North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Security gain from NAT

  • From: Fred Baker
  • Date: Mon Jun 04 23:08:03 2007
  • Authentication-results: sj-dkim-7; [email protected]; dkim=pass (si g from cisco.com/sjdkim7002 verified; );
  • Dkim-signature: v=0.5; a=rsa-sha256; q=dns/txt; l=2753; t=1181012743; x=1181876743; c=relaxed/simple; s=sjdkim7002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; [email protected]; z=From:=20Fred=20Baker=20<[email protected]> |Subject:=20Re=3A=20Security=20gain=20from=20NAT |Sender:=20; bh=IjPiP9cY5LmfNCbnYl2QUQzG06ficR5BMiQ3MN690PQ=; b=RlsH3d09jAvcJiWnNq41W8VIP3bJKZKmhis7YrNIhLQqOXbC63rEM5SJ4EgY6Us11s5u9ozL JAUgbDk79jARG5TxxHI3GvglX3UMoxmBrUYRR6+pHvo/ymJSQ281Iccs;


On Jun 4, 2007, at 12:22 PM, Dave Israel wrote:
[email protected] wrote:
On Mon, 04 Jun 2007 11:32:39 PDT, Jim Shankland said:
*No* security gain? No protection against port scans from Bucharest?
No protection for a machine that is used in practice only on the
local, office LAN? Or to access a single, corporate Web site?
Nope. Zip. Zero. Ziltch. Nothing over and above what a good properly
configured stateful *non*-NAT firewall should be doing for you already.

What the firewall *should* be doing? The end devices *should* not need protection in the first place, because they *should* be secure as individual devices. But they are not. So you put a firewall in front of them, and that device *should* give them all the protection they need. But sometimes, it doesn't. So you make end devices unaddressable by normal means, and while it shouldn't give them more security, it turns out it does. No matter how much it shouldn't, and how much we wish it didn't, it does.

The difference between theory and practice is that in theory, there is no difference, but in practice, there is.

Actually, I would disagree.

A large percentage of attacks, 80% by some estimates, are from behind the firewall. I will argue that the end system needs its own defenses anyway for that reason if none other.

That said, the end system is not the only thing one defends. One has an investment in bandwidth and in various other services that one provides for one's-self; the firewall primarily defends those assets, and incidentally gives a first line of defense for your end systems.

Defense in depth is also a very commonly used strategy; by limiting the attacks that can happen, in defended places one can focus more heavily on attacks that remain possible.

I compare it to the human body's defenses. We have all sorts of things that we use to defend against disease etc; cells that attack specific things, cells that attack things that differ from what is expected, sentinels, and all sorts of other things. We also have at least two firewalls. The skin keeps an awful lot of crud out, meaning we don't have to bring in the big guns, and between the brain and the rest of the body we have a second firewall.

NATs are overrated as firewalls. As defenses, they are breached with some regularity. Stateful firewalls are better, if only because they are more intelligent. And firewalls as a class are over-rated as a defense mechanism. There is a long list of attacks that cross them with ease. But as one weapon in the arsenal, they are a simple prophylactic that helps in a material way.