Well-planned firewall serves up more than security for net users

I've recently talked with several network managers who are reading up on, and shopping
around for, turnkey Internet firewall servers.

Their sudden interest is directly related to the latest crop of World Wide Web page
authoring software.

Let's take a look at how one has influenced the other, then see why a firewall-server
combo could be a good solution for small- to medium-sized government offices.

Over the past two years, many offices got onto the Internet by renting or borrowing
space on other agencies' Web servers. It made short-term sense, because they avoided
spending big money on equipment and special connectivity. But as sites grew, maintenance
became an ever-increasing problem.

That's where page authoring tools come in. Packages such as Microsoft's FrontPage and
Adobe Systems' SiteMill help users design good-looking Web pages. Even more important,
they provide tools for managing those pages. They establish a consistent directory
structure, build reusable templates and construct robot headers, footers, icons and
pointers that can be updated across all pages as needed.

The problem is, these packages do best with direct access to the Web server over a LAN.
If users have to create their pages off line, then use the File Transfer Protocol to
connect to and update the site, they can't take full advantage of the automated features
in these packages.

FrontPage users also have that package's unique pointer-addressing scheme to worry
about. FrontPage prefers to work in a mode where it makes its own ""web'' of
pages and controls the way the pointers relate to the site's directory. If you create
individual FrontPage documents on your desktop and then move them to a server, you'll be
shocked at the number of dead links.

A lot of FrontPage and SiteMill users have tried out the site management software but
wound up frustrated by the limits of hosting their Web sites externally. Many finally
decided the time had come to bring their operations in house.

To do so, they still need an Internet service provider, but the provider often just
offers a pass-through to the Internet rather than full hosting services. And small offices
don't want a large-scale setup with separate machines to handle gateway traffic, mail,
Web, Domain Name Service and FTP.

The solution could be a single plug-and-play LAN machine that acts as a secure firewall
while providing common network services. The firewall part of the device makes the
connection secure between a trusted and an untrusted network. That's important if you're
running an Internet server for the first time. Your LAN is a trusted network that's
controlled within your organization. It's probably set up with cross-mounted file systems
and security controls such as multiple user accounts on each machine.

Security problems begin when your trusted network gets connected to external networks
or even internal departmental networks that you don't control, and may not trust because
they have unknown security environments.

A firewall provides a single point where security and auditing can be imposed. A
combination system can act like a network server to support a small but well-defined set
of functions between the two networks, such as e-mail, file transfers, telnet and so on.

Some government offices use their firewall systems as a place to store public
information in the form of Web pages, or to provide files for downloading. The advantage
of a firewall server is that it stops users right at the gate--they can't pass through it
on their way to other machines on the LAN.

The firewall server is the perfect place to host and manage those pages you create
using something like FrontPage.

Some service providers offer turnkey firewall-server systems with an Internet
connection. For example, Network Intensive, a service provider in Irvine, Calif., offers
InterCept, a firewall gateway that doubles as a server. It comes configured for Web
service, FTP service, mail service and UseNet news, priced at $7,495 including on-site
installation.

To turn an existing machine into a firewall server, check out the Borderware Firewall
server software from Border Network Technologies Ltd. of Toronto. A basic 25-user package
with a limited Web server is $4,000. For $11,000, you can get an unlimited-user license
and a secure server option that lets you run something like Netscape Communications'
Commerce platform.

It's important to remember that firewalls aren't foolproof. They basically have two
functions. One is to allow connections, the other is to block connections. There are many
ways to set what will be blocked and what will be allowed in, and how suspicious activity
will be flagged if you make information publicly available.

You always end up trading a little security for convenience. Turnkey firewall servers
make it easier to get up and running quickly, because they implement standard security
procedures right out of the box.

Covering all the security concerns in operating your own server and maintaining a
firewall could fill several issues of this newspaper. A good place to start is at the
frequently asked questions (FAQ) security lists on the Internet. One of the best is
managed by Lincoln D. Stein at http://www.genome.wi.mit.edu/WWW/faqs/www-security-faq.html.
 

A FAQ that deals specifically with firewall issues is located at http://newton.data-io.com/security/FAQ.html.
  Internet Security Systems Inc. of Atlanta maintains a page of pointers to several
of the best security and firewall FAQs; visit http://iss.net/sec_info/faq.html.
 

For a peek at the Firewalls Mailing List archives, visit ftp.greatcircle.com  and check out the
directory pub/firewalls. I had trouble connecting there through a Web browser but logged
on just fine using a standard FTP client.

For a list of features in the $149 FrontPage package, visit http://www.microsoft.com/msoffice/frontpage/.
  To learn more about the $199 SiteMill or a $99 upgrade from Adobe's PageMill, visit
http://www.adobe.com/prodindex/sitemill/main.html.

Shawn P. McCarthy is a computer journalist, webmaster and Internet programmer for
GCN's parent, Cahners Publishing Co. E-mail him at smccarthy@cahners.com.