Quoting Ben Neigebauer <Ben.Neigebauer at compellent.com>:

> Everytime I see an exploit for XX version of linux or XX version of
> windows I wonder if there are known vulnerabilities for my little D-Link
> Router?
> 
>  
> 
> How secure are these little guys, and if there is a known hole, will
> D-Link notify me?
> 
>  
> 
> Maybe I should go all out and just plunk down the cash for a used Cisco
> Pix?
> 
I don't see anything on D-Link's site about signing up for notifications of new
software and/or vulnerabilities. My guess would be that they are going to take
no great effort to notify you of something, I doubt that you have a support
contract with them, so there is no financial incentive for them to do so. The
low end manufacturers just don't build that into their business. They may make
an effort if some really, really blatantly bad thing happened that they need to
do a CYA maneuver for. Best way to find out is checking things like the bugtraq
database, http://securityfocus.com/bid, there are entries there for D-Link.

As for how secure is it? Probably good enough. Change the default settings for
passwords and confirm that it has a relatively sane config and you will handle
99.9 of issues. Most of these "firewalls" are just NAT routers, and while NAT
may not be appropriate for security, it does buy you something. 

If you are exposing services to the Internet, i.e. web server, ssh server, mail
server, etc, the bigger issue is making sure that you are current on patches.
Any sort of packet filter, of which the PIX is a variety, will only prevent
allowing access to a service. If you make the choice to allow the Internet to
connect to your apache server, the firewall is not going to stop julie the
script kiddie from running the latest exploit against it. This is where proxy
firewalls, i.e. application layer firewalls, come into play, as well as things
like IDS and IPS.

To make a long story longer, for your home network on a cable modem, you'll
probably be ok. Typically speaking the nasty folks are looking to go after the
low hanging fruit. There are lots of unpatched systems plugged directly into
the cable modem, no sense making an effort to go after yours unless you have
something special to offer.

Josh

_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
Help beta test TCLUG's potential new home: http://plone.mn-linux.org
Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery
tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list