On 13/09/05 19:03 -0500, Helen Mats wrote:
In the next month or so I am going to be given an opportunity to bid on
a firewall project for one of our very best customers. I do not have the
scope or the rfp at this point and time, just wanted to get an idea from
other consulting companies, or consultants, what type of different
firewall skills are there? I assume developer's as well as people that
Apologies for the late reply, but I have been travelling.
I don't really see there being different "firewall" skillsets. There are
people with expertise in different product areas, but the basic set of
skills is the same. This is the skill to figure out what the client
really needs, as opposed to what they think they need, and then allowing
only that legitimate subset of communication to occur. I won't recommend
specific products, all of us have our own opinions on what is best.
IMHO, a firewall is generally treated as a bandage for bad code. Defense
in depth is an important part of the firewall scenario, and you will
need people with multiple product skillsets there. Things like replacing
IE with Mozilla (or Firefox with very few extensions), possibly
deployment of a desktop antivirus, proper subnetting, client and server
host configurations should, IMHO, be part of the firewall itself.
Once you have this in place, then deploy one or more packet filters at
the edge, and put a bunch of proxies behind them. The edge router should
handle the noisy bits (SMB, CIFS, MSSQL, etc) and ICMP rate limiting.
Packet filters do more fine grained inspection and maintain state. The
proxies actually make the outbound connections to the world.
Specific software will depend on what the client needs (SE Linux on the
desktop?). After you have decided on the policy, you will need to decide
which software best meets your needs. The skills of people will depend
on the software you choose. You would also need people familiar with the
applications and protocols the client is running. If you want to list
the skills in a job ad, all of system administration, programming and
network administration would be required.
I hope this helps.
Devdas Bhagat
