Front cover - IBM Redbooks

356 Lotus Security Handbook
and is left inadvertently with services and ports open. Such a system could be
used to mount an attack against other systems in the organization.)
Furthermore, proper security relies on proper documentation. This is the reason
why a proper PSPG (Policies, Standards, Procedures Guideline) document, in
which the details of the baseline configurations are kept, should exist for the
organization.
9.1.2 Protection and prevention tools
Protection tools are one of the major elements that provide a secure buffer
between IT systems and the people who would attack them. These tools include
anti-viral scanners, application filters, firewalls, and other tools.
It’s worth repeating that protection tools only reduce the likelihood of attackers
successfully gaining access to an IT system. Given that there are many ways an
attack can be mounted, you should limit your reliance on these tools and
consider them more like delay tactics than attack prevention.
Firewalls
The details about firewalls, their architecture, and how to best use them is
explained in 4.1, “Infrastructure components” on page 116. In this section we
review some basic firewall concepts.
A firewall is a device that screens incoming network traffic and allows or
disallows the traffic based on a set of rules. Firewalls normally sit at the perimeter
of an organization's network, protecting it from the Internet, extranets, or other
less secure network segments. A firewall can run on UNIX or Windows
(preferably NT-kernel based) or other operating systems with software that
performs packet filtering, which, at a minimum, has been hardened against
attack, and has multiple network cards to connect different network segments.
Firewalls are so commonplace these days that there has been an overreliance
on them, with many system administrators thinking that firewalls provide all the
network security they will need. Worse, some system administrators think they
can take a firewall out of the box, plug it in, never look at it again, and still have it
protect their network.
Firewalls are only as effective as their rule base, their configuration, and the
system administrators monitoring them. Firewalls must be configured with an
appropriate rule set and must be constantly patched to address new emerging
vulnerabilities. As well, they must be monitored to detect suspicious activity.