I haven't done too much research into appliance-based devices but you would
guess that are set up for one purpose.
If I was going to build a Snort IDS box, it wouldn't have telnet open and it
wouldn't use HTTP (unless I was using ACID, then I would use SSL).
If I wanted to make a DHCP server - I would take Linux and strip the kernel
of all unneeded modules and recompile. Turn off all unneeded services and
make the image reuseable.
Appliance-based devices should use the same idea. But maybe they are like
cars. You can buy a sports car...which is designed for speed. Yet the fuel
map isn't tuned like it could be and that is a lot of back pressure in the
exhaust.
Basically, it comes down to how much do you want to learn about network
security and how secure do you want to me. Will properly fine-tuned homemade
system beat an applicance? - yes!. But can everyone built that system, No!
Wow did that make any sense? lol
-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Paul Schmehl
Sent: Friday, July 30, 2004 1:34 PM
To: Bernardo Santos Wernesback; full-disclosure@lists.netsys.com
Subject: Re: [Full-Disclosure] Why should one buy (or not) an
Appliance-based security gateway?
--On Friday, July 30, 2004 02:55:04 PM -0300 Bernardo Santos Wernesback
<bernardo@ish.com.br> wrote:
A few colleagues and I started a discussion as to why one should or
shouldn't buy an appliance-based firewall, ids/ips or other security
appliance instead of installing software on a server.
We thought about patching, performance, and other reason for each option
but I'd like to hear what other people think.
I would really appreciate if you could share your thoughts with me.
1) Most appliance-based devices do not allow access to the operating system
from the application. In fact, they don't even allow access to the
application, except for its configuration.
2) Most appliance-based devices have a kernel and OS that is specifically
built (or the latest buzz word "purpose-built") for the service they
provide, making them capable of running on lower speed processors and lower
memory footprints than a general purpose OS (or conversely, capable of
doing a great deal more with the same CPU speed and memory footprint.)
Those are the two main benefits that I hear most often touted. I haven't
done any research into those claims. Perhaps someone else has?
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
