Take the 2-minute tour ×

I've recently changed jobs and I've been set up with a new workstation. On all previous places where I've been working they've had some sort of local firewall installed on each and every workstation - but here I've been told not to activate it because it is not necessary since we're already behind a HW Firewall.

To me this seem a bit naïve, but I cannot emphasise it. I always thought a local firewall was good practice, ie. if something managed to come through the hw firewall there might be a slight chance other computers on the lan would block the internal threath.

We got free access to internet and we got a virus checker installed.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

It pracitcally makes no difference. I keep the per workstation firewall up on all systems because it gives a jota more security (really small amount). All relevant ports are opened by grroup policy, so ping etc. works. This includes file sharing for the "c$" admin access.

At the end, I think the difference is really neglegible, unless you have a central control system like from TrendMicro OfficeScan (where you can turn on "outbreak mode" and th e local system blocks a lot more because something is supposedly running wild).

share|improve this answer
add comment

The biggest threats are internal, not external. A criminal trying to break into/through the corporate firewall has only a vague idea of what is on the other side. A disgruntled employee probably knows much, much better, and is already on the inside. Keep the software firewall up.

share|improve this answer
But then he also knows how to bypass the firewall. –  TomTom Jun 16 '10 at 13:13
Any software firewall is already going to be configured to allow internal applications to work, and not be able to stop an employee who wants to leak information. –  afrazier Jun 16 '10 at 13:23
A disgruntled employee isn't going to try to bypass your user-level firewall: he'll attack the weaker point in your setup and that's not the TCP stack. –  Stephane Jun 16 '10 at 13:30
add comment

Your Answer


