|
Posted by Mr. Arnold on July 15, 2007, 8:30 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>> Hi,
>> Vista FW with advanced security comes with an outbound traffic default
>> setting "allow everything which is not denied". I think this is
>> completely useless, because the main reason for outbound traffic filter
>> is to block UNKNOWN programs (worm, trojans ....) so it is impossible to
>> make a rule to deny an unknown program/destination port. On the other
>> hand if I change the outbound setting to "block everything that does not
>> match a rule" it is nearly impossible to design a rule for legitimate
>> programs because, as far as I understand, there is no "display
>> notification" for outbound breaking rule, and it is not simple to know
>> applications/services/ports of the majority of legitimate applications
>> (apart from browser mailer and few others).
>> My question is: is there a way to have a kind of display notification of
>> the outbound offended rule with applications/services/ports of the
>> offending programs?
>>
>
> Learn how to configure Vista Firewall to suit your computing habits.
>
> Interesting/educational reading:
>
http://www.microsoft.com/technet/technetmag/issues/2006/05/SecurityMyths/default.aspx
> Scroll down to:
> "Myth: Host-Based Firewalls Must Filter Outbound Traffic to be Safe."
>
>
http://www.microsoft.com/technet/technetmag/issues/2007/06/VistaFirewall/default.aspx
> "Outbound protection is security theater-it's a gimmick..."
> "...the Windows firewall will provide the protection you need..."
>
> Stay away from 'Phoney-Baloney' 3rd party PFW's - use your brain and
> filter
> out the absurd advertisement hype created by these makers.
> http://samspade.org/d/firewalls.html
> "Personal Firewalls" are mostly snake-oil"
Personal FW's are packet filters running at the machine level.
For the most part, the 3rd party solutions are doing the same thing as
Vista's FW in their ability to set packet filtering rules to stop inbound or
outbound packets to and from the machine, which is no different than Vista's
FW/packet filter.
Granted, 3rd party solutions have some snake-oil in them too, beyond just
being simple packet filters and so does Vista's FW/packet filter as well
with its WPF and BEF, which malware can cut right through it if it can get
on the machine and execute.
As far as outbound filtering by setting packet filtering rule to stop
traffic for a 3rd party solution, then there is nothing wrong with it.
| 
XML site map