| |
Firewall Testing About VESARiA |
|
|
2.5 What about viruses?
Firewalls can't protect very well against things like viruses. There
are too many ways of encoding binary files for transfer over networks,
and too many different architectures and viruses to try to search for
them all. In other words, a firewall cannot replace
security-consciousness on the part of your users. In general, a
firewall cannot protect against a data-driven attack--attacks in
which something is mailed or copied to an internal host where it is
then executed. This form of attack has occurred in the past against
various versions of sendmail, ghostscript, and
scripting mail user agents like OutLook.
Organizations that are deeply concerned about viruses should implement
organization-wide virus control measures. Rather than trying to screen
viruses out at the firewall, make sure that every vulnerable desktop
has virus scanning software that is run when the machine is rebooted.
Blanketing your network with virus scanning software will protect
against viruses that come in via floppy disks, modems, and Internet.
Trying to block viruses at the firewall will only protect against
viruses from the Internet--and the vast majority of viruses are
caught via floppy disks.
Nevertheless, an increasing number of firewall vendors are offering
``virus detecting'' firewalls. They're probably only useful for naive
users exchanging Windows-on-Intel executable programs and
malicious-macro-capable application documents. There are many
firewall-based approaches for dealing with problems like the
``ILOVEYOU'' worm and related attacks, but these are really
oversimplified approaches that try to limit the damage of something
that is so stupid it never should have occurred in the first place.
Do not count on any protection from attackers with this feature.
A strong firewall is never a substitute for sensible software that
recognizes the nature of what it's handling--untrusted data from an
unauthenticated party--and behaves appropriately. Do not think that
because ``everyone'' is using that mailer or because the vendor is a
gargantuan multinational company, you're safe. In fact, it isn't true
that ``everyone'' is using any mailer, and companies that specialize
in turning technology invented elsewhere into something that's ``easy
to use'' without any expertise are more likely to produce software
that can be fooled.
|
 |
Vesaria
3640 Fords Lane, Suite D
Baltimore, MD 21215
443 - 501 - 4044
|
