Assessing the security of the Windows XP Internet Connection Firewall

In public statements surrounding the release of Windows XP, Microsoft has touted it as a secure operating system for use in homes and small offices, as well as in large corporations. A key security feature of Windows XP is the Internet Connection Firewall (ICF), which provides a protective boundary between a computer and the Internet. Since ICF is targeted for home and small office computers, it is unlikely to be installed or configured by security professionals. Thus it is important for the security community to provide guidance to users as to the level of security provided by ICF, and how it compares to alternative 'personal firewall' products. This paper describes an empirical evaluation comparing ICF with ZoneAlarm Pro a popular workstation firewall. The evaluation consisted of running several simulated attacks against both products installed on a test network. The results of the tests lead to the conclusion that ICF while not as effective as ZoneAlarm is easy to use and has value as part of a 'defense in depth' security strategy.