[FW1] Specifically allowing access services vs. specifically denying them

["Frank Tirado" <ftirado@FW1-NOSPAMers.usda.gov>]

  Typically, our posture has been to allow services out through the
firewall unless specifically denied.  Soon, however, we will be
"asked" to specifically allow only those outgoing services which are
required.  

  We decided to get a head start on things and try it out ourselves. 
We kept finding needed services that we had no idea existed (for
example, http through unusual port numbers) and having to include them
in the rules.  My personal feeling is that this should be included
among the labors of Tartarus as a never ending task.

  Has anyone out there gone through this proccess, and if so, how
successful was it?

Regards,
  Frank


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================