Kerio responds to PC Flank users

May 2, 2002

We have received more than 1.000 questions regarding Kerio personal firewall from PC Flank users. We have selected 10 most prevalent and interesting questions and forwarded them to Kerio developers. Here are the responses from Kerio Technologies:

Why did you decide to use engine of Tiny for your firewall? Why not creating own engine? (Chris Madden)
Kerio Technologies:The engine used in the Kerio Personal Firewall has been under development for three years. Our engineers have a great deal of experience with the code and the technology is very solid.

When will Kerio personal firewall pass all leaktests? (Dan Platz)
Kerio Technologies:We cannot say. We strive to address all the security concerns surrounding KPF in a timely fashion, but it is an ongoing process. We have identified the exploits currently in use and hope to address them in the next three to six months.

What features will be added to your firewall in the nearest year? What improvements should we expect? (Peter McAllister)
Kerio Technologies:Following are some of the planned features: definition of multiple address groups, http filtering, increased control over network applications, added status for applications and filters, improved user interface.

Why aren't basic rules be included in the package as default rules? (Bird Senger)
Kerio Technologies:Currently, we do provide a basic set of rules. Our default setting requires that all activity be permitted or denied. We could create a very restrictive set of rules but it is our belief that the user or adminstrator should determine the rules for acceptable/safe use. Default rules to permit activity could expose the user/network to additional risk.

Does Kerio firewall perform Stateful packet inspection on packets coming from UDP as well as TCP? And also will there be more filtering of malformed packets? (Pete Repete)
Kerio Technologies:Acheiving 'state' in a broad sense refers to the firewall's prior knowledge of incoming network traffic. For network firewalls this type of functionality is a necessary component, however a personal firewall can incorporate different tactical measures as it has access to more information. In other words, KPF will only allow an inbound UDP packet (for example) if the destination port is arriving on a listening socket for a trusted application. Since KPF knows the listening socket of each trusted application, it is not necessary to record the activity of an outbound UDP packet. Requiring this could hinder functionality of applications, such as games and messaging utilities, where an outbound connection is established to a central server, so that inbound UDP packets may come back from different IP addresses.

Ben Haidri of Tiny Software said in his interview to PC Flank Tiny firewall was one of the best on the market. Considering Kerio is simply an improved version of Tiny - can you say Kerio is really the best? (Andreas Karlsson)
Kerio Technologies:The strength of the product is in the rule configuration and low level filtering. While this may not make KPF the best product for every user, from a security standpoint, it definitely ranks among the top products.

I wonder if there will be a Web filter integrated into KPF or if KPF will stay plain firewall? (Stefan Knutas)
Kerio Technologies:HTTP filtering is in plan for future versions.

What is the most significant distinction which distinguishes your firewall from the others? (Glen Brier)
Kerio Technologies:KPF has a very small footprint and is non intrusive to the system. It maintains an MD5 checksum of all trusted applications and monitors kernel level activity. The filter rules give the user a great deal of flexibility and logs/alerts can be applied to each rule.

What kind of software should I add to Kerio to completely secure my PC? (Jan-Pierre Leroux)
Kerio Technologies:Anti-virus software is important, given the proliferation of email borne viruses. Browser security settings should be considered and configured carefully as well. Software will never be 100% of the solution; usagepolicy is always a factor.

There is an opinion claiming security holes used by those leaktests are browsers' vulnerabilities and firewalls are not responsible for such holes. Do you agree? (Sean Bates)
Kerio Technologies:Technically, this opinion is accurate. However, as most PC firewalls claim to defend against a broader array of attacks than traditional LAN firewalls, there is some responsibility on the part of sofware publisher as a security solution provider to at least acknowledge the potential threat. We definitely do not think that browser exploits make firewalls like KPF useless. There are still other threats that are worth defending against, and a user with KPF is better off than a user without it. We would like to thank the online community for bringing these exploits to our attention, as we do take the security offerings of our product seriously.

Kerio Technologies
http://www.kerio.com/

Discuss this interview on the Forum