ls were intended less as security devices than as a means of preventing broken networking software or hardware from crashing wide-area networks. In those days, malformed packets or bogus routes frequently crashed systems and disrupted servers. Desperate network managers installed screening systems to reduce the damage that could happen if a subnet’s routing tables got confused or if a system’s Ethernet card malfunctioned. When companies began connecting to what is now the Internet, firewalls acted as a means of isolating networks to provide security as well as enforce an administrative boundary. Early hackers were not very sophisticated; neither were early firewalls.Today, firewalls are sold by many vendors and protect tens of thousands of sites. The products are a far cry from the first-generation firewalls, now including fancy graphical user interfaces, intrusion detection systems, and various forms of tamper-proof software. To operate, a firewall sits between the protected network and all external access points. To work effectively, firewalls have to guard all access points into the network’s perimeter otherwise, an attacker can simply go around the firewall and attack an undefended connection.The simple days of the firewalls ended when the Web exploded. Suddenly, instead of handling only a few simple services in an “us versus them manner”, firewalls now must be connected with complex data and protocols. Today’s firewall has to handle multimedia traffic level, attached downloadable programs (applets) and a host of other protocols plugged into Web browsers. This development has produced a basis conflict: The firewall is in the way of the things users want to do. A second problem has arisen as many sites want to host Web servers: Does the Web server go inside or outside of the firewall? Firewalls are both a blessing and a curse. Presumably, they help deflect attacks. They also complic...
