Surprise! Symantec kills off Sygate firewall range

Like no one saw this coming.

One month after closing the Sygate Technologies takeover, Symantec is cutting the Sygate personal Firewall products because of overlap with the Norton Personal Firewall.

The Sygate Personal Firewall and Sygate Personal Firewall Pro products will no longer be available effective Nov. 30, Symantec spokesman Phil Weiler said Monday. Consumers will receive special upgrade pricing when they buy a replacement product from Symantec’s Norton family of Internet security products, he said.

By pulling the Sygate Personal Firewall, Symantec is further reducing the options for people looking for a free firewall for their computer. Sygate offered the Sygate Personal Firewall at no cost and sold Sygate Personal Firewall Pro. Kerio Technologies has previously said it will discontinue its desktop firewall at the end of this year.

^{Symantec scraps Sygate consumer firewall | CNET News.com}

I mean, heres the simple fact of the matter. When it comes to Windows security, the only way you can be truly secure is to pay megabucks. And even that doesn’t guarantee you’ll be 100% secure. The simple truth is, no matter what you do or how much you spend, you’ll always be one bug away from losing control of your computer. This applies to Windows, MacOSX, Linux, Solaris (including OpenSolaris), FreeBSD, OpenBSD (although very unlikely) and just about every other OS on the market at this very moment.

However, here is one of the major differences that a lot of people are still surprised to learn.

Linux, MacOSX, all the BSDs and Solaris all come with industrial strength firewall built in to them. More impressively, these firewalls are all capable of sitting in place of something like Cisco’s PIX or Checkpoints FW-1 if you know what you’re doing. And even if you don’t, there are so many front ends available to help you configure them. And nearly all of them are free.

Windows XP SP2 comes with a firewall that provides absolutely minimal protection. It doesn’t do any sort of egress checking, but it’ll block stuff from coming in if you want it to. If you want anything really secure, you need to get an alternative from someone like ZoneLabs or Symantec. Unfortuantely, the number of trustworthy 3rd party software firewalls for Windows is shrinking daily. Not because you can’t trust them anymore, but simply because they just can’t continue to compete in such a cut throat market.

Which is why you get situations such as what Symantec is doing to the Sygate product range. Sygate offered a free firewally that was pretty damn good (IMO, YMMV) and that while not comprehensive in terms of the Pro product, even on its own was clearly competative with Norton’s Personal Firewall 200X. So it made no economical sense to keep a product that was simply vampiric. Especially when the technology was going to be incorporated in to the Symantec product range anyway.

Still, there are a few remaining free firewall solutions available from other vendors. Zonelabs still offer a free version of the ZoneAlarm personal firewall for home use. There are others. Just look at download.com for a pretty good list.

Or you could just switch to an alternative like Linux or MacOSX and use the built in industrial-strength firewalls for free. There are tools all over the web to help you configure and secure using these firewalls. iptables/netfilter, ipf, ipfilter are the 3 most common firewalls. Look at places like freshmeat.net for a good starting point.

Anonymous

For most people who use windows XP, a NAT router is the best way to do a firewall. I never saw the need for firewall software on a PC. For a server, even if behind a firewall router, sure, but not a workstation PC.
Anonymous

For most people who use windows XP, a NAT router is the best way to do a firewall. I never saw the need for firewall software on a PC. For a server, even if behind a firewall router, sure, but not a workstation PC.
Steve

Holy cow. I can’t believe people think that NAT is a security measure. NAT + a Packet filter maybe, but NAT on its own is an absolutely frightening experience. The suggestion otherwise is just dangerous.

I’ll grant that many routers now do come with a packet filter in addition to NAT, but not all. More importantly, a vanilla router most definitely doesn’t (think many Linksys and Cisco routers.)

The plain fact is, without a packet filter in the way, NAT allows traffic in and out. Not just out. NAT is not a security measure, nor a defense. Its an obfuscation with absolutely no security what so ever.

In this Google HTML cache of a PDF, there is a good explanation of why NAT shouldn’t be relied upon. Also, this FAQ at the popular dslreports.com site might be a good starter too.

I could give you a million and one reasons why I don’t consider NAT on a standard DSL router to be sufficient. Its a nice stop gap measure that will surely slow people down, but its not bullet proof on the ingress side of things and it does nothing to stop traffic getting back out without your permission. Quite simply, anyone browsing the internet without some form of egress (as well as ingress) checking gateway in place is just asking for trouble. Even now with my proxy server dead, I’ve set up a local copy of Squid on my desktop combined with transparent proxying with Netfilter/iptables. I am using that quite simply because even though I’m running Linux on this machine, I don’t like the idea of any traffic escaping without my direct knowledge and involvement. Nothing, absolutely nothing goes across my wires without my permission.

Essentially, my argument boils down quite simply. A NAT router doesn’t offer that kind of protection. It only obfuscates the internal network. Without a packet filter its useless as a security measure. It offers absolutely no outbound protection at all. It doesn’t stop spyware or worms or any other kind of bad stuff. A software firewall on a computer for the most part will offer you both ingress and egress checking and reporting. In most cases on a Windows machine with many of the common products (such as Nortons Personal Firewall, Zonelabs ZoneAlarm and so on) they will block traffic not only for ports and protocols but also for applications as well. That is significant and definitely something that Windows needs thanks to spyware (or malware in general.) Consider how much better it is if that keylogger currently hiding itself thanks to the Sony Rootkit was unable to send the logged keystrokes and screenshots back to its ‘master’.

There is always a case for software firewalls on a desktop (or any other) computer for any platform. NAT is most definitely not a security measure. NAT + Packet Filtering is better but not nearly enough. Hell, in my Windows installs I even run a piece of software called PrevX simply because I don’t trust only a firewall/AV/anti-spyware as being good enough. This is partly why I support the NX (No eXecute) bit on CPUs and chipsets. I think every operating system should support it and every program should take advantage of it. By not allowing chunks of the memory to execute code, you reduce half the problems introduced by sloppy programmers and buffer overflows.
Steve

Holy cow. I can’t believe people think that NAT is a security measure. NAT + a Packet filter maybe, but NAT on its own is an absolutely frightening experience. The suggestion otherwise is just dangerous.I’ll grant that many routers now do come with a packet filter in addition to NAT, but not all. More importantly, a vanilla router most definitely doesn’t (think many Linksys and Cisco routers.)The plain fact is, without a packet filter in the way, NAT allows traffic in and out. Not just out. NAT is not a security measure, nor a defense. Its an obfuscation with absolutely no security what so ever.In this Google HTML cache of a PDF, there is a good explanation of why NAT shouldn’t be relied upon. Also, this FAQ at the popular dslreports.com site might be a good starter too.I could give you a million and one reasons why I don’t consider NAT on a standard DSL router to be sufficient. Its a nice stop gap measure that will surely slow people down, but its not bullet proof on the ingress side of things and it does nothing to stop traffic getting back out without your permission. Quite simply, anyone browsing the internet without some form of egress (as well as ingress) checking gateway in place is just asking for trouble. Even now with my proxy server dead, I’ve set up a local copy of Squid on my desktop combined with transparent proxying with Netfilter/iptables. I am using that quite simply because even though I’m running Linux on this machine, I don’t like the idea of any traffic escaping without my direct knowledge and involvement. Nothing, absolutely nothing goes across my wires without my permission.Essentially, my argument boils down quite simply. A NAT router doesn’t offer that kind of protection. It only obfuscates the internal network. Without a packet filter its useless as a security measure. It offers absolutely no outbound protection at all. It doesn’t stop spyware or worms or any other kind of bad stuff. A software firewall on a computer for the most part will offer you both ingress and egress checking and reporting. In most cases on a Windows machine with many of the common products (such as Nortons Personal Firewall, Zonelabs ZoneAlarm and so on) they will block traffic not only for ports and protocols but also for applications as well. That is significant and definitely something that Windows needs thanks to spyware (or malware in general.) Consider how much better it is if that keylogger currently hiding itself thanks to the Sony Rootkit was unable to send the logged keystrokes and screenshots back to its ‘master’. There is always a case for software firewalls on a desktop (or any other) computer for any platform. NAT is most definitely not a security measure. NAT + Packet Filtering is better but not nearly enough. Hell, in my Windows installs I even run a piece of software called PrevX simply because I don’t trust only a firewall/AV/anti-spyware as being good enough. This is partly why I support the NX (No eXecute) bit on CPUs and chipsets. I think every operating system should support it and every program should take advantage of it. By not allowing chunks of the memory to execute code, you reduce half the problems introduced by sloppy programmers and buffer overflows.

Surprise! Symantec kills off Sygate firewall range

Archives

Recent Posts

Recent Comments

Surprise! Symantec kills off Sygate firewall range

Archives

Recent Posts

Recent Comments

User Login