Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

I've come across some Windows administrators that are disabling Windows Firewall because "it makes troubleshooting more complicated".

The systems are protected by firewall appliances at the edge. They believe that is sufficient.

My question is: Assuming that the firewall hardware appliance is ideally configured, are there any concrete reasons to enable the OS-level software firewall?

Some type of points I am looking for:

  • Some information from an OS developer (Windows or non-Windows) with regards to the importance of the OS-level firewall

  • A demonstration or example of an exploit that is only possible if the OS-level firewall is disabled

Edit: Modified question after discussion in comments with @joeqwerty.

share|improve this question
2  
Defense in depth. Is the physical network inside the perimeter firewall totally secure? Can a random PC with who-knows-what viruses or malware be connected? Is there WiFi available? If an exploit happens on the web server or SQL server leading to an attacker being able to remotely execute things on that server, what else can the attacker get to easily? How likely is any of those things, and how much effort will be required to protect against them (with OS firewalls or other measures)? – Mike Renfro Aug 21 '11 at 20:48
@Beaming Mel: No offense, but you've taken on the task of convincing sysadmins that disabling the Windows firewall is a security risk but yet you're at a loss to demonstrate or articulate why that is a risk? – joeqwerty Aug 21 '11 at 21:05
2  
@Beaming Mel: Am I misunderstanding what you're asking? Have you your own insight, experience, and demonstrations and you're only looking for supporting data from us or is it that you've launched a crusade without any authority on the matter and you're looking to us to build your case for you? – joeqwerty Aug 21 '11 at 21:11
@joeqwerty: I see your point. My argument is that it adds to security because it is another level a person with malicious intent would have to penetrate before obtaining access. However, their argument is that is not necessarily a real-world scenario. Thank you for pointing out the flaw in my approach. I will leave the question open for the time being because I'd like to see the input from others. I apologize for wasting your time though. – Beaming Mel-Bin Aug 21 '11 at 21:51
@Beaming: I don't see it as a waste of time and I don't neccessarily disagree with you. My point though is that you need to be able to support your argument with real world knowledge, experience, examples, and demonstrations. As a sysadmin I don't take advice from anyone who can't demonstrate real world experience and knowledge. – joeqwerty Aug 21 '11 at 21:57
show 7 more comments

3 Answers

up vote 5 down vote accepted

It is becoming increasingly common for hackers to penetrate networks using other methods than breaking in through the perimeter firewall.

A common one is dropping a USB stick loaded with a virus in a business carpark. Perhaps the most famous example of this is the Stuxnet virus. It was a virus aimed at systems that were totally off the grid, no internet or network access at all, so it was assumed that they required no firewall security. The story itself is an incredible read - how someone (we assume a government) managed to infiltrate an offline network with the specific requirement of sabotaging a nuclear facility.

These are far fetched, but they are by no means fiction. It depends on your industry. If you work in finance or banking, then you better make sure you're protected. Hell, even disable the USB ports on the computers. But if you run Nan and Pops Little Country Bakery, then perhaps it's not such a big deal.

share|improve this answer
up vote 1 down vote

As in most things, define your threat. If, for example, you know that for whatever reason you have poor manageabilty of the Windows servers, it may make more sense you just leave them all open and just have 1 central point to manage (the firewall). Security is always a tradeoff, and as we all know, the only way to be 100% secure is to unplug the computer. So, you're accepting some level of risk. If you have to go around to 30 machines to open port 5555 for some application, you've wasted some time that you could have spent in other areas. Of course, if you have very good group polcies, then this is less of an issue.

One important point about a lot of systems management is to immediately take the attitude that it does not matter how many "X" you have to support. i.e., if this solution works ok for 2, it should work ok for 40, otherwise you're just really setting yourself up for trouble. So do it right, don't do it dumb.

If their complaint is that it increases troubleshooting, focus on that complaint. Maybe this involves centralized management via windows policies of the firewalls on the desktops. If doing that will cause you to spend 100 hours on a tool, weigh that against how much time is wasted troubleshooting problems caused by the firewall.

Spend your time where it will have the most benefit.

share|improve this answer
Thank you, +1. You bring up some business reasoning that I believe is very fitting in my situation. Appreciate it. – Beaming Mel-Bin Aug 21 '11 at 22:12
up vote -3 down vote

While an OS level firewall is important, windows firewall is generally not recomended. It is an allow outbound firewall, and applications can turn it off. (reference: http://www.pcworld.com/article/117380/is_microsofts_firewall_secure.html)

share|improve this answer
1  
Sure, by default it allows all outbound traffic, but so does netfilter. So does pf. That's why there are systems administrators - to configure these things as appropriate for each application. It's a trivial process to deny all outbound traffic if that's your need. – EEAA Aug 21 '11 at 21:00
6  
If you have a decent perimeter firewall and you're running Windows XP SP3 or above (e.g. Windows 7), then the Windows Firewall is good enough for most scenarios. Plus you can manage it via GPO, which greatly lowered administrative overhead. Also, if you're going to quote a reference, make sure it's not one that's 7+ years old. – Mark Henderson♦ Aug 21 '11 at 22:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.