Hardware & Infrastructure
Commentary
2/16/2006
04:30 PM
Fred Langa
Fred Langa
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Langa Letter: How Much Protection Is Enough?

oo much or too little online security can lead to a world of trouble. Here's a solution.

Even if your PC contains no sensitive or personal information, it may still draw the attention of hackers and crackers. They seek to hijack innocent systems to use as staging areas or spam relays or to be "zombie agents" in denial-of-service attacks on other systems. (For an example, see http://www.msnbc.com/news/460824.asp?cp1=1).

Almost any hacker, cracker, or warez site offers tools that will make a law-abiding Netizen's hair stand up. For example, port-scanner tools can run through upwards of 10,000 IP addresses an hour, looking for any online system with an open and attackable port. It's astonishingly simple for a malicious hacker to simply point, click, and let the software run until it finds a vulnerable system.

With tens of thousands of miscreants on the prowl for vulnerable systems, any PC--even systems with dynamic IP addresses and intermittent dial-up connections, such as notebooks and non-networked PCs--can be vulnerable to attack.

Clearly, any system, networked or standalone, containing sensitive data or not, needs some level of protection from hackers other external threats, such as viruses, Trojans, and worms.

But how much protection is enough? How much is too much? Where along the broad spectrum between complacency and paranoia lies the perfect amount of protection?

The Extreme Views
At one extreme end of the spectrum are those who swear by single-layer defenses: They'll install a firewall running either on a connection-sharing server or on the local desktop and believe they're essentially immune to attack. Or they may similarly employ an external hardware or firmware firewall (such as in routers and gateways) and believe that systems on the protected side of the firewall are about as safe as they need to be.

Then there are those who inhabit the opposite end of the spectrum. They load up their systems with multiple firewalls and intrusion-detection and back-tracing utilities, perhaps in concert with an E-mail virus/attachment filter and a local antivirus scanner. After all, if one firewall or antivirus scanner is good, then two or three or four in concert must be better, right?

The trouble is, both extremes can get you into trouble.

The 'Single-Layer Defense' Fallacy
Let's first look at the single-layer defense argument. The problem here is simply that no product is flawless or foolproof or can protect you against all threats, as this reader recently discovered:

I've been using BlackIce [a desktop firewall] for around a year and a half. It's quite interesting to see how often I am "hit" and what people will try.

[Then] I purchased a Dlink 704 firewall/router. This model has a four-port hub built in and requires no extra software to install or change settings. With a flick of a switch on the back of the unit, you're on or off the Internet. Nice feature.

Last week, BlackIce on my primary desktop began flashing. I had someone breach my firewall and hit my machine! I'm glad I kept the BlackIce program installed. The intruder was, as far as I can tell, unable to access anything.
--Blaine

While it's possible that Blaine's attack was a false positive--BlackIce is a good tool, but it has somewhat of a reputation for false alarms--it's also entirely possible it was real. Even an excellent hardware firewall can be misconfigured, spoofed, or otherwise made to fail.

In fact, security tools and techniques fail all the time, as you can see by visiting a good security test site such as the free and excellent DSLreports.com. The people who use the security tests there are, by definition, already conscious of online safety concerns and more proactive about them than most users. And yet, in both DSLreports' quick-and-dirty "port probe" and the far more detailed "full scan" sections, you'll see an array of astonishing real-life, real-time examples from the test results database that show PCs with wide-open services (potentially available to attackers) or even with full access to the testers' local disks and printers.

These kinds of problems are much more likely to happen with a single-layer defense than with multiple layers because, in the former, any single point of failure will fundamentally compromise your security, perhaps disastrously. In contrast, with multilayered defenses, a problem with any one security layer won't necessarily affect the other layers.

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - August 20, 2014
CIOs need people who know the ins and outs of cloud software stacks and security, and, most of all, can break through cultural resistance.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.