Re: [WEB SECURITY] Query: Are Firewalls obsolete in an Enterprise Web Service Environment?

["Justin Thomas" <justin@xxxxxxxxxxxxxxxxxx>]

That's a great article; it illustrates nicely the point that a network
firewall can be made redundant/irrelevant if you have tight and
effective controls on your hosts and applications.

It also illustrates the point (although less forcefully made) that
where that control cannot be enforced or needs to be duplicated (in
the author's "Outback" network near the end) a network firewall may
have an appropriate place.

As the author states, network firewalls are not a panacea - Honestly,
does anyone on this list believe that they are? - but they do have
their place.

Consider the solution based on it's capabilities and the value it
provides in your situation.

On Wed, Mar 26, 2008 at 12:50 AM,  <uzxd1t902@xxxxxxxxxxxxxx> wrote:
> This isn't directly related to application security, but more about
>  security without firewalls.
>
>  http://www.usenix.org/publications/login/2003-12/index.html
>  life without firewalls
>  by abe singer
>  It goes into how he got fed up with firewalls after a breach of a
>  major data processing center, and the subsequent solution he
>  implemented.
>
>  Apparently he gave a followup presentation in 2006.
>  http://www.usenix.org/events/usenix06/training/tutonefile.html#r4
>  (linked via http://digg.com/security/Security_without_firewalls%3A_Sensible_or_silly_?t=1895290#c1895290
>
>
> )
>
>  ----------------------------------------------------------------------------
>  Join us on IRC: irc.freenode.net #webappsec
>
>  Have a question? Search The Web Security Mailing List Archives:
>  http://www.webappsec.org/lists/websecurity/
>
>  Subscribe via RSS:
>  http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
>
>

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]