🚀 go-pugleaf

Ben Lovejoy wrote:
[snip]
> Sorry to keep pushing on this one, but I really do need to get some kind of
> meaningful sense of the risks involved before deciding what precautions
> need to be taken.

Ben,

You can't eliminate the risk of someone hacking into your system. What you can
do though is to minimise the chance of someone getting in, and secondly,
minimise the damage than can be inflicted if someone does get in. A firewall
achieves both of these in a number of ways.

Suppose that I knew of a way to hack into a standard Mac running OT and I
publicise that information in a hacking forum. All the wannabee hackers
immediately go off attacking every known Mac in sight and word gets back to
Apple who release a patch. Mac users install that patch and sleep easily
again. However in your case you have two options: without a firewall you have
to install that patch on every one of your Macs. With a firewall you only have
to install it on one machine. Well big deal you think, "I've only got a few
tens of machines at the most and it's not that big a problem." But suppose
that while you are away on holiday a user has a disk crash and re-installs the
MacOS. Except they don't know about the patch so their machine is now
vulnerable. Suppose someone hacks in while you are still on holiday and
haven't even had a chance to check up? Well your back's covered but it didn't
help your company much.

If you had taken the firewall approach users wouldn't be allowed to access the
machine so there is no danger of the patch inadvertantly being removed. And
because the machine is solely for use as a firewall you can produce a
backup/recovery tape with all the right software on to be used in the event of
a disk crash. While you're on holiday a deputy can be instructed to only
restore from that tape only should it become necessary to do so.

So the risks here are not what chance is there of being hacked into but what
chance is there of you or a user making an inadvertant change to a machine
that could leave your network vulnerable? Let's face it - if users didn't
screw up their machines on a fairly regular basis we wouldn't need help desks
and system administrators. I think that this risk is nearly unquantifiable in
terms of how many times will it happen in a year on average but

    (small risk) * (one machine) < (small risk) * (tens of machines)

is indisputable.

Not convinced by this scenario? The recent crack-a-mac contest was won, not
because of a weakness in the MacOS or the web server software being used, but
because of a weakness in a third-party add-in to the web-server. Such a
weakness could just as easily be present in an add-in to Netscape, or
Photoshop or whatever. Are you going to prevent all of your users from
installing add-ins? Sooner or later one of them will complain to the boss that
they can't get their work done without such-and-such an add-in. Your response
of "Well it might have a security vulnerability" won't wash because you can't
prove it. Besides your boss probably won't even understand and will (a) tell
you to install the add-in for the user and, (b) still blame you for any
security breach that happens anyway.

In this situation, using a firewall doesn't prevent the add-in from having a
vulnerability but it will help to prevent and contain the activities of any
hacker who does exploit the vulnerability. It will also alert you to
suspicious activity so you'll know about the breach earlier than you would
otherwise, and hopefully before too much serious damage is done. In this
situation the firewall has helped to reduce the consequences of the security breach.

In 99.999% of all hacking incidents that cause damage, the hacking was carried
out either by, or with the assistance of someone inside the targetted
organisation. Usually it's an aggrieved employee getting even, occasionaly it
is bribery, blackmail or some other form of coercion. Companies that
manufacture widgets have procedures to deter employees who try to steal them
from the warehouse so it is perfectly reasonable to try and stop the same
thing from happening with your valuable data. Okay, admittedly, stopping an
employee from stealing data is much harder, but at least a firewall could be
configured to log data transfers - dates, times, volumes, ip addresses etc.
Without a firewall you would have no evidence at all.

What about pornography and related evils of the internet? The security advisor
for my own company was telling me (and this happened only recently, just
before Christmas) that an employee was escorted to the door to be arrested by
waiting police officers for downloading child pornography using the company's
internet link. What gave him away was the fact that the corporate firewall
logs all accesses by source and destination ip address, time of transfer etc.
and in his case these details were a bit supicious. Without the firewall we
may never have known.

Now comes the nightmare scenario to have sleepless nights over. Suppose that
we didn't have the firewall, didn't keep the logs and hadn't found out
ourselves but instead the police had caught him by other means. Suppose that
he claims in his defence that the company had led him astray by providing
unfettered access to such material? Where does that leave us? The internet and
criminal law is a whole new ball game with little in the way of precedent. Do
you want to be the company that has to fight the test case in such a
situation? Besides, even if you win, mud sticks and the company may never live
it down.

The risk of this is slight (although remember that it may yet happen to us)
but the repercussions are horrendous. I suggest that you put a proposal for a
firewall on your MD's desk: if he rejects it because there's only a _slight
risk_ of the system being hacked into then tell him that there's only a
_slight risk_ of him going to prison and see what colour his face turns...

Regards,

-- 
Bruce Horrocks
Hampshire
England
bh@granby.demon.co.uk