches. I have a feeling a 'firewall on a NIC' would be even less flexible...
We don't have a state-run media we have a media-run state.
Now firewalls area available to the masses who don't know what they are!
No news threre. Windows XP has a bundled software firewall and many consumer routers toute built in firewalls as well. The main significange is the NIC taking the (nominal) load off the rest of the system and allowing greater control of user terminals, I believe. Now, the article :-) says a selling point of this dealy is that computers with it installed can only connect to trusted adresses /on the hardware level/. "The device also makes it harder to misuse corporate equipment by plugging it in in the wrong place" or CONTROL, you be the judge. Somebody correct me if [when] I'm wrong.
What is especially interesting is what is loaded: Secure Computing's Gauntlet firewall product (yes, it is originally derived from the old TIS stuff, but has been commercially, er... hydrogenized :) ). This would seem to indicate that the card can support applications that weren't written for it, e.g., it can use software whose platform has been retargeted in compilation (well, at least it implies that).
I wonder what other derived applications could be loaded into that space? Hmmm... the mind wanders...
You thought I was going to mention a Beowulf cluster, didn't you? Shame on you. No cookie for you.
3 Policy Servers can be in a load balancing and redundant configuration. If one policy server goes down, the other two pick up the slack. The whole network doesn't go "haywire" if all 3 of them go down... each NIC that was up and running will continue to run with it's established policies.
Should all 3 policy servers be down, then the nics will go into a pre-defined fallback policy until the policy servers come back up. You can fail open, closed, and in the near future, to the last policy you had.
Anyone who uses multiple DMZ's in their network. With a lot of servers. I'm thinking hosting companies that want to ensure their clients only get the services they pay for.
Yay me!
Merilus already has a FireCard.
It isn't quite the same, but it exists.
I can't say that I don't give a fuck. I've just run out of fuck to give.
In answer to your questions the answer is: 1) Yes 2)Yes - but not in all cases. 3) No. 4) Well if one computer gets infected - say through an employee getting an infected e-mail it means it doesn't spread to the rest of the network (a good thing).
Video Game cheats, hints a
It could be used as a second layer of defence when combined with a perimeter firewall. (Good security practice, don't rely on one single device to provide security).
It can be used as access control, only allowing client devices to go to certain places on your network. (ie: kiosk in the lobby only needs to surf through proxy server 1.1.1.1:8080, all else is denied).
Protect desktops w/ confidential information (Human Resources, Finance, etc.)
It can be used to harden servers. Many companies take the "tootsie pop" approach to security. Hard shell, gooshey center. This way, you open a couple of ports on a server, potentially not allow it to initiate connections to other boxen, etc.
Maybe the server is co-located at an ISP. You still control the rules.
Even if the server is owned, the machine itself has no control over it's security policy. That only happens from a central management station.
There are lots of uses for these NICs - just depends on where your security need is.
The most common implimentation is to use a single firewall to protect a network. This configuration also provides a single point of failure. If a cracker can get past the single firewall, he can mount attacks on any internal systems.
With a firewall on every machine and a general network firewall, you have a layered defense that is exponentially harder to subvert. It will also help stop internal attacks by employees, which are much more likely to succeed than external attacks.
The main reason that per machine firewalls are not a common practice is the administration overhead for a heterogenous network. Putting the firewall in an OS independant and inexpensive hardware implimentation might change this.
Software firewalls... HAHAHA. That's funny. You can't rely on software to protect an OS that has holes in it already. If code can circumvent the OS, it has complete control over the software running on that OS, including software firewalls or antivirus.
Y3kRAT
You can't rely upon a software firewall when readily-available, freely-downloadable, simple programs can take it completely out? These trojans and viruses can take out software firewalls today:
OptixPro
OptixLite
OptixKiller
Buschtrommel
Pentagoner
Plus more. Embedded Firewall is hardware-based. Because all of the firewalling functions happen in hardware, they are completely independent of the host operating system. Even if you circumvent the host OS, you will never be able to change your own security policy.
That's not the way these cards work. I've been testing the cards for some time now and you don't need any fancy network equiptment (other than the cards themselves) to set this up. The Policy Server here is a Windows applications (downside: no automation ability in the beta I had, not even a simple scripting engine). Configuration is sent over the network as special UDP (I think) packet.
The card has a few oddities nonetheless. First, when you install these cards, you need to build an "install image" on the policy manager. You then have to run that after you put the card in the machine to flash it's firmware (the cards send heartbeats back to the Policy Server, so they have to know where to send them). In effect, your users always have to download an install from your network to set up their cards, they can't just go out to the web and grab one. Fortunatly the card works as a regular NIC before you flash it.
This card also includes IPSEC offload for people running VPNs and the like. I never actually got it to work, but it's supposed to do the encryption in hardware. Apparently the firewall sits OUTSIDE of the ipsec traffic though, so all it sees are the encrypted packets, which limits its usefulness considerably.
All in all the cards are OK, not supurb yet (that management console is very click intensive to use), and reasonably cheap for their target market. I think they stand a good chance of taking off, especially as corporate security folks notice that these are the perfect replacment for the ubiquitious software firewalls in use today.
One more thing I thought would be amusing. If someone were to steal your machine and turn it on elsewhere without noticing what card you have, the security folks would immediatly know where their machine went.
I read the internet for the articles.
Internal attackers.
Disgruntled employees. Fired employees. Untrustworthy people on the inside trying to access payroll systems.
(avoiding debate between hardware vs software firewalls here)