Hello everyone,
Some of you may remember my earlier email, I said that I was going to do my
dissertation on a client-side firewall system that can be configured from a
centrally located web interface. Unfortunately most of you responded with
the fact that many companies have already written such a system.
So I have had to think of another project and unfortunately again, my
dissertation supervisor wont let me change top, so I have to think of other
issues with firewalls.
Anyways, I did a search on limitations of current firewall technologies, and
one site said a common misconception is that you run a firewall and that's
it, it takes care of itself. We admins know this, firewall rules have to be
added and modified all the time to deal with new threats and policies. But
it did get me thinking that maybe someone could write a firewall that is
semi-self managed.
So, my idea is, to write a client-side firewall system that can be
configured through a centrally located web interface (which has already been
done) but! interface the firewalls with an IPS/IDS system such as snort...
Snort stores alerts into a database, so, I could just write the firewalls to
look at the database and block off IPs and Ports which are shown in the
alerts. Does such a product already exist? I realise Snort and other IDS
systems give off false positives, that isn't too much of a biggie I could
deal with that in the following way:
The rules generated from the snort database will have some kind of marker,
so that admins know they were generated by snort.
If an admin takes off a firewall rule because it was a false-positive, then
the firewall will know next time it sees that alert that it was a
false-positive.
I'm also thinking that it will help admins find false-positives too... if a
user complains that he cant do something (something that is within company
policies) then you know that one of the alerts generated was a
false-positive and the IDS can be tuned.
Anyways, if you guys called tell me what you think and if there are any
firewall products out there that use IDS/IPS systems to generate rules.
Thank You
~Davie Elliott
