On Sun, 20 Oct 2002 17:13:54 EDT, Sean Donelan <sean@donelan.com> said:
The problem is the complexity level of trying to maintain those perimeters, DMZs and firewalls is increasing. Massive firewall complexes with swiss-cheese rules, and huge network perimeters with numerous external access points are very difficult to manage.
They're still popular because *most* sites have only a small number (1 to 5 or so) official entrance points into the net, and can probably hire one or two people with a clue to babysit the firewall units. The perimeter may be difficult to manage, but the interior is, in general, totally out of control.
Although many of the oldest firewall creators have long pointed out the limitations of firewalls, currently practicing security consultants rely mostly on Internet security designs with firewalls, DMZs and defining perimeters. This may be partly because some security consulting firms are also VARs for firewall vendors; but I don't think its that simple.
As I like to say, firewalls are *not* a complete solution by themselves. They need to be addressed as "part of this complete security breakfast". Unfortunately, users are involved, and you end up having to decide if you want to make some toast while the users burn the scrambled eggs, or if you want to say 'screw it' and get an Egg McMuffin on the way to work. ;) Or stated differently - let's say you're a consultant. Which can you sell to the customer more easily - a firewall, or telling them that somebody needs to explain to the VP that 'viceprez' is a Bad Password?
Is the Orange Book really dead?
It's dead as far as providing an actual useful spec, as far as I can tell. It had a number of problems - an actual rating was only for *ONE* specific configuration, and changing it (even by upgrading memory or adding disks) would technically invalidate it. The whole RAMP thing to maintain a rating across a software upgrade was a true horrorshow paperwork-wise, and it didn't addresss network connectivity (although to be fair, there were other Rainbow Books that talked about RAMP and network stuff). It's still useful as a framework reference, mostly due to its ubiquity. /Valdis