The Deperimeter Problem

Yes, the castle-and-moat model has lots of shortcomings, but the concept of "deperimeterization" is a long, long way off

The fundamental problem with the Jericho Forum's deperimeterization vision is that it ignores the security doctrine of defense in depth. Even if all your hosts can withstand attacks from the open Internet, there are still advantages to adding the extra layer of defense that comes from a firewall. For example, when a new attack is discovered, it's invariably faster to block the attack with a new rule on the firewall than to program every computer to update itself. Indeed, I don't see how any self-respecting CSO could decommission a firewall once one was installed. What if an attack comes through that could have been stopped by the firewall?

Another problem with Jericho's vision is the whole idea of developing a new security architecture rather than making incremental modifications to the one that's currently deployed. The Internet was successful because it could be incrementally deployed. Instead, Jericho's vision will probably come to pass partly through companies adopting application-level VPNs that use SSL to bridge connections over a hostile Internet. Each time a business partner needs to use a remote service, one application will open an SSL connection to the remote server and check the certificate. A very simple versionone company setting up an SSL-enabled website for another company's employees to useexists today.

Digital rights management (DRM) is another technology that will help bring about Jericho's vision. DRM systems encrypt the contents of sensitive documents so that they can be deciphered only by authorized individuals. There are many players in this space, including Microsoft, Liquid Machines and even Adobe. DRM systems can reduce our dependence on firewalls because they lower the potential damage that can be caused when a firewall fails.

Still, I'd rather have a firewall in place around a company than put bad-guy hackers on my internal LAN and rely solely on the effectiveness of SSL-protected application-level VPNs or DRM. Yes, Joshua blew his horn and the walls of Jericho came tumbling downafter which the invasion force killed every man, woman and child inside the city. Internal defenses are a great ideabut so are nice healthy walls around your perimeter.