Safer Firewalls

Ask a network manager at a large company about the effectiveness of a firewall, and he or she will likely admit that it's impossible to ensure that all access permissions across all firewalls are 100 percent consistent and secure. The lack of manageability of many firewalls is one reason why the CCv.1 aims to improve and clarify existing architectures.

In addition, the CCv.1 is intended to provide auditing capability, a certain level of assurance in security functions, and a criterion for firewall deployment in commercial environments with flexible access-control policies. The Firewall Protection Profile of the CCv.1 describes in essence the state of the art in firewall technol ogy and demands stronger auditing functions -- a feature that's required by many users.

However, the CCv.1 has been roundly criticized for covering only the transport-packet level and for not being demanding enough in terms of security on higher-level Open Systems Interconnection (OSI) layers and the logical structure of firewalls. Critics say that the CCv.1's Packet Filter Firewall (PFFW) protection profiles support the better-than-nothing mentality of many of today's security solutions and lack an overall concept.

In principle, the critics' arguments go, the philosophy of firewalls -- isolating yourself -- is contrary to the open-network philosophy of the Internet. As soon as more-secure internal enterprise-security systems are installed and strong data encryption is accepted internationally, mere transport-packet firewalls might become obsolete.