Outbound Firewalls---"Security Theater"

[johnrr6]

I've been rethinking the necessity of having a special Firewall that blocks outbound traffic.....

Maybe the Firewall in Vista that DOES allow blocking of outbound traffic (albeit hard to set up) is enough for the average joe like me who is behind a router with a small group of 7 computers all running AVG.....

Is all they hype about blocking outbound "Security Theater" as this article from a Microsoft Guru claims.....

http://www.microsoft.com/technet/tec...l/default.aspx

Heck---even WITH an outbound firewall----I almost always just click "Yes" or "Allow"----and as Mr. Riley claims in his article----many times these attacks take the form of something you would normally allow anyway.....

And the new Vista Firewall is already set up for blocking what they feel are the most dangerous types of outbound traffic.....

Maybe this IS just hype-----Maybe the Vista Firewall, Windows Defender built into Vista----- and a Decent AV program is just plain good enough for most of us.....

What are your thoughts????

[ctal]

I think you'll do fine without outbound filtering. A relative who is not computer savvy, who uses broadband cable and has her computer connected directly, without a router, has not had any problems after several years of being protected only by XP's built-in (inbound only) firewall. I have a Sonic Wall hardware firewall (which blocks inbound only), and a broadband cable connection. I also keep XP's firewall enabled on each PC that is behind the Sonic Wall (which is probably not necessary, but there appear to be no side-effects so I leave it enabled). I also use PC-Cillin and Adaware, and I have never had any problems either.

In the Sonic Wall's logs I typically see some sort of illegitimate inbound data every few minutes, but they are routinely blocked.

-- Al

[Redleg]

I don't think it is 'just' hype. I prefer to have this level of added security on my home network. While my hardware based firewall keeps my lan safe from internet attack I want to reduce the risk of attack from within caused by malware downloaded by one of the other users in the house. Even more its not the firewall containing the threat that provides my piece of mind but the prompt that pops up saying something wants to access the net. I remember being surprised by M$ Word trying to phone home the first time I launched it after installing Zone Alarm.

[ctal]

Redleg makes some good points. My previous comments apply to situations where all users are mature, and do not download from questionable sites. Regards,
-- Al

[johnrr6]

Well-----and this applies to Vista which does have an outbound firewall capability---and not XP which doesn't have an outbound capability-----anyway-----I read this guy Riley's article very closely and he made a lot of sense to me......

Most of us just click "allow" even when we have an outbound Firewall set up.....

And if the threat is so sophistcated that it calls itself something we would normally allow.....

You are going to click and say yes anyway.....

And after a few months of clicking and saying yes.....

You don't really have a firewall anymore----it's porous....

Microsoft is saying "why bother" -----We've set the VISTA firewall to defeat the most dangerous outbound stuff already and if you use Windows Defender and keep it updated------matched with updated AV software----you really have a tremendously reasonable amount of protection without all the clicking "allow"-----which in the long run----doesn't work anyway.

Shouldn't a good AV and spyware/malware product warn us of a threat or contamination in this arena????

If I know Iv'e been contaminated----presumeably there are ways to get rid of it.......