Greetings, interesting interchange of opinions, nevertheless we must
consider: a firewall everything in one has a great disadvantage in
performance, reason why a rasonable solution is a distributed
infrastructure, not forgetting the subject redundancy as much in connections
as of equipment, this increases the costs independently of the
infrastructure by which it is selected.
Of another side, I am a partisan of infrastructures of security based on
FLOOS, not by a subject of costs but by the freedom in the design of the
infrastructure and the integration that we can obtain from it, it is not a
secret which the monitors in diverse points its necesary in a possible
attack and a IDS or IPS send a early alert, of being able to analyze in real
time and to have information and alert, with the FLOOS alternative we can
make any thing and for my that it is the advantage.
is necessary to have the knowledge necessary to integrate the perfect
infrastructure, but this not finish, that is single the principle since
there is to maintain it, to update it and to improve it.
I says that but that to have a scapegoat if something fails but to try to
avoid in max the failure and option to leave this task into the hands of a
company or in our hands, I decide on the second. A clear item it we can find
in the Computer Crime and Security Survey CSI/FBI 2005 (
http://www.gocsi.com/forms/fbi/csi_fbi_survey.jhtml) where we can see that
companies that have great investment in security, do not make use of
outsourcing in security but that they handle they themselves to it, this
have a security equipment that maintains infrastructure. Since to do it with
FLOOS he is interesting, you can use GNU/linux in especificos
Bridge+firewall way as it base and to separate I deal to others hosts, as
one why analyzes mail + antivirus + antiSpam, other that it analyzes I deal
before it arrives at the web server like proxy inverse, proxy that controls
the use of the network resources towards Internet and one that can handle to
connections VPN in routing and processing of the coding, ipsec is the ideal.
There is much to speak on this IMHO FLOOS is a very good option in an
infrastructure of security to the measurement, tensile and reliable :)
ska
