Attacks/Breaches
3/1/2010
00:29 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Product Watch: Free Tool Cleans Up 'Rusty,' Unsafe Firewall Settings

Matasano Security rolls out open-source product that cleans up and checks firewall configurations for security holes

SAN FRANCISCO -- RSA Conference 2010 -- Matasano Security here today rolled out a new Web-based open-source tool that scans for any firewall rules that are outdated, redundant, or could potentially expose a network to security threats.

"Flint makes sure nothing in [your firewall changes and configurations] creates a security problem," says Tom Ptacek, principal with Matasano, a security consulting and research firm.

Ptacek says compliance requirements -- namely PCI -- and secure software development efforts are forcing organizations to take a closer look at their firewall configurations. "They are starting to take their internal apps a lot more seriously ... as they review their apps, they have a review associated with firewall configurations," Ptacek says. "Apps get retired and get new revs. As part of their assessments, they are going back to the firewall rules that let those apps run."

Flint is the second product offering from Matasano: Its first product, Playbook, is a VMWare-based virtual appliance that centralizes and synchronizes the control and management of multiple vendors' firewalls. Flint can work with Playbook by ensuring any changes to firewalls are correct and don't open security holes into the network, according to Matasano. Flint also can run as a standalone tool for checking firewalls.

The tool also offers insight on complex firewall configurations and how they are working -- or not -- within a firewall.

The Ruby on Rails-based tool is available for download as a virtual appliance for VMWare, and Matasano also is offering the source code. The first version of Flint supports Cisco firewalls. "This is not a plug-in," Ptacek says. "We want this to have a life of its own."

Ptacek says Matasano is making the source code available as well for those who want to rebrand or extend it. "It's easy to extend, and we're hoping to get a lot of feedback from the network security community," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2008-3277
Published: 2014-04-15
Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before ibutils-1.5.7-2.el6 in Red Hat Enterprise Linux (RHEL) 6 and ibutils-1.2-11.2.el5 in Red Hat Enterprise Linux (RHEL) 5 allows local users to gain privileges via a Trojan Horse p...

CVE-2010-2236
Published: 2014-04-15
The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, rela...

CVE-2011-3628
Published: 2014-04-15
Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.0...

CVE-2012-0214
Published: 2014-04-15
The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user fro...

CVE-2013-4768
Published: 2014-04-15
The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the "network connection clean up code" and (1) Cloud Controller (CLC), (2) Walrus, (3) Storage Controller (SC), and (4) VMware Broker (VB).

Best of the Web