Firewall all the Things

With customers and security professionals demanding more integrated solutions, security features are increasingly built into Network Printers, UPS, Wireless Access Points, Switches and, of course, actual firewalls. These features are switch “off” by default and have given rise to some interesting internal vulnerabilities -- which can result in a lockout, brick, or denial of service your own devices and network. Through building these devices and examining their security features, I’ve found that not a single device demanded a change from the default password. As a basic Payment Card Industry (PCI)-compliance requirement, all of these devices fail out of the box unless you spend some time changing defaults. These features all “work,” but what they don’t do is “work” securely.

From a practical learning perspective the SMB network looks the same no matter what sort of business it is. Every business has some sort of server/file share setup, workstations and firewall/router and core switch – even if that switch is the four ports on the back of a router. Most SMB’s also have wireless of some sort, possibly built into the router or firewall. Today, it would also be a pretty rare scenario where the business did not have at least one network-attached printer.

SMB IT departments and MSPs are going to be successful if they can provide secure, predictable and reliable networks to their customers. Certainly the opportunity to experiment with configurations and system changes with no risk to production networks is huge value-add. Being able to test backup, disaster recovery, application updates or new applications and even new hardware becomes very easy to do with a small investment in a virtual business. Simply understanding what “typical” network activity looks like between a domain controller and workstations; can help troubleshoot the most difficult support calls for a customer.

About the Author Ian Trump, CD, CPM, BA, is an ITIL certified Information Technology (IT) consultant with 20 years’ experience in IT security. From 1989 to 1992, Ian served with the Canadian Forces (CF), Military Intelligence Branch; in 2002, he joined the CF MP Reserves and retired as a Public Affairs Officer in 2013. His previous contract was managing IT projects for the Canadian Museum of Human Rights. Currently, Ian is Security Lead at LogicNow working across all lines of the business to define, create and execute security solutions to promote a safe, secure Internet for businesses worldwide.