SLAC Computer Security		Search SLAC
SLAC Home | Computing Home | Computing Outages | Help

Cyber Security Awareness Month

These tips are part of a month long effort to distribute useful computer security information to the SLAC community.

Day 7 - Host-based Firewalls and Filtering

SLAC has many network ports blocked in our border routers and at several points within our internal network. We also have firewalls built into the operating systems of most of the computers and laptops we use. We then have anti-virus on our servers/desktops/laptops as well. This gives us multiple levels of protection, called defense-in-depth. SANS Internet Storm Center handler shared this regarding host-based firewalls and filtering: Increasingly I have seen Host-Based firewalls being brought up on the corporate radar in those arenas that have to deal with such things as VPN's, other remote computing solutions, and thusly trojans, worms, and other auto-spreading malware. Host-Based firewalls are basically exactly what they sound like (excuse me for taking a step back for everyone's benefit), a firewall that resides on the HOST itself.  Your computer.  The Machine you using right now.  Whether it be Windows, OSX, *nix, or *bsd variant, there is a firewall available for every OS, and every OS has one built in.  Some better than others (in the interest of full disclosure, I am typing this on a PowerMac, which has a built in firewall, and one that needs a bit more tweaking).  As firewalls should be (IMHO) "Deny All, Permit by Exception".  When my parents or a friend asks me what kind of "free firewall" to install on their Windows machine, I usually go with "at least turn on the built in one! (Which is now on by default as of XPSP2)", and then if more assistance is needed I usually go with ZoneAlarm.  I'm not partial to any one firewall in particular, whichever gets the job done quickly and efficiently.  Basically I say all that to make this point:  Host-Based firewalls (especially for home users) are a great idea, they come in a lot of variants, and should be deployed.