[BookReview] Building Internet Firewalls

Building Internet Firewalls
By Elizabeth D. Zwicky, Simon Cooper, and D. Brent Chapman
Copyright © 2000 O'Reilly & Associates, Inc.
ISBN 1-56592-871-7
$65.95 CAN, $44.95 US
869 pages

This is not a new book, first appearing in print in April of 1995, now updated and on it's second edition. To be honest, I didn't really feel this book would offer me much after all, I am comfortable writing ipfilter rules and since I use OpenBSD for everything , I don't have to do much in the way of OS hardening. I was wrong, Building Internet Firewalls is about much more than just firewalls. In fact, you have to go quite a ways into the book before you actually get to the nuts and bolts of firewall building. Building Internet Firewalls focuses primarily on Unix systems, with occasional sections focusing on WinNT/2k, and a chapter dedicated to Windows NT/2000 bastion hosts. Though it provides useful information on hardening Windows machines, this is not a good sole resource for you if your firewall runs on NT.

Part I Network Security provides an excellent overview of security principals, and is recommended reading for everyone who might be involved in a firewall project. In Chapter 1, you are faced with questions that are key to creating a successful security strategy. Chapter 3 does an effective job of describing security strategies and terminologies to everyone who might be involved in the firewall project.

Part II Building Firewalls provides system administrators and technical leads with a high-level view of the information they will need to make intelligent choices. The IP protocol is covered, along with a description of common attack methods based on low-level protocol details. Firewall architecture and technology chapters provide information useful to system archtects. These sections are excellent as well for management types who may not understand exactly where some of the requirements you are developing come from.

Of particular note to system administrators are the chapters on preparing bastion hosts. If you are less than intimately familiar with the platforms you administer, I highly recommend this series of chapters.

Part III Internet Services , systematically covers application protocols providing advice on the packet filtering and proxying characteristics of each service, along with specific information on how to secure each service further to prevent abuse. At the end of discussion of each application protocol, a summary of recommendations is presented.

Part IV Keeping Your Site Secure is geared more towards policy wonks, and provides a description of how to put together a security policy, what that policy should contain, and how it should be enforced.

Building Internet Firewalls is a well organized comprehensive resource, I have provided a complete chapter listing to pique your interest.

1. Network Security
   1. Why Internet Firewalls?
   2. Internet Services
   3. Security Strategies
2. Building Firewalls
   4. Packets and Protocols
   5. Firewall Technologies
   6. Firewall Architectures
   7. Firewall Design
   8. Packet Filtering
   9. Proxy Systems
   10. Bastion Hosts
   11. Unix and Linux Bastion Hosts
   12. Windows NT and Windows 2000 Bastion Hosts
3. Internet Services
   13. Internet Services and Firewalls
   14. Intermediary Protocols
   15. The World Wide Web
   16. Electronic Mail and News
   17. File Transfer, File Sharing, and Printing
   18. Remote Access to Hosts
   19. Real-Time Conferencing Services
   20. Naming and Directory Services
   21. Authentication and Auditing Services
   22. Administrative Services
   23. Databases and Games
   24. Two Sample Firewalls
4. Keeping Your Site Secure
   25. Security Policies
   26. Maintaining Firewalls
   27. Responding to Security Incidents
5. Appendixes
   1. Resources
   2. Tools
   3. Cryptography

Building Internet Firewalls is an excellent resource. It provides a comprehensive overview of the security process. The detailed descriptions, and summary of recommendations of application protocols alone make it outstanding for firewall administrators. This is a book that is useful on many levels, and by many people within an organization.