« Two Things that Everyone in Infosec Agrees WIth | Main | Don't Trust. And Verify. »


Andy Steingruebl

Ok, but if they are wrong about the countermeasures, why do you think they're right about the threats?

I'll point out again that if you look at number of attempted attacks on a raw internet connection, the majority of them are un-targeted attacks against OS and Middleware, not against applications. They are worms, scanners, etc. I don't know if the honeynet guys have current number about quickly you get owned without basic packet filtering and turning off services, but I bet you don't survive long.

Maybe you think we ought already to have fully invested in technologies to stop those attacks and start focusing our efforts higher up? Not sure....

Michael Janke

"How do you reconcile spending on something (firewalls) that does not address any of your top threats?"

Could it be that the reason application attacks are the top threat because most systems *are* firewalled? And that spending money on firewalls is the reason that other threats are *not* the top threat?

Or - could it be that IT managers look at 'security gateways' as firewalls and buy them out of the firewall budget? Add layers 4 through 7 to the firewall and set some more policies?

Speaking of 1995... that would be about where we'd be if we stopped spending money of firewalls. Land attacks, smurf attacks, ping 'o death...

Firewalls are necessary, not sufficient. It's been that way for the last decade, and will be for the next. Enterprises will spend money of firewalls for at least the next decade. If anything, they'll buy more and smarter firewalls - so that they can isolate and protect internal users and applications from each other, micro segment applications and databases, create PCI and HIPAA islands, and [...drumroll...] so that they can protect higher layers in the stack.


I bet FishNet (whoever they are) also magically sell Firewalls, AV and other such magic ;-)


I would tackle this bit of data by focusing on the 3 top concerns, rather than attacking the top 3 budget items.

I'd note that those top 3 things are alarmingly new, or at least currently growing out of control. Maybe they are:

- so new that we fear them more

- too new to have solid approaches to tackling the issue (at least that are as widely known and accepted as things like firewalls/AV)

- too new to have real budget items, unlike product lines like firewalls and AV. I don't know of any box an exec can demand to buy that says "secures cloud" or "sanitizes social media."

- too new to even know how business wants or can use these items effectively, or how to control them. Especially for things that start making their ways into business from consumerland (mobiles, social media, and various definitions of what cloud is). If the business doesn't even know how to use them yet, I'm not sure security is in any position to guide that usage securely.

- sort of related, but these 3 items are business-pushed (or consumer-pushed) as opposed to firewalls, AV, and AM which are really IT dept solutions. Does this mean we aren't matching business? Not necessarily. It more likely means business desires/processes are more complex than just blocking specific bits or ports or signatures or even behaviors.

Maybe in 10 years mobile device (as we know them today) security will be as old habit as firewalls?

The comments to this entry are closed.