Commentary
2/16/2006
04:30 PM
Fred Langa
Fred Langa
Commentary

Langa Letter: How Much Protection Is Enough?

oo much or too little online security can lead to a world of trouble. Here's a solution.



Even if your PC contains no sensitive or personal information, it may still draw the attention of hackers and crackers. They seek to hijack innocent systems to use as staging areas or spam relays or to be "zombie agents" in denial-of-service attacks on other systems. (For an example, see http://www.msnbc.com/news/460824.asp?cp1=1).

Almost any hacker, cracker, or warez site offers tools that will make a law-abiding Netizen's hair stand up. For example, port-scanner tools can run through upwards of 10,000 IP addresses an hour, looking for any online system with an open and attackable port. It's astonishingly simple for a malicious hacker to simply point, click, and let the software run until it finds a vulnerable system.

With tens of thousands of miscreants on the prowl for vulnerable systems, any PC--even systems with dynamic IP addresses and intermittent dial-up connections, such as notebooks and non-networked PCs--can be vulnerable to attack.

Clearly, any system, networked or standalone, containing sensitive data or not, needs some level of protection from hackers other external threats, such as viruses, Trojans, and worms.

But how much protection is enough? How much is too much? Where along the broad spectrum between complacency and paranoia lies the perfect amount of protection?

The Extreme Views
At one extreme end of the spectrum are those who swear by single-layer defenses: They'll install a firewall running either on a connection-sharing server or on the local desktop and believe they're essentially immune to attack. Or they may similarly employ an external hardware or firmware firewall (such as in routers and gateways) and believe that systems on the protected side of the firewall are about as safe as they need to be.

Then there are those who inhabit the opposite end of the spectrum. They load up their systems with multiple firewalls and intrusion-detection and back-tracing utilities, perhaps in concert with an E-mail virus/attachment filter and a local antivirus scanner. After all, if one firewall or antivirus scanner is good, then two or three or four in concert must be better, right?

The trouble is, both extremes can get you into trouble.

The 'Single-Layer Defense' Fallacy
Let's first look at the single-layer defense argument. The problem here is simply that no product is flawless or foolproof or can protect you against all threats, as this reader recently discovered:

I've been using BlackIce [a desktop firewall] for around a year and a half. It's quite interesting to see how often I am "hit" and what people will try.

[Then] I purchased a Dlink 704 firewall/router. This model has a four-port hub built in and requires no extra software to install or change settings. With a flick of a switch on the back of the unit, you're on or off the Internet. Nice feature.

Last week, BlackIce on my primary desktop began flashing. I had someone breach my firewall and hit my machine! I'm glad I kept the BlackIce program installed. The intruder was, as far as I can tell, unable to access anything.
--Blaine

While it's possible that Blaine's attack was a false positive--BlackIce is a good tool, but it has somewhat of a reputation for false alarms--it's also entirely possible it was real. Even an excellent hardware firewall can be misconfigured, spoofed, or otherwise made to fail.

In fact, security tools and techniques fail all the time, as you can see by visiting a good security test site such as the free and excellent DSLreports.com. The people who use the security tests there are, by definition, already conscious of online safety concerns and more proactive about them than most users. And yet, in both DSLreports' quick-and-dirty "port probe" and the far more detailed "full scan" sections, you'll see an array of astonishing real-life, real-time examples from the test results database that show PCs with wide-open services (potentially available to attackers) or even with full access to the testers' local disks and printers.

These kinds of problems are much more likely to happen with a single-layer defense than with multiple layers because, in the former, any single point of failure will fundamentally compromise your security, perhaps disastrously. In contrast, with multilayered defenses, a problem with any one security layer won't necessarily affect the other layers.



Protecting The Back Channel
But there's more to a multilayered defense than simply providing backstop protection. For example, most hardware/firmware firewalls don't do much, if anything, about protecting the outbound side of a connection. They have no way of knowing if a port request from a desktop machine is legitimate or spoofed by a Trojan, a virus, or a worm. (In fact, Blaine's attack could have been the result of just such an attack, where malicious code on his system fooled his firewall into opening a port.)

So, many users employ a multilayer defense that also guards the outbound channel:

I'm an MIS/network-support engineer at a major distribution company. I have a Linksys router, and I run ZoneAlarm on all of my PCs as well. The reason for this is that even though Linksys acts as a firewall, it doesn't block any information from being sent out of your computers. If you happen to download a program that contains spyware, the Linksys router won't do anything to stop those packets from being sent out. ZoneAlarm does. It will allow virtually nothing to enter or leave your computer without your permission and works perfectly well with Linksys systems. Of course, you should still run antivirus software as well.
--O'Leary

While Blaine and O'Leary both use a combination of hardware and software firewalls, you can achieve the same effect just with software. For example, I distribute Internet access across my office LAN via WinProxy running on a dedicated server. WinProxy includes a software firewall to protect the inbound leg, but I still use ZoneAlarm on my desktop machines. It acts as a secondary firewall to block any inbound attack that makes it through the main firewall (as in Blaine's case). And (as O'Leary pointed out) it also can flag any outbound attempt by any program to access the Internet. Should a Trojan application or spyware end up on my machine, ZoneAlarm will alert me to any attempts by the hostile application to establish an outbound connection and let me block the attempt.

In this way, multiple layers of defense can buttress each other and improve your overall security.

Two Big 'Ifs'
But there are two big ifs: Multiple layers of defense are better than single layers only if they truly complement each other and if they don't interfere with each other.

By complement, I mean that they shore up each other's weaknesses. For example, a segmented LAN that uses a number of the same kind of routers, firewalls, etc., throughout the network does not--repeat, not--have a true multilayered defense. Conceptually, this is like having many locked doors, all of which are vulnerable to the same lock pick. Any attacker who can break in at any one point will be able to exploit the same weakness to attack other points in the LAN.

A truly effective multilayered defense is one that requires attackers to start from scratch at each layer and employ different break-in strategies. The harder it is, the less likely it is the attackers will succeed. Even if they're determined to try, the extra time it takes them to work through the layers is time during which you can detect and stop the intrusion.

Going Too Far
But make no mistake--a multilayered defense can go too far. That's where the issue of interference crops up. In cases where people run multiple firewalls, intrusion monitors, antivirus tools, etc., on the same PC, they can run into trouble because the apps may compete to "own" the processes they're designed to monitor.

This is perhaps easiest to see in the case of antivirus tools. In my own case, WinProxy offers some limited antivirus protection for the LAN as a whole. It runs on the server and does its own thing there. But separately, I run Norton AntiVirus on my desktop PCs. Because neither tool is working on the same data at the same time or on the same machine, they coexist well and buttress each other. Anything that gets by one is caught by the other.

But if you install multiple antivirus tools on the same PC, they can end up stepping on each other's toes. I saw this recently when I was asked to troubleshoot a problem PC in a school's administrative office. The machine was balky, unstable, and very slow. It had a number of problems, but the worst was that some well-intentioned soul had installed both Norton and McAfee antivirus tools on the system and set both to check for viruses each time any file was created, downloaded, opened, or saved. As a result, with almost any disk activity, both apps would try to grab and process the same file at the same time. The system was mired in file-contention hell.

You can run into the same kind of problem with other protective tools such as software firewalls. Adding, say, BlackIce and ZoneAlarm to the same system probably isn't worthwhile and may be downright counterproductive. You're asking for trouble by having two apps simultaneously trying to monitor, process, and log a single system's Internet activity.

Fortunately, the issue of interfering tools usually doesn't arise when the protective technologies are carefully chosen and split, with some residing on the local desktop and the rest residing in external routers, servers, and firewalls. Because the tools operate independently, they can coexist well and provide more security than either could alone.



Peaceful Coexistence
If you chose and deploy your security tools wisely, you also can increasingly layer them to provide whatever level of defense you require without running into interference and performance problems. In my case, for example, not only do I have the server-level and desktop-level firewalls and antivirus scanners in operation, but I also use a desktop folder-encryption tool to scramble the contents of some especially sensitive material on my system. An intruder would first have to find my LAN's unpublicized IP address (it's separate from my public Langa.Com domain), break the main firewall, defeat the LAN's intrinsically secure setup, find my machine on the LAN, defeat the secondary firewall there, then break the 192-bit Blowfish encryption of my protected folders before he or she would get to anything even remotely sensitive.

While no system (including mine) is 100% hack proof, if you make your system harder to break into than the next guy's, most hackers/crackers will opt for an easier target and move on. And that's just what you want.

So, to me, the key to online security lies neither in complacency nor paranoia, but in carefully choosing and deploying at least two different and complementary defensive layers, and increasing the layers up to the least number that provides the amount of security desired--without duplicating tools at any one layer.

As such, I believe that everyone--no exceptions--should have at least a two-layer defense and that the "let one firewall do everything" people and the "throw in every security utility you can find" crowd are both wrong.

But what's your take? Is my "multiple layers" advice in itself paranoid? Can one solid, defensive layer really do it all? What security tools do you use? Which ones would you recommend and which would you warn others to avoid? And if you could design an ideal security setup, what would it be? Share your thoughts in the Listening Post discussion area!

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Email This  | 
Print  | 
RSS
More Insights
Copyright © 2020 UBM Electronics, A UBM company, All rights reserved. Privacy Policy | Terms of Service