Do you need a Software as well as Hardware Firewall?

bradavon · Post by **bradavon** » 29 Jan 2007, 23:52

I currently run ZoneAlarm Internet Security Suite 7.0.

Generally it is a decent Security Suite giving me:

* One of the worlds best Software Firewalls
* AntiVirus Checker
* Spyware Remover
* Privacy/Cookie Control - More trouble than it's worth
* Other bits and bobs

I've historically liked Security Suites as they're all-in-one and in theory should communicate better with each other.

Version 6.1 worked a treat but as of 6.5 the software has become bloated and more importantly buggy. Version 6.5 has a bug whereby MSN & Yahoo Messenger Display Pictures cannot be seen and nor can Emoticons/Smilies be sent or received. Granted it's a small problem but an annoying one.

Zone Labs finally fixed this after 6 months+ of complaints in Version 7.0. It's actually not fixed but finally the IMSecure (Instant Message) OFF option actually turns IMSecure off hence it's basically fixed.

However with Version 7.0 three new bugs have been introduced:

1. A service called KL1 tries to load at Start-up, fails because a file it needs is missing and it causes Windows boot up to be delayed. I've been told the it's not needed.
2. Windows Security Center reports the virus definitions are out of date yet they aren't. Zone Labs recommend turning WSC Notifications off (leaving the software open if it happens to crash).
3. Expert Rules are not saved upon restarted, these are used to allow specific ports etc... to be opened for specific programs.

Add to that memory resource usage has increased a fair chunk in v7.0. In order for ZoneAlarm Internet Security Suite to work 5 files need to run in the background taking 90Mb or so in memory. V6.5 it was 3 files, coming to 67Mb.

I love ZoneAlarm's amount of options, so many things can be configured. I also like how robust the Firewall is and generally how strong the product is. Before this I ran Norton Internet Security (and before it Norton AntiVirus) for 10+ years and while it was absurdly bloated it did what it said on the tin and worked 100% of the time.

I'm now strongly considering ditching ZoneAlarm and installing a Virus Checker + Spyware tool. I already have an ADSL Wireless Router with it's own Hardware Firewall.

* Are Internet Security Suites worth the money or is a Router with it's own Hardware Firewall "actually" as secure/more secure?
* Should I just stick on a Virus Checker and be done with it?
* Or are Internet Security Suites worth it and if so which do you recommend?

With Windows Vista getting an improved Software Firewall (which based on the XP Firewall never causes a resource hit) and a Spyware Remover would adding a virus checker be sufficient? I appreciate Windows XP has no Spyware remover. I'd need to add one of those. I'm hoping the Windows Vista Spyware checker is seamless like the Firewall and doesn't sit in the system tray.

I'm after a more technical response than "I use AVG and it works fine" please.

I'd like to know if a Software Firewall is really needed with a Hardware Firewall?

Thank you

Kurgan · Post by **Kurgan** » 30 Jan 2007, 00:13

A software firewall is not necessary when a hardware firewall is correctly implemented; not on a home-user level anyway. The firewall within an OS, if they don't detract away from the total pool of system resources, may as well be left on, but I don't believe it necessary to run a separate software firewall.

bradavon · Post by **bradavon** » 30 Jan 2007, 00:32

Thanks Kurgan that is great and what I've heard from a fair few people.

Can you please elaborate why a software firewall is not needed? Please be technical.

As per my Hardware Firewall it should be configured. It's definitely enabled and looks to be configured correctly. NAT is also enabled too. Is there anything I should look out for?

As per the OS Firewall that's exactly why I'd leave it turned on, just to be sure. The XP one at least uses 0% system resources. You barely know it's running but it is basic as hell, the Vista one fixes this.

The XP Firewall only checks inbound not outbound traffic.

IronMonkey · Post by **IronMonkey** » 30 Jan 2007, 09:25

Hardware fiewwalls are more secure simply because they stop any unwanted intrusions before they actually get to the computer itself.

I have been using a hardware firewall on my router (Netgear DG834G) and a combination of Windows firewall (might as well leave it on, uses no resources & stops annoying Windows Security alerts), Grisoft's AVG Anti-Virus (doesn't hog system resources at all) and Lavasoft's Adaware SE for spware removal.

To be honest, I don't even have to run Adaware SE that often (maybe once a month). I'm careful with where I visit on the Internet (only trusted sites) and the combination of AVG and hardware & software firewalls makes things as secure as needed for any home PC.

If you ask me, your security package using 90MB of memory is way too bloated to make it useful. I always say there is no point in crippling your PC just to make sure it is secure. There is a balance between security & useability.

Kurgan · Post by **Kurgan** » 30 Jan 2007, 11:33

What he said

gasteropod · Post by **gasteropod** » 30 Jan 2007, 12:05

I too use Windows firewall, AVG Anti-virus, and Ad-Aware SE. I also use AVG Anti-spyware, Spybot, and Windows Defender from time to time for scans because they often spot different things.

bradavon · Post by **bradavon** » 30 Jan 2007, 20:00

gasteropod wrote:I too use Windows firewall, AVG Anti-virus, and Ad-Aware SE. I also use AVG Anti-spyware, Spybot, and Windows Defender from time to time for scans because they often spot different things.

Fair enough. Personally I think that's overkill. There is no way I want more than one of each tool.

Fair enough though. I do run Spyware Blaster too but that's actually very basic in that all it does is add malware, spyware etc... sites to Firefox's and/or Internet Explorer's banned list. It doesn't run in the background or check files.

IronMonkey wrote:If you ask me, your security package using 90MB of memory is way too bloated to make it useful. I always say there is no point in crippling your PC just to make sure it is secure. There is a balance between security & useability.

Oh I didn't say it cripples my PC. I agreed 90Mb is too much though and my pc has got a bit slower since putting v7.0 on (v6.5 was fine) but it's nothing slightly as bad as Norton Internet Security/AntiVirus.

I'm just weighing up my options right now. I still have 6 months of ZoneAlarm Internet Security left. Which I would call a loss when it only cost me £16 for 12 months anyway.

I used to run Adaware SE but personally I don't like it as you have to run it manually. I'd prefer an automatic checker. Windows Defender does this for Free. I didn't find Beta 2 particularly effective but maybe it's now improved.

Thanks guys this is just the sort of thing I was after.

I used AVG Free Edition ages ago and going by reviews it still looks very basic (ZoneAlarm has double the configurable options). If I went the free route I'd give Avast a go first. That gets good reports too.

Still I don't want to turn this thread into a "AVG is great, it's free" type thread, so moving on.

IronMonkey wrote:Windows firewall (might as well leave it on, uses no resources & stops annoying Windows Security alerts)

I could be missing something but wouldn't it be easier to just turn them off?

bradavon · Post by **bradavon** » 30 Jan 2007, 20:13

The consensus here seems to be saying Suites are a waste of time as are Software Firewalls (if you have a Hardware Firewall. That is actually what a mate has said who is also in the know.

However I draw your attention to this link:

http://www.avforums.com/forums/showthread.php?t=467021

It's the equivalent thread I started at AV Forums and they say you do need a Software Firewall as a Hardware Firewall only protects against Inbound not Outbound traffic. As Windows XP's Firewall is inbound too. Aren't you guys leaving yourself open?

I'm no expert but they seem to have a point. Don't they?

My Master Plan was to use Vista's Firewall + AntiSpyware (as well as a virus checker of course) as both are integrated and work in the background.

I'll be getting Vista late Feb/early March, until then I'll be sticking with ZoneAlarm. I'm keen to start a fresh and get it right for Vista.

However apparently unlike the Inbound Firewall the Outbound has no Prompt box and you need to configure each Program manually, which of course could get messy. That is if I even need an Outbound Firewall at all, you guys seem to be saying no?

I'll no doubt give it a go to see what I think. You can see screen shots here, it looks very much like most apps Advanced section:

http://www.microsoft.com/technet/commun ... g0106.mspx

Some interesting articles:

* Zone Labs ZoneAlarm vs Windows Vista Firewall vs XP SP2 Firewall: http://labnol.blogspot.com/2006/04/zone ... vista.html
* Vista Firewall Outgoing protection disabled by default: http://news.zdnet.co.uk/software/0,1000 ... 528,00.htm

Instead of providing a simple Block/Unblock window like they do for the Inbound Firewall and all other apps have MS have opted to just disable it and let you configure it if you so wish.

Kurgan · Post by **Kurgan** » 31 Jan 2007, 23:07

I have to open ports on my router to be able to allow information to pass out from my systems; to play Metal Gear Solid 3: Subsistence or Pro Evolution Soccer 6 on the PS2, I need to open up the ports to be able the games online, so I've no idea what else I need to do.
Same goes for a little program I've got called Nicecast, which plays my iTunes music to anyone who wants to listen to the music (like a radio station). I have to open the appropriate ports on both my iMac as well as on the router, so I don't understand why a software firewall is needed for most people.

bradavon · Post by **bradavon** » 31 Jan 2007, 23:39

Interesting, thanks.

What about a an app which appears safe, you install it but it then sends malicious data out. You'd be left open surely?

EvaUnit02 · Post by **EvaUnit02** » 01 Feb 2007, 00:59

bradavon wrote:My Master Plan was to use Vista's Firewall/b]

Why? That article you linked to said that Vista's Firewall was not much better than XP SP2's. Adding the ability to block out-bound traffic doesn't automatically it a viable option. I'd certainly miss the power of ZA Pro.

Plus aren't you getting like a 2GB RAM machine to run Vista? RAM hogging shouldn't be a problem when you that much to play with.

I'd recommend switching to ZoneAlarm Pro, as it is just Security Suite minus the anti-virus and 6.5 only uses like 7.5MB of memory (dunno bout version 7.0 though).

Your plan of getting a laptop is a good one. With a larger desktop monitor at home you can use multiple-monitor support and have twice as much work room.

bradavon · Post by **bradavon** » 01 Feb 2007, 20:03

EvaUnit02 wrote:Why? That article you linked to said that Vista's Firewall was not much better than XP SP2's. Adding the ability to block out-bound traffic doesn't automatically it a viable option.

Maybe I missed that but the other links I posted illustrate Vista's Firewall is much improved over XP SP2s.

It uses an MMC snap-in to kind of work like Group Policy and basically when Outbound protection is enabled it blocks ALL outbound protection unless you manually allow things.

The windows to do this look identical to ZA's Expert Rules. The killer problem though is the lack of a popup prompt which for 90% of applications is all you need.

It's an odd one when Vista's Firewall inbound protection does of course, as do most third-party Firewalls such as ZA.

Yes agreed overall it's pretty obvious ZA's Firewall is superior, Vista's is literally configure port/application/domain etc... that's it. It has no behavioural characteristics like ZA and cannot learn.

However XP SP2s Firewall lets face it uses zero resources and is dead simple to use. It's also completely integrated into Windows. I didn't say I would outright use Vista's Firewall, what I did say was I'd give it a go and if it's a right pain in the neck to configure I'll go back to ZA Internet Security.

TBH I suspect it will be as it looks basic but we'll see.

FYI ZA Internet Security is ZA Pro plus much more. The Firewall is identical.

EvaUnit02 wrote:Plus aren't you getting like a 2GB RAM machine to run Vista? RAM hogging shouldn't be a problem when you that much to play with.

Three reasons:

1. Vista needs more RAM than XP
2. If I was thinking that I'd just dump Norton AV on as that does work very well but uses resources like crazy. I run 1Gb on XP now and RAM is still a concern.
3. Finally when I get my new Vista Laptop I want to do everything right with as near to 100% efficency as possible that means no Software Firewall if I don't really need it.

I'm reading very conflicting views on that one.

EvaUnit02 wrote:I'd recommend switching to ZoneAlarm Pro, as it is just Security Suite minus the anti-virus and 6.5 only uses like 7.5MB of memory (dunno bout version 7.0 though).

V7.0 will use more that's for sure and thanks but no thanks. I'm interested in it being integrated into Windows (+ Virus Checker) or a Suite.

I can't believe people run 3-4+ programs in their system tray. You say it's only 7.5Mb but that's not strictly true as you still need to add in the virus checker an antispyware resource pull.

EvaUnit02 wrote:Your plan of getting a laptop is a good one. With a larger desktop monitor at home you can use multiple-monitor support and have twice as much work room.

Thank you.

My primary reason to get a laptop is space. When I move out in March-April I know for sure I'll be living in a much smaller house, we have 5 bedrooms here (there was 4 of us + a dog when we moved in).

I really have no need for a all singing/all dancing desktop PC and plugged into a normal size monitor/keyboard/mouse there is very little difference anyway.

The second reason is lets face it PC's are ugly and again due to space I'm going to more than likely need to put it in my living room. If I can have a small table in the corner with just a monitor/keyboard/mouse visible it will be ideal. I'm planning to hide the laptop behind something. As long as I can get to the DVD drive and on/off button I don't to see it.

I doubt I'll get multi-monitor. I'm not really a fan and again space will be a premium.

bradavon · Post by **bradavon** » 01 Feb 2007, 20:35

I've changed the thread title to reflect what I'd like to know about more.

Guys:

What about an app which appears safe, you install it but it then sends malicious data out. You'd be left open surely?

tom2681 · Post by **tom2681** » 05 Feb 2007, 17:39

Happened to me a few months ago.
I launched an exe file and it opened a port on the Win XP firewall, and it allowed a hacker to get into my computer.

He took control of my mouse and started browsing.

So I created a txt file on the desktop, opened it and wrote:
"Don't you have anything better to do ?"

And then I unplugged my network cable.

Who needs protection ?
If you get a trojan or a virus, just kill it manually.
I still maintain that anti-viruses and Internet Protection Suites are useless.

Look at that tray:

No icons at all, no background processes, no anti-virus.
Full speed !!

Lourdes · Post by **Lourdes** » 05 Feb 2007, 19:11

I believe a software firewall with application control, DLL authetication and anti-hijacking features to be essential. Open ports mean nothing, the only time you get hacked is through security exploits in applications that you aldready have open to the web. Or malicious software that has gotten onto your computer. The 'hardware' firealls on routers are more of a nuisance than anything. They just cause more resource use on the router and make it harder to troubleshoot issues. I think you're much better off just being behind NAT and running a decent software firewall.
Personally I use Sygate Pro. No longer developed but it's very light and offers full control on many layers. I used Zone Alarm Pro years ago but they just kept added junk and more processes.

Kurgan · Post by **Kurgan** » 05 Feb 2007, 21:09

tom2681 wrote:Who needs protection ?
If you get a trojan or a virus, just kill it manually.

I've had to do that before, but the time it takes is just stupid. It's a real bitch when Task Manager's been disabled as well.

EvaUnit02 · Post by **EvaUnit02** » 06 Feb 2007, 13:26

I had a trojan (Svchoct) siting amongst my Java VM installation for several months and Norton was unable to remove it, only quarantine. It never managed to broadcast anything cuz I had set ZA Pro to block it. I finally just manually removed it after becoming fed up with NAV's ineptness.

bradavon · Post by **bradavon** » 07 Feb 2007, 21:48

tom2681 wrote:Who needs protection ?
If you get a trojan or a virus, just kill it manually.
I still maintain that anti-viruses and Internet Protection Suites are useless.

Two things they're not useless just maybe from your point of view OTT but usless means they don't work and generally they do.

Secondly fat good killing the process is if your PC doesn't boot up because a virus has completely fried it.

How about you send on spyware via e-mail which you didn't know you had, that spyware infested e-mail is received by a close friend who is uber illiterate at computer maintenance, they don't have security tools because they trust you and you've told them they're useless.

They open said attachment and are in real trouble.

tom2681 wrote:No icons at all, no background processes, no anti-virus. Full speed !!

What happened to Sound Mixer/Volume Control?

Lourdes wrote:The 'hardware' firealls on routers are more of a nuisance than anything. They just cause more resource use on the router and make it harder to troubleshoot issues.

Surely it can cope? If you think the routers firewall is causing problems turn it off. Personally I think they're a great idea as they take the resource away from the PC.

Lourdes wrote:I used Zone Alarm Pro years ago but they just kept added junk and more processes.

Unfortunately they still are

. ZoneAlarm was recommended to me by a far few people, as well as reviews but it's getting too bloated.

I've only been using it since v6.1 just over a year and while 6.1 was fine, 6.5 added some nice features but also introduced an annoying bug. It took ZoneLabs 6 months to fix in v7.0 which fixed that issue but has introduced 3 new ones :twisted:

EvaUnit02 wrote:I had a trojan (Svchoct) siting amongst my Java VM installation for several months and Norton was unable to remove it, only quarantine. It never managed to broadcast anything cuz I had set ZA Pro to block it. I finally just manually removed it after becoming fed up with NAV's ineptness.

I would of removed it ASAP.

That's one clever filename. Some friends PC was utterly full of spyware and maybe some viruses too. One of the spyware was called explorer.exe so I didn't spot it at first.

bradavon · Post by **bradavon** » 07 Feb 2007, 21:53

Thanks for your help guys.

I've asked the same sorts of questions over at AV Forums and searched loads on Google. The first thing you discover is there is NO consensus on this issue (generally speaking regarding security programs).

Some say you must have both, some say a hardware firewall is fine, some say free security tools are fine, some say they don't.

I have decided to:

* Stick with ZoneAlarm Internet Security 7.0 for the next few weeks, and hope they get off their asses and fix the bugs

* When I get my Vista laptop turn on Vista's outbound Firewall and play around with it.

* I'll also install NOD32 which as of v2.5 now has AntiSpyware support. So it's AntiVirus (I hear excellent) + AntiSpyware.

* If Vista's Outbound Firewall is as much a nightmare to configure as I hear I'll ditch it and also NOD32, and install Kaspersky Internet Security (hopefully it's less intrusive than ZoneAlarm) which offers Firewall, AntiVirus and AntiSpware, and is also supposed to be excellent.

To clarify I'm happy to run one program in the system tray but any more would annoy me to much. Splitting the Firewall off via Vista is fine as it's part of Windows.

I plan to test NOD32 and/or Kaspersky via my Windows XP PC first. I'm keen to put JUST the programs I need on my Vista laptop at first. I plan to start with a 30 Day trials for both NOD32 and/or Kaspersky.

It means my ZoneAlarm subscription will have 4-5 months left on it unused but so be it. It only costs £16-17 a year for the Suite, if you know where to look

(fully legal).

* Completely ignore Tom's advice on this subject (who stands alone)

EvaUnit02 · Post by **EvaUnit02** » 03 Apr 2007, 10:10

You still looking for a complete solution security suite, Brad?

I was recommended this one while I was looking for an x64 firewall alternative to ZA Pro (there is no 64-bit ZoneAlarm

):-
BitDefender Internet Security.

I didn't bother with it honestly. I use Symantec Antivirus Corporate Edition + ZA Pro on my XP x86 installation and SAVCE + Outpost Firewall on my XP x64 installation.

BTW I strongly recommend using multiple monitor support if you're planning on having running laptop in a fixed location. IMO your idea of "hiding away the laptop" is retarded.

A laptop LCD + an LCD monitor = supreme awesomeness. This is how our MacBook Pro + Cinema Display is configured. Once you go black, you can never go back.

bradavon · Post by **bradavon** » 03 Apr 2007, 21:09

EvaUnit02 wrote:You still looking for a complete solution security suite, Brad?

I knew I was going to Vista and after the disastrous release of ZoneAlarm 7.0 I did lots of research and settled on Kaspersky Internet Security. Funnily enough the Kaspersky engine and moulding it to the ZoneAlarm engine is precisely why ZA7 is soo full of bugs and to be avoided at all costs.

Anyway the Kaspersky AV engine gets great report after great report and the IS Suite does well too. I'm now running KIS6 and I'm very impressed. Even if ZA7 worked KIS6 is streets ahead of it.

I did read up on BitDefender but it didn't do too well. If memory serves me right it's mostly made up of software from other vendors.

My other option was to go with the Vista Firewall and use NOD32 (which now also has AntiSpyware), NOD32 also gets very good reports. I decided against this due to the manual nature of the Vista Firewall.

I was even thinking of ditching ZA before 7.0 was released. It's just to intrusive and unintelligent (assuming the best thing to do is block everything).

EvaUnit02 wrote:I didn't bother with it honestly. I use Symantec Antivirus Corporate Edition + ZA Pro on my XP x86 installation and SAVCE + Outpost Firewall on my XP x64 installation.

I presume you're on a pre-7.0 ZA Pro? I found ZAISS 6.5 and 6.1 generally very good (but like I said KIS6 is miles better) but 7.0 is a disaster. They need to go back to the drawing board with that one.

Actually considering Pro has no AV it maybe okay. I'm not sure.

EvaUnit02 wrote:BTW I strongly recommend using multiple monitor support if you're planning on having running laptop in a fixed location. IMO your idea of "hiding away the laptop" is retarded.

I know you've said and I've said why multi-monitor support is well out of the question. Have you seen a lounge with a pc stuck in the corner? Yuck it looks bloody atrocious. I'll be looking for a flat over the next few weeks and there's no way I'm having it destroyed with a computer in the corner of the room. A laptop, monitor, keyboard and mouse I reckon I can get away with. It's very unlikely I'll have the luxury of a room to stick the PC, if I did I'd not care in the slightest.

Obviously you can't get away from cables entirely but I'll be doing my best to hide them so you can just see the monitor cables. Regardless I don't really like the idea of two monitors anyway tbh, it's overkill IMO. We have them at work and they just look ott.

EvaUnit02 wrote:Once you go black, you can never go back.

Didn't a black porn star once say that?