OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Windows 2000 Professional and firewalls
From: Forrester, Mike (mforresterHSACORP.NET)
Date: Tue Aug 01 2000 - 12:40:55 CDT

Personally, I think that I'd use NT4 before Windows 2000. NT4 can be
stripped down and secured very well (IMHO). Also, it has been out for
awhile, so people have had a lot of time to poke and prod it. Windows 2000
looks like it might have some good potential, but there haven't been any
good, published research on locking it down (that I've seen). So until I
have time to complete my own analysis and/or someone else does, I'm not
approving any of our production stuff to run on Windows 2000. Personally,
I'd recommend OpenBSD. Windows was designed to give users graphics and
GUI's, not security. OpenBSD was designed for security. I'm not bashing
Windows, I just don't think it's designed for stuff like firewalls.

Mike Forrester - Systems Security Engineer
High Speed Access Corp. - Denver, CO USA
mforresterhsacorp.net - +1 303 256 2134

-----Original Message-----
From: Ken Grossman [mailto:ken.grossmanGSA.GOV]
Sent: Tuesday, August 01, 2000 6:50 AM
To: FOCUS-MSSECURITYFOCUS.COM
Subject: Windows 2000 Professional and firewalls

I have been tasked with investigating setting up a firewall for my office.
In some of the lectures on firewalls that I have attended in the past, the
lecturer was against using Windows NT as the underlying OS of the machine
that is running the firewall software due to its security problems. Has
there been any evidence that Windows 2000 is a more secure and viable
firewall OS than Windows NT? I would prefer to use UNIX/Linux as the
underlying OS but would like to have some supporting evidence. Thanks.

Ken Grossman