Firewalls’ False Sense of Security - Computerworld
Firewalls’ False Sense of Security - Computerworld
FEBRUARY 28, 2005 (COMPUTERWORLD) - The Internet front door to almost every bank and financial services company in the world is guarded by two sets of firewalls defining a DMZ. Nearly every e-commerce site sits in a similar DMZ in what has become the de facto standard in Web security architecture. According to Sun Microsystems, “In today’s tumultuous times, having a sound firewall/DMZ environment is your first line of defense against external threats.” But I would argue that guarding the perimeter is lulling organizations into a false sense of security that results in ignoring the implementation of other security mechanisms in their applications and databases.
In contrast, the Internet front door to MIT doesn’t have a DMZ and pretty much doesn’t even have a firewall. Universities begin with an assumption that everything is open, but these large organizations are arguably no more vulnerable to external threats than banks and financial institutions, and perhaps less vulnerable to internal threats.
A key reason for reduced vulnerability is the approach many universities take to creating authorization and application-level security in the absence of a secure perimeter. For more than a decade, universities have been implementing homegrown systems and working with vendors to ensure that their products don’t make assumptions about working behind a firewall. We look for systems to incorporate application-level security based on verifiable user identities — an approach that continues to gain ground as organizations realize that firewalls alone don’t provide the level of security they need in today’s world.