On Tue, 15 Nov 2011 17:16:23 GMT, Leigh Porter said: > Quite right.. I bet all Iran's nuclear facilities have air gaps but they let > people in with laptops and USB sticks.
And that's the point - *most* networks have so many bigger issues that the whole "NAT makes us secure" mantra is dangerous self-delusion. If you have machines in the NAT area where you're actually concerned that "ZOMG the firewall might fail and expose them", why aren't they airgapped? As the Iranians discovered, if the attacker gets a foothold inside the NAT you're screwed anyhow, and *that* is probably a lot more likely scenario than a fail-open firewall..
pgph1iAeCaxvD.pgp
Description: PGP signature
