Re: Air Gap VS. Firewall

["Marcus J. Ranum" <mjr () nfr net>]

> There is no real difference between this description and an application
> proxy firewall.  It's a fine design for a proxy firewall.

It seems to me that there are a couple of basic laws of
security for firewalling, kind of like gravity and friction for
the real world. They look like this:

1) The easier it is for outside systems to talk to you, the less
secure you are.
2) The more transparent operations are for your users, the
more transparent they will be for a trojan horse (and by
extension, the less secure you are)

I think the second law of firewall thermodynamics
certainly applies to these "air gap" firewalls.

One source of confusion in this discussion is that some
of the list members have used _real_ "air gap" firewalls
(hi Joe!) and are confusing the whale/spearhead "air
gap" firewalls with the kind they know of. The classical
"air gap" firewall is pretty darned secure: you have the
Email go to a queue file on an externally reachable
machine. Every so often (once or twice a day) someone
makes a tape of the queue file, carries it to an internal
machine, runs a program against it that vets it for
attachments, executables, etc, and discards them,
then pushes the messages into a mail system. Now,
that _is_ good security. It also makes web surfing
difficult. :) Which was what prompted my earlier post
on the topic: if you can transparently surf the web through
it, it's an "ordinary" firewall at best.

mjr.
---
Marcus J. Ranum     Chief Technology Officer, Network Flight Recorder, Inc.
Work: http://www.nfr.net
Play: http://pubweb.nfr.net/~mjr


_______________________________________________
Firewall-wizards mailing list
Firewall-wizards () nfr net
http://www.nfr.net/mailman/listinfo/firewall-wizards