Re: FIX for ZoneAlarm & KB951748 issue released
Harry Johnston [MVP] wrote:
> John John (MVP) wrote:
>
>> You constantly shift the discussion from the value of proper egress
>> filtering to software firewalls, even though I have said right from
>> the start that egress filtering at the firewall can be foiled and that
>> users should consider better methods. So get it in your thick skull,
>> egress filtering at a perimeter appliance is a sound security measure,
>> [...]
>
>
> As far as I recall, nobody in this thread has ever said otherwise. The
> discussion is about software firewalls, after all!
>
> Harry.
Read Kayman's posts, specifically:
John said:
>>There is also a developing and troubling trend in this whole debate, one
>>> that some people are bent on spreading at all costs, that because
>>> software firewalls are not immune to exploits by malware attempting to
>>> send data to outside networks, then by simple deduction any and all
>>> egress filtering as a security concept is unnecessary. Egress filtering
>>> at the perimeter, done by reliable network appliances, is a vital part
>>> of network security, without proper egress control your network security
>>> is incomplete, ignore egress traffic at your own perils!
Kayman said:
> Fact:
> Outbound control on an XP platform as a security measure against malware is
> still utter nonsense.
> The windows platform was designed with usability in mind providing all
> kinds of possibilities for e.g. inter-process communication. This
> together with the very high probability that the user is running with
> unrestricted rights makes it impossible to prevent malware allowed to
> run and determined to by-pass any outbound "control" (which, of course
> modern malware is) from doing so. It's simply too unreliable to
> qualify as a security measure.
Does that not say that "any" outbound control (egress control) is "utter
nonsense that is too unreliable to qualify as a security measure"? The
comment was made in direct reply to my statement that egress filtering
at the perimeter was a vital part of network security, how else can you
interpret Kayman's reply?
John