Dont Toss That Personal Firewall

Dont Toss That Personal Firewall
( Page 1 of 2 )

Opinion: The new Windows Firewall in Windows XP Service Pack 2 is a big step forward and should make systems safer in general, but if you want to be serious about security you need more.The new firewall in Windows XP Service Pack 2 is not by any means the most important security advance in the service pack. Other changes, principally locking down the My Computer zone in Internet Explorer, will have more profound implications for security of the average system. But its not unimportant.

Had Microsoft done the Internet Connection Firewall in the initial Windows XP this way—that is more aggressive, less troublesome for normal networking uses, and on by default—it would have prevented a lot of the damage caused by Blaster, Sasser, Slammer and some lesser attacks. Microsoft pointed out at the time that users who ran ICF were safe from those attacks, but that missed the point: Why would anyone run ICF when it interfered with the ability to do many normal networking operations?

Windows Firewall, as the new ICF is known, is a much better program. Ive been running it for months now, and it hasnt interfered with anything. In fact, Ive barely noticed it. You may already have realized that this is a clue to some of the problems with it.

Resource Library:

Read all about Microsofts battle to deliver secure software in eWEEK.coms special report on

It was important for Microsoft to build a firewall that didnt hassle users with a lot of messages that would redound to their beloved OEMs and Internet service providers as support calls. Unfortunately, to do that, they made a firewall thats very conservative about blocking potentially suspicious traffic.

For instance, with very few exceptions, Windows Firewall monitors and blocks no outbound traffic. Outbound monitoring is actually (mixing a couple metaphors here) like locking the henhouse after the fox is already in. A user who infects himself with MyDoom might be stopped from being part of a DDOS attack on www.microsoft.com by outbound monitoring. Windows Firewall doesnt do this (hows that for irony?).

There are still plenty of problems you might have with a default configuration of Windows Firewall. If you are running a game server of some kind or an uncommon chat program, you might need to accept incoming connections on a nonstandard port. For this, Windows Firewall lets you set a program and port "exception."

Next page: Third-party firewalls go much further.

>>> More Network Security & Hardware Articles          >>> More By Larry Seltzer