Langa Letter: How Much Protection Is Enough? - InformationWeek
Hardware & Infrastructure
04:30 PM
Fred Langa
Fred Langa

Langa Letter: How Much Protection Is Enough?

oo much or too little online security can lead to a world of trouble. Here's a solution.

Even if your PC contains no sensitive or personal information, it may still draw the attention of hackers and crackers. They seek to hijack innocent systems to use as staging areas or spam relays or to be "zombie agents" in denial-of-service attacks on other systems. (For an example, see

Almost any hacker, cracker, or warez site offers tools that will make a law-abiding Netizen's hair stand up. For example, port-scanner tools can run through upwards of 10,000 IP addresses an hour, looking for any online system with an open and attackable port. It's astonishingly simple for a malicious hacker to simply point, click, and let the software run until it finds a vulnerable system.

With tens of thousands of miscreants on the prowl for vulnerable systems, any PC--even systems with dynamic IP addresses and intermittent dial-up connections, such as notebooks and non-networked PCs--can be vulnerable to attack.

Clearly, any system, networked or standalone, containing sensitive data or not, needs some level of protection from hackers other external threats, such as viruses, Trojans, and worms.

But how much protection is enough? How much is too much? Where along the broad spectrum between complacency and paranoia lies the perfect amount of protection?

The Extreme Views
At one extreme end of the spectrum are those who swear by single-layer defenses: They'll install a firewall running either on a connection-sharing server or on the local desktop and believe they're essentially immune to attack. Or they may similarly employ an external hardware or firmware firewall (such as in routers and gateways) and believe that systems on the protected side of the firewall are about as safe as they need to be.

Then there are those who inhabit the opposite end of the spectrum. They load up their systems with multiple firewalls and intrusion-detection and back-tracing utilities, perhaps in concert with an E-mail virus/attachment filter and a local antivirus scanner. After all, if one firewall or antivirus scanner is good, then two or three or four in concert must be better, right?

The trouble is, both extremes can get you into trouble.

The 'Single-Layer Defense' Fallacy
Let's first look at the single-layer defense argument. The problem here is simply that no product is flawless or foolproof or can protect you against all threats, as this reader recently discovered:

I've been using BlackIce [a desktop firewall] for around a year and a half. It's quite interesting to see how often I am "hit" and what people will try.

[Then] I purchased a Dlink 704 firewall/router. This model has a four-port hub built in and requires no extra software to install or change settings. With a flick of a switch on the back of the unit, you're on or off the Internet. Nice feature.

Last week, BlackIce on my primary desktop began flashing. I had someone breach my firewall and hit my machine! I'm glad I kept the BlackIce program installed. The intruder was, as far as I can tell, unable to access anything.

While it's possible that Blaine's attack was a false positive--BlackIce is a good tool, but it has somewhat of a reputation for false alarms--it's also entirely possible it was real. Even an excellent hardware firewall can be misconfigured, spoofed, or otherwise made to fail.

In fact, security tools and techniques fail all the time, as you can see by visiting a good security test site such as the free and excellent The people who use the security tests there are, by definition, already conscious of online safety concerns and more proactive about them than most users. And yet, in both DSLreports' quick-and-dirty "port probe" and the far more detailed "full scan" sections, you'll see an array of astonishing real-life, real-time examples from the test results database that show PCs with wide-open services (potentially available to attackers) or even with full access to the testers' local disks and printers.

These kinds of problems are much more likely to happen with a single-layer defense than with multiple layers because, in the former, any single point of failure will fundamentally compromise your security, perhaps disastrously. In contrast, with multilayered defenses, a problem with any one security layer won't necessarily affect the other layers.

1 of 3
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll