ISBN: 9780201634662

But after a time, as Frodo did not show any sign of writing a book on the spot, thehobbits returned to their questions about doings in the Shire. Lord of the Rings-;J. R.R. TOLKIEN The fi… Mehr…

But after a time, as Frodo did not show any sign of writing a book on the spot, thehobbits returned to their questions about doings in the Shire. Lord of the Rings-;J. R.R. TOLKIEN The first printing of the First Edition appeared at the Las Vegas Interop in May, 1994. At that same show appeared the first of many commercial firewall products. In many ways, the field has matured since then: You can buy a decent firewall off the shelf from many vendors. The problem of deploying that firewall in a secure and useful manner remains. We have studied many Internet access arrangements in which the only secure component was the firewall itself-;it was easily bypassed by attackers going after the protected inside machines. Before the trivestiture of AT ISP machines for months-;machines that had access to a major percentage of the ISP''s packet flow. By some estimates, these sniffers captured over a million host name/user name/password sets from passing telnet, ftp, and rloginsessions. There were also reports of increased hacker activity on military sites. It''s obvious what must have happened: If you are a hacker with a million passwords in your pocket, you are going to look for the most interesting targets, and .mil certainly qualifies. Since the First Edition, we have been slowly losing the Internet arms race. The hackers have developed and deployed tools for attacks we had been anticipating for years. IP spoofing Shimomura, 1996 and TCP hijacking are now quite common, according to the Computer Emergency Response Team CERT . ISPs report that attacks on the Internet''s infrastructure are increasing. There was one attack we chose not to include in the First Edition: the SYN-flooding denial-of- service attack that seemed to be unstoppable. Of course, the Bad Guys learned about the attack anyway, making us regret that we had deleted that paragraph in the first place. We still believe that it is better to disseminate this information, informing saints and sinners at the same time. The saints need all the help they can get, and the sinners have their own channels of communication. Crystal Ball or Bowling Ball? The first edition made a number of predictions, explicitly or implicitly. Was our foresight accurate? Our biggest failure was neglecting to foresee how successful the Internet would become. We barely mentioned the Web and declined a suggestion to use some weird syntax when listing software resources. The syntax, of course, was the URL... Concomitant with the growth of the Web, the patterns of Internet connectivity vastly increased. We assumed that a company would have only a few external connections-;few enough that they''d be easy to keep track of, and to firewall. Today''s spaghetti topology was a surprise. We didn''t realize that PCs would become Internet clients as soon as they did. We did, however, warn that as personal machines became more capable, they''d become more vulnerable. Experience has proved us very correct on that point. We did anticipate high-speed home connections, though we spoke of ISDN, rather than cable modems or DSL. We had high-speed connectivity even then, though it was slow by today''s standards. We also warned of issues posed by home LANs, and we warned about the problems caused by roaming laptops. We were overly optimistic about the deployment of IPv6 which was called IPng back then, as the choice hadn''t been finalized . It stillhasn''t been deployed, and its future is still somewhat uncertain. We were correct, though, about the most fundamental point we made: Buggy host software is a major security issue. In fact, we called it the fundamental theorem of firewalls : Most hosts cannot meet our requirements: they run too many programs that are too large. Therefore, the only solution is to isolate them behind a firewall if you wish to run any programs at all. If anything, we were too conservative. Our Approach This book is nearly a complete rewrite of the first edition. The approach is different, and so are many of the technical details. Most people don''t build their own firewalls anymore. There are far more Internet users, and the economic stakes are higher. The Internet is a factor in warfare. The field of study is also much larger-;there is too much to cover in a single book. One reviewer suggested that Chapters 2 and 3 could be a six-volume set. They were originally one mammoth chapter. Our goal, as always, is to teach an approach to security. We took far too long to write this edition, but one of the reasons why the first edition survived as long as it did was that we concentrated on the concepts, rather than details specific to a particular product at a particular time. The right frame of mind goes a long way toward understanding security issues and making reasonable security decisions. We''ve tried to include anecdotes, stories, and | Firewalls and Internet Security by Aviel John Fuller Paperback | Indigo Chapters Books > Computers > Networks P10116, Aviel John Fuller<