-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> -----Original Message-----
> From: R. Michael Williams, MCSE [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, March 23, 1999 11:12 PM
> To: Larry Cannell; Firewall List
> Subject: RE: Netmeeting
>
> [...]
> He is not addressing the inherent flaws in any other system. We know
> those exist, too. The point is that NetMeeting is very difficult to
> proxy effectively with content examination, it uses a potentially
> large number of ports (compared to SMTP mail traffic), and has no
> secure method of authenticating and identifying those connecting.
Michael.
The point he was making is that the whole communication industry and
the way we communicate is changing. Yeah, SMTP was great then. But
today everyone is emphasizing Confidentiality, Integrity and
Availability (CIA). S/MIME and (Open)PGP provide integrity for email.
What about streamed sessions? Not just NM but RA/RV and the like as
well. They still lack the session authenticity and integrity
assurance. However, people seem to scream real loud about how
'insecure' NM is for that reason. Incredibly, these are the people
that still use plain text SMTP email without A or I assurance.
> I don't care how many other systems are also insecure if I'm
> specifically discussing NetMeeting. They are off-topic, and I'll
> address them separately. Tell be about the ones that *are* secure.
Sometimes you have zoom back to see the whole picture, to see how one
product fits in the grander scheme of things.
> [...] But let's face
> it, MS PPTP, RRAS, and NetMeeting are just too partially designed
> and/or implemented to be allowed to pass traffic through the outer
> membrane of any organization that has internal data or systems that
> are not for public consumption or operation. Period.
Ouch. You won't gain any clients with that attitude. A lot of times
the best security consultant is the one that implements the fewest
security constraints while still providing sufficient protection for
information and systems.
And what is wrong with RRAS anyway? (Let's take that off-list)
> [...] Products with no real predictable way to ensure their
traffic's
> content and origins (Cu-See-Me, and others, included) should be
> re-examined by their designers if they are to be used for business
> purposes inter-organization.
So, you suggest filtering and disallowing them? You may as well
disconnect the firewall. But rest assured, folks are reviewing
protocols, see above.
> Maybe a secure implementation or a
> content-based proxy (with source code available, at least to third
> parties like NCSA, etc., for certification) could be written by the
> designers of the protocol or application for use in corporate
> settings.
The ICSA (former NCSA) might certify a product based on their
measurements and guidelines, but I think it would be better if a
product underwent public scrutiny as well. Anyway, are you suggesting
to create two versions of a piece of software or a protocol, a
commercial and a public one? And what does secure mean anyway? You can
tackle even the most 'plain and insecure' protocol. Do you need
authenticity? Authenticate. Do you need integrity? Sign. If you need
to hold a closed NM session, have participant use a separate ILS
server that they have to authenticate against before their data stream
may flow into the sacred meeting...
> I don't know. I do know that I'll not use these things even
> for personal use as long as I have systems at home that house any
sort
> of personal data that I consider sensitive or need-to-know.
I hope you have a firewall at home and an encrypted channel to your
ISP....
Again, I'm baffled by the level of paranoia that is present among
current security practitioners. People have to realize that a) nothing
is secure out of the box, b) anything can be implemented to fit
someone's needs. We should not try to implement the tightest security
controls possible, but strive for a sound implementation with the
least restrictions of use and still an appropriate level of
protection. NetMeeting, for what it is used for, is appropriate
(although I miss the reflector type video hosting, oh well, maybe in
3.0...;)
The issue here is not NM or the protocols it's using, but how you can
implement it in a secure fashion. If that means to set up a Proxy
Server, that can dynamically open ports, behind, before, or next to an
existing, static rule firewall, then so be it. Open your mind, and the
bytes will follow...
Regards,
Frank
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.0.2
Comment: PGP encrypted email preferred
iQA/AwUBNvssOClma9DCzQQeEQLwWACg0/w6wHYrKTY+UDzeXOVTdZa+KTIAn1Pd
STOi4ky6G8mlk1wv4eMrYRsQ
=OFDr
-----END PGP SIGNATURE-----
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
