Spyware, viruses, & security forum: Do firewalls really work?

The super simple answer is: for the homeowner and their home PC, the Windows based firewall is sufficient. If you are running a business and a "server", then you will want 3rd party firewall. You can "google" for a more in depth response as to how a firewall works.

clear simple and very well explained

Hi, affinityvison, you elaborate on the whole thing, but then offer just one solution - MS Security Essentials. Just for the record, IMO (& I'm not alone in this, believe it or not lol), MSE is one of the worst solutions available. Simply because it comes from Microsoft, hehe.

There are plenty of other alternatives, free and paid, for both an antivirus solution as well as malware/adware (many also with both and a firewall packed in one application, like Comodo). Avast, AVG, Norton and many, many other companies create products far superior to what Microsoft has to offer.

ps. Apologies in advance, I will not follow through on any pro-Microsoft arguments, because they are simply not true.

For the average user, Windows does a fine job with its firewall. If you do decide to use a third party firewall on your computer, disable the windows version first as they could conflict with one another. If your router has a firewall also (I recommend that you do use one) use it. I should not conflict with the one on the computer since it is on another device. There maybe times when you will have to open ports to allow programs/devices to work correctly. There are plenty of articles on the web that will walk you through steting up a firewall from novice to expert settings.

The correct response to something like this is what do they do to be effective? Everytime you access the Internet you pick up a tracking cookie. Usually this is an Ad tracker or a hit tracker to check visibility over the internet by advertisers. Occasionally you get a tracking cookie which is a Bot. These are the ones that create access points on your PC's portal for the owner of the Bot to access your PC anytime that you have your PC on and connected to the internet. These are very dangerous if you carry private information on your PC and things like Credit card detail and so forth. They can even create an Echo screen on the Bot screen while you log on to your Bank account etc. This is why your should backup your registry before connecting to the internet as a form of protection.
The most a Firewall can do in this day and age is to limit which applications have access to the internet and under what conditions and be authorized to a Trusted website. They control which ports are available and to what internet application can access them.
There are some malicious sites around which your Internet Security program will advise you not to access because some malicious software has been accessed from this site in the past and is otherwise advised against using. There is a disclaimer if you choose not to adhere to this advice.

Most software is maliciously sent via E-Mail these days and can appear quite legitimate. If there is a software vendor which decides to send you free access to software always check the E-mail certificate of authority and ask the site directly if you are interested in the software. Never just click a link. That is you giving them authority to access your PC.

In my final recommendation I would advise you that any firewall is as good as is the user wary. No matter how much protection you have and how high you set the security on your firewall, you still have to use common sense when accessing the internet. It used to be safer when it was dial-up, but with always on connections your PC is accessible the moment you log on. In my experience a reliable backup is always advisable even with a decent security setup. If you can image it is better because you can compare images. A lot of people install security programs and just install every piece of junk that comes their way but often find their system slowing down for no reason because something is hogging resources. The system then has fallen into the junk trap or has a virus which may be accessing your computer without you knowing. All these PC magazines may give you a free CD or DVD, it will say it has been checked for viruses but to access it you have to accept their disclaimer. In short you are letting them off the hook for something they may be the cause of. Just a piece of advice. In finishing Internet security or Firewalls can only help you so far you have to keep in the habit of keeping your computer tidy and free of rubbish.

This is a false assertion. A firewall only blocks a few packets by inspecting a few bits from your incoming (or even less, outgoing) Internet traffic. The lists that the firewall must check are very small when compared to the heavy and very complex task that an antivirus has to do.

No, a firewall is completely invisible to you. The problems of performance on any PC (even the slowest outdated ones) do not come from the firewall. If you have internet speed problems, this most probably comes from incorrect performance settings in the TCP/IP protocol stack, or because of incorrectly written applications.

If your CPu is too much active and the temperature never goes down, with the fan constantly running, this does not come from the firewall but because of a bogous application that is leaking memory or waiting indefinitely in a loop for some software or hardware event that never comes, or because tou have too many unnecessary programs that are running in the background and started from boot, when most of these "idle" programs should preferably run only in a scheduled way in a task from the Windows Scheduler, or because your PC suffers from hevy fragmentation and there's a constant overhead when managing the NTFS filesystem, or when updating databases, or because you have an invasive program running trying to index everything you do with your local files.

Some programs can cause a huge CPU overhead, one of these is Adove/Macromedia Flash, that you should keep up-to-date. Make sure you update your graphics drivers, and be careful before using "tweakers" programs for graphics (if you have a notebook/netbook, avoid using these programs, they make things worse, and use the normal default settings for your graphics board, or use only settings that apply to specific games when they are running).

Avoid programs like icon tweakers, theme managers, use a basic background photo for your desktop. You may also close the Windows gadgets (they are really extremely slow and use too much memory and CPU resources !) : if you like gadgets, consider using Google Desktop instead.

Avoid using those many program updaters from various sources. You may be notified from software updates using a central tool that can trak lots of softwares at once (except Windows and Microsoft programs: keep them managed with Microsoft update).

But a firewall takes zero ressources and will definitely not make your PC slow. An antivirus can on the opposite be much slower (I have banned McAfee for this reason, and free antivirus can even do a better job, notably Avira, AVG, and Avast that I now recommend).

Don't use multiple antivirus running in the background! Choose only one. You may still use an online antivirus checker for your emails (that's why now I only use a webmail and have completely abandonned using Outlook or Fedora or Outlook Express : the antivirus is managed and updated by a professional team that also monitors various security sites for you).

You should know which programs are taking CPU time: open the Windows Task manager and make sure to display the full list of process (you'l get an UAC prompt for administrator privileges): you can sort the displayed list of processes by CPU time. Look also for fast growing counters for disk I/O, even when your PC is supposed to be idle : you can reduce this overhead using a disk/registry cleaner (such as CCleaner), and a basic defragmenter (other than the Windows builtin one), preferably running as an automated process (Defraggler can do this background maintenance job quite fast). And about once in a month use a good thorough defragmentation just after performing a maintenance cleanup of the filesystem (launch it when going to dinner or leave it running while you sleep or look at TV, just after rebooting the PC and then immediately performing all pending updates and using CCleaner to clean heavily fragmented temporary files or log files).

Never forget to revisit the list of programs constantly running at boot : do you still need them? Aren't there duplicate functionalities with several programs you no longer use and should better uninstall (with the additional benefit that you will no longer need to update it to avoid security issues). Do you need all these custom toolbars in your web browser ? Uninstall most of these extensions (choose only ONE of these toolbars, e.g. Yahoo! or Google, i.e. tools coming in a collection of tools sharing lots of common components instead of duplicating functionalities), don't just close or disable them.

But the best protection does not come from a firewall. A firewall in fact is very deceptive, and most hacks today are not caused by an absence of firewall, but by security exploits in the installed software that your firewall will connect to the Internet without condition.

If you need more performance, consider adding RAM (4GB is a minimum for Windows Seven, notably in its 64-bit version, so make sure, when you buy a PC, that you'll get the possibility of adding RAM. RAM is very cheap today, and it saves much more CPU performance than using any kind of "tweaking" tool which will take you personal time to use too often).

If you need security, the best you can do is to save time in the maintenance of your PC, so that you an react manually when it is really needed (a version scanner such as CNET update checker can inform you about which programs need updates, and can help you manage when you'll need to udpate them ; among them, the media players, Flash, and Windows programs have high priority); Office programs and Adobe Reader need to be updated only when you use them : it's not needed to update them more often than when you use these programs, as long as you don't let them run constantly on the background.

Disable as many active background tools as possible (instead, all programs that you are currently using contain now an "Help/About" menu that also allows to check for updates (only consider security updates, avoid upgrading when you dont need the extra features and have no time to evaluate them, even if the software starts with a nag screen saying that a new version is there for sale, ignore the "urgent" promotions).

Don't forget, sometimes, to use Checkdisk on your system disk (this requires rebooting) when you have some time to do that (it normally requries a few minutes: profit from your caf pause, or lunch time, or the morning time when you arrive and will go to a corporate monday meeting to let it run).

Finally, never leave your PC session open when going outside of your desk. You don't need to close the session, click on "change user" in the Windows menu, the maintenance tools will continue to run in the background, all you'll need will be to logon again to see the results. You should enable the automatic blicking of your active session in the screensaver settings (10 minutes of idle time is OK, but if you are frequently moving out or need to reply to various emergencies, you may reduce it). Make sure that your windows session is protected by a password at least, don't use automatic logon !

The job of a firewall is NOT to keep out traffic, it is to CONTROL traffic. Think of a firewall as a gatekeeper in a gated community. They let people who belong in and stop suspicious people from leaving - imagine a lawncare truck leaving with a bed full of TVs... doesn't seem right, stop and ask questions.

The main difference between firewalls are their effectiveness, their load on your system, and their ability to be configured.

If the gatekeeper is asleep on the job, things can go in and out that maybe shouldn't. If the gatekeeper isn't very smart, he closes the gate afraid of everyone; even the police and mailman can't get in.

If the people who live in the community don't want to get very involved, they hire a gatekeeper who is pretty smart, but might not recognize their aunt or let the deliveryman in with flowers for your wife because her name is spelled wrong.

If they want to get involved, they hire a gatekeeper who is smart, but wants to talk out things. When should I let your aunt in? Do you ever plan on sending flowers to your wife?

Same with firewalls, some are basic and keep out known bad stuff along with some good stuff because they don't ask YOU any questions. Some are more advanced and ask you specific questions that you need to think about carefully.

Do you ALWAYS want to let the gardener out regardless of what he has in his truck, or do you want me to ask you each time he leaves?

A program like windows firewall is a bit harder to configure than some like Zonealarm. The latter asks you questions and you think about them. Do I want to let this program go to the Internet anytime it wants to, or just this one time? It remembers your answer. If a program is trying to get out that you KNOW you didn't run - like Adobomomie Updater is trying to get out, is that okay? - you can decide that it's okay because you have Adobomomie and want it to update itself. You might decide you don't want it to.

A much bigger problem than firewalls is what we open in emails, which websites we go to and what programs we load on our machines. SO many people's computers barely run because they have downloaded every toolbar, widget, and toy that they have very little memory left. S L O W Not to mention that a lot of these spy on you and send info out about you.

work - keep out the bad guys, let in the good guys, and not slow you system down by enough to be an annoyance.

You really wrote that, but you never put it together in the one sentence statement that I suspect the asker wanted.

This is not an indictment, merely a very mild thought.

Thanks Stuart... I was in IT in the USAF and had to explain things so pilots could understand them...

The Windows built-in firewall is only one-way; that is, it is only watching what's trying to come in. But, let's say something does get in (and yes, it happens all the time), it doesn't monitor anything outbound. You need a two-way software firewall (like Comodo). Additionally, a hardware firewall is a necessary compliment to your software firewall security. Hardware firewalls are usually part of your router, and provide (among other things) NAT (network address translation)and SPI (stateful packet inspection). The "easily hacked" issue usually happens because people don't set up their router with passwords - they leave everything at the default settings. And then there's the issue of anti-virus software...

Excellent analogies and explanation. Thanks.

Does anyone know the best FREE firewall with the capability of stopping "outgoing" connections? For use without a router and with a router?

The answer is yes, firewall software works. So does anti-virus and anti-spy-ware software (the last two often come packaged together in free editions. No Firewall software is perfect, and no anti-virus is perfect. Hackers can and do get in. However, You are reasonably well protected with free anti-virus, free anti-spy-ware, and free firewall software.

Without all or any one of these components, you are basically leaving your doors and windows unlocked and opened with a big neon sign in your front yard flashing and announcing loudly for all to see and here that this house has all the doors and windows opened and unlocked and lots of valuables and money free for the taking. In other words, you are much better off with these vital security programs than without them. Without a firewall, your computer is free and open for anyone to look and see all of your information on every website you ever visited or every email you ever sent or received. You might as well sit out on your front lawn naked.

Yes firewalls work. They set rules for what can come in to a network or a computer. However rules are only as good as the rule-maker and if the rule-maker allows themselves to break the rules - then all best are off.

Basically, set a restrictive firewall as as admin, then log on as a regular user to do most of your browsing and you'll be as safe as you let yourself be. If you, as a user, allow something in, using your admin password, you risk infection and compromise of your system.

As to which system works best, companies pay the most for separate hardware firewalls as they set another (physical) layer of protection - but you pay for it. If you have the extra $$, then get a separate HW. Or just configure your router as a firewall. It's separate and most can provide decent protection.

Let devide my answer to your question to three main issues:
1. What do firewalls do?
2. Do firewalls perform according to spec?
3. Do I need a firewall at all?

1. What do firewalls do?
Firewalls are designed to stop illegal actions from unauthorized sources.
So what are unauthorized sources and actions?
Well, the firewall is aupposed to "lean" your activity types and catalogue:
A. The types of applications you are using
B. What you normally do in these applications
C. The type of sites you normally enter
D. What you normally do in those sites
E. The kind of emails you recieve (if your firewall has the email monitoring module included)
F. The kind of enclosures you normally recieve

You might notice that I used the word "normally" in all the selections. That is because a firewall learns your NORMAL activity, so each activity is comapred to you normal usage.

Each firewall has a different "learning" period and in most you can control the length of this "learning" period and extend it according to your needs.

This period can be sometimes frustrating. You get a lot of questions regarding your activity: Programs you open, sites you enter, downloads you perform, enclosures to your emails etc. However, these question are crucial for the correct tuning and performance of your firewall.

Like any other software package, especially security packages, firewalls do recieve regular updates, especially a list of blacklisted internet sites (blacklisted by the firewall company) - for site blockage and anti SPAM capability, virus tables - for those firewalls that also have anti-virus capability. This is something you MUST know, because at the learning stage the firewall might ask you for permission to update it's internal tables.
Another kind of update is a new version or module updates. This usually needs to be downloaded and installed. Sometimes a major version update will resume the learning period, due to new features added to your firewall.

2. Do firewalls perform according to spec?
the answer is short: mostly yes!

Personal firewalls are NOT designed to be 100% safe. They are designed to be safe enough to give the regular hacker enough of a headache to leave you - or more precisely your computer - alone!!!
And this - they perform nicely.

3. Do I need a firewall at all?
This answer is also short: Most Definitely!!!!

I personally use ZoneAlarm. It's free (there is also a commercial version for a price) and it covers most of what a person might need for a personal workstation.