if my router has firewall do i need windows firewall?

[mattbiernat]

1) if my router has a firewall do i really need to use windows firewall? is it an overkill?
2) if i connect to an unsecure network:
a what are the risks of not using a firewall?
b. will windows firewall protect me or is it useless and i should get another one?

[jdhurst]

It depends. If you have a desktop always behind a router and also have good ant-virus and spy-ware removal on it, then you probably do not need a software firewall. If you have a laptop and take it outside your place of work, then you probably do need a good firewall. For ease of use, I use an integrated product on both my laptop and desktop, but it is over-kill on the desktop. ..... JD

[basketb]

Definitively get a 3rd party software firewall as the Windows firewall will at most protect against incoming threads but won't control outgoing connections.

[Marin85]

Definitively get a 3rd party software firewall as the Windows firewall will at most protect against incoming threads but won't control outgoing connections.

But if he has some decent AV/anti-malware software installed, there wouldn´t be no source of unwanted outgoing connections.

[basketb]

That depends on what your understanding of "unwanted outgoing connection" is. For me, this includes Acrobat, Windows Media Player, and others trying to make a connection back to the ranch as soon as you start them.

[Marin85]

That depends on what your understanding of "unwanted outgoing connection" is. For me, this includes Acrobat, Windows Media Player, and others trying to make a connection back to the ranch as soon as you start them.

Indeed a good point! Having all these windows defender/AV/anti-malware programs installed most users believe they and their privacy are protected, but more so they forget about what some "good and trusted" applications actually do in the background... While we are still on that topic, what software firewall would you recommend to control such activity?

Thanks,

Marin

[jdhurst]

I understand the point, but there is next-to-nothing in the way of firewall log entries on my desktop and lots on my laptop which is not always behind a hardware firewall. There is no harm, of course, in adding a software firewall to a hardware firewall. .... JDH

[bill bolton]

1) if my router has a firewall do i really need to use windows firewall? is it an overkill?

It depends on what level of paranioa you consider to be normal.

If your router implements NAT, then additional firewalling is probably not going to do anything much for you for common "net" computing tasks.

Cheers,

Bill B.

[spuddog]

Also make sure you use statefull packet filtering if your router supports it.

As far as windows firewall goes. you can configure what programs can access the web. Any software firewall must
be configured to your individual needs. An improperly configured firewall, can be worse than none as it gives one a
false sense of security.

Scott

[basketb]

Indeed a good point! Having all these windows defender/AV/anti-malware programs installed most users believe they and their privacy are protected, but more so they forget about what some "good and trusted" applications actually do in the background... While we are still on that topic, what software firewall would you recommend to control such activity?

Thanks,

Marin

My company makes me use the Symantec Client Firewall and I'm happy with this one. Many people don't seem to like Symantec products because of their resource usage. However, I've never had a problem with that. A few years ago, I used Zone Alarm (was also pretty good considering it was free). But I've not kept up with the development of Zone Alarm. So, I wouldn't know whether this is any better or worse than Symantec or anything else out there.

[mattbiernat]

so the general consensus is that router fire wall is good enough and no secondary firewall is needed at least for a desktop.
so what about outside of my hosue? how dangerous is connecting to an unsecured network which is administered by my school (only limited number of people can connect to it as you have to have access to the building).
can i get actual virus/spyware/malware directly from the network? would it be unsafe to access banking information from such network without prior firewall?

[jdhurst]

Because a laptop may find itself in unexpected circumstances, I will stick to my view that any laptop should have an integrated anti-virus, firewall suite. Not commonly available to consumers, Symantec Endpoint Protection works perfectly well. ... JDH

[bill bolton]

so the general consensus is that router fire wall is good enough

No.

The consenus above is that what is in most routers is probably good enough in a general sort of way. Few stand-alone routers implement a firewall per se. They will generally implment an approach known a NAT (Network Address Translation) which creates a private network on your side of the router, with stateful transfer of packets between the public and private network sides of the router

You should go and do some reading on what NAT is before assuming it will meet your specific needs

Cheers,

Bill B.

[Marin85]

My company makes me use the Symantec Client Firewall and I'm happy with this one. Many people don't seem to like Symantec products because of their resource usage. However, I've never had a problem with that. A few years ago, I used Zone Alarm (was also pretty good considering it was free). But I've not kept up with the development of Zone Alarm. So, I wouldn't know whether this is any better or worse than Symantec or anything else out there.

Thanks for the reply, as of now I try to cope with Vista built-in firewall that is supposedly not bad but it doesn´t really stop outgoing connections of "trusted programs" even if I tell it to do so Anyway, I´ll check it out, thanks again for the info!

so what about outside of my hosue? how dangerous is connecting to an unsecured network which is administered by my school (only limited number of people can connect to it as you have to have access to the building). can i get actual virus/spyware/malware directly from the network? would it be unsafe to access banking information from such network without prior firewall?

What do you mean by "unsecure"? No encryption, no VPN? Actually It doesn´t have much to do with malware dangers in direct way...but if there is really nothing that secures the connection, then "unauthorized" access to the network is throughout possible (meaning hack attempts), so the question is basically whether you trust the administration of this network. This is actually the question even if the connection is secured in some way. The only other problem with unsecured connections is of privacy matter. On such networks it´s not a big problem for someone to compromise your privacy by reading the transmitted packages between your laptop and the school network.

Marin

[Temetka]

I have always believed in multiple layers of security when it comes to my computers.

My home network is protected by a Watchguard hardware firewall which is fed from my FIOS connection and then spits out IP's to the rest of my network and handles my wifi needs as well. I follow this up with a good software firewall. I highly recommend the comodo firewall.

http://www.personalfirewall.comodo.com/ ... ewall.html

I also recommend doing some reading on a topic we in IS field use on a daily basis. It's called Defense in Depth.

http://en.wikipedia.org/wiki/Defense_in ... computing)

DEFINITION - Defense in depth is the coordinated use of multiple security countermeasures to protect the integrity of the information assets in an enterprise. The strategy is based on the military principle that it is more difficult for an enemy to defeat a complex and multi-layered defense system than to penetrate a single barrier.

Defense in depth minimizes the probability that the efforts of malicious hackers will succeed. A well-designed strategy of this kind can also help system administrators and security personnel identify people who attempt to compromise a computer, server, proprietary network or ISP (Internet service provider). If a hacker gains access to a system, defense in depth minimizes the adverse impact and gives administrators and engineers time to deploy new or updated countermeasures to prevent recurrence.

Components of defense in depth include antivirus software, firewalls, anti-spyware programs, hierarchical passwords, intrusion detection and biometric verification. In addition to electronic countermeasures, physical protection of business sites along with comprehensive and ongoing personnel training enhances the security of vital data against compromise, theft or destruction.

Source: http://searchsecurity.techtarget.com/sD ... 92,00.html

And finally:

http://www.google.com/url?sa=U&start=5& ... 68B4BTSVpw

[bill bolton]

to protect the integrity of the information assets in an enterprise.

Enterprise systems are a completely different topic space!

Cheers,

Bill B.

[Marin85]

As you already very well pointed out, "It depends on what level of paranioa one considers to be normal"... My home is my fort...

[Temetka]

Enterprise systems are a completely different topic space!

Cheers,

Bill B.

Depends on your level of thinking. At home my setup is pretty close to enterprise with a true server, dedicated hardware firewall and a managed anti-virus in the for of Vipre from Sunbelt Software.

As you already very well pointed out, "It depends on what level of paranioa one considers to be normal"... My home is my fort...

Exactly.

++

[Nick Y]

... as of now I try to cope with Vista built-in firewall that is supposedly not bad but it doesn´t really stop outgoing connections of "trusted programs" even if I tell it to do so ...

You may like to look at Vista Firewall Control, by Sphinx Software, at www.sphinx-soft.com/Vista/index.html, which has a free version.
Feature list from web site:
========================

* Designed for Windows 7 & Vista
* Free versions available
* Decreases expenses of mobile/satellite connections
* Zone based network permissions management
* Integration with Window Explorer for direct access permission management
* Integration with Windows Security Center
* Instant notifications of blocked activity
* Special editions for portable devices (USB flash/HDD drives, iPod etc)
* Special editions for U3 smart devices
* Protection from incoming and outgoing threats
* External network connection (firewall/router) box support
* Automatic network connection box detection/management
* External/worldwide access to selected local application
* Port Forwarding management
* Automatic Port Forwarding-to-applications synchronization
* Simplicity of operation
* Per-application security settings
* Group zone and application network access permission management
* IPv6 support
=======================

[Marin85]

Thanks I´ll have a look at it.

Marin