Great post.

But let's turn it up to 11.

Today's port based firewalls are unable to identify and control applications that hop ports, use SSL, or port 80. The result, the FW guy who has to deal with the 10 problems above is doing so while he (or she) is blind.

Read more about it here:

http://blog.paloaltonetworks.com/?p=153

Great post.

But let's turn it up to 11.

Today's port based firewalls are unable to identify and control applications that hop ports, use SSL, or port 80. The result, the FW guy who has to deal with the 10 problems above is doing so while he (or she) is blind.

Read more about it here:

http://blog.paloaltonetworks.com/?p=153

I am sorry, but this article seems to me has been written in at least one century ago ;-) or author is trying to present firewall admins as stupid people.
i dont see those points real or not manageable, reality is different, believe me ;o)

I would have to disagree Alex. My company has approx. 120 FW pairs mainly comprised of CP and Cisco with a very few NS that were acquired. While maybe not perfectly stated, I believe the author's points are valid and a growing concern for any IT security group who owns FW mgmt responsibility. Maybe you don't have many FWs to manage or have not had the great fortune to inherit someone elses FWs through merger or aquistion. As a FW admin for 6+ yrs my experience agrees with the article. Additionally, in support of the author I read with interest a recent ISSA Journal article by three Notre Dame researchers that would definitely support the authors points. Rule bases are growing in complexity; FW administrators and their supervisors both know mistakes are being made but lack the resources to identify and correct them in a more proactive stance.

http://issa.org/Members/Journals-Archive/2009.html#February

I also found a very compelling survey by one the authors competitors that also supports his points.

http://www.securepassage.com/Downloads/?id=db590230-d54f-47bb-ae82-2eb569bdd8a5

Sorry for the anonymous post but I plead the 5th for fear of unsolicted sales calls... ;-O