This is a topic that I am looking to learn more about, for my own general knowledge. I think an in depth discussion that revolved around this topic could result in producing another excellent learning resource on this website that would end up being referred to many a time in the future.

The topics & questions that I currently had in mind include the following, but certainly isnt limited to this. Any knowledge sharing + links to any leaning resources would be great. I've spent a significant chunk of the past could days trying to turn up a comprehensive guide via. search engines, but have yet to find anything beyond your generic Q&A/ How to/ FAQ article about software (and hardware firewalls).

  • Understanding how software firewalls intercept outgoing malicious connections, especially from malware that poses a big security threat, such as backdoors or keyloggers.
  • Understanding the countermeasure that various malware can employ against this, and the counter-counter measures that can be applied in return…. and so forth
  • Any resources for information on detailed, quantitative test information as far as software firewalls & intercepting malicious outgoing connections goes? I've seen lots of qualitative information, i.e. "Software firewalls can significantly improve your security", but no comprehensive quantitative data.
  • Side by side comparisons of the "good firewalls" out there, within the context of topics like the above. Is the fundamental approach to the above topics pretty much the same across the board for all software firewall technology…. with the difference being one of quality & degree…… as opposed to taking a fundamentally different approach? I.e. some signature based scanners are much better than others, but the technology behind heuristics, for example, is a fundamentally different approach than signature-based.
  • Are there different technologies behind software firewalls, each having their own pros and cons, or is there pretty much just one main approach to intercepting malicious outgoing connections. If there ARE different technologies that are employed, what are the pros & cons of each/ a side by side comparison? If there are indeed different technologies, do different (good) firewalls focus on different technologies, thus resulting in different firewalls being best for certain scenarios?

    For example, pretty much every modern antivirus employs signature-based technology & Heuristics/proactive/behavior based technology. There are a few crappy programs out there, but any good antivirus uses the same basic technologies. The difference between them is one of degree & quality…. not of kind.
  • Rootkit scanners, as contrasting example, employ different technologies, with different pros and cons of each, meaning that you cannot simply say "what rootkit scanner should I use/what are the best rootkit scanners", but you might have to ask "what technologies would be best for a certain scenario", and "what technologies are behind so-and-so scanner?"

    There are signature-based rootkit scanners – which would seem to be undermined by the very concept of a rootkit. However, scan the infected drive while it's offline, and you get a different scenario, as the rootkit cant function if the infected OS is offline. Other antirootkit technology works based on anomolies/heruisitcs. And the other primary technology, to my knowledge, is based on the concept of cross-checking.

    Different technologies, each with their pros and cons, and each being more effective in certain scenarios than others. Many different "good anti-rootkit programs", yet they can be based on fundamentally different technologies. Both of them good technologies, but still fundamentally different.

    ******************
  • The question then, is, are software firewalls more like antivirus software in this regard, or more like anti-rootkit technology? If they are the latter, then how are they; what are the different technologies, their pros and cons, etc?
  • If there are different technologies, then are different firewalls best for certain security needs, or is it mostly a matter of picking any one from the handful of good ones, and seeing which one you like the feel & layout of better?

    ****************
  • In the areas of software firewalls that are most vulnerable to countermeasures by malicious software, are there other technologies/programs whose strength is software firewalls weakness? In other words, are there programs which complement the technology(s) of software firewalls, thus producing a kind of synergistic effect, where one's strength covers the other's weakness?

    If so, what is the basic concept behind this; what is the basic technology behind these complementary programs, and how do these technologies complement each other? I.e. with antivirus, heuristic technology and signature based technology complement each other. Signature based is mostly ineffective against any decent polymorphic technology, whereas heurisitics helps cover this weakness by for patterns & rules instead of exact matches. And signature-based technology helps to cover the weakness of heuristic technology.

    If these apply to software firewalls, what are they?



Conclusion: I know that I'm definitely interested in learning more about this. I want to be able to answer any possible question from a fairly-tech savvy individual like "What exactly does a firewall do to stop this backdoor from dialing home? I know that it helps, but what does it do?"…… rather than the common questions answered by every copy & paste FAQ about software firewalls on the internet.

The direct knowledge + awareness of various good learning resources most definitely exists here among the WTT veterans – now they just need to come out of the woodwork and reveal the contents of their mind. :)