1999-03-28-06:14:42 Frank Knobbe:
>Bennett Todd:
>> - People are falling all over themselves to invent new protocols --- and
>> increasingly, tunneling those new protocols through old ones in an
>> effort to bypass any attempt at security controls. By and large the new
>> protocols are being designed without attention to security issues.
>
> Actually you would tunnel older protocols through newer ones...I'm
> sure that is what you mean. But if these new protocols eliminate the
> security issues, then please explain, why we shouldn't?
I meant exactly what I said. Most notoriously, people inventing new protocols
often like to tunnel them over http, once they realize that (a) they have
neglected security issues in their design, and so (b) their new whizzo gizmo
isn't going to be available to people working at sites that care about
internet security. The old protocols may have had acceptable security,
typically due to limitations of what they could do (e.g. display text and
optionally images on the screen); the new ones may not have those limitations
(e.g. allow the web author to run arbitrary executable machine code on the
victim's workstation).
Perhaps _you_ would tunnel older protocols through newer ones. Perhaps _you_
believe new protocols "eliminate the security issues". I'm very happy to say I
don't. Please, stop putting words in my mouth, then debating those words.
>> - You don't have an infinite budget of either time or money.
>
> With the proper procedures, tricks and innovations, you will be able
> to succeed.
With proper procedures, no tricks, and just taking advantage of regular
innovations as I hear about 'em, I have no trouble keeping machines secure. I
just don't assume that whatever the customer asks for _must_ be permitted ---
and don't have a lot of respect for those who do.
> After all, a lot of inventions were born out of desperation...
Desperation is where you operate _after_ you've failed to do things right in
the first place. I avoid it.
>> I don't know about the person you were replying to, but no, I don't suggest
>> filtering and disallowing that kind of stuff, I filter _Everything_, and
>> only _allow_ select, carefully-chosen protocols, and these playthings never
>> even get considered as candidates for opening up. To even start considering
>> a new protocol, there's gotta be a strong business case for that protocol.
>
> Let's say the whole board of directors wants NetMeeting... strong
> enough case?
Happily, I've never worked at a place where the "whole board of directors"
didn't have plenty of real work to do, and wanted video games to entertain
them during the hours they were forced to sit in the office. If I did, though,
it'd be easy: just put all their workstations out in the DMZ.
-Bennett
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
