Dont Toss That Personal Firewall

By Larry Seltzer  |  Posted 2004-08-05 Print this article Print

Opinion: The new Windows Firewall in Windows XP Service Pack 2 is a big step forward and should make systems safer in general, but if you want to be serious about security you need more.

The new firewall in Windows XP Service Pack 2 is not by any means the most important security advance in the service pack. Other changes, principally locking down the My Computer zone in Internet Explorer, will have more profound implications for security of the average system. But its not unimportant. Had Microsoft done the Internet Connection Firewall in the initial Windows XP this way—that is more aggressive, less troublesome for normal networking uses, and on by default—it would have prevented a lot of the damage caused by Blaster, Sasser, Slammer and some lesser attacks. Microsoft pointed out at the time that users who ran ICF were safe from those attacks, but that missed the point: Why would anyone run ICF when it interfered with the ability to do many normal networking operations?

Windows Firewall, as the new ICF is known, is a much better program. Ive been running it for months now, and it hasnt interfered with anything. In fact, Ive barely noticed it. You may already have realized that this is a clue to some of the problems with it.

Read all about Microsofts battle to deliver secure software in eWEEK.coms special report on
It was important for Microsoft to build a firewall that didnt hassle users with a lot of messages that would redound to their beloved OEMs and Internet service providers as support calls. Unfortunately, to do that, they made a firewall thats very conservative about blocking potentially suspicious traffic.

For instance, with very few exceptions, Windows Firewall monitors and blocks no outbound traffic. Outbound monitoring is actually (mixing a couple metaphors here) like locking the henhouse after the fox is already in. A user who infects himself with MyDoom might be stopped from being part of a DDOS attack on by outbound monitoring. Windows Firewall doesnt do this (hows that for irony?).

There are still plenty of problems you might have with a default configuration of Windows Firewall. If you are running a game server of some kind or an uncommon chat program, you might need to accept incoming connections on a nonstandard port. For this, Windows Firewall lets you set a program and port "exception."

Next page: Third-party firewalls go much further.

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel