Slashdot Mirror

← Back to Stories (view on slashdot.org)

Tear Down the Firewall

Posted by timothy on from the tripartate dept.

lousyd writes "'What's the best firewall for servers?' asked one Slashdot poster. 'Give up the firewall' answers Security Pipeline columnist Stuart Berman. Through creatively separating server functions into different, isolated servers, and assigning them to a three tiered system of security levels, his company has almost completely eliminated the need for (and headache of) network firewalls. "Taking that crutch away has forced us to rethink our security model," Berman says. The cost of the added servers is greatly minimized by making them virtual servers on the same machine, using Xen. With the new security-enhanced XenSE, this might become easier and more possible. What has you chained to your firewall?"

3 of 395 comments (clear)

  1. "Simple" ACLS by wcdw · · Score: 4, Interesting

    By defining simple ACLs, we further isolate our backend servers.

    Personally, I've never found ACLs as easy (or as flexible) as other firewall solutions. But in any event, ACLs are firewalls, call them what you will....

    --
    If you're not living on the edge, you're just taking up space!
  2. Firewalls aren't totally expendable by cerberus4696 · · Score: 5, Interesting

    It's one thing to give up the firewall if all you have behind it is servers. It's quite another to give it up if you're protecting user workstations. While it's certainly possible to carefully arrange your external services such that they are secure, it's really only possible if you have absolute control over every single device behind the firewall.

  3. I use a firewall to isolate networks by StupidKatz · · Score: 5, Interesting

    I'm running all kinds of crud on the intranet that I don't want exposed to the Internet, such as NetBIOS on Windows and some permissive SAMBA shares on assorted servers.

    So, the services are running so that I can use them from the inside (with any device on the inside, without mucking with ACLs, additional equipment aside from a switch, etc.) without having the services exposed to the outside.

    Now, if you're running services which aren't being used by legitimage users at all... ;)