Hello everyone,
Some of you may remember my earlier
email, I said that I was going to do my dissertation on a client-side
firewall system that can be configured from a centrally located web
interface. Unfortunately most of you responded with the fact that many
companies have already written such a system.
So I have had to think of another
project and unfortunately again, my dissertation supervisor wont let me
change top, so I have to think of other issues with firewalls.
Anyways, I did a search on
limitations of current firewall technologies,
and one site said a common misconception is that you run a firewall and
that's it, it takes care of itself. We admins know this, firewall rules
have to be added and modified all the time to deal with new threats and
policies. But it did get me thinking that maybe someone could write a
firewall that is semi-self managed.
So, my idea is, to write a
client-side firewall system that can be configured through a centrally
located web interface (which has already been done) but! interface the
firewalls with an IPS/IDS system such as snort... Snort stores alerts
into a database, so, I could just write the firewalls to look at the
database and block off IPs and Ports which are shown in the alerts.
Does such a product already exist? I realise Snort and other IDS
systems give off false positives, that isn't too much of a biggie I
could deal with that in the following way:
The rules generated from the snort
database will have some kind of marker, so that admins know they were
generated by snort.
If an admin takes off a firewall
rule because it was a false-positive, then the firewall will know next
time it sees that alert that it was a false-positive.
I'm also thinking that it will help
admins find false-positives too... if a user complains that he cant do
something (something that is within company policies) then you know
that one of the alerts generated was a false-positive and the IDS can
be tuned.
Anyways, if you guys called tell me
what you think and if there are any firewall products out there that
use IDS/IPS systems to generate rules.
Thank You
~Davie Elliott
