Is a software firewall necessary nowadays ?

[#1]

I look after five silver surfers. They all use XP and I have installed Avira (free), SpywareBlaster and Spybot (for the immunization only).
They also have ZoneAlarm. Unfortunately, although I have documented and coached them about the 'Allow/Deny' and 'Remember this setting' for ZoneAlarm, they see it as an annoyance and just click on 'Allow' every time an alert appears. Of course this means that they get an alert each time that program wants to access the internet which adds to their annoyance.
With todays routers and Windows Firewall is it necessary for them to still have a software firewall ? (especially as they are not using it correctly).
Any opinions would be greatly appreciated.
Thanks, Peter

[#2]

I have the same trouble with SWMBO,
Dont think that the M$S firewall below Win 7 actually do anything with outgoing information, and how often do there Info bases get updated

[#3]

I have had the same situation with one of my 'silver surfer' friends. Zone Alarm is without doubt one of the biggest pains of all free software (apart from Comodo which is even worse IMO).  I can't see the point of it popping up time and again if the user does not understand what it is asking for.
Yes, you do need a software firewall and if push comes to shove then the Windows firewall is better than nothing.
In the case of my friend I took all the free security software off the machine and installed Kaspersky.  Blessed silence!  She has not complained once and the computer is secure.  This is one situation where I would say that paid for security is good as it is all in one and gets on with the job with no hassle for the user.  There are plenty of good 3 license offers for Kaspersky - get them to share and it won't sting the pocket so much.

[#4]

I think good firewall and antivirus software is essential.
I have tried free firewall and antivirus software on several occasions. After a short period of usage, I have always returned to using Norton Internet Security. NIS is available for about £20 for a 3 user 1 year licence - a small price to pay for good security.
From a 'silver surfer'

[#5]

Thank you all for your very prompt and informed replies.
Looks like general consensus is to keep a s/w firewall.
Will do some research into suggestions.
Peter

[#6]

Double click on the ZoneAlarm icon on the desktop >
open "Program Control"  (left side menu)

Click on Programs......
You will now be presented with all the programs that "could" need access to the web,
all you need to do is to see which ones have a tick, and which ones don`t....
left click on the program you want to change in the ACCESS column, and you will be presented with  three choices.... Allow....... Block..... or ... Ask....
once you have set these, then there will be less incidences of the "pop - up" window appearing, and you can advise your "pupils" that if they are not sure, to just give you a quick call,....

[#7]

I hate to keep saying this but you have not needed ZoneAlarm since Windows brought out Service pack 2 for XP.  The built in Windows firewall will keep you perfectly safe without asking you all those irritating and frankly incomprehensible questions about what to allow and what to deny.  Yes, if you are fortunate enough to have more time on you hands than you know what to do with and can spend a happy hour researching what each individual request actually means, then you could extract some value from the outbound program control that ZoneAlarm provides.  In the real world that very rarely happens and people will guess whether to accept of deny outbound internet access.
I fix peoples computers for a living so I get to see a lot of different ones.  These days very few people indeed still run ZoneAlarm.  Many people have other security software with a built-in firewall (e.g. Norton Internet Security) but I don't find that these people are less prone to trouble than those using a pure antivirus program and the Windows firewall.   

[#8]

and it your customers who run the botnets tha keep sending us thousands of spam and they dont get any indication that they are doing it

[#9]

Quote from: pierre_pierre

and it your customers who run the botnets ...

Absolutely not (and that is rather libellous, don't you think)?  Nobody who becomes a customer of mine goes away without a full suite of all the necessary security software (unless they refuse).  I also do my best to make sure that all those non-Windows applications like Java, Flash Player etc. are up-to-date to minimise the risk of infiltration though security holes in older versions.
I used to install ZoneAlarm as a necessary part of the security software on computers running Windows 98 & ME and I saw how my clients struggled with it.  The point I have to make time and time again is that ZoneAlarm adds no value unless you have the time and computer skills to find the correct answers to the cryptic questions posed by its outbound firewall.  A botnet running on your computer isn't going to identify itself as such.  You'll get a message like "FriendlyApp.exe wants to access the internet" and then it's down to the computer user to discover if "FriendlyApp.exe" is the friendly app. it purports to be.       

[#10]

I used the Windows firewall for quite a long time with no problems at all so am not at all against it, particularly in the newer versions of Windows.
For a while I added the firewall control software that made it fully two-way because for me it was too complicated to configure.
These days I am more cautious due to the increasing sophistication of cyber criminals.
I agree with comments about paid-for software being a small price to pay for security and peace of mind, particularly if (like me) you conduct a fair amount of financial transactions online.
Without being 'ageist' (and I include myself in this category), most older people find it easier to have an all-in-one solution to security which 'just works' and does not intrude or present complex problems.  That is why I much prefer the simplicity of the internet security suite - one programme and that's it.  With Kaspersky I hardly know it's there.
Added to this, if necessary there is help available via the telephone or dedicated forums when purchasing paid-for security.

[#11]

ZoneAlarm is a great bit of kit when you know how to use it but when you don't its a nightmare. People tend to just think 'Allow' is the correct answer to give to any program seeking access to the internet. It's a pain because no matter how much you tell them that unless they know what the program is and why it needs access that they should click Deny, most people will still go and click allow because they're too busy to think it through properly. They'll then complain afterwards when they're riddled with virus's, trojans, bots etc.
Windows XP software is good for defending against an external attack but its useless at stopping outbound connections from rogue software which in this day and age is still just as dangerous.
I still firmly recommend a software firewall which stops outbound connections. ZA is the best I've used and certainly the easiest to setup and use but it still has its niggles. One being its ability to question the user who hasn't initiated the program (IE the one who is disconnected from their session instead of the one who started the program and has an active session).

[#12]

Personally the windows FW is more than adequate - as RR stated.
Most people are behind routers etc. and provided they dont go looking for trouble (dodgy porn sites and such) you tend to be alright regardless what security packages you prefer.
Personally i use NOD32 Business + windows Firewall, i DID use NOD32 Smart Security for a while, but the SS slows the machine down, the AV is barely noticable (except in Garrys Mod)

[#13]

The problem i though Matt the Windows FW and routers still don't stop outbound traffic do they. At least the XP FW doesn't - I've not used Vista or 7 so can't speak of those.
The problem with outbound connections is that they are just that - CONNECTIONS.  Just because it's not an incoming connection doesn't mean it can't still transmit and receive data streams and commands. On the contrary they still can its just that the connection is initiated the other way around.
The machine can still be taken over, still zombied and still used as a bot etc. The consequences of not stopping outbound connections as well as inbound are still dangerous. Imagine a program on your PC which finds your personal information saved somewhere and transmits it to another system via an outbound connection. Or worse it makes an outbound connection and turns itself into a p2p file sharer for child porn.
Anything could happen. Admittedly for incoming connections and attacks you don't really need much more than a router or the basic OS in a perfect world but this isn't.

[#14]

The issue with the outbound connection protection offered by those firewalls you've described is that you're attempting to protect yourself against programs that are already running on your computer.
I suppose that technically it is better to be warned about some nasty program wanting to send data than to not be warned about it, but what is best is to not be running that malware on your computer in the first place.
If some particularly nasty malware <b>is already running</b> on your computer, without getting detected by the anti-virus software, I don't really see what is stopping it disabling any software firewall. Plus it could always try sending all your stolen personal data by launching and controlling the default web browser - which would be already allowed by the firewall. Anyone remember that tooleaky program?
Someone mentioned doing financial stuff online - according to one of my banks, antivirus + firewall isn't enough, you also need "Rapport", in some insane attempt to keep your online banking details secure against all the keylogging and screenshooting programs and other malware that your computer might be infested with. It's the wrong solution, even if it could work.

[#15]

The current copy of PCPlus magazine nudged my thoughts against the dont need it brigade, I use an XP netbook when on my travels and often use Hotel etc WiFi links that are open access, so in those cases there is no firewall or antivus outside of my machine, a very good reason for having it on the machine