full-disclosure - Why should one buy (or not) an Appliance-based security gateway?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200407302045.i6UKjk3V026010@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Why should one buy (or not) an Appliance-based security gateway? 

On Fri, 30 Jul 2004 14:55:04 -0300, Bernardo Santos Wernesback <bernardo@....com.br>  said:

> A few colleagues and I started a discussion as to why one should or shouldn't
> buy an appliance-based firewall, ids/ips or other security appliance instead of
> installing software on a server. 

Does "installing software on a server" mean:

a) Building your own sentinel/gateway box and installing security software on it
or
b) installing security software directly on the server that needs protection?

> We thought about patching, performance, and other reason for each option but 
> I'd like to hear what other people think.

An often overlooked issue is that the right choice for a clued and technically
competent site is quite often a poor choice for a site that's not able to
get its clue together.  And there's a lot more of the latter than the former.

The best thing about an appliance is it's an *appliance* - a site can get
it, park it in its spot, plug the DMZ-side and inside-side cables into it,
do a little bit of basic config, and it works.  The more configuration
knobs, the more chances to break it by accident.

And if you're installing software directly on the server that needs protecting,
that's just a disaster waiting to happen, especially in the Windows world -
the last thing a low-level admin needs is for the security software to install
a DLL that's incompatible with the service to be protected.....

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040730/edd0f31a/attachment.bin