Firewalls and Internet Security: Repelling the Wily Hacker

by William Cheswick, William Cheswick, Steven Bellovin

The Barnes & Noble Review
The first generation of Internet security professionals cut its teeth on Firewalls and Internet Security, Repelling the Wily Hacker, by William R. Cheswick, Steven M. Bellovin, and Aviel D. Rubin.

But much has happened since that book became an instant classic in 1994. Unfortunately, the "good guys" have been gradually losing the Internet arms race. "The hackers have developed and deployed tools for attacks we had been anticipating for years. IP spoofing and TCP hijacking are now quite common...ISPs report that attacks on the Internet's infrastructure are increasing."

Well, it's taken nine years, but the Second Edition has arrived -- and not a moment too soon.

Above all, this book teaches the right attitude about security. With the right frame of mind, you're far more likely to make reasonable security decisions when new challenges arise. To that end, the authors waste no time, presenting the no-nonsense principles of Internet security right up front.

Keep the level of all your defenses at about the same height. (You wouldn't fit a bank vault with a screen door on the back, yet many people do the same thing with Internet security.) An attacker doesn't go through security, but around it. They're looking for your weakest link.

Put your defenses in layers. Some of the layers will be physical, some conceptual, but together, they're far more effective than any of them would be alone. (This is, incidentally, how your immune system works.) Keep it simple. Complex systems are difficult to understand, audit, explain, and troubleshoot, and virtually impossible to perfect.

Also: Don't hand out more privileges than someone needs to do the job. Security should be integral to the original design, not bolted on later. Programs are insecure until proven secure. But: If you don't run a program, who cares if it's secure? Most folks have heard at least some of these, but few people take them sufficiently to heart. The rest of this book is about translating these common-sense security maxims into safer systems.

In Chapters 2 and 3, the authors move on to discussing key Internet protocols from the viewpoint of security. They start at the lowest levels, with IP packets, ARP, and TCP-based virtual circuits, then systematically review routing protocols like BGP; DNS and DHCP; network address translation, and more.

When you really understand how TCP opens a connection, you can see how SYN flood attacks attempt to flood a host with "half-open connections." When you understand how UDP works, you can see why it's so easy to spoof UDP packets -- and why you'd better be careful about using the source addresses they present.

Along the way, the authors utterly massacre WEP, the standard wireless security protocol for WiFi networks. (When you read what they have to say, you have to shake your head and wonder about how this protocol was designed.)

Oh, and speaking of wireless: "[J]ust because you cannot access your wireless network with a PCMCIA card from the parking lot, it does not mean that someone with an inexpensive high gain antenna cannot reach it from a mile (or twenty miles!) away. In fact, we have demonstrated that a standard access point inside a building is easily reachable from that distance." Ouch.

The definitive coverage of protocols represents only one-fourth of this outstanding book. It's equally strong on assessing today's diverse classes of attacks; implementing safer tools and services; and designing and deploying secure firewalls and VPNs. The authors show how to improve security by optimizing your network's layout; present intelligent overviews of intrusion detection and encryption; and finally, preview some emerging innovations in Internet security.

While we hope we won't have to wait nine years for the next edition, this one should hold us in good stead for a very long time. Bill Camarda

Bill Camarda is a consultant, writer, and web/multimedia content developer. His 15 books include Special Edition Using Word 2000 and Upgrading & Fixing Networks For Dummies®, Second Edition.

Genres: Technology, Computers, Nonfiction, Computer Science, Technical, Software

464 pages, Paperback

First published January 1, 1994

Reviews

[Thomas Bray · Rating 5 out of 5]

What a delightful read. The fundamentals are sound - passwords are the worst, don’t trust the “sent by” field in an email, and the human is the most vulnerable component of a computer system.

It is odd to imagine a world where stateful firewalls aren’t a thing, http isn’t the network service to rule them all, and TLS/SSL and IPSEC are merely working specifications and not underlying any serious communication. Oh, and SSH isn’t a thing yet. Phew. We are truly spoiled.

[carl theaker · Rating 3 out of 5]

This book is more slanted to an admin, but a few things for the home users.

After reading I concluded the best thing to do is just disconnect from the wall
and use your home computer to play video games, but since we're not going
to do that there was a summary statement for us poor saps at home:

- for your browser, recommend turn off java, javascript, browser
plugins, activex controls, if you can, of course many useful websites
stop working when you do so.

java script, oddly this is not a Sun product, don't know where
that comes from. anyway i turned it off from the preferences menu
and the first site i visited wouldn't work as it needed java script.

for Microsofters turnoff AcitveX controls (not necessary
on UNIX/apple systems using MS browsers). since i dont have access to a
MS system i don't know if this is a pain or not.

Other tidbits:

- you should tier your passwords, that is if you do banking or your 401k
online, make that the 44 character password.. ok maybe not that long,
but use odd chars numbers etc.

for login into some public site, yahoo.music.download, use something
else, etc

[Joe · Rating 4 out of 5]

This book is amazing or useless, depending on how you look at it. :-D

If you need to simply "get it done" with a particular firewall, proxy etcetera, forget it. This book is useless.

If, however, you have worked with firewalls, proxies, and their kind for a while and you want to enrich your mastery of them, this book is amazing. Cheswick and Bellovin present fundamentals and subtleties that cut across particular products with amazing clarity and detail.

[TK Keanini · Rating 4 out of 5]

Back when Firewalls were first being put in to production, this was the classic text. Bellovin is still very active in the security community. Most of this book is outdated today but the fundamentals are still the same.