Firewalls at David Piscitello's Blog

I was scanning the web looking for interesting content this morning on Firewalls and noticed David Psicitello's web log. Dave is the President of Core Competence which is a data network consulting firm. I first met Dave years ago at the First "The Intenet Security Conference" or TISC that was held in San Jose in the late 1990's(he met a couple of hundred people at that event so I don't count on him remembering me). I look for Dave's writing because I find that he's very objective in his approach to different products and technologies . I need to think about that all the time since I work for a Firewall product manufacturer. Dave's also from the east coast and as suchI think he's pretty clear at speaking his mind. If somethings broke, he'll point it out and tell you just how broke it is.

One of the neat things about Dave's blog is the list of topics on the left side of the screen. I can choose "Firewalls" and then see only Dave's content on that topic. In the same list he has also included links to some other authors sites (Avolio, Chuvakin, others,..). I found the Firewall references to all be interesting.

Finishing the Book Proposal

Work on the book proposal is nearing completion. The working title will be "Firewall Fundamentals". I've got the scope of the book, the Firewall market and the competitive portions of the proposal completed. The writing outline is looking great to me. I have a lot of detail in there. I've got some work to do in defining the audience, listing key objectives, and defining the format. I hope to get the proposal completed between tonight and tomorrow morning, and then submit it tomorrow afternoon.

Two Firewall FAQs

As I start doing research for my Introduction to Firewalls book I'm looking at some of the information that is out on the Internet that I've always recommended. Two resources that I often suggest are the Firewall FAQ at Interhack and Robert Grahams "What am I seeing" Firewall Forensics FAQ for Firewall logs.

The Firewall FAQ does an excellent job or answering most of questions that someone who is new to network security would ask.

In the description of the Firewall Forensics FAQ the author says it explains what you'll see if Firewall logs and 'especially port numbers". This is a great reference for port to application and specifically hostile port to application mapping.

Both of these are great non product specific resources.

And so it begins...

Based on a conversation I had a couple of weeks ago with one of the acquisition editors at Cisco Press I have decided to pursue a dream and write an introduction to Firewalls book. The funny thing is that about two years ago I contacted Cisco Press (different people then) and asked if they would be interested in a book that introduced readers to Firewall technology. At the time they weren't interested. At all. But they were really nice and did call on me for opinions on other proposals and technologies from time to time. That progressed to reading other peoples manuscripts and later proposals. Last year they asked if I wanted to lead the development of a book about troubleshooting some specific Firewalls. Unfortunately that effort has been bogged down by the development of products.

I'm excited about this new project. I've been very interested in Firewall technology for years. I've worked at the edges of Firewall product development within Cisco Systems for years. I've been explaining Firewalls to Cisco customers and helping them with their issues for years.

I think there are a few challenges to writing an introduction to Firewalls book. I want the reader to be someone who is learning about Firewalls and security. I have to step back and make sure I keep the writing on target to that audience and stay away from "geek speak." How can I make the book relevant to lots of people. I want to write something that talks about a Linux Firewall and the Cisco PIX. I'd like to show readers what both do and let them decide which is best. I think it is important to talk about applications to be Firewalled. When I think about applications I think Network News (NNTP) is yesterday and that VoIP is today. I think that most of the books out there are really dated in that regard.

I think a problem that I may run into is that I tend to favor very closed security policies. It goes back to what I learned in the "old days" from the likes of Marcus Ranum and Joel Synder ("only talk to your friends"). To do this right I need to educate the reader and not preach.

It's not going to be easy. But I think it is going to be fun.