Pro und Kontra XP ICF

#1 Nachdem man die ICF ausgiebig getestet hat, kann man folgende Zusammenfassung geben:

Pros

Windows ICF has a lot of features and advantages going for it. It’s difficult to overlook some of these features, particularly the following:

- ICF is free. You can’t argue with free and integrated into the operating system. Well, unless you are Netscape or the Department of Justice.
- ICF performed robustly under attack as well as under high utilization.
- ICF will prevent most attacks from the Internet. By default, the firewall ruleset is very restrictive, preventing most attacks. I say most, because it won’t prevent against virus and other attacks that initiate from your computer.
- ICF is a stateful firewall. Stateful firewalls are generally more secure than packet filters.
- ICF may already be installed and active. If you’ve used the Network Setup Wizard, it may have already turned on ICF for you.
- The ICF programmatic API allows ICF aware applications to open up “holes” in the ICF to allow incoming traffic. This is useful for programs like Windows Messenger and games like Warcraft 3 that require inbound connections.
Application proxies allow ICF to work with firewall unfriendly protocols

Cons

Despite all of these advantages, Windows ICF may cause some problems, especially for corporate users and power users who need more control of their firewall. Some of the problems listed below may be difficult for some users to accept.

- ICF breaks a lot of applications. This is arguably a good feature for a firewall, after all, firewalls are designed to stop traffic. However, the inability to create granular access rules and specify “trusted” hosts encourages users to just shut it off. ICF doesn’t support RPC, so message notification in Outlook will not function properly. In addition, services such as file sharing won’t work.
- ICF does not perform any outbound filtering. This is by design; however, it makes ICF useless against Trojans and other malicious applications that “phone home”.
- ICF lacks real-time notification of attacks. ICF can be configured to log allowed or denied traffic in a file; however, no real time notification is available.
- The ability of applications to dynamically open ports requires administrative-level privileges. If you’re applying the "Principle of Least Privileges" and your account is only a “limited” account, the applications you run will not be able to take advantage of the ICF programmatic API and open up ports dynamically.

http://online.securityfocus.com/infocus/1620
__________
powered by http://different-thinking.de - Netze, Protokolle, Sicherheit, ...