[Next] [Up] [Previous]
Next: Data authentication Up: Access Control and Previous: Network Authentication: Kerberos

The Role of Firewalls

A firewall is a term used for a ``barrier'' between a network of machines and users that operate under a common security policy and generally trust each other, and the outside world. In recent years, firewalls have become enormously popular on the Internet. In large part, this is due to the fact that most existing operating systems have essentially no security, and were designed under the assumption that machines and users would trust each other.

There are two basic reasons for using a firewall at present: to save money in concentrating your security on a small number of components, and to simplify the architecture of a system by restricting access only to machines that trust each other. Firewalls are often regarded as some as an irritation because they are often regarded as an impediment to accessing resources. This is not a fundamental flaw of firewalls, but rather is the result of failing to keep up with demands to improve the firewall.

There is a fairly large group of determined and capable individuals around the world who take pleasure in breaking into systems. Other than the sense of insecurity that it has instilled in society, the amount of actual damage that has been caused is relatively slight. It highlights the fact that essentially any system can be compromised if an adversary is determined enough. It is a tried and true method to improve security within DOD projects to have a ``black hat'' organization that attempts to break into systems rather than have them found by your real adversaries. By bringing the vulnerabilities of systems to the forefront, the Internet hackers have essentially provided this service, and an impetus to improve existing systems. It is probably a stretch to say that we should thank them, but I believe that it is better to raise these issues early rather than later when our society will be almost 100% dependent on information systems.


[Next] [Up] [Previous]
Next: Data authentication Up: Access Control and Previous: Network Authentication: Kerberos
Kevin S. McCurley
Sat Mar 11 16:00:15 MST 1995