[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ipsec vs. firewalls
> > The problem is that for a corporate network of any substantial
> > size, there will *never* be a way to make the interior crunchy.
>
> Eventually, I believe it is reasonable to expect that vendors will
> automate patch application, and that patches will be obtained from the
> vendor over the network...
Perry has already pointed out that big outfits with mission-critical
applications want to vet new software releases very carefully. Even
less-fussy organizations often want to do updates in a controlled way,
because changes and new releases so often have unwanted side effects.
(Auto-update schemes would be more acceptable to many users if the
software suppliers weren't such bungling incompetents half the time.)
To say nothing of the security implications of having your binary-only
software going off and doing unspecified things over the network without
being asked... "Trust us, it's for your own good." Yeah, right. One
of the reasons why firewall configurations often restrict outgoing calls,
as well as incoming ones, is distrust of software suppliers.
Henry Spencer
henry@spsystems.net
(henry@zoo.toronto.edu)
References: