The problem is that you cannot "firewall" the networking protocols. Okena and other products like it make a good attempt at stopping attacks, but they are outrageously expensive for the most part.
I'd argue... many vendors (Okena aka Cisco, BlackICE aka ISS, etc) provide integrated corporation-wide mechanisms for enforcing group firewalling, access and logging/IDS policies on workstations or groups of workstations (and, why not, also servers).
Paul Schmehl (pauls@xxxxxxxxxxxx) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html