Firewall Design Philosophy

Firewall Design Philosophy

The key to administering network security is the firewall. While there are important issues concerning internal security, those issues are the same regardless of whether or not you are connected to the Internet. (Refer to Chapter 4 for information on host security and "Local Area Network Access" for information on local network security.)

Regarding the firewall itself:

Limit users--if possible, limit users to the sole administrator of the system. If additional users are necessary, refer to Chapter 4 for a discussion of issues regarding password protection and educating users.
Limit services--the more services you allow, the more possible security holes you present. In addition and in general, the more complex the software providing these services, the more chance for compromise, and the newer the software, the less chance it has been well tested in the "real world."
Monitor the system--this document helps you configure the IRIX software of your firewall to maintain log files that can provide information on accesses to your firewall host, including time of access and unsuccessful access attempts. Also, make use of the many standard IRIX tools such as w(1), ps(1), and so on that give you snapshots of current system activities (see Table 4-3 for a list of security-related commands).
do not run applications on the firewall--any additional software, besides containing possible security weaknesses, further complicates the software environment, making security control more problematic.